34 changes:
- The half of OAuth discovery that was missing
- Three components that were nearly accessible
- The Model Context Protocol, over HTTP, for somebody else's assistant
- Offering an MCP capability without writing a class
- A page head that stops claiming things the page never said
- What the site tells a machine that arrives uninvited
- A keyboard can get past the navigation, and the consent screen stops phoning out
- A token outlived the client that issued it, and kept working
- An error log that was mostly not errors
- A client secret nobody had to present
- The SMTP password was readable to anyone who could read the database
- The webhook signing key and the TOTP seed, likewise
- A tenant scope that held until you asked for page 1
- A grant on one record opened the whole collection
- The session cookie lost its
secure flag behind every TLS-terminating proxy
- The legacy CSRF check compared tokens with
===
- A LIMIT built by string concatenation
addslashes() as an escaping fallback, and as a PHP-literal encoder- The README described a framework this is not
- The schema promised tenant isolation nobody implements
- Joins on two columns, and aliases that survive resolution
- Permissions can now be resolved within one organisation
- Roles had two tables, a permissions screen, and no way to make one
- The client secret is hashed, and the realtime key moves out of its way
- A public client can say it is one
- The roles screen had a menu entry and no address
- A guard that read a variable that did not exist (FW-047)
- A pager that could not be told to stop counting (FW-048)
- Two components no theme could style
SchemaBuilder::hasIndex()- Tokens are encrypted at rest, and matched on a digest
5 changes:
- Twenty-five migrations dated 2020 that were written in 2026
- A full cache flush never removed a directory
deferredwrites moves to pramnos, and the schema builder learns how- Web push had no sender in the authentication flow
- The advanced sign-in rules had no field on any screen
27 changes:
- Two invisible columns, and a row of chips that ran off the panel
- Reading a sent message back: what it carried, and what came of it
- Web push: a notification on a device whose browser is closed
- The coverage gate reported 100% on a change that added an untested package
- Sending one account a message, on the channels it can actually receive
- Mass messages: an audience worth choosing, and push that reaches people
- The line the inbox shows, dark mode, and what DNS says about your mail
- Three MCP tools for the questions that were being answered by failing
- A log viewer in the DevPanel, at the address that used to 400
- The mail log grows without limit, and deleting it is the wrong fix
- The drift check's own false alarms, and the panel that had never worked
- The email preview's findings were taking a third of the width from the message
- Push had five parts and shipped four of them
- Every browser restart minted a session, and none of the old ones ever ended
- Nothing knew what kinds of mail an application sends
- Choosing who a mass message goes to, and seeing who that is
- The soft prompt was rendered on every page and never shown
- Nothing recorded a sent push
- The DevPanel had a second log viewer because of one hard-coded URL
- The database tab could not answer a developer's question about a database
- An unread message was something you had to go looking for
- Two development query logs that grew until the process died
- The database tab, again: chunks, and the half of the admin screen it still lacked
- Twenty-five forked PHP processes, for a constant
- The database tab, third time: copied rather than rewritten
- An unsubscribe is two records, and the second had nowhere to go
- The coverage gate, and the two bugs it found
66 changes:
- A sign-in is questioned when it looks wrong, not when the browser is new
- One TOTP code, one login
- A password change that cannot be the same password
- The bundled sign-in forms can price automation
- The mail an account was sent is on the account's screen
- Themed email: the column that had never been read
- An email is written in the recipient's language
- A datatable over an
authserver.* table read as empty on MySQL
- Authorization is three layers, and the guide said two
- Two reported bugs: a date of zero, and a cropped PNG's black corners
- Something runs the second-factor cleanups
- The services screen says whether anything is listening to its buttons
- A message to many accounts, composed and sent from a screen
- Three test classes were spending their time emptying the cache
- Requiring a second factor, and requiring a real one
- The debug bar says where the second factor stands — and stops forgetting your tab
- Three dead ends on the administration screens
- A settings row no longer opens the debug toolbar
- Nothing on the settings screen opens the DevPanel any more
- A scaffolded application comes with something that runs its background work
/admin/Services says how to create the supervisor- New-sign-in alerts can be on unless turned off
- The DevPanel's Back button goes where you came from
Session can write, not only read- One apostrophe no longer destroys a page's breadcrumb structured data
Html\Date renders the time and the dropdowns it always claimed to accept- The queue worker runs under a supervisor
/admin/Services can see a supervisor in another container- An unsubscribe link, and the two headers Gmail actually reads
Addon::trigerAddon() refuses a nameless addon too- The default language is a list, not ten characters of free text
- Adminer, at
/adminer, behind the application's own gate
/messages — the inbox those internal messages were going into- Any browser with JavaScript can solve the human check — and a test proves it
