- Shipped
- August 28, 2026 at 3:18 AM UTC
- Author
- Kamo
- Commit
- 480006e
Three things wrong with /verification, all visible on one screen. The wallpaper never loaded. PostCompletionScreen called **************** but that parameter is the organization ALIAS and is validated against ^[a-z0-9-]{1,63}$ — a hostname has dots, so it failed the pattern and the helper returned "". Every asset fetch then became a relative /json/config.json against this app, which 404s, so backgroundImageCount was never read and the carousel had no frames. The slideshow code was already correct; only the argument was wrong. Calls getThemePath() bare now, as the landing page and the register flow do, and a 50% scrim sits inside the carousel layer so it dims whichever frame is up and holds still across a crossfade. Resending no longer asks anyone to prove they are human. The *** gated the button and nothing else: the server never read a payload for a resend, so the widget only ever stopped the person who did not receive their email, never the script. SecurityService now holds a real time budget (af05296), and this mirrors it — the wait is stored as the INSTANT the next send is allowed rather than a counter, so a reload or a second tab keeps serving it and a backgrounded tab does not drift; the deadline is armed BEFORE the request so two fast clicks cannot both land; and a 429's retryAfterSeconds overwrites the local guess, because the server knows what this address has already spent and this screen does not. The proxy forwarded no client address, so every request reached the Java API from this pod and anything upstream judging a caller by IP saw one identity for the platform. It forwards the X-Forwarded-For chain verbatim now — the next hop appends and ClientIpResolver reads right-to-left, so a value a client invented can only sit left of the truth. Status messages use the sign-in panel's frosted plate, copied from kamo-login so the two screens either side of the hand-off speak in one voice. One plate, not the old pair of MUI Alerts: a stale "email sent!" stacked above a fresh error told two stories at once. Also removes a second Powered-by badge and a redundant 100dvh wrapper the token branch put around a screen that is already full-bleed.