# Frozen Acceptance — [your app name] login & backend

*Fill this in, then FREEZE it before the build session that touches
login. The build is graded against these lines and no others. Lines
you can't check are decoration; delete them and write checkable ones.*

## LOGIN is DONE when all of these are true

- [ ] A brand-new visitor can register with email + password and is
      immediately able to log in with them.
- [ ] A wrong password is refused with a message a non-technical
      person understands (not a raw error code).
- [ ] Logout works: after logging out and refreshing the page, the
      visitor is still logged out and sees no account data.
- [ ] Login survives a page refresh (a logged-in user stays logged in
      until they log out or the session expires by the stated rule).
- [ ] Passwords are stored ONLY by PocketBase's users collection
      (hashed by PocketBase). No custom password table exists
      anywhere in the project — check by searching the code for
      "password": the only hits are form fields and SDK calls.
- [ ] Password reset either works end-to-end (mail settings filled in
      and a real reset email tested) or the app says plainly that
      reset is not available yet. No silent dead button.

## DATA ISOLATION is DONE when the two-account test passes

- [ ] Account A creates one of the app's things (a note, a save, an
      order — whatever your app stores per user).
- [ ] Account B logs in and CANNOT see, open, or guess the address of
      A's thing. (This is PocketBase's collection rules doing their
      job — login-that-works.md step 3.)
- [ ] Logged OUT entirely, the same thing is also unreachable.
- [ ] Every per-user collection has a non-empty access rule. A rule
      left blank means "anyone" and fails this acceptance on sight.

## HOSTING is DONE when

- [ ] The live app points at the hosted PocketBase address (not
      127.0.0.1) and register + login + the two-account test all pass
      again ON THE LIVE ADDRESSES, not just locally.
- [ ] The monthly hosting total is written here: $______ and it is
      ≤ the ceiling you set before hosting: $______.
- [ ] A copy of the `pb_data` folder exists somewhere that is not the
      server (your backup), dated: ____________.

## Explicitly NOT in this version (the fence)

- No social login, no magic links, no two-factor, no roles/admin
  panel for app users — unless written here before the build.
  (Google sign-in has its own route: the `google:oauth-signin`
  research pack. Add it as a new version of this file, not mid-fix.)
- No redesign of auth mid-project. Repairs happen inside the
  PocketBase design, or this file is re-frozen with a new date.

## Grading

Someone who is not the builder (a second AI, or you with fresh eyes)
runs the boxes against the live app — both accounts theirs to create.
A box that can't be checked by using the app doesn't count as passed.