[plainprogrammer]

Closes #230. Refs #218 (rulings 4 and 5).

What changed

• Fix (ruling 5). A sign-up that omits password_confirmation created the account: has_secure_password validates a confirmation with allow_nil: true, so it checks one only when it is sent. Registration now checks an omitted confirmation as the empty one it is, so it gets the mismatch's error ("Password confirmation doesn't match Password") on the same field, with 422 and no user or account (spec 004 AC-4.1, AC-4.3). The fix is one line in app/models/registration.rb; the form's HTML and the copy are unchanged.
• Rate-limit store (ruling 4). docs/architecture/tenancy-and-accounts.md replaces the "no spec source" mark with a decision: the counters live in Rails.cache (Solid Cache), and a reset on a cache clear or cache-database restore is accepted. No code change. The confirmation rule is stated there too, with Accounts and sessions: six behaviours no spec describes #218 and Sign-up refuses a missing password confirmation; record the rate-limit store as a rule #230 as sources.

Tests: which example was red

• Red before the fix: a sign-up with the password_confirmation field absent (request spec and model spec), and a nil confirmation (model spec).
• A regression pin, not red: a blank ("") confirmation. Rails' validator skips only nil, so a blank one was already refused. The issue text said "missing or blank"; only "missing" was the gap. The examples pin both, and the mismatch and success examples stay green.
• Lesson recorded: docs/lessons/2026-11-09-check-the-validator-before-calling-a-test-red.md.

Other password paths: checked, not affected

• Admin users pages: app/controllers/admin/users_controller.rb:55 permits only name, email_address and password. They have no confirmation by design (spec 004 AC-5.2, AC-5.3: "the admin's new-password field has no confirmation").
• Operator command: app/models/user/command.rb:12 sets user.password directly (collector:user, lib/tasks/collector.rake; spec 004 AC-5.7).

Implementation review (Mode B, Opus, read-only, no spec so recorded here)

SPEC-ALIGNED. No blocking or major findings. Three minors: a Sources line still said "six" (fixed), the doc's "no confirmation by design" sentence now also cites AC-5.2 (fixed), and a note that a blank password with a blank confirmation shows both errors, which is unchanged behaviour. The area-doc change was reviewed separately (Fable, read-only): APPROVE, minors applied (the count dropped from the "no spec source" bullet to ease merging with #228 and #229).

Verification

• The pre-push hook ran the full bin/ci and the push was accepted (head a4459ec); the suite has 2838 examples (bin/rspec --dry-run count). The hook prints nothing on a pass; GitHub CI on this head is the evidence of record.
• Targeted: bin/rspec spec/requests/registrations_spec.rb spec/models/registration_spec.rb spec/models/user_spec.rb spec/requests/sessions_spec.rb spec/requests/admin 114 examples, 0 failures (before the doc and lesson commits).
• No UI copy or markup changed, so no design-system change.

Owed

• The tenancy doc's shared "no spec source" count lines (149, 169) get their final count at the next merge of main, once Sessions expire after 30 days unused, and stop storing IP address and user agent #228, Hold instance_settings to exactly one row #229 and Scanner area doc: record #219's rulings and measurement mode's local-only rule #231 land (coordinator's rule).

🤖 Generated with Claude Code