Updates

<p>The release tasks are renamed: phlat:tag tags and pushes, phlat:release publishes the Forgejo release.</p>

<p>The cache and History's deploy key move out of data/storage into data/cache and data/git.</p>

<p>composer.lock is tracked, and backup:create reports what it is doing.</p>

<p>Collection items move out of per-item folders into one SQLite database per collection field, which is never in git.</p>

<p>collection:export and Csv are removed, and Record::create() requires a guard.</p>

<p>Blocks can opt into a server-side fragment cache, collections gain count, sum and prune, and a registry rebuild refuses other requests with a 503 instead of exposing a half-built index.</p>

<p>Every record is created through Record::create(), so two creators of the same slug or uuid can't both win.</p>

<p>Saves lock against concurrent writers, the admin uploads several files at once with a progress bar, and the edit panel remembers its tab.</p>

<p>Outbound Http requests start at once and run concurrently, and their responses are read lazily.</p>

<p>A file is public exactly when a template has asked for its URL, recorded in the registry instead of the file's index.json.</p>

<p>The login URL comes from the mounted login page, and the PHP memory limit drops to 64M.</p>

<p>env.json and env.cli.json move back to data/.</p>

<p>Hidden belongs to Page, and a collection item has no published or hidden flag of its own.</p>

<p>A page with no published key in its index.json is live.</p>

<p>Admin saves are recorded in History automatically, and the Changes page becomes a History page with one Sync button.</p>

<p>The registry search index is keyed by registry id, and a rebuild no longer takes quadratic time.</p>

<p>URLs are limited to lowercase slugs and file names, error messages and URL fields are locked down, and registry queries escape LIKE wildcards.</p>

<p>A field's context (path, uuid, page, view, url) is passed apart from the options its author wrote.</p>

<p>Worker mode, SSE and the admin Templates screen are removed, the ui addon becomes a set of daisyUI components, Clockwork does nothing unless debug is on, and the session classes split into login and scoped values.</p>

<p>A site's override of an addon view now gets the site's global controller data.</p>

<p>Pages get a published flag and an access limit that visitors and queries both respect, and the admin gains a page Settings tab, a ⌘K search palette and page status lights.</p>

<p>The page tree shows published, draft, uncommitted and locked state as four status dots.</p>

<p>Locked records and addon-shipped pages are enforced, pages can be moved, the query engine is split out of the registry, and fields gain previews, a pages fieldtype and color palettes.</p>

<p>Git history moves into core, addons are referenced by alias and mounted from config, and the global helper functions become template functions.</p>

<p>The edit panel follows preview navigation, and a draft flag guards unsaved changes.</p>

<p>The admin navigation is rebuilt around a page tree, a page picker and dual panels, and dead page routes are removed.</p>

<p>The dev image moves to Alpine and compose pulls it prebuilt, and resolveField() keeps its underscore context keys again.</p>

<p>The admin is reorganized: browse becomes edit, search is its own page, and a nav bar replaces the toolbar links.</p>

<p>Fixed the image publish task failing when more than one tag points at HEAD.</p>

<p>Pages autosave drafts with a draft/published preview toggle, the Changes page gets diffs and bulk actions, and password becomes a fieldtype.</p>

<p>Users get profile fields and avatars, the admin gets a profile page, and the first system tests land.</p>

<p>The admin head gets a site override hook, and the logo moves to a top-level template.</p>

<p>Before hooks now run on auto-rendered pages, the runtime image no longer bakes in site/, and the preview resizes without reloading.</p>

<p>The release Docker image gets zip support so Composer isn't stuck without it.</p>

<p>The hand-written docs browser is replaced by a live reference generated from PHP reflection, the runtime moves to FrankenPHP with optional worker mode, and a self-contained Docker image ships for releases.</p>

<p>The git addon gets its own SSH deploy key so push/pull/fetch don't depend on a human's credentials, a hand-written docs browser lands in admin, and the current release tag shows on the dashboard.</p>

<p>A substantial admin UI overhaul: a real icon-grid dashboard homepage, a collapsible edit panel with a mobile/tablet/desktop preview toggle, full git branch and remote management from the Changes page, and per-action permission checks across nearly every admin write route.</p>

<p>registry:check gains drift detection and a --heal flag, and the reactive heal added last release now keeps the field index in sync too.</p>

<p>The Souin HTTP cache layer is dropped for standard Cache-Control headers, full registry rebuilds now commit in chunks, and pages get a cheap opportunistic registry heal.</p>

<p>A one-line gitignore fix for paths the data/ move left stale.</p>

<p>Runtime state - pages, users, the registry, file variants - moves out of site/ into a new sibling data/ root, a site-wide Changes page adds publish/discard for pending edits, and images drop their old eager-mirror-to-disk behavior.</p>