- A CSP-blocked redirect, and a script with two nonces
- Adminer signs itself in
Html\Date reads the properties it declares- An idle connection is not a query running for three hours
Html\Date's field is validated by the browser again- A date is written the way the language writes dates
- Two of the widest columns on the process list said the same thing four times
- Two empty boxes where the log charts should be
- The log dashboard's figures, asked for by something that is not a screen
- The components guide listed
Seo and then never mentioned it again
mcp:serve had its own copy of the tool catalogue, and it was stale- The most frequent error in the log was the framework asking a question
- Every log entry was dated the moment you looked at it
mcp:serve is not something a person could debug- An MCP tab in the DevPanel: the schema as a form, the answer on the page
find-symbol: the question grep cannot answer- The DevPanel's MCP tab shipped with a JavaScript syntax error
route-list executed the views, and then said there were no routes- A link in the DevPanel is styled wherever it is
- Two more MCP tools: what the CLI can do, and what the theme is made of
- Three tests that were a copy of the tool catalogue
api-docs and find-tests: the other two of the four- Two rules that could not be checked, and now can
changelog-add: the one tool that writes- The plain-text part of an email was the CSS, with the links removed
- Four headers that decide what happens to a message
- Gmail actions: a button in the message list, and the reason yours is not showing
- A ViewAction never needed a handler — the password-reset mail has one now
- One-click mail actions, and the handler a "this wasn't me" button needs
- The unsubscribe page was 181 KB, and 180 of them were the website
- A session count that was not a number, and four tables called
sessions
- Email tracking that works, and only for mail somebody agreed to receive
52 changes:
- A select and a pager that need no form around them
- Four legacy input classes become one
- One search box over many entities
- A model save cost 1358 milliseconds
- Two flags that keep a migration honest
- reset() left the page where the next request would find it
- The form field now uses the controls
- Nine readers of a stream that can only be read once
- An API endpoint's status code was untestable
- A flash that worked once per process
- A permanent cache entry was deleted by the next sweep
- The dashboard's JSON endpoints returned a web page too
- The backup codes a user saved were never the stored ones
- Adding a member to an organization was impossible
- Any signed-in account could rewrite the system settings
- The lockout settings configured nothing
- The tailwind scaffold theme is a daisyUI theme
- A view directory you half-own rendered a page shell
- An argument a method does not declare is dropped silently
- The datatable search that could not be slowed down, and the columns that were all searched the same way
- Every page after a sign-in page lost its header
- Seventy-nine queries had lost the table prefix
- The Redis cache listing read a key nothing writes
- Vendored assets that were still remote
- A page could not call its own API
- One palette, every UI system
- The administration area has its own directory
- Six filings from one project, all small and all silent
- The palette moves under app/themes/
- Two guides that had become their own history
- A generated screen the vanilla stacks could not reach
- Every breadcrumb in the area pointed at /adminusers
- URL is the administration area, sURL is the site
- Organizations had no way to look at one
- A column filter per column, on the lists that need one
- What a usertype means, and how an application changes it
- Row actions are icons, and the row is a link
- The log viewer's own endpoints 404'd inside its iframe
- Everything the framework knows about a user, on the user's screen
- Per-user settings, and permissions edited where the user is
- A screen for the message templates the framework already had
- New-sign-in alerts got a site policy
- A login left the previous session's token valid for a month
- One definition of the guard every admin screen opens with
- What each usertype may do, written down and on a screen
- A correct password was refused, and bcrypt had been dropping characters
- No language was ever selected
- The administration area may be in another language than the site
- A second factor that needs nothing set up in advance
- A new device can be made to prove something, not just reported
- A second factor an application can bring its own of
- Seven account-security switches, every one off until asked for
19 changes:
- One set of controllers, two addresses
- The administrator that could not administer
- The admin links that left the admin area
- The logout that revoked nothing
- A webhook queue with no consumer
- Three endpoints that had never worked
- A column you could write and not read
- Every scaffolded project refused to test itself on macOS
- The test database that would not copy
- The recovery path was the crash
- The HTTP tests that were all testing the home page
- The discovery document that was not JSON
- The pages that rendered nothing
- The scopes the server advertised and refused
- Five actions that could never be called
- Four views indexing keys that were never there
- A password you can set from a shell
- Two language objects, and themes that could not be found
- The manifest that synced nothing
30 changes:
- The audit log gets a key that fits
- A delete that holds the table
- A policy you could create but never change
- Two answers to "where do the views live?"
