Folder chevrons expand nested files in place; opening a directory still highlights that path. The previous sidebar only listed top-level names. check-in: 16cabf2a05 user: pluto tags: develop

Killing the preview VM left an orphan fossil on 8821, so repo pages proxied into a dead HTTP connection and showed Bad gateway. Startup now frees that listen port before spawning Fossil. check-in: 451ee53005 user: pluto tags: develop

Keep Overview, General, Members, Invitations, Repositories, Branding, and Danger zone. Drop Teams, Security, Plan, and Audit because they do not match Fossil-managed repository users. Default .btn is now a filled accent control. check-in: e14e4ebeff user: pluto tags: develop

Account pages keep Overview and Repositories; stats only show repository count. Follow POST is 404 because there is no activity feed for follows. check-in: 5433991d07 user: pluto tags: develop

Cambrian no longer invites, lists, or provisions per-repository collaborators; tickets, wiki, and users stay in Fossil. Sync and Mirrors can save an HTTP(S) Fossil remote with optional credentials and push when authenticated. Save and Sync/Push buttons share one action row instead of stacking. check-in: 3d65a0a25e user: pluto tags: develop

Explore chips now come from repository topics and detected primary languages instead of fake AI/Web/Mobile catalogs. Cambrian no longer pretends to host Git, merge requests, releases, webhooks, OAuth, or API tokens; Fossil remains the source of truth, and repository settings can push a Git mirror to GitHub, GitLab, Gitea, or a self-hosted remote with username/password or token auth. Optional TOTP enrollment shows a local QR code, and organization logo text plus accent color appear on the public org page. check-in: 5661ea433d user: pluto tags: develop

Those two items already live in the top nav, and the homepage hero plus Quick actions were extra doors into the admin console. Site admin remains an admin-only workspace section; other chrome now uses the same CTAs as a regular signed-in user. check-in: 2b2150ed21 user: pluto tags: develop

QEMU linux/amd64 releases were crashing in beam_asm/zlib NIFs, and bundled Fossil needs GLIBC 2.38, so the docker profile compiles without embedding ERTS and the runtime image moves to Ubuntu 24. SSH and GPG keys were never used; settings, store ports, and migration 0023 remove them while API tokens remain. Platform 404s now cover Projects, Actions, Insights, Workspaces IDE, empty Explore catalogs, and similar shells. Tickets, wiki, timeline, and branches stay Fossil links. Webhooks POST on repository, member, and merge_request events, merge requests can merge/close/reopen, and Packages is labeled as Releases. check-in: 3c8de2f42f user: pluto tags: develop

Postgres, Fossil repos, mail, and logs bind-mount under ./data with Asia/Shanghai. The app waits for a healthy database, runs the job worker, and drops root after chown so bind mounts are writable. Caddy terminates TLS in front of loopback 8820 for long Fossil and Git-mirror transfers. leaf check-in: 705f5110ae user: pluto tags: v2-review-ui-parity

The runtime no longer installs Debian's older fossil package. Docker validates the supplied linux x64 archive against its SHA-256 checksum, refuses non-amd64 targets, extracts fossil to /usr/local/bin and executes fossil version during the build. Track the archive with the source so builds do not depend on a server package repository or an external download.

The supplied 2026-08-01 binary requires GLIBC_2.38 while Bookworm only ships 2.36, so the extraction and runtime stages move to Debian Trixie (glibc 2.41) rather than attempting an unsafe libc replacement. The Erlang release remains built on OTP 27 and runs forward-compatible on the newer runtime layer.

Verified image cambrian:fossil-bundled as linux/amd64: Fossil 2.29 f3c2b9a29e, no dpkg fossil installation, no unresolved shared libraries. check-in: c890b782d7 user: pluto tags: v2-review-ui-parity

The Dockerfile downloaded whatever rebar3 S3 served that day while CI pinned 3.24. A clean image therefore used 3.27 and depended on transitive project plugins being fetched in just the right order. Nova registers an erlydtl compile hook, but its Git-sourced provider failed to load; rebar then executed a missing provider and crashed with badrecord not_found. Pin rebar3 3.24 and make the Hex-published erlydtl provider an explicit root plugin.

Once that hook ran, the OTP 27 image exposed a hidden get/1 old-BIF conflict in the settings persistence module which local OTP 29 did not reject. Keep the public get/1 API but route internal calls through fetch/1.

The final test pass also exposed that permanently failing outbox records could occupy the oldest 50 rows forever and starve all newer mail and notifications. Claim retry-zero events first, then older events within the same attempt count, for both PostgreSQL and SQLite.

Verified with a clean buildx linux/amd64 image, the container secret startup gate, and all 245 EUnit tests. check-in: 7571647943 user: pluto tags: v2-review-ui-parity

notify/6, the notifications table, the inbox page and the preference screen all existed, but nothing in src called notify/6, so every user's inbox was empty forever and the unread badge was permanently zero. Repository membership changes, merge request activity, ownership transfers and password changes now raise notifications.

The email half of notify/6 was broken twice over. It built its payload with io_lib:format and a tilde-p, which is Erlang term syntax rather than JSON and would corrupt on quotes, and it wrote an email_notification event that mail.lfe dropped on the floor because that module only handled the mail dot prefix. Encoding moved behind a store port so the application layer stays clear of thoas, and the mailer now renders these with the notification title, body, link and an unsubscribe pointer at the preference page.

Mail delivery was refactored to carry a prepared body instead of a kind and a token, so the two sources of mail share one write and SMTP path. The repository path helper members.lfe grew last commit moved into a shared links module, since notifications need the same two-segment canonical path. check-in: 5f8cd7ee44 user: pluto tags: v2-review-ui-parity

Every message body was a placeholder pointing at example.invalid, a host that does not exist, with paths that match no route. A new user could never verify their address and a password reset could never be completed. Bodies are now written per kind against the instance's own base URL, using the real routes (/verify, /reset, /invites, /transfers), and the repository invitation carries the owner and slug link it was missing. The one-time token no longer travels in an X-Cambrian-Token header where relays would log it.

OAuth was broken in three independent ways, so any instance that configured a provider would fail on the first click: configured?/1 and authorize-url/3 fed a client id string to andalso and not, which only accept booleans, and the callback URL used a string:trim direction of 'right' that does not exist. configured?/1 is also read by the Site Admin authentication and security pages, so those crashed as well once a client id was present.

The SMTP test keyed on the token header to know the message had arrived; it now keys on the type header and asserts the reset link resolves to the configured base URL. Without that change the test silently timed out and swallowed the three cases behind it. check-in: 9da9fa0099 user: pluto tags: v2-review-ui-parity

The new Site Admin section views were never added to the views module export list, so Plans, Organizations, Projects, Feature flags, Health, Authentication, Security, Moderation, System logs and Integrations all crashed with undef. The SQLite bootstrap used PostgreSQL-only ADD COLUMN IF NOT EXISTS for a column the CREATE TABLE already declares, which made the whole SQLite deployment path unusable even though Setup offers it. TOTP backup codes reached into the application layer for a plain sha256 digest, and the SSH authorized_keys sync and OAuth client called persistence and httpc directly; the digest moves to domain.token and the two effects now go through store ports.

The community search tests still assumed the flat result list from before search grew user, organization and topic buckets, so the private-repository filter had silently lost its coverage. The skin contract asserted a cb_tab spelling that never existed. Both now check the real shape. check-in: daee7bf375 user: pluto tags: v2-review-ui-parity

The previous sidebar-plus-main stack omitted About, social links, highlights, activity, organizations, achievements, and language stats, and the contribution grid did not read as a year calendar. The page now uses the design header and tabs, and only shows Fossil check-ins, orgs, and counts that actually exist. check-in: a7fc51cfa3 user: pluto tags: v2-review-ui-parity

The catch-all /site-admin handler was swallowing detail URLs and POST bodies, and several sidebar destinations only dumped maps. Those routes now use the existing user/repo/job handlers, and Organizations, Plans, Health, Flags, and the remaining design sections render operational lists instead of placeholders or fake status copy. check-in: e2e51cdf99 user: pluto tags: v2-review-ui-parity

A default secret, single-round SHA-256, fail-open rate limits, and localhost webhooks are not safe to ship. Production now refuses weak secrets and SQLite unless explicitly allowed, hashes with PBKDF2 while still verifying old hashes, and packages a prod release plus an amd64 Docker image for server deploys. check-in: cac27d8e85 user: pluto tags: v2-review-ui-parity

Those header links were not a real destination, leaked a broken arrow, and fought the page chrome. The action buttons belong beside each other so the recent-repo table reads as one row of work, not a stacked control stack. check-in: a6f9d26283 user: pluto tags: v2-review-ui-parity

Dashboard in the middle of the top bar duplicated the real workspace entry, and Browse public sat on the same page as the sidebar catalog link. Putting Workspace beside New, keeping names and Private on one row, and adding Your profile to the account menu makes the chrome match how people actually move between their work and their public page. check-in: e58beba214 user: pluto tags: v2-review-ui-parity

Explore already lists the public catalog, so a second top-nav label for the same directory made the bar look like two copies of one link. /repositories still serves the catalog for old URLs and tests. check-in: 06febb409b user: pluto tags: v2-review-ui-parity

Star toggles, org follow and pins, honest Fossil contribution cells, TOTP, configured-only OAuth, webhook delivery lists, admin username redirects, workspace cancel, and a scoped star API exist because the previous round still advertised those surfaces as chrome. Keeping empty days empty and hiding OAuth until client IDs are set matches the honesty rule for this branch. check-in: 6a772268ff user: pluto tags: v2-review-ui-parity

