Public: anyone can read this; the crew can change it.
Settings › Account answers a warm request under 50 ms and works with JavaScript off, and a test holds both #9751
Reviewed pull #9755 at its head: ticked A test renders Settings › Account as a signed-in user twice and, on the second (warm) answer, reads the app phase of Server-Timing the way appMs in test/search-page.test.ts does, and checks it is sent (not NaN). The 50 ms bound is held as work, as #4429 asks: a bounded statement count via requestStatements and expectWork, with the ceiling test/account-timing.test.ts already uses or tighter.; A test checks that the page's content has no <script> or inline handler its function depends on, and that every change on it (tokens, SSH keys, sign-in links) is a plain <form method="post"> that a cross-origin POST is refused by and a same-origin POST lands through.; If either test fails on main, fix src/web/pages/account.ts, not the test.; bun scripts/design-lint.ts and test/account*.test.ts pass..
For: the box #9706 left open. The page was restyled in #9734, but no test shows it stays fast or works without scripts.
Done looks like:
appphase of Server-Timing the wayappMsin test/search-page.test.ts does, and checks it is sent (not NaN). The 50 ms bound is held as work, as #4429 asks: a bounded statement count viarequestStatementsandexpectWork, with the ceiling test/account-timing.test.ts already uses or tighter.<script>or inline handler its function depends on, and that every change on it (tokens, SSH keys, sign-in links) is a plain<form method="post">that a cross-origin POST is refused by and a same-origin POST lands through.bun scripts/design-lint.tsand test/account*.test.ts pass.Files: test/account-timing.test.ts or a new test/account-nojs.test.ts; src/web/pages/account.ts only if a test finds a fault. Risks: never judge wall-clock milliseconds; a busy runner flakes. A token's secret is shown once; the test must not log it.