Confirm Verification

Create the account the link authorises, and — separately — decide about the client.

connect_client is a second consent, not a formality. Creating an account and handing a credential to whoever asked for it are two different things, and one button doing both is what makes "an attacker starts a signup at a victim's address" pay: the victim's click would release a key to the requester as a side effect of getting an account. Two buttons on the page, two outcomes here, and the default is no.

The password is hashed before the transaction opens. argon2id takes hundreds of milliseconds by design, and that is the width of the window in which a decline can race this. complete_link_signup takes the row lock; hashing outside it is what keeps the lock short enough for the race to be decided rather than merely narrowed.

This is where user.subscribed is reported (doc/architecture.md §"Platform event notifications") — the only self-serve account-creation path there is, so the only place a subscription can be observed. Scheduled after the response like every send in this module, and only on this success path: every refusal above raises first, so a declined or replayed link reports nothing. The timing-oracle rule the module docstring states does not bite here — it guards the two start routes, which are pre-proof and enumerable, whereas reaching this line requires the 256-bit token we mailed.