Skip to content

Database

1 September 2026

65 changes:

  • The exit code a scheduler reads from spool:drain
  • The rest of the Adminer route, and a log line read back rather than copied
  • One broken job does not stop the work pass
  • The refusal in auth:unlock
  • …and the rest of the day, below

30 August 2026

5 changes:

  • Twenty-five migrations dated 2020 that were written in 2026
  • A full cache flush never removed a directory
  • deferredwrites moves to pramnos, and the schema builder learns how
  • Web push had no sender in the authentication flow
  • The advanced sign-in rules had no field on any screen

26 August 2026

19 changes:

  • One set of controllers, two addresses
  • The administrator that could not administer
  • The admin links that left the admin area
  • The logout that revoked nothing
  • A webhook queue with no consumer
  • Three endpoints that had never worked
  • A column you could write and not read
  • Every scaffolded project refused to test itself on macOS
  • The test database that would not copy
  • The recovery path was the crash
  • The HTTP tests that were all testing the home page
  • The discovery document that was not JSON
  • The pages that rendered nothing
  • The scopes the server advertised and refused
  • Five actions that could never be called
  • Four views indexing keys that were never there
  • A password you can set from a shell
  • Two language objects, and themes that could not be found
  • The manifest that synced nothing

14 August 2026

39 changes:

  • The server now says where its own time went
  • An API request is not a browser session
  • auth:unlock — lifting a lockout you gave yourself
  • The toolbar answers "who am I, and until when"
  • A parent class for services, and a tab that admits they exist
  • An Errors tab, for what the browser threw
  • A Client tab: what the browser thinks the world is
  • The page outranks the toolbar
  • An API playground in the toolbar — and a doubled slash it found
  • A WebSocket daemon that can read a Redis stream
  • The body of a DELETE request
  • A ? in a raw fragment now binds where it was written
  • init will not scaffold over your application
  • Debug data for an application that does not use the API layer
  • The other way to lose a page
  • The toolbar injects through the response, not an output buffer
  • Two build settings that failed quietly
  • Three dead stubs, and four corrections to older posts
  • scaffold:spa — a front end for an application that already exists
  • The MCP server says which project it is
  • Typed endpoints, generated from the document
  • Where the suite's fifteen minutes actually go
  • A shared document, seven eight-second tests, and a ? in the bar
  • A scaffolded application was set up to learn it the hard way
  • The suite was running composer update sixty-one times
  • The test database was afraid of losing data
  • TRUNCATE is slower than dropping the table
  • The comment said // product 1 = Apple
  • The same change made PostgreSQL slower
  • A suite that only passed in one order
  • The guide described an API nobody had built
  • The widget area that rendered nothing
  • maxRuntime was a range, and it read like a number
  • An empty ban list is still a ban list
  • The ingest dropped the id it had just read
  • Which rule said no
  • Four corrections from the other side of the boundary
  • "Minor variable name changes"
  • A blank page is not an error

12 August 2026

14 changes:

  • Late writes into compressed chunks no longer have to be lost
  • print replaces the pdf document type, which had not worked for years
  • MariaDB stops pretending to be MySQL
  • The toolbar now sees what a page does after it renders, and can be opened on a live server
  • Nine queries per request, most of them avoidable
  • The SPA debug panel now says it exists
  • The docs now say when you would need them
  • The toolbar's hide button now hides the toolbar
  • spa:dev / spa:build, and a service container that actually exists
  • One toolbar, delivered two ways — and the SPA panel gains every tab
  • A name for every request, and the log lines it wrote
  • The server-rendered toolbar now uses the one renderer too
  • Settings read every key one at a time on PostgreSQL, and said nothing
  • SSE events published during a reconnect are no longer lost

11 August 2026

6 changes:

  • Five rolled-up views were frozen on every database without TimescaleDB
  • A model may give load() whatever parameters it needs
  • Five developer panels had been empty for years, and nothing said why
  • The rate limiter counted the proxy, and counted it badly
  • A human check that prices spam instead of pretending to detect it
  • getInstance() is a factory, and two call sites forgot

10 August 2026

16 changes:

  • pramnos init checks both Docker ports before proposing one
  • init scaffolds a working SPA — Svelte + daisyUI, Vite, Vitest and Docker
  • Files the container writes now belong to you, not to root
  • SPA follow-ups: the dev server, the site root, and the docs generator
  • The FK migration stops assuming the schema of tables it does not own
  • The scaffolded SPA now actually talks to the API
  • create:crud builds the SPA half too
  • A debug bar a SPA can actually use — and a guide for testing the front end
  • Generated CRUD gets real authorisation — and delete gets any at all
  • A SPA project gets an administration screen
  • cache:clear no longer wipes every installation sharing the backend
  • Signing in works, screens have URLs, and the SPA wears the project's colours
  • Permissions answers from whichever store the installation has
  • One permission system, available to every project with users
  • timescale:ensure — repairing hypertables on a database that got TimescaleDB late
  • The GDPR endpoints queried a table that does not exist

27 July 2026

8 changes:

  • Column comments are now applied when altering a table
  • Partial indexes and column ordering in the schema builder
  • Native enum types in the schema builder
  • Attribute-routed controller actions now dispatch
  • Auth controller tests no longer drop the shared users table
  • The test suite no longer leaves an app/ directory in the repo
  • Realtime: pluggable SSE + WebSocket backplane
  • Cross-cutting improvements: flat-key cache, log output modes, media alpha fix

15 July 2026

Authorization core: capabilities, permissions & passkeys groundwork. The authorization stack lands: trusted-client silent consent, a client capabilities registry with manifest sync and push endpoint, the RBAC+ABAC permission grain and resolver with a live-fetch internal endpoint, instant permissions_changed webhook invalidation, feature-gated auto-migrations, and the passkey credential store + WebAuthn ceremonies.

10 changes:

  • Capabilities push endpoint
  • Client capabilities registry and manifest sync
  • Framework auto-migrations are now gated by enabled features
  • Internal permissions endpoint (live fetch)
  • Passkeys groundwork: credential store and WebAuthn library
  • Passkeys: WebAuthn registration & authentication ceremonies
  • Permission resolver (RBAC + ABAC, live-fetch read side)
  • Permissions grain: audience and ABAC conditions
  • Instant invalidation: permissions_changed webhook
  • Trusted clients: skip the OAuth2 consent screen (silent flow)