🎯 What's New

Added as pattern #25 to both, matching the existing gold-xauusd version. Search index now 372 scenarios.

Text guidance only, not a fabricated chart - no real OHLC data exists to generate genuine multi-timeframe charts from.

Retest: H1/H4+M5/M15. Reversal: H1/H4+M1/M5 (faster). Trend: M15/H1+M5. Verified all 3 appear across gold-xauusd (24/12/8 split).

Analysis: H1/H4, Entry: M5/M15 - universal, same guidance on every pattern.

The v12.4 fix only tracked same-site link clicks to distinguish normal navigation from a genuine close - but pressing Back doesn't click anything on the current page, so that tracking never caught it, and the beacon fired on every Back press. Reported as 'clicking a nav button logs me out', but the actual trigger was the Back press in between, not the second click. Fixed using event.persisted on the pagehide event - a browser-native signal for whether the page is being cached for possible back-forward restoration (covers Back/Forward navigation and most link clicks) versus genuinely destroyed (an actual close). Verified the exact reported scenario, a real tab close, and the owner exemption all still resolve correctly via direct simulation before shipping.

$50 -> $50K Platinum Standard now shows first, followed by $100 -> $100K Century Sprint - display order only, no changes to either plan's numbers.

Down to 2 plans total: $100 -> $100K and $50 -> $50K.

Recalculated the daily rate for the new target over the same 30 days: ~25.9%/day instead of ~16.6%/day, verified the exact compounding math lands precisely on $100,000 before regenerating the 30-row table.

The old '16-29%' range included the now-removed $20->$40K plan's 29% rate - both remaining plans sit close to 26%, so corrected the text rather than leave a stale range.

Back to the original 2 plans plus one new one, 3 total. Also removed the now-unused FTP-specific CSS (.challenge-card.ftp, .ftp-rules-note, .scale-milestone) and the Audacity affiliation disclaimer, since there's no more Audacity-specific content on the page.

A 100x return over 30 days, calculated at ~16.6% daily - positioned as a third aggressiveness tier between the existing $20->$40K (29%/day) and $50->$50K (26%/day) plans, scaled down appropriately for the larger starting capital. Verified the exact compounding math lands precisely on $10,000 before generating the 30-row table. Reused the existing 'emerald' card theme and confirmed the instrument-switcher's data-start tagging is correct for all 3 remaining cards (100/20/50).

Removed the FTP-specific risk-comparison language that no longer applies now that those plans are gone.

Reuses the exact same findKeyLevel() logic already trusted for the chart's own reference line, so the text and the chart can never disagree - refactored the build script (renderScenario now computes keyLevel/retestCandle/reversalCandle once and shares them with both renderDetails and renderChart, instead of renderChart computing them in isolation). Extended coverage to reversal-based patterns too (e.g. #1 Classic Reversal, the exact pattern used to request this feature) using the same trusted reversalCandle data already computed for the chart's dashed reversal marker. Only renders when a real structural reference was found - skipped entirely for pure trend-continuation patterns with no confirmed pivot, rather than fabricating one. Ends up covering roughly half of all 368 scenarios across every instrument; verified pattern #1 specifically now reads 'Keep below the marked reversal candle's wick' for the bullish side, matching the requested example exactly.

This was already implemented (renderEntrySignal) - the BUY/SELL box already visible in the reference screenshot.

This page already had a fully working system that recalculates every table's SL/lot size when you switch instruments (EUR/USD, GBP/USD, USD/CHF, USD/CAD, WTI) - it works generically across every table on the page, so nothing new needed to be built. But it captured each table's starting balance with a hardcoded guess (table 0 = $20, everything else = $50) that only ever matched the original 2-plan layout. With the 4 new FTP tables inserted first, this guess was wrong for all 6 tables. Fixed by tagging each challenge-card with its actual starting balance (data-start) and reading that directly instead of guessing from position. Verified the bug's severity directly: the old logic computed a day-1 'profit' of $5,028 for the $5K table (using the wrong $20 baseline) instead of the correct ~$48 - a two-orders-of-magnitude error that would have produced nonsensical lot sizes the moment someone switched instruments.

Kept the same safe daily rate (~0.96%, unchanged - still only ~10% of the daily loss allowance per trade) rather than slowing it down, since Audacity's scaling rule repeats every +10% gain, not just once. At the same rate over 30 days, this naturally triggers 2 scaling events per plan (day 11 and day 21 for every tier, since the percentages scale proportionally) rather than just 1, landing at +33.1% total growth by day 30. Both milestones are marked in the table with a distinct row style.

Fetched Audacity Capital's actual Instant Funding (FTP) program rules: 5% daily loss limit (trailing), 10% static max drawdown, 5 minimum trading days, and the real scaling mechanic - account doubles every +10% gain. Each plan targets a realistic +10% over 10 days (~0.96% daily), calculated so every single trade risks only ~10% of the daily loss allowance - verified with exact numbers per tier ($5K: $24-26 risk against a $250 daily limit; scales proportionally up to $50K). This is meaningfully safer than the site's existing $20/$50 aggressive challenges, which require 26-29% daily growth that would blow through any real prop firm's daily loss limit almost immediately.

Since the plans now reference a specific real company and program by name, added a clear disclaimer stating this site has no partnership or endorsement relationship with them, and that current rules should be verified on their own site before trading a real funded account.

Previously described a single moderate plan that no longer exists in this form - now distinguishes the two aggressive invented-target plans from the four rule-based FTP plans.

The idle-timeout exemption (session-check.js's idleTimeout flag) already worked correctly. But the separate pagehide-triggered logout beacon added later applied to everyone unconditionally, including the owner. Added the same bypassPaywall-based exemption to that beacon, captured once session-check resolves.

