safeImageURL and ValidURLRef refused only //, so a stored og_image of
/\evil.example/x.png loaded a third-party image in the admin. Both now
refuse /\ like models.validTarget already does.
Both elements sent their first summer-action from connectedCallback and
kept it in flight forever when the host dropped it (the v0.5.1 widget host
appends the element before it keeps a reference). A shared ActionQueue no
longer trusts that an emitted action was taken: one the host did not mark
busy synchronously is retried once on the next task, a second drop shows
an error, and a disconnect forgets the request in flight. The first
request is sent on a microtask. Element tests drive a fake host that
mirrors WidgetField's contract, including the append-first ordering, and
the robots.txt tester gets its own tests.
UI-SPEC E-1: a title or description wider than its pixel budget is cut
at the last word boundary that fits, then " …" is appended. The preview
cut inside a word and appended "…" without a space. A first word too
wide on its own is still cut inside the word. Bundle rebuilt.
- golem15-seo-transfer: export by dataset with a Blob download, the
import file read in the browser and refused over 60 KB, the preview
table (refused first, 200 rows, scrolling wrapper), Apply gated on
refused and empty previews, a stale preview kept with the message
- en and pl copy; assets/dist rebuilt
- golem15.seo.robots singleton (UI-SPEC C10): staging callout and the
served file (P4); the plugin's own extension adds the editor, the
tester and the AI bots tab, saved to the robots row with history
- field type robotstxt (E4, live lint, size meter; Decode refuses over
500 KB) and widget golem15-seo-robotstester (E5) on robots_test, which
tests the unsaved text and switches through grobotstxt
- saving rules that block a noindex address answers robots.blocks_noindex
