52 changes:
- A select and a pager that need no form around them
- Four legacy input classes become one
- One search box over many entities
- A model save cost 1358 milliseconds
- Two flags that keep a migration honest
- reset() left the page where the next request would find it
- The form field now uses the controls
- Nine readers of a stream that can only be read once
- An API endpoint's status code was untestable
- A flash that worked once per process
- A permanent cache entry was deleted by the next sweep
- The dashboard's JSON endpoints returned a web page too
- The backup codes a user saved were never the stored ones
- Adding a member to an organization was impossible
- Any signed-in account could rewrite the system settings
- The lockout settings configured nothing
- The tailwind scaffold theme is a daisyUI theme
- A view directory you half-own rendered a page shell
- An argument a method does not declare is dropped silently
- The datatable search that could not be slowed down, and the columns that were all searched the same way
- Every page after a sign-in page lost its header
- Seventy-nine queries had lost the table prefix
- The Redis cache listing read a key nothing writes
- Vendored assets that were still remote
- A page could not call its own API
- One palette, every UI system
- The administration area has its own directory
- Six filings from one project, all small and all silent
- The palette moves under app/themes/
- Two guides that had become their own history
- A generated screen the vanilla stacks could not reach
- Every breadcrumb in the area pointed at /adminusers
- URL is the administration area, sURL is the site
- Organizations had no way to look at one
- A column filter per column, on the lists that need one
- What a usertype means, and how an application changes it
- Row actions are icons, and the row is a link
- The log viewer's own endpoints 404'd inside its iframe
- Everything the framework knows about a user, on the user's screen
- Per-user settings, and permissions edited where the user is
- A screen for the message templates the framework already had
- New-sign-in alerts got a site policy
- A login left the previous session's token valid for a month
- One definition of the guard every admin screen opens with
- What each usertype may do, written down and on a screen
- A correct password was refused, and bcrypt had been dropping characters
- No language was ever selected
- The administration area may be in another language than the site
- A second factor that needs nothing set up in advance
- A new device can be made to prove something, not just reported
- A second factor an application can bring its own of
- Seven account-security switches, every one off until asked for
39 changes:
- The server now says where its own time went
- An API request is not a browser session
auth:unlock — lifting a lockout you gave yourself- The toolbar answers "who am I, and until when"
- A parent class for services, and a tab that admits they exist
- An Errors tab, for what the browser threw
- A Client tab: what the browser thinks the world is
- The page outranks the toolbar
- An API playground in the toolbar — and a doubled slash it found
- A WebSocket daemon that can read a Redis stream
- The body of a DELETE request
- A
? in a raw fragment now binds where it was written
init will not scaffold over your application- Debug data for an application that does not use the API layer
- The other way to lose a page
- The toolbar injects through the response, not an output buffer
- Two build settings that failed quietly
- Three dead stubs, and four corrections to older posts
scaffold:spa — a front end for an application that already exists- The MCP server says which project it is
- Typed endpoints, generated from the document
- Where the suite's fifteen minutes actually go
- A shared document, seven eight-second tests, and a
? in the bar
- A scaffolded application was set up to learn it the hard way
- The suite was running
composer update sixty-one times
- The test database was afraid of losing data
TRUNCATE is slower than dropping the table- The comment said
// product 1 = Apple
- The same change made PostgreSQL slower
- A suite that only passed in one order
- The guide described an API nobody had built
- The widget area that rendered nothing
maxRuntime was a range, and it read like a number- An empty ban list is still a ban list
- The ingest dropped the id it had just read
- Which rule said no
- Four corrections from the other side of the boundary
- "Minor variable name changes"
- A blank page is not an error
4 changes:
- The toolbar finds the log endpoint itself
- The stream driver had the gap it was built to close
- The request body is back in the toolbar
- The Time tab starts answering the question in its name
14 changes:
- Late writes into compressed chunks no longer have to be lost
print replaces the pdf document type, which had not worked for years- MariaDB stops pretending to be MySQL
- The toolbar now sees what a page does after it renders, and can be opened on a live server
- Nine queries per request, most of them avoidable
- The SPA debug panel now says it exists
- The docs now say when you would need them
- The toolbar's hide button now hides the toolbar
spa:dev / spa:build, and a service container that actually exists- One toolbar, delivered two ways — and the SPA panel gains every tab
- A name for every request, and the log lines it wrote
- The server-rendered toolbar now uses the one renderer too
- Settings read every key one at a time on PostgreSQL, and said nothing
- SSE events published during a reconnect are no longer lost