Your account
HOL-D089Story implementation: In progress

Keep my profile and saved stories when I return

account · Proposed launch phase 1

Start from Home

Review as Registered user

User story

As a registered user, I want to keep my private profile preferences and saved public stories across sessions so I can return without losing my activity.

Draft requirements for review · Updated 2026-10-19

What the app should do

  • Initialize only the dedicated synthetic accounts with believable private profile facts and supported modest account data; repair provably untouched known defaults once. Preserve custom names, cleared fields, existing preferences, ownership, saves and entitlement. Counts/history reflect persisted evidence or truthful empty/unavailable states.
  • Keep one owner account/profile and its saved activity across Member, Professional and organization contexts. Workspace selection changes no ownership or entitlement.
  • Persist the initial agreed slice only: own profile/preferences and a save of Reading Wind on the Ridge (stable public story ID reading-wind-on-the-ridge). Reuse existing D001/D002 UI instead of duplicating those feature stories.
  • Private account fields are owner-only by default, including interests, broad home region and preferences. Public approved person pages use a separate projection; account email must not become a public display name.
  • Sign out/in or return in a second session and recover the same owner data. Preserve it through a failed/cancelled upgrade and successful trusted test activation; changing paid access must not change the account owner.
  • Support loading, failed save/retry, duplicate save, unsave and stale updates; reject unknown content IDs rather than writing arbitrary unchecked item keys.
  • Deny signed-out, unverified and other-account private access. Retained public saves do not unlock premium content, staff scope or group/event operations; broader follows, orders and community persistence remain in their own stories.
  • The October19 editor increment now authorizes section-scoped profile reads/patches for D001/D104: actual verified owner, current field validation, stale same-field conflict detection and concurrent disjoint-update preservation. Keep unrelated preferences, activity, public drafts, grants, entitlement and selected Home unchanged.

What to check in the demo

Follow these steps from the role’s landing page through navigation and feature checks.

Review asStart here: Home

Begin on the free Member Home. For a local example use Sign in → Try a demo account → Alex Morgan → Open account, then choose Member in the account/workspace menu if a remembered workspace opens. This is a genuine local account; no paid access is supplied.

Navigation from sign-in

  1. 01Open the fictional Registered user account through the connected sign-in service. Seeded Home review opens directly. Real HOL staff access and protected actions require an authenticator check.
  2. 02From this role’s Home choose Member in the account/workspace menu, then Edit profile + interests on free Home or footer My Backcountry → Profile → Edit profile.
  3. 03Use footer Explore → Stories → Open Reading Wind on the Ridge → Save this story. The persistence check starts with a specific profile field and this public story.

Feature checks start here

Keep my profile and saved stories when I return

Owner account data is connected in dev and staging for fictional review accounts. Casey’s profile-line save survived refresh and its exact original value was restored; owner/cross-owner API checks pass. Earlier broader save/upgrade/transfer evidence is from dev. Full stale/error and domain-persistence acceptance remains separate; no stakeholder approval is implied.

  1. 04Inspect all nine private identities; none uses Backcountry member or Returning Member as its person name. Repeat bootstrap after custom edits/clears and verify no overwrite or restored grants/data. Real registrations never receive these demo facts.
  2. 05In the delivered private profile editor save a specific harmless test value, then use the story archive → Open Reading Wind on the Ridge → Save this story.
  3. 06Use Your saved stories or Member Home to check the saved public work. Reload, sign out/in using the same account and compare that exact field and story.
  4. 07Review membership failure/cancel/success on a dedicated free account through D068, preserving that account’s profile and saved work. The demo role selector switches identities and is not this persistence test.
  5. 08Cross-account denial and stale/revoked session checks require a second dedicated session and are separate security checks, not ordinary clicks in another person’s profile.

Backend work for this feature

Backend development authorized · Dev only

What needs to be supported

  • The October19 editor increment now authorizes section-scoped profile reads/patches for D001/D104: actual verified owner, current field validation, stale same-field conflict detection and concurrent disjoint-update preservation. Keep unrelated preferences, activity, public drafts, grants, entitlement and selected Home unchanged.
  • Initialize only the dedicated synthetic accounts with believable private profile facts and supported modest account data; repair provably untouched known defaults once. Preserve custom names, cleared fields, existing preferences, ownership, saves and entitlement. Counts/history reflect persisted evidence or truthful empty/unavailable states.
  • Harden provisional profiles from authenticated-wide visibility to owner-only private account access. Define an allowlist of writable profile fields and stop the signup trigger deriving public names from email.
  • Use stable auth user IDs, explicit D001/D002 field mapping and constrained public-content references. reading-wind-on-the-ridge is the first approved fixture; synchronize the same ID with UI2 without copying the editorial body.
  • Enforce signed-out/unverified/other-user denial and permitted owner access in database/server policies; a public professional profile is a separate approved projection under D013/D014/D083/D084.
  • Handle idempotent saves/unsaves, stale updates and interrupted saves; retain data across session changes and independent entitlement changes. Do not expand to every library/follow/order table in this slice.

How to verify in dev

  1. Inspect all nine private identities; none uses Backcountry member or Returning Member as its person name. Repeat bootstrap after custom edits/clears and verify no overwrite or restored grants/data. Real registrations never receive these demo facts.
  2. Use two isolated verified owners, an unverified user and signed-out requests to test private profile/save create/read/update/delete restrictions.
  3. Save the agreed public story twice, reload/sign out/in/second-session, unsave, retry a failed update and submit unknown/other-owner IDs; verify deterministic owner data and clear errors.
  4. Test free → pending/cancel/fail → trusted test paid and revocation once D069 exists, proving unchanged profile/save ownership and no protected-content leakage.

Before this can work

  • Begin on the free Member Home. For a local example use Sign in → Try a demo account → Alex Morgan → Open account, then choose Member in the account/workspace menu if a remembered workspace opens. This is a genuine local account; no paid access is supplied.
  • Use only fictional account fixtures and dummy credentials. No real password, factor secret, card or recipient data in the frontend review.
  • UI2 owns frontend; HOL - Backend owns local schema/auth/API/policy/tests. Hosted migrations, public enrollment, outgoing email/payment and deployment remain outside this authorization.
  • HOL-D057 · HOL-D057

    Reviewed local environment/migrations and isolated synthetic fixtures; hosted promotion remains separate.

Connected stories