The existing plans require 26-29% daily growth (2000x and 1000x returns) - genuinely extreme even by the site's own risk warnings. The new plan targets a 4x return (still ambitious) over 60 days at ~2.3% daily, calculated precisely to land exactly on $20,000 - verified the compounding math lands exactly on target before generating the 60-row table. Added a new 'emerald' card theme to visually distinguish it from the aggressive gold/platinum plans.

The existing text stated a blanket '26-29% daily growth' for all challenges, which is no longer accurate now that a more moderate plan exists. Updated to describe each tier's actual requirement.

Confirmed against visitor-counter.js and the master migration - the real table is site_stats. This alone would make the visitor-stats portion of every sync fail with a Postgres error.

The real success path already included it, but the early-return for zero active Telegram subscribers didn't - so a perfectly normal, expected state (nobody's subscribed yet) displayed as a red failure with no explanation.

admin-run.js wraps every task's response as {task, status, result: {...}} - the other 3 admin utility buttons (Refresh Calendar, Check News Alerts, Calendar Health) already correctly read data.result, but these two checked data.success and data.synced at the top level, which never exists in that shape. This meant these two buttons displayed 'failed' on every single click regardless of whether the underlying task actually succeeded. Verified with a direct simulation: the old logic reports failure even when result.success is true; the fixed logic correctly reports success.

v12.39 made the backend correctly reject deleting the owner account, but the button itself still showed in the UI, which looked like a bug even though it was already safely blocked. Now shows 'Owner account' in place of the button for that specific row, matching the same protection already in the backend.

There was no protection against this before - deleting it would have permanently locked the owner out of their own admin/bypass access. admin-delete-account.js now explicitly blocks it with a clear error message, using the same OWNER_ACCOUNTS reference already used in session-check.js and check-access.js. Verified the check is case-insensitive.

admin.html prompts for an optional reason before sending the reject request. admin-approve-account.js accepts it, HTML-escapes it (it's admin-typed free text going into an email), and includes it in the email sent to the rejected user - so they actually know why, instead of just 'not approved.'

New notifyAdminByEmail() in both auth-register.js and request-access.js, using the same Resend credentials already configured. Sent to fxjithin@gmail.com (the same hardcoded owner address used elsewhere) rather than a new env var. Telegram notification is unchanged and still fires alongside it - this is an addition, not a replacement.

New sendRejectionEmail() function, same Resend pattern as the existing approval email (requires RESEND_API_KEY/RESEND_FROM_EMAIL, already configured). States the account was not approved and invites them to contact support if they believe it's a mistake, matching the tone already used in auth-login.js's rejection message.

Kept the important distinction (not a course, not a signal service, nobody tells you what to trade) but corrected the factually wrong 'FREE and open source' framing to state the real $100/$200 per year pricing. Updated the matching JSON-LD structured data entry to match, and confirmed the JSON-LD still parses as valid JSON after the edit.

Page <title>, main meta description, meta name="title", og:title, og:description, twitter:title, twitter:description all still said 'Free' or '100% free' - these are what search engines and social media link previews actually display, so they were actively misleading anyone who found the site via Google or a shared link. All updated to state the real pricing instead.

Reverted the 9 blurred/locked answers back to plain, fully visible content - removed the lock overlay CSS, the wrapper divs, and the check-access.js unlock script entirely.

Only 5 sections remain: Getting Started, Trading & Execution, Technical Questions, Common Mistakes, Advanced Questions. Also removed the corresponding 4 entries from the page's JSON-LD structured data (FAQPage schema), which had its own separate copy of that content for SEO - confirmed the remaining JSON-LD still parses as valid JSON after the removal.

This is what actually solves the scrolling problem: the page now renders as a scannable list of 16 questions, and only the ones a visitor clicks expand. Works within the existing 2-column grid on wide screens unchanged.

The tickers=FOREX:USD,EUR,GBP,CAD,CHF query was too narrow - Alpha Vantage's forex-specific ticker tagging is sparse, so even a fresh, correctly-working fetch had little recent content to find. Switched to topics=financial_markets,economy_monetary (Fed/ECB/inflation coverage is near-daily) as the source pool, with a hard time_from cutoff (5 days) so nothing older can ever be shown regardless of what the keyword filter lets through. The keyword filter itself is unchanged - same forex/gold/monetary-policy terms, just filtering a much larger and fresher candidate pool now.

Same pattern as the WTI fix earlier - a new cache key can never accidentally serve data cached under the old query's logic.

Q5 (Pattern #4 vs #17), Q6 (combining patterns), Q7 (Previous Day NY), Q9 (entry timing), Q10 (stop loss placement), Q11 (profit targets), Q14 (BSL/SSL marking), Q15 (IFVG), Q17 (why patterns fail) - these reveal specific pattern mechanics, the actual paid content value. The remaining 11 questions (pricing, account setup, general guidance, 'are you selling a course') stay fully open, since those are exactly what helps an undecided visitor convert. Checks check-access.js?instrument=any independently of the page's login gate - fails closed (stays masked) if the check itself fails, rather than risk exposing paid content.

So the FAQ page still functions as a table of contents for what's covered, giving a logged-in-but-not-purchased visitor a reason to buy, rather than hiding the whole item and giving no indication it exists.

When Alpha Vantage returned no feed, or the keyword filter matched zero articles, the code correctly served the old cached articles - but never updated fetchedAt. Since the timestamp never advanced, the 90-minute TTL check always failed, so the function re-hit Alpha Vantage on every single request instead of once per 90 minutes - burning through the 25/day quota fast, and once exhausted, permanently stuck serving whatever was cached the last time a real match succeeded, however long ago. This is what 'news hasn't changed at all' actually was. Verified the fix with a side-by-side simulation: the old logic re-fetches on every request indefinitely, the fixed logic correctly waits out the cooldown after the first attempt.