- A model save reaches the browser
- A socket that received nothing
- Three tables, because retention is per table
- A config key that did nothing
- Compression that made it larger
- The busiest table, and who calls it
- A stale stat should not cost you the admin user
- The page cache could not be switched on, and a hit lost its CSP
- The scaffolded .gitignore had not kept up with what init writes
- Every scaffolded .mcp.json named a file that was not there
- A cache hit was telling the browser whatever PHP had already said
- /login came with the site header on top of it
- Every inline script was blocked and the report said "the button does not work"
- The database password was in three committed files
- A service worker that refuses to cache HTML
- "I have just cloned this — what do I have to create by hand?"
- The policy forbade the worker the framework had just started shipping
- A browser detector with nothing underneath it
- "No manifest detected", with the link right there in the source
- A nonce on a data block buys nothing and costs the cache
- The discovery controller had no address
- The health report said ok, and no token worked
- Three endpoints, three opinions about health
- Two views that nothing could render
- One long word came back as an ellipsis
- The memory_limit raise that was lowering it
15 changes:
- Seven filings from a consumer, and the two more they turned up
- The Svelte generator catches up with the MVC one
- A flush that cleared nothing, and said it had
- On PostgreSQL a key was a guess, and a response could not say what it cost
- The scanner that cost more than it saved
- A filing against a patched
vendor/, and the three real bugs inside it
- The slash that only broke the routes with placeholders
- A page cache, and the two things its spec could not know
- Clearing one cache category cost the whole database
- Two bodies, one URL, and no
Vary
- A model that says what it changed
- A commit that says so
- A save that announces itself
- A bypass that only stopped half of it
- An application can now decline a session
1 change:
- Realtime, in both directions — and what building it turned up
14 changes:
- A default that answered for the configuration
- A fragment that was written twice
- An error message from a different statement
- A dashboard that reported empty
- A red suite that exited zero
- A schedule nobody was running
- A scheduled command that reported "Done"
- A pid that belonged to another container
- Rows that could never be written
- A default that named a store nobody installed
- A table that only grew
- A stop request with no deadline
- A report of zeroes
- A session that nobody is in, and a report that ranked the unmeasured first
7 changes:
- The last twelve were choices
- A linter for the one asset that ships
- A JSON reply that did not stop
- A placeholder that ate the query string
- Every page answered 404 to HEAD
- A supervisor that could not tell a corpse from a worker
- A pid answers a question about your own process table
9 changes:
- Two seams that were already half there
- The docs shipped in
vendor/ and nothing ever offered them
- A correct header, a correct footer, and nothing between them
- A guard for a null that could not happen
- A stale
@todo, and two classes that do not exist
- Being told no
- The suite is finished, and the answer to the last question changed
- A form class that was never ported
- Sixty-seven messages nobody could see
15 changes:
- Wrote 1 path(s), and every word of it was true
- The JSON renderer decided every response was fine
- A failed list query killed the request
- The controller a model needs costs 1.5 microseconds
- The one place a shared layout could not be
- A comparison table is a claim too
- The redirect the guide promised
- The cache category was accepted and discarded
- A marker nothing flipped
- The HTML document could not say what page it was
- getData() and the columns it never returned
- An alarm that stays rare
- A column that described data nobody wrote
- Fourteen tabs do not fit
- Two things that did not complain
2 changes:
- One quote in a station name
- Two flags that never met
39 changes:
- The server now says where its own time went
- An API request is not a browser session
auth:unlock — lifting a lockout you gave yourself- The toolbar answers "who am I, and until when"
- A parent class for services, and a tab that admits they exist
- An Errors tab, for what the browser threw
- A Client tab: what the browser thinks the world is
- The page outranks the toolbar
- An API playground in the toolbar — and a doubled slash it found
- A WebSocket daemon that can read a Redis stream
- The body of a DELETE request
- A
? in a raw fragment now binds where it was written
init will not scaffold over your application- Debug data for an application that does not use the API layer
- The other way to lose a page
- The toolbar injects through the response, not an output buffer
- Two build settings that failed quietly
- Three dead stubs, and four corrections to older posts
scaffold:spa — a front end for an application that already exists- The MCP server says which project it is
- Typed endpoints, generated from the document
- Where the suite's fifteen minutes actually go
- A shared document, seven eight-second tests, and a
? in the bar
- A scaffolded application was set up to learn it the hard way
- The suite was running
composer update sixty-one times
- The test database was afraid of losing data
TRUNCATE is slower than dropping the table- The comment said
// product 1 = Apple
- The same change made PostgreSQL slower
- A suite that only passed in one order
- The guide described an API nobody had built
- The widget area that rendered nothing
maxRuntime was a range, and it read like a number- An empty ban list is still a ban list
- The ingest dropped the id it had just read
- Which rule said no
- Four corrections from the other side of the boundary
- "Minor variable name changes"
- A blank page is not an error