- pact.FormVirtualFields lists form fields that are not model columns: never
bound, filled or projected; their values reach the Form hooks through
cabana.VirtualFieldsFromContext when the field's context allows the operation
- type: password is a masked field that must be listed as virtual
- pact.FormRules supplies the rule set per operation and replaces the model's
Rules() for admin saves; a rule on a virtual field sees the submitted value
- preset on a text field follows another text field on the create form
- SPA: PasswordField, preset handling in FormView, empty password left out of
an update
- README, docs, OpenAPI document, TS types and dist updated
- config_form.yaml preview block (optional headerPartial), reported in the form schema as preview
- fields with context: preview show only on the preview screen and are never written
- form messages preview and edit; recordActions without a preview block stops boot
- SPA route {id}/preview, PreviewView and PreviewField, record actions in the footer
- mapWinterUrl maps preview/:id; the update form returns to the preview
- summer-callout partial style classes for status hints
- README, docs, OpenAPI document, TS types and the embedded build updated
- hooks and bulk, record, toolbar and widget actions may return it
- 403 forbidden with the localized message and field details; the write's
transaction is rolled back; other errors stay the opaque 500
- form shows a refused save as a persistent banner and keeps the values;
a refused delete is a toast
- smoke tests, OpenAPI notes, dist, README, docs
- pact.ListRowStates with the fixed RowState set deleted, negative, disabled
- list response meta.row_states keyed by row id; unknown values dropped
- list messages rowStateDeleted, rowStateNegative, rowStateDisabled
- update writes through the scope the load used, so a soft-deleted record
a controller includes stays soft-deleted
- DataTable row state badges and text styles
- roster fixture, smoke tests, OpenAPI, TS types, dist, READMEs, docs
- pact.HasAdminRecordActions with AdminRecordAction (Applies, Run)
- config_form.yaml recordActions, compiled fail-loud
- show response meta.actions lists the permitted actions that apply
- POST .../{controller}/{id}/actions/{action}: record loaded and locked
through the form scope; 404 out of scope, 409 when it does not apply
- RecordActions.vue with confirm and request flow (mounted by plan 02)
- roster fixture, smoke tests, OpenAPI, TS types, READMEs, docs
- pact.HasAdminBulkActions with AdminBulkAction, its input and result
- config_list.yaml bulkActions, compiled fail-loud, needs showCheckboxes
- POST .../{controller}/bulk/{action}: ids resolved and locked through the
list scope in one transaction; partial selection is 409
- list schema offers declared actions per principal, with confirm text
- admin SPA bulk actions menu with confirm, busy state and failure toasts
- acme.roster fixture, tracer test, OpenAPI, TS types, dist, READMEs, docs
- 14-VALIDATION.md: per-task map 14-01-T1 to 14-06-T4, all green, the
measured coverage, validated, Nyquist-compliant, Wave 0 complete, the
final --all and --removal results
- REQUIREMENTS.md: INTG-02 and API-08 Complete (JOBS-02, JOBS-03, SRCH-02,
INTG-01, CLI-05 already were)
- COVERAGE.md: every INTEGRATE row's test confirmed by --named
- fetchguard-guarded-http-client and redacting-slog-handler moved to done
- every T-14 threat has one review row copying its plan's severity and
disposition; a mitigated one names a test --named runs and a removal row
- the validation map is validated, Nyquist-compliant and Wave 0 complete,
with no open row and only tests --named runs
- each COVERAGE.md INTEGRATE row names a run test, each OPT-OUT a reason
- REQUIREMENTS.md keeps no SDK wording for INTG-02 and no sitemap output
for API-08; the ROADMAP Phase 14 repos and criteria name the album
Discogs and recognize routes and both shared plugin repos
- --all runs it after the coverage stage
- --named runs every test the validation map and the security review name,
by package, the fonoteka, discogs, golem and feedback suites with -race
- --coverage enforces the 80% floor on the framework packages, classes/
discogs, console and every package of both shared plugins, and on each of
the 132 Phase 14 functions of the fonoteka root, classes and
controllers/api (two exemptions with their reasons)
- --removal applies 43 anchor-exact mutations, one or more per mitigated
threat, requires the named test to fail on an assertion and restores
each file byte for byte; the self-test plants each refusal
- LoadUpstream names the file for a missing, unknown-field, wrong-version,
method-less, relative-URL or out-of-range-status sidecar
- WriteUpstream writes nothing for an invalid sidecar or an uncreatable
directory
- compareParts reports count, name, filename, content type, sha256 and
value mismatches and a non-multipart body
- --self-test proves each detector fails on planted failing, skipped,
zero-test, racy and non-JSON runs, a fourth pending route, a vendor SDK
in the module graph and planted corpus secrets
- --go runs vet and tests in summercms.go and, with -race, in fonoteka.go
including sm-golem-plugin and sm-feedback-plugin
- --parity requires 175 recorded, 172 ported and passing, 3 pending, every
TestFonotekaNuxtFlows subtest, the sidecar replay, check_corpus secrets
and the docs checks
- every OPTIONS on a CORS path: 204 with Cache-Control no-cache, private
- a preflight echoes the requested method (upper-cased) and headers when * allows any, with Vary and PHP's default Content-Type, as recorded from PHP
- README and the routing docs describe the answer
- A response body that is not valid UTF-8 (a cover image) is written as a
YAML !!binary scalar, never masked and replayed byte for byte
- The upload URL normalizer covers every key ending in _url (cover_url),
not only url and thumb_url
- README and parity-testing docs updated
- lets a plugin test assert what its Jobs() registers, such as the CSV
match job's 240 s timeout, without reaching into conga internals
- README API table, jobs docs page and an example
- the command context had no signal handling, so stopping the proxy
killed it before Flush and no sidecar was ever written
- a background proxy (SIGINT ignored by the shell) now stops on SIGTERM