Defensive addition - their documented default already appears to be LATEST, but being explicit removes any doubt rather than relying on an assumed default.

Restored the auth-gate.js requirement removed in v12.31 - FAQ access is now a signup benefit rather than public content.

Text changed to 'Have questions about pricing, access, or how patterns work? Sign up and see the FAQ Page', linking to register.html instead of faq.html - avoids the earlier bug of linking a public page to a gated one, since the link now honestly goes where the action actually happens.

faq.html had the same auth-gate.js login requirement as the main dashboard pages, so an unauthenticated visitor clicking the teaser would just get bounced back rather than seeing any content. Removed the gate from faq.html entirely - checked for any session-dependent elements first (account widgets, logout buttons) and found none, so this was safe. FAQ content is exactly what helps an undecided visitor before they sign up, so gating it behind login was working against its own purpose.

Now sits below the FAQ teaser as the last element on the page, styled as a proper footer instead of inline hero text.

Reuses the existing visitor-counter.js function and the exact same sessionStorage-gated increment pattern already on index.html - counts once per browser session, just reads the count on subsequent loads. Honest phrasing ('X visitors', a cumulative total) rather than implying a live 'online now' number the underlying data doesn't actually support.

Create a Free Account -> Pick an Instrument -> Get Session-Based Patterns. Stacks vertically with rotated arrows on narrow screens.

Surfaces the existing FAQ page, which wasn't linked anywhere on the welcome page before.

Previously hidden entirely on tablets, laptops, and every phone. Now stack as static, full-width glass cards in normal document flow right after the topbar. Caught and fixed a real cascade-order bug during this: the mobile override was positioned earlier in the stylesheet than the base widget rules, which with equal CSS specificity would have meant the base position:fixed rule won at narrow widths despite the override - moved the mobile media query to the end of the stylesheet and added a defensive !important on position specifically.

Covers every table/column across the site's full history in one idempotent file, safe to run regardless of which individual database-*.sql files were already applied. Deliberately does NOT include the original destructive DROP TABLE trades from database-setup-trades.sql, which would have wiped real trade data if run again.

Architecture, every required environment variable, database instructions, open items needing the site owner's action (not code), recent feature summary, and key file locations - independent of chat history.

Checked symbol lists, gold-pricing sets, account-status values, owner-account exemptions, and the full instrument list all match exactly across every file that references them, rather than assuming they still agree after many rounds of edits.

Switched from the broad topics=financial_markets query to tickers=FOREX:USD,FOREX:EUR,FOREX:GBP,FOREX:CAD,FOREX:CHF. On top of that, added a keyword filter (forex/currency/gold/xau/fed/ecb/interest rate/inflation/etc.) that drops anything not genuinely forex or gold related - verified against 8 realistic headlines including ones that should be dropped (Apple, Bitcoin, Tesla, generic oil news all correctly excluded; gold, EUR/USD, nonfarm payrolls, SNB all correctly kept).

If the feed comes back but every article gets filtered out, a sample of the actual returned titles is logged - so the keyword list can be tuned against real headline wording instead of guessing twice, same approach as the WTI diagnosis.

Cache-aside via the existing KV store, same pattern as get-live-prices.js. Caches for 90 minutes (not 60 seconds) since Alpha Vantage's free tier is only 25 requests/day - a 90-minute cache gives ~16 refreshes/day, comfortably under the limit no matter how many visitors load the page. Requires ALPHAVANTAGE_API_KEY in Netlify env vars - not written to any file (confirmed via repo-wide search before shipping, same as the Twelve Data key earlier).

Positioned right side (price card is left), same frosted-glass style with a green tint. Shows up to 5 headlines with source and relative time (e.g. '45m ago'), each linking out to the original article.

News titles/sources are HTML-escaped and article URLs are checked to start with http(s):// before being used as a link href - verified against an XSS payload and a javascript: URL in simulation before shipping. Same defense-in-depth pattern already used elsewhere in the site for any content that isn't fully within our control.

The exact error: "symbol WTI/USD is not available with your plan. You may select the appropriate plan at https://twelvedata.com/pricing." Their general docs list WTI under commodities, but the free tier this key is on doesn't include it - confirmed from the API's own response, not assumed. The other 5 symbols were unaffected (only WTI/USD appeared in the missing-symbols log), so removed WTI/USD cleanly from both SYMBOLS and the display order rather than leave it generating a 403 on every request.

If the Twelve Data plan is ever upgraded, WTI/USD can be added back into the SYMBOLS array with no other code changes needed - the cache-key-includes-symbols fix from v12.25 means it'll pick up cleanly with no stale-cache risk.

Repositioned from top:250px to top:170px.

When WTI/USD was added to SYMBOLS in v12.23, the cache key stayed the same generic string, so any snapshot cached before that deploy (missing WTI) would keep being served for up to 60 seconds - or longer if the KV write pattern meant it never got a fresh trigger. The cache key now includes the symbol list itself, so changing SYMBOLS always produces a different key and can never serve data cached before the change.

If WTI/USD still doesn't show after this deploys, the real reason (wrong plan, rate limit, symbol not recognized) will now be visible in Netlify's function logs for get-live-prices, instead of the symbol just silently never appearing with no way to tell why.

Now sits below the 'Session-based trading patterns for Gold, Oil & Forex' heading level instead of alongside it.

Confirmed via Twelve Data's own documentation that WTI/USD is available on the same basic tier as forex and XAU/USD gold spot, so it's now the 6th price shown. Formatted with 2 decimals like gold, not 4 like the forex pairs.

Confirmed these specifically require Twelve Data's separate Commodities API product (starting at $29/month) - a different plan from the forex/spot-metals endpoint the current key covers. XAU/USD spot remains the closest available stand-in for gold on the free tier.

Semi-transparent frosted-glass style (backdrop-filter blur, subtle red-tinted gradient border) instead of a solid bar, so the bear artwork shows through. Each price is now its own row (label + value) instead of an inline strip.

The card is position:fixed at a set left offset, but the hero heading is centered with max-width:800px - at medium viewport widths (1024-1500px) the hero's centered box would have shifted left enough to overlap the card. Verified the math at the new 1500px threshold leaves a 70px gap, growing wider as the viewport gets bigger.

Fetches EUR/USD, GBP/USD, USD/CAD, USD/CHF, and XAU/USD gold spot. Requires TWELVEDATA_API_KEY as a Netlify environment variable - not embedded in any file (confirmed via direct search of the whole repo before shipping). The upstream API is only called when the cached snapshot (stored in the existing Postgres-backed kv_store table) is older than 60 seconds, so traffic on the welcome page never multiplies into API calls - one visitor or one thousand visitors in the same 60-second window all read the same cached snapshot. Falls back to the last good cache (marked stale) on any upstream error, and degrades to hiding the ticker entirely if no key is configured yet or no cache exists.

Shows each pair with green/red coloring based on whether it moved up or down since the last poll (every 45 seconds). WTI oil and gold futures (GC1!, MGC1!) are intentionally not included - free-tier futures coverage is inconsistent across providers, so only forex + gold spot are shown to avoid displaying data that might silently be wrong or missing.

The badge was hiding the upward green arrow in the background artwork behind it. Padding, border-radius, and every text element scaled down to make the badge noticeably smaller and less intrusive.

Repositioned from top:100px/left:24px to top:15px/right:24px, aligning with the topbar's vertical position in the space beyond the centered 1100px topbar content on wide screens.

Fully removed the session-badge CSS, HTML, and JS from index.html (confirmed zero references remain, div count back to its original 188). Added the same compact MARKET OPEN/CLOSED badge to welcome.html instead, positioned fixed on the left side since that page has no other sidebar widgets to avoid - shown at 1150px+ viewport width so it doesn't overlap the hero text on narrower screens. Same proven session/weekend calculation as session-timer.html, unchanged.

New, separate widget (session-badge) from the existing left-sidebar session timer - a compact colored-dot status, current session or 'MARKET CLOSED', UTC time, and a countdown to the next session. Reuses the exact same weekend/session calculation already proven in session-timer.html (verified against Friday/Saturday/Sunday boundary cases and all three session windows before shipping) rather than reimplementing it from scratch. Positioned in the same safe wide-screen (1300px+) gap next to the profile card already used for other supplementary widgets, avoiding any overlap with the existing sidebar widgets or the Quick Jump menu.

The cards were overlapping the bull and bear's faces/eyes in the background artwork. Pushed them down so more of the animals is visible above the cards.

Their marketing guidelines state all promotional material must contain 'a sufficiently prominent risk warning/disclaimer' - the page previously only had an affiliate-commission disclosure, not an actual trading-risk warning. Added leverage/loss-of-capital language plus the required 'past performance does not guarantee future performance' statement.

BlackBull does not accept clients from Canada, the US, the EU, the UK, or India (per their own footer). This wasn't disclosed anywhere on the page before.

BlackBull's guidelines state only their own affiliate-portal banners/materials are pre-approved - custom content (like this comparison table) may need their written sign-off. Also flagged: their rule against ever telling a client what to trade and in which direction sits in tension with this site's core Buy/Sell pattern content being shown alongside the BlackBull promotion. Both are business/policy decisions, not something fixable in code.

Now explicitly states the site is for educational purposes only, is not financial/investment/trading advice, that probability ratings are historical observations rather than promises, and links through to the full Terms of Service - visible directly on the most-trafficked page instead of only inside terms.html.

Hero paragraph no longer ends with 'Not selling a course - $100/year...'. The footer line 'Not Selling Courses | Charting my own path | Learning | Growing | Evolving' was removed along with its now-unused CSS.

Removed welcome-bg-bullbear.jpg (Noto Color Emoji based). New welcome-bg-bullbear-art.jpg extends the provided artwork into a full-page canvas: the artwork's own bottom edge (rgb 6,14,26) was nearly identical to the site's navy tone already, so it was extended downward into the site's own gradient with a 180px feathered cross-fade - no visible seam, and the original artwork isn't stretched or cropped to force it into a taller canvas.

Removed the personal photo entirely. New background (welcome-bg-bullbear.jpg) is applied to <body> itself instead of just the hero section, so it now covers the full page height including the feature cards below, not just the top strip. Drawn from a bear and a bull emoji glyph (Noto Color Emoji, upscaled and sharpened) rather than hand-drawn silhouettes - an earlier attempt at drawing the animals from scratch didn't read as recognizable, this does. Each has its own glow halo in red/green matching market direction, plus subtle grid lines and a full-page vignette that darkens toward the bottom so the feature cards stay readable.

Since they now sit directly on top of the full-page background image, added a slight backdrop-filter blur and a more opaque card background so they read clearly against the busier backdrop.

welcome-hero-bg.jpg was reused for the new composite, and that path falls under the site's /assets/* rule (Cache-Control: public, max-age=31536000, immutable). With no cache-busting query string and an identical URL, the browser/CDN had no reason to ever re-fetch it. Renamed to welcome-hero-bg-v2.jpg and updated the CSS reference - a new filename can't collide with any existing cached copy, regardless of which caching layer was holding onto the old one.

Left ~40%: the personal photo, color-graded to the site's navy palette. Right ~60%: an original candlestick chart graphic drawn in the site's own green/red palette, telling a bear-to-bull story left to right - not a stock photo, avoids any copyright concern. The seam between them is cross-faded over a 260px feather zone rather than abutted as two rectangles, then the whole composite gets one shared vignette and tone grade so it reads as a single image, not two glued together.

The new composite already has its own built-in vignette; the original overlay strength would have stacked with it and over-darkened the result.

Processed the uploaded beach photo to fit the site's dark theme: cropped to a wide 21:9 banner centered on the subject, desaturated and color-graded toward the site's navy palette, darkened overall, and given a built-in vignette so it blends into the surrounding page. A CSS overlay on top guarantees text contrast regardless of viewport width. Saved as assets/img/welcome-hero-bg.jpg (87KB, reasonable for a hero background).

The 'Create Free Account' and 'I already have an account' buttons in the hero were duplicates of the Sign In / Create Account buttons already in the top bar. Removed the hero pair and its now-unused CSS.

It was nested inside #navButtons, which the menu's X button collapses via a CSS class on the whole container - anything inside it disappeared along with the rest of the menu. Pulled it out into its own independent floating widget (account-float), positioned bottom-right, mirroring the existing Telegram button on the bottom-left. It now stays visible regardless of whether the main menu is expanded or collapsed.

Moved out of the separate wide-screen-only floating widget (which required a 1300px+ viewport to even appear) into the empty space at the bottom of the nav-buttons panel itself, so it's visible at any width the menu shows at. Kept as its own compact side-by-side row (button + separate icon) rather than turning it into another full-width stacked button like Risk Calculator or Consistency, so it stays visually distinct from the rest of the list. Removed the now-unused floating-widget CSS.

Verified every cookie-setting code path is correct (session cookie, no Max-Age, only one place sets it). The remaining cause is a well-documented Chromium default: with that setting on, closing every window doesn't end the browser process, so the session cookie technically never expires even though the user perceives having closed the browser. Confirmed via direct testing that the session cookie logic itself is not the issue.

A pagehide listener calls navigator.sendBeacon() to auth-logout.js the moment a window is torn down, independent of whether the underlying browser process keeps running afterward. Scoped to skip normal same-site link clicks and form submits (tracked via a short-lived flag) so it doesn't fire on ordinary navigation between pages - verified both cases in isolation before shipping. Not a complete substitute for actually closing the browser (typed URLs, bookmarks, and back/forward aren't covered), but a real, working safety net for the most common case: clicking away vs genuinely closing the tab.

auth-register.js now creates the account with status 'pending' and does not set a session cookie. register.html shows a confirmation message instead of redirecting. auth-login.js checks status after verifying the password (never before, so an invalid login attempt can't be used to probe whether an account exists or its approval state) - pending and rejected accounts get a clear error and no session cookie.

New admin-approve-account.js function and a Status column showing pending/approved/rejected. Approving sends an email via Resend if RESEND_API_KEY/RESEND_FROM_EMAIL are configured (same as instrument access approval), and is skippable without breaking anything if they're not set.

Same pattern as request-access.js - if TELEGRAM_BOT_TOKEN and ADMIN_TELEGRAM_CHAT_ID are set, a message is sent the moment someone registers, so new signups don't sit unnoticed.

The migration explicitly approves every account that already existed before this workflow was added, including the owner account and any test accounts already in use. Only registrations from this point forward start as pending.

auth-login.js and auth-register.js set fxj_session with a 30-day Max-Age, so closing and reopening the browser kept visitors logged in. Removed Max-Age entirely, making it a true browser session cookie per RFC 6265 - it's cleared automatically when the browser itself closes, not just the tab. The token's own 30-day expiry stays as a safety ceiling, it just no longer determines real-world session length on its own.

admin.html's bearer token has only ever lived in sessionStorage, never localStorage - already cleared on browser close by design. No code change needed there, just verified no persistent fallback exists.

Gold XAU/USD, GC1! futures, and MGC1! micro futures are now $200/year; EUR/USD, GBP/USD, USD/CAD, USD/CHF, and WTI Oil stay at $100/year. The paywall screen, PayPal link, and button text now show the correct price per instrument - verified all 8 instruments map to the right amount before shipping.

request-access.js independently determines the price from the instrument slug and stores it in a new price_usd column, so the amount the admin checks against PayPal can't be tampered with by the request itself.

New Price column in the Access Requests tab, so it's clear which requests need a $100 vs $200 PayPal payment confirmed before approving. The Telegram notification also now states the expected amount.

Both now state the $100/$200 tiers instead of a single flat price.

Same category of gap already found with Edge Functions - a documented case exists of netlify.toml configuration not being honored on drag-and-drop specifically. Rather than keep trusting server-set headers for something this security-critical, assets/auth-gate.js is now loaded via a small document.write with a Date.now() query string computed fresh on every single page load. A URL that's literally different every time can never be served from any cache, regardless of what headers do or don't apply - verified the exact string transformation in isolation before shipping.

Confirmed zero pages still reference the old static (non-cache-busted) script tag.

Covers: educational content only (not financial advice), no guarantee of results, PayPal as a third-party processor, manual approval (not automatic), no-refund policy once access is granted, 1-year non-renewing access, non-transferable accounts, and limitation of liability. Written as a plain-language starting point, not a substitute for a lawyer's review given real payments are involved.

The paywall's 'I've completed payment' button starts disabled and only enables once the Terms checkbox is checked - enforced in three layers: the disabled attribute, a change listener, and a redundant check inside the click handler itself. request-access.js also rejects the request server-side (checked directly - any value other than a literal true is rejected, no truthy-string bypass) if agreedToTerms isn't true, so the checkbox can't be skipped by calling the API directly.

register.html now requires agreeing to the Terms and Privacy Policy before an account can be created, enforced both by the browser's native required checkbox and a server-side check in auth-register.js.

