admin
0b1486df8f
gates / gates (push) Successful in 24s
/recovery is in the AUTHENTICATED route table — its reader is the household, not a visitor. The first draft of v0.254.0 gave it the anonymous form, which sets the felhom_lang cookie that langFor deliberately ignores once there is a session: the button would have appeared to work and done nothing. Found by the live probe on demo-hp reporting no globe on /recovery (it 302s to /login without a session) and then reading the route table. executeTemplateLang now branches on hasSession: household form with its session CSRF, or the visitor form without. The parity harness and TestI18nDirectRenderPagesFollowLanguage carry the same branch, so the fixture is the form the real page serves — the trap this release already walked into once with the shells. A per-session CSRF token cannot be a fixture value, so it is blanked on both sides of every parity comparison, exactly as relative ages already were. What stays pinned is that the field is THERE and WHICH form it sits in — the half that says whether the globe writes the household's setting or the visitor's cookie. Evidence regenerated: 3 change shapes across 106 fixtures, 5 byte-identical (both guest share pages and the catch-all — the three that must not change). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS