You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
AUTH-MAIL-002B: make verification resend honest - #154
My Account now distinguishes Firebase request acceptance from delivery. It reports accepted or a fixed generic unavailable result, never says the email was sent, synchronously blocks rapid duplicate activation, and shows the same visible 60-second browser cooldown after either result.
The control uses a native large button, explicit live status/alert text, timer cleanup, and a UID-keyed stale-result guard. A refresh or account change may reset this usability timer; Firebase throttling can still apply. No email, UID, provider error, action link, or token is displayed or logged.
Tests use Firebase mocks and no network or mailbox
Continuity
Officer impact: Members get one plain request result and a visible wait before retry. Officers never need an email address, password, code, link, screenshot, mailbox, or Firebase Console repair.
Officer documentation: docs/officers/EVENTS_SHOP_MEMBERS.md and docs/officers/EMERGENCY_AND_RECOVERY.md
Deployment evidence: Source and local tests only at PR creation. No website publication, runmprc.com verification, Firebase/provider configuration, production email, member record, or live behavior was performed or verified. The exact #118 Rules/Functions deployment and readback must succeed before this website revision may be published through the protected profile-recovery plan.
Exact-head merge gate verified at 2026-07-13T13:05:16Z: commit 1b4519932f51037d239a41001822a9817ca87fc4 remains based on current origin/main7c7a41c366223bcf435b4f24ecc1cc0c87a62505. Hosted CI run 29252233611 passed Frontend (119 Jest tests, SPA 10/10, release workflow validation, lint/build), Functions, and Firestore Rules. Netlify deploy preview 6a54e213c9a5fa0007b0d70e is ready; its applicable redirect check passed and non-applicable header/page-change contexts skipped. Two independent exact-diff reviews approved. Proceeding with the user-authorized admin squash merge; production publication remains a separate protected release with per-surface evidence.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #153
Outcome
My Account now distinguishes Firebase request acceptance from delivery. It reports accepted or a fixed generic unavailable result, never says the email was sent, synchronously blocks rapid duplicate activation, and shows the same visible 60-second browser cooldown after either result.
The control uses a native large button, explicit live status/alert text, timer cleanup, and a UID-keyed stale-result guard. A refresh or account change may reset this usability timer; Firebase throttling can still apply. No email, UID, provider error, action link, or token is displayed or logged.
Verification
Continuity
Officer impact: Members get one plain request result and a visible wait before retry. Officers never need an email address, password, code, link, screenshot, mailbox, or Firebase Console repair.
Officer documentation: docs/officers/EVENTS_SHOP_MEMBERS.md and docs/officers/EMERGENCY_AND_RECOVERY.md
Deployment evidence: Source and local tests only at PR creation. No website publication, runmprc.com verification, Firebase/provider configuration, production email, member record, or live behavior was performed or verified. The exact #118 Rules/Functions deployment and readback must succeed before this website revision may be published through the protected profile-recovery plan.