What actually landed, and when.

The first public deployment. Password changes are real and require your current password before anything happens, because a session here is a long-lived cookie and a borrowed browser should not be enough to take an account over. Changing your email address is not available yet, and the field says so plainly rather than pretending. First sign-ins now always reach onboarding — signing in with a password used to skip it.

Account deletion is real and irreversible, and reports success only after confirming the account is actually gone. Every value the public data API can write is now bounded by the database itself rather than by the app in front of it, and habit and log ownership is enforced by the shape of the schema instead of by application checks. Settings that previously did nothing now do what they say.

Habits and logs tables with row-level security policies that scope every read and write to the owning account, plus a Supabase-backed repository behind the existing storage seam and its contract tests. Merged and live since 20 Jul, verified against the running database rather than only against mocks.

Focus traps and trigger restoration for every dialog, the ARIA tab pattern in the habit detail drawer, accessible names and screen-reader tables for the stat charts, and AA-contrast tokens on both themes. Habit editing gained category, strictness, and grace days per week. The public security page went up.

Sign-up, sign-in, password reset, and email confirmation against a real backend, with an open-redirect guard on every destination, a twelve-character password minimum, bot resistance on each auth form, and a server-side route guard that runs before any protected page renders.

Streak freezes you earn and choose to spend, a habit detail drawer with a seven-day back-date editor, drag and keyboard reordering, and the quote pool grown from twelve to fifty-eight — every one traced to a primary source, with a remote top-up that degrades to the bundled pool when unavailable.

Worded correlations gated by significance, streak-risk and habit-stacking cards, a monthly recap, and a grouped searchable Settings screen with JSON and CSV export. A companion prototype landed here too — it has since been deferred; see the roadmap.

The domain engine — five habit types, five schedules, forgiving streaks, momentum — behind a storage interface, then the matte editorial design system, the app shell with its command palette, and the Today, Habits, and Stats screens rebuilt on it. The earlier glassmorphism direction was dropped entirely.