v0.19.4

Two cartridges fixed after a review of their DESIGN papers, each measured
on a running project.

Fixed

• health_probe v0.3.0: the probes answer in production. Since
  Phoenix 1.8.2, phx.new turns force_ssl on in prod.exs, and
  Plug.SSL runs before any plug of the endpoint, so a probe in plain
  HTTP on the pod's address got a 301. The installer now lists both
  probe routes in force_ssl's exclude: [paths: …] (Plug 1.19). It
  also bounds the readiness check at 500 ms as a whole: the query's own
  timeout does not cover DBConnection's queue, and with the database
  down /ready used to take about 4 s to fail. It now answers 503
  in 0.5 s.
• clustering v0.3.0: the default DNS query names a Service that can
  exist. It was <app>.default.svc.cluster.local with the app name as
  is. A Kubernetes Service name can't have underscores, and nothing said
  the Service had to be headless. Either way the release boots and never
  finds a peer, with nothing in the log. The default is
  <app>-headless now, short so that it resolves in the pod's own
  namespace, and .env carries a note for Kubernetes, Fly.io and
  Compose.
• clustering v0.2.2 and v0.3.1 correct the reasons and the setup
  its papers described, and a test now runs the boot script under dash,
  the /bin/sh of the release image.

Updated

• The README's hero shows the console's Cartridges screen, and its
  captures no longer carry the author's path.

Full record: CHANGELOG.md

v0.19.3

v0.19.3 (2026-10-07)

v0.18.0

Added

• Six boxes on the shelf that are identified and not designed:
  security_review, machine_learning, seo_aeo, browser_tests,
  message_broker, event_stream. Pending, as stripe and specdd are — a manifest
  whose pending?/0 is true, so the catalog lists them, the console
  counts them under Not done and add refuses them — and each with
  the two papers such a box can honestly have: a NEED.md, which the
  catalog test asks of every cartridge, and a README that says what the
  box is expected to bring and, under Open, what its design has to
  settle before a line of installer is written. No DESIGN.md, no
  version, no test: there is nothing yet for them to be about.

  That made a second kind of pending visible, and the console was
  saying one thing of both. Designed, not built was its line for
  every box that is not done, true of specdd, whose design is
  written, and false of these six the moment they appeared — and of
  stripe, as it turns out, which has had a need and no design all
  along. A pending box is now read as one of two stages:
  designed when it carries a DESIGN.md, identified when its
  need is all there is. ConsoleWeb.Cartridges.not_done/1 reads it off
  the papers on the mount, the way the Manual reads them, so no
  manifest declares it and nothing has to be flipped: writing the
  design is what moves the box. The chip's title, the reason the Files
  screen is dark and the sentence that stands in for a missing summary,
  on the box and in the shelf's list, all say it from that one place.

  They are named for the need and not for the tool, the rule db_admin
  and test_doubles already follow, because the tool is the part most
  likely to become an option: message_broker starts from RabbitMQ and
  event_stream from Kafka, each with Broadway in the project, and
  either may offer another server the way db_admin offers four
  admins. security_review is a review of the project against the
  OWASP Top 10's current edition, kept as a file of the repository,
  with the checks a machine can run (Sobelow, mix deps.audit,
  mix hex.audit) behind one task to shorten it — the review is the
  box, the tools are what speed it up. machine_learning is a model
  served from inside the application with Nx — Bumblebee to load it, an
  Nx.Serving in the supervision tree — where the usual answer is a
  second service in another language. seo_aeo is the one named by
  its discipline, because that is the name the need goes by: what the
  application emits so a search engine and an answer engine find and
  quote its pages — metadata, sitemap, crawling rules, structured data
  — with the answer-engine half as options the reader chooses, since
  that half is young and llms.txt is a proposal, not a standard.
  browser_tests is tests that drive the application through a real
  browser — Playwright as a service of the workspace under a profile
  up never starts, the way k6 is — for what only a browser does: a
  hook, an upload, a full navigation. The two messaging services go
  after monitoring in the registry and the other four before the
  services;
  both services are expected to take messaging, a role the vocabulary
  has had since it was written and no box has used.

  More candidates were listed the same day (a notebook on the running
  node, background jobs, tracing, type checks) and deliberately not
  made boxes: choosing them and drawing where each one ends is analysis
  that has not been done, and a shelf with more boxes pending than
  built would read as a promise. The README names the eight pending
  ones, by stage, in a table assets/readme/build.py writes from the
  catalog.

