v0.33.1

The flash shows on the page it was left for, once, whatever else the browser asks for meanwhile. A partial reload, as the auth starter's bell's, could come while a form's redirect, in the same tab or another, was loading the page it goes back to, both with one session cookie, and both read the flash the form left: a token made in one tab showed up in the other, as a run of the browser suite caught, and a reload that came first took the flash and a form's errors from the page they were left for. v0.31.1 had the bell wait for a visit in flight in its own tab; a page can't see another tab's, so it's mended on the server:

POST /settings/tokens   tab B makes a token         303, the token flashed
GET  /settings/tokens   tab A, the bell's reload    shows none of it, and writes no cookie
GET  /settings/tokens   tab B, the redirect         shows the token, once

• A partial reload leaves the flash: one of the page it renders shows none of the session's flash data, or a form's errors, only what it flashed itself, and leaves them for the page they were left for, whichever comes first.
• session.Session.Pass: leaves the session as the request came with it, and writes no cookie for a request that changes nothing and flashes nothing, so no response can bring back a flash another has shown. One that changes the session still writes it, with what the request before flashed kept for the next.
• The guide: Forms, what a partial reload does with the flash.

Upgrading: go get github.com/cuonggt/tug@v0.33.1 mends an app made before with no change of its own. A poll, a deferred prop's fetch, and router.reload({ only: [...] }) no longer show a flash that was waiting: the next visit does.

The guide is in docs/. tug needs Go 1.26.