From 2d6782780a8f3ed0536b1f8e7f1666910e98551b Mon Sep 17 00:00:00 2001
From: Claude <claude@projects.petruzalekr.cz>
Date: Sat, 5 Sep 2026 19:56:14 +0200
Subject: [PATCH] Say why the direct password field is there, accurately

The note justified it with "reset silently fails when somebody types a capital
letter". That stopped being true: both the login form and the reset form on the
site lowercase the address before sending, the app does the same in
normalizeEmail, and all nine stored addresses are lowercase already. A dashboard
that states a fixed bug as current makes the owner distrust a working feature.

What is still true, and is the actually useful thing to know while standing at
this table, is that the endpoint answers "sent" whether or not the address
matched, on purpose, so a failed reset is undiagnosable from the outside.

The second note is today's lesson, which cost an hour: a reset the owner sends
to his own address is delivered by Proton as his own outgoing mail, so it sits
in All Mail and never appears in the inbox. He is the only person this affects,
because he is the only recipient who is also the sender.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 pb_public/status.html | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pb_public/status.html b/pb_public/status.html
index b75b55d..a370c4c 100644
--- a/pb_public/status.html
+++ b/pb_public/status.html
@@ -764,10 +764,13 @@ function viewAdmin(users, tpls){
     '<section class="wide"><h2>Účty</h2><table class="accts">' +
     "<tr><th>e-mail</th><th>strop</th><th>vznik</th><th>heslo</th></tr>" +
     (rows || "<tr><td colspan=4 class='note'>nic</td></tr>") + "</table>" +
-    '<p class="note">Heslo nastavíš rovnou, bez e-mailu. Reset přes e-mail ' +
-    "selhává tiše, když si adresu někdo napíše s velkým písmenem, protože " +
-    "PocketBase hledá účty přesně na znak a stejně vždycky odpoví „odesláno“, " +
-    "aby přes něj nešlo zjišťovat, které adresy existují.</p>" +
+    '<p class="note">Heslo nastavíš rovnou, bez e-mailu. Hodí se to, když reset ' +
+    "nedorazí, protože z odpovědi serveru to stejně nepoznáš: PocketBase odpoví " +
+    "„odesláno“ i na adresu, ke které žádný účet není, aby přes něj nešlo " +
+    "zjišťovat, kdo je zaregistrovaný.</p>" +
+    '<p class="note">Když si reset posíláš na svoji vlastní adresu, hledej ho ve ' +
+    "Všechna pošta. Odesílatel sedí na stejném Proton účtu, takže se uloží mezi " +
+    "odeslané a do Doručené se nedostane.</p>" +
     '<p class="note">Varianta rozhoduje, jaký build dostane přes automatickou ' +
     "aktualizaci. Server ji vybírá podle tohohle příznaku, klient si ji nemůže " +
     "vyžádat.</p></section>";