• The Changes paper can throw the changes away, not only commit
  them. The paper said what a dirty tree costs — add and eject
  both want a clean one — and offered one way out of it: the commit.
  The reader who had decided their changes were not worth keeping had
  to leave the console for a terminal, which is the one thing the
  console is for. wb.sh discard is the other way out: the tracked
  files back to HEAD and the untracked ones gone, exactly what the
  commit would have taken, and nothing git ignores — deps/ and
  _build/ are the container's work, and throwing them away would cost
  a recompile to undo nothing. It is the verb undo_failed_insert
  already ran for an insert that failed, named and given to the reader.
  The console keeps its side of the house: Console.Git still only
  reads, the button runs the verb as a job, and the job waits for the
  reader's word first, like delete and prune.

  The two live in the one card, whose foot now reads down and presses
  across — the Deployments card's shape (2026-09-26) — each line the
  danger card's three-cell grid: the command taking the width, the verb
  at the right edge on --verb, the note under the command, where what
  it says is what that command takes. Which cost Commit the row it had
  been keeping to itself, with the button at the left and the wb.sh
  line nowhere but in its title, and gained it the shape every other
  box that runs a command already had. Discard went through a danger
  card of its own under the files first, the way delete sits apart on
  the Deploy tab: one dirty tree is one thing, and what can become of it
  is a choice between two, not two boxes. What that card's red edge
  said, the button says, filled as delete is: in this house the fill
  is what the verb costs and not how often it is pressed — eject is
  outlined because the cartridge can go back in, and this, like
  delete, cannot be taken back. The note is under it, and the word it
  asks for comes before it runs. Asking, the note takes the row, so the
  card does not move under the hand at the moment it decides, and its
  two buttons carry type="button": a button with no type inside a form
  is a submit, and the card is the commit's form, so bare they confirmed
  the discard and committed behind it — the author saw it. In the danger
  card they had stood in a section, where there was nothing to submit.

Updated

• The README is a tour, read in order. It was an operating manual
  in the order the commands were written; it is now written so that
  every section only uses what an earlier one explained. It opens on
  the two things the workbench is — a development environment that
  asks the host for nothing but Docker, and a knowledge base of the
  ecosystem kept as cartridges — and on what that is good for; then the
  workbench and its workspace, the cartridges as a concept and as a
  shelf, the console screen by screen with a capture of each, writing a
  cartridge, and why it is shaped like this, with what each decision
  costs. The captures are on the dark ground and come from one session
  on a real workspace (assets/readme/console/); the legend of the
  rail's plates is drawn from the console's own stylesheets
  (assets/readme/legend.html).

  Two tables are not written by hand: the shelf, one cartridge to a row
  with its cover, version, summary and papers, and the pending boxes
  with their stage and need. assets/readme/build.py writes both from
  ./wb.sh catalog --json --brief, between markers, and cuts the
  covers' thumbnails. CI holds the README to them: build.py --check
  writes nothing, compares the tables the catalog would give with the
  ones the page has and looks for every thumbnail, off the package's
  own mix workbench.catalog and with no Docker, so a cartridge added
  or versioned without writing them again fails the run and says how
  to mend it. The file is Markdown with two tags, each for what
  Markdown cannot say — an <img> for a width or a side, a <br> for a
  second line inside a table's cell — and says so to markdownlint.

  What it claims was measured or read, and it says where it was not: it
  has been run on Linux, and macOS and Windows are still to try. On
  Linux it names the native Engine, with the one measurement behind it
  (2026-10-04, one run each on the same machine: the workbench's image
  from scratch in 143 s on the Engine and 837 s on Docker Desktop;
  compiling, testing and inserting a cartridge the same on both). What
  I would do differently is a sentence for now, to grow as the
  decisions are tested. The draft's two predecessors
  (README2.md, README3.md) and the two captures only the old page
  used are gone.

• The two package READMEs say what is there. igniter/README.md
  still took health_endpoint for its reference, kept templates inside
  the cartridge's directory and Elixir assets under an .asset suffix,
  listed five Mix tasks of eleven and named one cartridge as not done:
  it now draws the package as it is — health_probe the reference,
  everything that is not code under priv/features/<feature>/, the
  file modules, the three suites that stand over the cartridges' own
  tests. console/README.md names the seven screens and the modules
  that came after its table was written (Docker, Terminals, Installers,
  Nodes, Hex, Themes, Services, Doors, Reports), and speaks of the mock
  in the past.

• The rail opens 500px wide. 380px was the width the rail was born
  with, and the papers it now carries — the Record's address face, the
  cartridge in hand, the tables — were all read in a rail the reader had
  to drag wider first. The default is what they would have dragged it
  to; the bounds, the memory per browser and the grip's double-click
  reset are unchanged, so a reader who already has a width keeps it.

Fixed

• CI is green again, and it had not been since 2026-09-29. Two
  things, neither of them in the code under test. The console's
  Dialyzer step failed every run with ten calls to functio...