- mlLocale: type predicates, localeRecord, the ML_LOCALE_CHANGE broadcast
- MLField: locale switch, whole-map emit, broadcast follow, content-locale
- FileCaptionModal: prefill, save via FileRoutes.update, 422 stays, danger toast
- ApiTokensPanel and ApiTokenCreateDialog mounted directly next to the app tests
- network rule exempts only the line-anchored upload XHR in admin/src/api/files.ts
- api-listing rule exempts only the exact path admin/src/api/files.ts
- self-test plants an XHR elsewhere and an extra admin/src/api file
- The process-global debounce map was keyed by token ID, so a stamp from one test database suppressed a later write in another and turned TestBackendTokenPostgres red depending on order
- Each compositeGuard now owns a stampThrottle; the backend guard and the ResolveBackend guard of one activation share it, so a single-app binary still writes last_used_at at most once a minute per token
- TestTokenLastUsedThrottlePerGuard pins the per-guard isolation
TestMain scanned os.Args for a literal -test.short, but go test passes
-test.short=true, so beachcomber, conga, lagoon and lighthouse started a
Postgres container even under -short. Parse the flags and use
testing.Short() instead; skip cabana's newListService fixture under -short
like adminGorm already does.
- Add TryMap, Filter, Reduce, KeyBy, GroupBy, Uniq, UniqBy, Partition
and Find, plus the Set type built with SetOf (Has, Add, Slice).
- Add unit tests at 100% statement coverage and a runnable example for
every function and Set method.
- Complete the module README: contracts, use cases, Pluck rationale,
standard-library pointers and the full API reference.
- docs/architecture/introduction.md: add a Utilities row for sieve.
- docs/setup/coming-from-wintercms.md: map Laravel collection methods
to sieve and narrow the not-provided row to the fluent collection
object.
Assert submit stays disabled with no scopes; keep the 422 focus path
with a selected scope so check-phase16.3.sh --all stays green.
Co-authored-by: Cursor <cursoragent@cursor.com>
Client-side canSubmit now matches the 422 rule so Submit stays disabled
with an empty scope set (WR-02).
Co-authored-by: Cursor <cursoragent@cursor.com>
Account token POST/DELETE routes made TestPhase10Coverage expect 32 unsafe
routes; token_scopes.go is hand-authored and excluded from the scaffold pin.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record SUMMARY, advance STATE/ROADMAP to 4/4 plans executed, and
mark Phase 16.3 ready for verify-work after the gate passed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Fill every 16.3-VALIDATION.md row from plan 04 results, tick Wave 0,
and set nyquist_compliant true after the phase gate passed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add scripts/check-phase16.3.sh with fail-closed go/admin/docs/postgres
stages, detector self-tests and NOT RUN postgres without Docker.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pin list states, row anatomy, revoke paths and create-dialog step 1/2
behaviours from the UI-SPEC, including plaintext lifetime backstops.
Co-authored-by: Cursor <cursoragent@cursor.com>
Account token create/revoke added two state-changing mounts; update the
Phase 10 CSRF walk count so the release gate inventory stays green.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Add compiled ResolveBackend example with acme.blog cover
- Include src= fence in authentication docs (Bearer-only)
Co-authored-by: Cursor <cursoragent@cursor.com>
Tag the 17 open todos with their g15office task IDs, close 7 todos that
are already done or promoted to Phase 16.3, and record the sync rules
and the phase-to-task map in .planning/G15OFFICE.md.
