- cors_profile_test.go: credentials with * refused (global and profile),
pattern errors, anchored wildcard origins, Vary: Origin on dynamic
answers, api/www credentialed case, unchanged * answers, profile
preflight routes and boot errors, turnstile factory params
- apidocs_test.go: off by default, pinned 5.33.1 page with the RESEARCH
SRI hashes and nonce CSP, ordered compact JSON, provider count, path
validation, escaped title
- store_lookup_test.go: MemoryStore fallback, published Store, no dial
- reorder_hook_test.go (Postgres): hook sees the new order in the tx,
its error rolls back, no hook answers unchanged
- gate: surf names in the go stage, cabana names in the docker stage
- new module cooler: Install, Handle, OpenRedis (no URL in errors), RateLimitStore
(atomic fixed-window Lua script with MemoryStore semantics, per-instance fallback)
- serve installs cooler and publishes the Redis surf.Store before BuildRouter;
BuildRouter looks up a published Store, route:list keeps the memory store
- config keys http.rate_limit.store and redis.url; go-redis v9.23.0
- cooler README, root table row, surf README and rate-limiting, configuration
and scaling docs
