Account security
- Added single-use email verification and password-reset links with short expiry windows.
- Password reset now revokes every existing session, and recovery requests do not reveal whether an account exists.
- Added a retryable notification outbox. External delivery remains disabled until an approved mail provider is configured.
Administrator protection
- Administrator access now requires a TOTP authenticator.
- Authenticator secrets are encrypted outside the database and sensitive sessions expire after 12 hours.
- One-time recovery codes are supported and replayed authenticator codes are rejected.
Learning-content review
- Translations and educational pages must move through draft, reviewed and published states.
- The author cannot review their own draft, and the reviewer cannot publish it.
- Vocabulary packs use the same multi-person release gate, and the general content API cannot bypass it.
Verification
The account-security lifecycle passed 15 isolated staging checks. Editorial approvals passed 13 staging checks. Chrome, Edge and Firefox browser checks completed without runtime errors.