New agreed_to_terms column on both the accounts and instrument_access tables, set to true only when the server-enforced check passes - real evidence of agreement if a dispute ever comes up, not just a UI formality.

Updated the hero text and meta description to state the $100/year per-instrument plan instead of implying everything is free. The Create Free Account button text was left as-is since registration itself genuinely is free - only instrument access costs money.

Its Cache-Control was public, max-age=300, must-revalidate - a real window where a browser or CDN edge could still serve the PREVIOUS version of the gate logic (e.g. one that predates the any-instrument check added in v11.5), silently reverting general pages to no gate at all until the cache expired. Changed to no-cache, no-store, must-revalidate so this file is never servable from cache, matching the security-critical role it plays.

Confirmed via direct console check: typeof window.__FXJ_REQUIRE_ANY_INSTRUMENT__ returned undefined on a page whose current source clearly contains that marker - meaning the page load in question never executed today's code at all, consistent with a browser cache or back-forward-cache restore of an older page. No auth-gate.js or gtag.js requests appeared in the Network tab either, which a genuinely fresh load would always show.

The general netlify.toml header rule now forces every HTML page to revalidate with the server before being reused from any cache, so a real visitor can no longer be served a stale, pre-gate version of a page. Assets (/assets/*, /icons/*) are unaffected - their existing hard-cache rules still take precedence.

check-access.js gained a new ?instrument=any mode: checks whether the visitor has at least one active, unexpired instrument purchase, rather than a specific one. All 13 pages reachable from the Quick Jump menu (Trusted Brokers, Pattern Guide, Common Patterns, Session Patterns, Search, Session Timer, News, Trade Journal, Analytics, Risk Calculator, Consistency, Challenge Plans, Glossary) now show a generic 'Activate an Instrument Plan' screen with a link back to the homepage if the visitor has no active plan. My Account (profile.html) remains free, along with the footer's plain-text links (FAQ, What's New, Privacy, Code of Conduct).

The same bypassPaywall exemption already used for instrument pages applies here - verified the owner account never even calls check-access.js on these pages.

session-check.js, check-access.js, and auth-me.js never sent Cache-Control headers, so a browser could serve one visitor's cached access response to a completely different visitor requesting the identical URL - confirmed as the cause of two fresh test accounts viewing paid instrument content with no purchase on record. Added a new noCacheHeaders() helper (Cache-Control: no-store, Vary: Cookie) to all three endpoints, plus cache: 'no-store' on the client-side fetch calls in assets/auth-gate.js and profile.html as a second layer of defense.

New admin-delete-account.js function and a Delete button in the Accounts tab, which also removes that account's instrument_access rows. Trade journal entries are untouched since they're owned by trader_name, not account email.

admin-approve-access.js now emails the visitor when their access is approved, using RESEND_API_KEY and RESEND_FROM_EMAIL. If those aren't configured, or the send fails, approval still succeeds - the email is a courtesy notification, not a dependency. Requires a Resend account with a verified sending domain to email arbitrary recipients (not just the account owner).

Free-text fields (trader name, instrument, session, pattern, plus the new email/instrument fields) were rendered into page HTML without escaping. Since the admin bearer token lives in sessionStorage (JS-readable), a malicious trader name could have executed arbitrary JS in the admin panel and taken over the session. Added an escapeHtml() function to trade-journal.html, admin.html, and profile.html, applied everywhere user data is rendered. One spot (deleteTraderTradesConfirm) also had a quote-breakout injection in an inline onclick handler - replaced with a safe data-attribute pattern. Verified against real attack payloads before shipping.

isValidEmail() now rejects characters with no place in a real address (<, >, ", '), closing off the XSS vector at the source in addition to the output-escaping fix.

session-check.js now also returns a bypassPaywall flag for the owner account (same exemption list as the idle-timeout bypass). assets/auth-gate.js skips the check-access.js call entirely when that flag is set, going straight to the page - verified check-access.js is never even called for the owner. check-access.js itself also grants automatic access to the owner account as a safety net, in case it's ever called directly.

Replaced the placeholder with https://paypal.me/fxjithin/100usd - the $100 USD amount is pre-filled so the payer doesn't need to type it in.

Visiting eurusd, gbpusd, or any of the 8 instruments without active paid access now shows a paywall screen with a PayPal link and a request-access button, instead of the pattern content. New check-access.js and request-access.js functions. Payment is NOT verified automatically - clicking 'I've completed payment' just files a pending request.

New admin-access.js and admin-approve-access.js functions. Approving sets access active for exactly one year from that moment; a daily scheduled function (expire-instrument-access.js) marks expired access as expired automatically so it must be repurchased.

If TELEGRAM_BOT_TOKEN and ADMIN_TELEGRAM_CHAT_ID are set (same variables the existing calendar-health alert already uses), a message is sent immediately when someone requests access, so requests don't sit unnoticed.

assets/auth-gate.js has a single PAYPAL_LINK constant currently set to a placeholder - swap in the real PayPal link there once available.

session-check.js now returns an idleTimeout flag alongside valid - true for regular accounts, false for the owner's own account. assets/auth-gate.js only starts the 20-minute idle timer when that flag is true, so every other account still auto-logs-out as before.

Moved out of the main menu into the gap next to the Fx-Jithin profile card (wide screens), with a small logout icon to its right that logs out in one click without visiting the profile page.

New Accounts tab in admin.html (backed by a new admin-accounts.js function) shows every registered email with its signup date and last login time, so new signups are visible without querying the database directly.

The footer's Log Out link previously redirected straight to login.html; both it and the new quick-logout icon now redirect to welcome.html, matching the rest of the site's flow.

Any mouse, keyboard, touch or scroll activity resets the idle timer. If a visitor is inactive for 20 minutes, they're automatically logged out and redirected to welcome.html.

