Agreed 2026-10-13 ("the e-mail must be confirmed"); his choice of
2026-10-17 for notifications: "Без подтверждения слать" - they go to the
address confirmed or not; only a reset link needs it confirmed.
Sign-in gets "Forgot your password?" (login.html). login-reset.html asks
for the username and says what will happen; login-reset-sent.html is the
sign-in page after it, the same answer for any name ("If that account has
a confirmed e-mail, the link is on its way"); login-reset-set.html sets
the new password from the link and says that every session ends.
confirm-email.html is where the confirmation link lands: a button, not a
GET that changes state, as a mail scanner opens links.
Account: the e-mail's tag (confirmed / not confirmed), what a new address
is sent, the current password asked only to change the e-mail (roadmap,
2.0 security review: the e-mail becomes where a reset link goes), and
"Send the link again" while it is unconfirmed. The user form shows the
tag too. Help #account says it all. The user form loses "The same form,
empty, creates a new user" (panel-words: a new user has its own head).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mixandClaude Opus 5.5
2f5f5b2b93