• September 2, 2026
• in Changelog, Security, Media
• 91 min read

2 September 2026

57 changes:

• A caller of OutboundUrl::fetch() could not tell a 404 from a 200 — and the framework's own caller was storing the placeholder
• The tokenactions self-repair could not run on MySQL
• What the email second factor does when the store or the mailer fails
• The class added this morning was the day's biggest coverage gap — and addRemoteImage() with it
• Who counts as signed in for the administration area, and what a missing page answers with
• A grouped page could not be asked for at all
• Where the write spool buffers, and how long it keeps trying
• Re-running create:model destroyed the model
• The Redis operations that only Redis has
• …and the same reconnect on the path most statements take
• The Select2 branch of the CRUD generator
• Revoking one device, and the cascade that is MySQL-only
• What each DevPanel card shows when the thing behind it is missing
• A security-notification class at 6% covered
• The per-address rate limit had never run
• The session upsert had never been issued against PostgreSQL
• What a client is told about every MCP tool before it calls one
• A round of 69 tests that moved coverage by one statement
• route-list was tested through its parser and never through itself
• The two scheduled commands whose execute() had no test at all
• The scaffolders' refusals, and two things that cannot be tested the obvious way
• MediaObject's error arms, and a dead-code finding that was not one
• An application's own User class was never once returned in a test
• Losing Redis would have taken the application down, not the cache
• The Memcached counter had never run, and clear() empties more than you think
• What the human check does when it breaks, and the top three targets that cannot be reached
• The Greek in the search box had never been tested
• The URL cache that keeps a worker's memory bounded
• ST_MakePoint() takes longitude first, and nothing had ever checked
• The deadlock retry, which had never retried anything
• The privilege boundary in the admin area, and a green run that proved nothing
• A better index: 48 methods with no covered line at all
• TOTP replay protection, which had never run and stands down three ways
• The webhook credential check, and the fourth test that replaced what it tested
• The second leg of an API login had never been taken
• The account a client-credentials token hangs on, and a one-character invariant
• --spa-components and the two conditions that silently decide nothing happens
• 453 statements were being excluded from measurement by accident
• Three small classes off the never-run list, and a test that told me it was empty
• What auth:twofactor-cleanup actually sweeps, and the assertion total I made unreadable
• A test called "the omnibox limit is capped" that would pass on an uncapped omnibox
• Configuring a local asset list crashed every page build
• An addon setting called 2fa_enabled is not called that
• The query behind hasIndex(), and the assertion that PostgreSQL does not inherit it
• Three counters, sessions and headers — and a setter that means the opposite of its name
• Seven more off the never-run list, in one pass
• Three more, and a state leak I caused and had already written the guide entry for
• Three small ones to close the gap
• The machine account, an MCP call's identity, and a helper the framework ships untested
• /adminer refuses with a 404, and why that is the security decision
• The reconnect that must forget, and the first sign-in that is not a new device
• The middleware list, and the bracket somebody will forget
• can() and cannot() — the pair every guard clause is written with
• The last three: two seams and the accessor every closing test reads
• The two gaps that were in the environment, not the tests