<p>Click-to-edit lands: clicking an annotated field in the live preview jumps straight to it in the edit form, plus a datetime string-conversion fix, a required user-role select, and bun dropped from the JS toolchain.</p>

<p>A big admin-UX pass: Cmd/Ctrl+K spotlight search replaces the sidebar, per-file metadata fields become a general mechanism, drag-and-drop lands for uploads and reordering, and Users gets the same master-detail treatment as Views.</p>

<p>The CLI ships in-tree as a built-in addon, Views and Fields merge into one admin screen, Addons folds into a new System page, and a Latte bug that dropped trailing markup gets fixed.</p>

<p>Field definitions drop out of the registry, and the experimental qbixserver dev server is gone.</p>

<p>File-type guards tighten - icons are never treated as resizable images, and forcing an image type on a non-image file now fails loudly.</p>

<p>An ASCII slug helper, case-insensitive string replace, and a guard against pointing Phlat at the wrong root - plus an experimental bundled dev web server.</p>

<p>Session idle timeouts, a Clockwork CLI fix, and a symlink-safe entry point for shared-dir deploys.</p>

<p>Object, blocks, and stack fields get full admin sub-field editing, and collections get a paginated manage panel.</p>

<p>Registry admin table switched to infinite scroll, and standard-sized UI controls restored in a few admin panels.</p>

<p>App-level HTMX response wrappers, a new View class for editable view definitions, addon-scoped @id/ fieldtype references, and cascading page deletes.</p>

<p>Image transform presets can now be layered and combined with literal overrides.</p>

<p>Admin addon management UI, an autosave data-integrity fix, and per-option image format control.</p>

<p>Blocks and stack fieldtypes, dot-path registry queries, a tightened image DSL, and a bug that dropped page/user status fields.</p>

<p>FieldTypeCollection::items() returns a populated collection directly instead of requiring a second lookup loop.</p>

<p>Memoized collection item lookups, batched registry gets, and a mime type fast path for images.</p>

<p>Fixed PageImage::base64() producing output inconsistent with what a live request serves.</p>

<p>Faster SQLite writes for cache and registry, skipping redundant variant writes.</p>

<p>Custom fieldtype metadata fields, a per-request CSP nonce, and addon loading split out of App.</p>

<p>Fixed nested and hyphenated view names resolving to the wrong controller class.</p>

<p>Nested database transactions and scoped, resumable registry rebuilds.</p>

<p>File operations now accept a parent UUID for files owned by collection items.</p>

<p>Per-request registry caching, item identity scoped to parent pages, and a faster file mirror sweep.</p>

<p>Addon listing helper and a fix for SVGs being misclassified as raster images.</p>

<p>Batched registry lookups when hydrating page collections, cutting N+1 queries.</p>

<p>App-level SQLite cache, image effects and lifecycle hooks for collection items, and file-identity fixes for subdirectory-stored files.</p>

<p>App-level SQLite cache, addon-provided fieldtypes and fields, auto-merged fragment controller context, and router/slug fixes.</p>

<p>FieldTypeHttp for live API field values, image effects (invert, blur, brightness, contrast, gamma, pixelate, sharpen), item lifecycle hooks, and HTTP/2 curl fix.</p>

<p>Items indexed in full-text search, deterministic item UUIDs, FieldTypeCollection::has() and item(), and single-level sharded storage.</p>

<p>Item shard path revised to two-level, FieldTypeCode language option, Dir symlink fixes, Hx::trigger JSON encoding, and resize condition fix.</p>

<p>File support for collection items : ItemFile, ItemImage, and nested public URLs under the parent page.</p>

<p>FieldTypeCollection::new() moved onto the fieldtype itself, RecordCollection::withContext/new removed, and git auto-commit disabled by default.</p>

<p>FieldTypeCollection and Item for registry-backed collection fields, {fragment} and {companion} Latte tags, and hidden/status/locked moved to the Record base class.</p>

<p>CLI config override via env.cli.json.</p>

<p>PageFiles::store split into store and upload, App::instance boots eagerly, and Page::new always calls save.</p>

<p>Db::listen, F::listen, and App::onEmit observability hooks; Clockwork addon reworked to use Clockwork's Log tab throughout.</p>

<p>Named-parameter callable dispatch, per-page session scoping, config-driven addon load order, TemplateFields base+type merge, and functions.php cleanup.</p>

<p>Field/FieldValue split, Session/SessionRoot scoped-access refactor, class renames throughout, Collections namespace, Res::ensureCacheControl backstop, and cache addon.</p>

<p>Permission system, Page::new() for programmatic page creation, Field::validate(), weighted and fuzzy FTS5 search, and fieldtype search metadata.</p>

<p>SSE toolkit, outbound HTTP client, FTS5 full-text search in the registry, page navigation helpers, image dimension metadata, and Api\Client.</p>