The gate script that used to be duplicated inline across all 22 protected pages now lives in a single assets/auth-gate.js, referenced by a short script tag. Future changes to gate behavior (like this one) are now a one-file edit instead of re-touching every page. Given its short-cache header, edits take effect without needing a version-hash query string synced across every page.

Shows the logged-in email, when the account was created, and the last login time, with a Log Out button. New auth-me.js function returns the account's own details. Linked from the main menu under Track as My Account.

The Edge Function approach from v10.0 does not deploy via drag-and-drop uploads - only Git-based deploys or the Netlify CLI reliably deploy Edge Functions - so require-auth.js was likely never actually running, while netlify.toml still routed every request through it, breaking navigation site-wide. Removed the Edge Function entirely.

New session-check.js (a normal Function, which drag-and-drop deploys fine) checks the session cookie. Every protected page now has a small inline script in its head that calls it on load and redirects to welcome.html if not logged in, with the page body hidden via CSS until the check resolves. Applied to all 8 instrument pages via build.mjs and all 17 other protected pages directly. login.html, register.html, welcome.html and admin.html are correctly excluded.

Unauthenticated visitors now land on a page describing the site and its content, with Sign In and Create Account buttons at the top, instead of going straight to the login form. The edge function's redirect target and public-path list were updated accordingly.

database-add-accounts.sql now also inserts the site owner's own account (fxjithin@gmail.com) using a pre-computed password hash, so no separate registration step is needed. The plaintext password is never stored in the database or the repo.

New login.html and register.html pages (email + password). A Netlify Edge Function (require-auth.js) checks every page request server-side before the page is served, so unauthenticated visitors are redirected to login rather than the content just being hidden client-side. Admin login, static assets, and the API routes are exempt.

database-add-accounts.sql adds the accounts table. New functions: auth-register, auth-login, auth-logout. Sessions are a signed cookie, verified identically on both the Node-side functions and the Deno-side edge function (cross-runtime HMAC compatibility confirmed by direct test).

Cross-checking all 8 instruments after the v9.13 fixes found EURUSD's pattern #5B NY session read 'Overlap Dump' instead of 'Reverse DOWN', while its own Trading Signal says 'Sell NY Reversal After London Pullback' and all 7 other instruments correctly tag NY with the reversal. Fixed so all 8 instruments now land the marker in the NY session consistently.

Pattern #5 names a reversal twice (once as PREV NY context, once as the actual NY entry per its own Buy/Sell NY Reversal After London Pullback text). The reversal marker now prefers the later, actionable mention instead of the first one it finds.

The retest marker used to search every later session for the closest matching wick, which could accidentally prefer an earlier Consolidate candle over the session explicitly named Retest High/Low or Sweep Above/Below - confirmed on #12A vs #12B, which have identical structure but only #12A landed correctly. The marker now searches inside the explicitly-named session's zone first. Fixes patterns #4 (Liquidity Sweep) and #12 (Session High/Low Retest) across all instruments.

Checked all 368 scenarios' markers against session text and Trading Signal wording. One more case (#3 Gap Fill and Reversal) was reviewed and confirmed correct - its marker matches the session explicitly named Reverse UP, even though Entry Timing separately mentions London for the gap-fill condition.

Broke High/Low describes a momentum event already in progress, not a level meant to be retested. Because #7's only later price action near that level was the final leg of a full round-trip, the retest and BUY/SELL markers were landing at the bottom/top of an already-finished move instead of a sensible entry. Broke High/Low no longer triggers a key level, so #7 (16 scenarios across all instruments) now shows no marker rather than a misleading one. No other pattern was affected.

For scenarios with a confirmed retest or reversal candle, the chart now draws a short dashed line out from that exact candle with a small BUY or SELL label, using the scenario's own bullish/bearish field (never guessed). Covers 181 of 368 scenarios - anywhere a retest or reversal candle was already reliably identified; scenarios without either anchor are left unmarked.

Where a session is tagged 'Reversal UP/DOWN' or 'Reverse UP/DOWN', the chart now marks the exact turning-point candle - the zone's lowest wick for a reversal up, highest for a reversal down - in a dashed pink/magenta style, with a matching Reverse entry in the chart legend. Covers 92 scenarios where the session names an explicit direction; sessions like 'Strong Reverse' or 'Sweep & Reverse' with no UP/DOWN word are left unmarked rather than guessed.

128 scenarios across all 8 instruments had a copy-paste bug where the Bullish legend entry showed a red dot instead of green. Fixed at the data level in every instrument file.

Scenarios with a marked retest candle now show a matching dashed Retest entry in the chart legend, so the hollow cyan candle from v9.8 is explained instead of unlabeled.

Chart height now stretches to match its details panel instead of leaving empty space below it, and every candle's vertical scale increased 1.5x so overlapping wicks spread out and read more clearly.

For the 104 scenarios with a marked High/Low key level and a later session to retest it, the specific candle whose wick actually touches that level is now drawn hollow with a dashed cyan outline, visually confirming the retest. The 2 scenarios where the level is set in the final NY session (nothing left to retest) are correctly left unmarked.

Where a pattern's session flow calls out a High or Low (e.g. 'Set New Low' or 'Retest High'), the mini chart now draws a dashed reference line and label - e.g. 'ASIAN LOW' or 'PREV NY HIGH' - at the exact candle wick that set it, computed directly from each chart's own geometry. Applies automatically wherever the pattern narrative names a High or Low (106 of 368 scenarios); patterns without a clear High/Low reference are left unannotated rather than guessed at.

Each pattern's Entry Timing (e.g. '02:00-10:00 EST') now shows a second line with the equivalent window in the visitor's own timezone. Uses the same timezone selector already on the homepage - a choice made there carries over to every instrument page automatically, with no clutter when the visitor is already on EST or GMT.