These pages existed as chrome or empty states. Wiring them to store ports and real empty copy keeps the UI from advertising work the instance cannot do, and keeps personal quota from blocking organization repositories. check-in: 8c657e986e user: pluto tags: v2-review-ui-parity

The public Organizations page is a directory only. Create lives next to New repository at /workspace/new-org, and /orgs/new redirects there. check-in: 97af09ec48 user: pluto tags: v2-review-ui-parity

The top nav and account settings now open /organizations with membership and public listings; creating an organization stays on /orgs/new. check-in: d555217f6e user: pluto tags: v2-review-ui-parity

Stop centering a narrow General card in leftover whitespace, highlight Overview separately from General, and list members with names instead of user ids. check-in: ee8699c0f7 user: pluto tags: v2-review-ui-parity

Rebuild the settings chrome as a three-column layout with icon navigation and an account rail, and make the public profile form match the personal-info card including a real JPG/PNG avatar upload. check-in: 05b37f431c user: pluto tags: v2-review-ui-parity

Add ignore-glob and SPDX license files so new repositories can take a real first check-in. Align workspace create and repo settings with the designs, keep the account menu in the header, apply the default skin to every new repo, and pass Fossil login cookies through so Admin appears after sign-in. check-in: 964ce8c837 user: pluto tags: v2-review-ui-parity

The catch-all site-admin handler was rendering Settings as a public shell plus a dump page. Route it to the instance settings form and stack General, quotas, and Fossil/mail cards in the console chrome. check-in: bb3e9225db user: pluto tags: v2-review-ui-parity

The old sidebar Initialize/Clone page is gone. GET and POST return 404. Create repositories at /workspace/new; manage them at /site-admin/repositories. check-in: ee7896fc16 user: pluto tags: v2-review-ui-parity

Admin login now lands on /site-admin. GET /admin/repositories redirects to the Site Admin registry, and creating a repository uses /workspace/new to match the create-repository design. check-in: dbeffa8202 user: pluto tags: v2-review-ui-parity

Global input height and padding were applied to checkboxes, so the control sat off the text baseline. Reset checkbox/radio sizing and use a dedicated remember-row. check-in: 70dee43591 user: pluto tags: v2-review-ui-parity

Clone addresses now use /{owner}/{repo}. Shared page chrome lives in a components module. Repository settings, explorer categories, members, transfers, org public pages, and site-admin subpages match the design layouts instead of stub views. check-in: dd7e248699 user: pluto tags: v2-review-ui-parity

- Full-width gradient hero with copy on the left and a layered mountain illustration on the right; View source and Documentation actions per the mockup (converted to Cambrian semantics: source is hosted on this instance, docs point to fossil-scm.org). - Feature cards gain circular tinted icon discs (database, shield, users, sparkle) from the shared SVG icon set. - Vision and project information render as a borderless two-column band with a vertical divider; admin instance-message editor kept. - ic accepts atom or string icon names. leaf check-in: de14680af0 user: pluto tags: v2-review-about-design

Provisioning (and the recycle bin within it) now renders inside the same three-column workspace layout as the dashboard: shared sidebar with active-item highlighting, main column, and the quick actions/quota rail. Sub-navigation no longer swaps the page frame. Full eunit: 239 passing. leaf check-in: bed7875fbf user: pluto tags: v2-review-ws-subnav

- Remove the change-password and session-management panels from the workspace page; account management belongs in /settings where the same flows already exist. Sidebar account links now point to /settings/sessions, /settings/password and /settings/profile. - Add Favorites (real starred repositories) and Recent activity (real user notifications) panels in place of the removed blocks, both with honest empty states. - Drop the nickname form from the rail (owned by settings/profile) and point the codespaces banner at /about until a workspace launcher exists. - Starred repository rows now carry the owner namespace slug so favorite links resolve to canonical URLs. Full eunit: 239 passing. leaf check-in: f040d1e54a user: pluto tags: v2-review-workspace-dashboard

Implements the 仓库开通中.png layout: - /workspace/provisioning lists every owned repository with status badges (ready/creating/failed/trashed), honest progress (100% only when ready), creation time and actions (open, view status, or move failed repos to the recycle bin). - Failed-repository alert banner when any provisioning failed. - Recycle bin section on the same page: trashed repositories with deleted time, retention remaining days, restore and delete- permanently actions (new purge route backed by recycle:purge). - Workspace sidebar gains Provisioning and Recycle bin entries. - Fixes: deletions query uses trashed_at (no created_at column) and fractional timestamp seconds are normalized before date math. Full eunit: 239 passing. leaf check-in: 7a35848299 user: pluto tags: v2-review-provisioning-page

The blue lifecycle counters overlapped the step labels; the check mark and pill state already convey progress. leaf check-in: 427376446f user: pluto tags: v2-review-status-pills