Removed the FAQ and What's New buttons from the Quick Jump menu and added them to the footer link row alongside Privacy Policy and Code of Conduct.

Changed the button text from all caps TRUSTED BROKERS to title case Trusted Brokers, matching the other menu button styles.

trusted-brokers.html previously used one gold theme for all three cards. BlackBull Markets is now blue, FP Markets is now red, and Fusion Markets is now purple, matching each broker's own branding.

Removed the separate floating button and header widget (including the BB logo, the Trusted Broker label, and the Compare 3 brokers caption). Added a new Brokers group at the very top of the menu panel, above Learn, with a single TRUSTED BROKERS button linking to trusted-brokers.html.

Changed both the floating button and the header widget button text from Create Account to Trusted Brokers with a shield emoji, and removed the emoji from the label above so it reads plain Trusted Broker, with Compare 3 brokers underneath.

Added trusted-brokers.html comparing BlackBull Markets, FP Markets, and Fusion Markets - account types, spreads, commissions, and minimum deposits, each with its own Create Account link and an affiliate disclosure.

The floating button and the header widget both now open trusted-brokers.html instead of going straight to a single broker, so visitors can choose between all three.

Changed the BB text inside the badge (floating button and Trusted Broker widget) from gold to white.

Added a small BlackBull Markets caption below the Create Account button in the Trusted Broker widget.

Added a shield emoji before the Trusted Broker text for a stronger trust signal.

Added spacing between the Trusted Broker label and the button, and changed the label text to white for better visibility.

Moved the widget down below the top row so the label is fully visible, and swapped the bull emoji back for the BB badge used on the floating button.

On wide desktop viewports the BlackBull Markets link now shows as a Trusted Broker label with a pill button, styled like the Pattern Guide and Common Patterns buttons, in the gap next to the menu panel. The floating bottom-right button remains as the fallback on smaller screens.

The hotlinked BlackBull logo image failed to render (broken icon). Replaced with a self-contained BB text badge that always displays correctly.

The bottom-right Create Account button now displays the official BlackBull Markets logo instead of an emoji, in a white circular badge for visibility.

Replaced the large hero banner with a compact floating button in the bottom-right corner, matching the style of the Telegram Alerts button on the bottom-left.

The homepage, the instruments API and the database display_order now list Gold (XAU/USD), Gold Futures (GC1!), Micro Gold (MGC1!), then Oil (WTI).

The 14:00-16:00 UTC window where London and New York are both open is the deepest liquidity of the day, and now has a pattern of its own.

GC1! and MGC1! add Contract Roll Distortion, Settlement Reopen Gap and Open Interest Divergence - behaviour that only exists on futures and has no spot equivalent.

Forex pairs add the daily benchmark fix and its reversion. Gold, oil and the forex pairs add the Sunday reopen gap, the only scheduled gap of the week.

Several pages stated the wrong number of patterns in their heading and footer. Every page now reports its real count.

Both COMEX contracts now have their own pattern pages, with contract specifications and roll notes. They are also in the trade journal and challenge planner at the correct tick values - $10.00 per 0.10 tick on GC1!, $1.00 on MGC1!.

Coverage is now spot gold, GC1!, MGC1!, WTI crude and four forex pairs. Silver, natural gas, all crypto and the minor forex pairs have been removed so the remaining instruments get more attention.

Commodities now run Micro Gold, Gold Futures, spot Gold, then Oil, so the three gold instruments sit side by side.

One pattern described hash rate and mining difficulty, which have not applied to Ethereum since it moved to proof-of-stake. It was rewritten around staking flows and gas demand before Ethereum was later removed.

The long tail of minor crypto and forex pairs was removed to keep the pattern set focused.

Send /resetpin YourName to the Telegram bot for a 6-digit code, then choose a new PIN. Only works if that trader name is linked to your Telegram username, so nobody else can reset it.

Patterns 18 to 21 appeared out of sequence on the eight crypto pages. They now run 1 to 24 in order.

The FAQ page now carries structured data, making its answers eligible to show directly in search results.

The bot now messages you 15-30 minutes before CPI, NFP, FOMC and other high-impact releases, with forecast and previous figures. Send /news to the bot to turn them on or off.

Pick any instrument and lot sizes and stop-losses recalculate automatically. Pip value and TP are editable so you can match your broker.

Compact header with the profile moved to the top, a collapsible side menu, and a floating Telegram button.

A new search page covers every setup on the site. Filter by direction, minimum probability and instrument, and share results by URL.

Jump straight between instruments without going back to the homepage.

The timer now shows the next high-impact release and warns inside the 15-minute news window.

It emptied the on-screen list but never removed anything from the database, so trades reappeared on the next refresh. Every row is now deleted properly and the list is re-read from the database afterwards.

Anyone could previously read every trader's trades, notes included. Your journal is now visible only to you unless you opt in, and even shared journals hide notes, screenshots and price levels.

Chart candles are drawn far more efficiently. Same charts, much faster loading on mobile.

Bullish and bearish now carry arrow symbols as well as colour, animations respect reduced-motion settings, and keyboard focus is clearly visible.

This week's high-impact releases (CPI, NFP, FOMC) in your local time, with a live countdown and currency filters.

The third-party TradingView embed is gone. The sidebar widget now uses our own feed, matching the site's styling and time zone, with no external tracking.

Challenge plans now start on the first trading day of the current month and skip weekends, so the tables never go stale. You can also set your own start date.

The admin password used to sit in the page source and was checked in the browser. It is now verified on the server, with rate-limited sign-in and expiring sessions.

Trades can only be edited or deleted by the trader who created them, protected by a short PIN.

Shared stylesheets across all instrument pages, generated from a single content source, plus a sitemap for search engines.

Hide the pattern navigation panel when you want a clear view of the charts.