Stratos v5.2.0

Features

• The Foundational Shape diagnostics page can now export the named data behind
  the anonymous shape: orgs, spaces and apps as a tree with their GUIDs, quota
  links, per-app composition, and — once the new single-request "Users & roles"
  measure has run — the org and space role grants. The export is CF-admin only
  and takes a confirmation that spells out what the file names, the filename
  says detail where the anonymous one says anonymous, and page-capped
  datasets are listed in the file rather than passed off as complete.
• The User Service Instances tile on the space summary page is now
  clickable and navigates to the space's User Services tab, matching its
  sibling tiles.
• Loading indicators are now one coherent system with visual variety. Four
  logical groups — inline busy ticks, area "Loading…" blocks, the page
  overlay, and indeterminate bars — each draw from a small pool of looks
  (arc, dual-ring, dashed, blinking dots, conic sweep, shimmer text,
  portal rings, and a rotating or breathing brand logo). A page picks its
  look deterministically, so different screens vary while any one screen
  stays stable. Pending list counts animate as blinking dots instead of a
  static ellipsis.
• The named detail export on the Foundational Shape page now has a spreadsheet
  form alongside the JSON: one workbook with the tree flattened to a sheet per
  entity type (overview with drain stamps and totals, organizations, spaces,
  apps, service instances, service bindings, role grants). It passes the same
  CF-admin-only confirmation as the JSON form, a never-run drain's sheet is
  absent rather than empty, and orphaned children stay visible with an
  (orphaned) marker in their parent columns.
• The Foundational Shape page's Compare card gains a named diff: pick two
  detail snapshots — live sections (CF admin only) or exported detail files —
  and see exactly which named organizations, spaces, apps, service instances,
  bindings and role grants appeared, vanished or changed between them,
  before → after. Entities match by guid so renames read as changes, a level
  whose drain never ran on a side reads as not measured rather than deleted,
  and page-capped datasets carry a truncation warning instead of letting the
  cap read as change. Importing a detail file into the anonymous Compare slot
  (or vice versa) now points at the right selector instead of failing
  cryptically.

Bug Fixes

• Fixed ng serve bootstrapping to a blank page with "The injectable
  '_PlatformLocation' needs to be compiled using the JIT compiler". The vite
  entry in overrides was still pinned to the v7 line the Angular 21 upgrade
  needed, which forced @angular/build 22.1 down off the v8 it now requires.
  Vite 7 ignores the rolldownOptions the builder uses to register its
  dependency-optimizer plugin, so the Angular linker never ran and the
  prebundled framework packages kept their partial declarations. Production
  builds were unaffected — they link through a different path.
• Fixed the Users count on the organization and space summary pages
  undercounting on foundations with more than 50 users. The summary tiles
  read a users snapshot that fetched only the first page of the paged
  users endpoint; the snapshot now drains every page, so the tile matches
  the Users tab. The organization tile also now counts users whose only
  grant in the org is a space role, matching what the Users tab lists.
• List pages no longer show a hard 0 in the header count while the
  first fetch is still in flight. The count renders as an ellipsis until
  the initial load completes, so a slow users or service-instances drain
  no longer reads as an empty list.
• Fixed the Foundational Shape "Users & roles" measure silently keeping only
  the first 50 users on foundations with more than 50 — the same server-paged
  truncation the summary tiles had. The measure now drains every page of the
  users endpoint, so the detail export's role grants cover the whole
  foundation, and its stated cost reads "1 request per 500 users".
• Release notes no longer open with an unformatted duplicate of the
  release name. The publish step consumed the whole annotated tag
  message, whose first line is the tag's own display name; it now
  extracts only the tag body, so the notes start at the first section
  the way the release title already says the rest.
• The dev server binds all interfaces explicitly. Without a --host,
  ng serve picks its own loopback binding and can come up IPv6-only,
  which reads as connection refused to anything resolving localhost to
  127.0.0.1.

Maintainability

• make publish REPLACE=yes replaces the GitHub release already on a tag in one
  invocation instead of requiring make unpublish first. CI runs make publish
  itself on a v* tag push, so the local target was effectively unreachable for
  a normal release — and the case that matters is CI publishing something wrong,
  which is a replacement, not a first publish. Without REPLACE the guard still
  refuses, and DRYRUN=yes prints both the delete and the create.
• Fixed a rare false failure in the jetstream CSP route test. Its sentinel for
  the raw static file was RAW, which is spellable in the base32 alphabet the
  nonce generator draws from, so roughly one run in a thousand found it inside
  a nonce and reported that the static handler had won when the document had in
  fact been served and nonced correctly.
• make release cf now refuses to package a fallback backend artifact that
  does not carry the version being released. The cf fallback takes whatever
  cross-compiled binary the last backend build left in dist/bin, which can
  predate the release being cut — that once shipped a v5.1.0 backend inside
  a package labelled 5.2.0-dev.1. The version is linked into the binary via
  ldflags, so the script now asks the artifact itself before packaging it.
• The eight independent spinner implementations (three separate spin
  keyframe definitions, two gap positions, three speeds) collapsed into
  shared components driven by one keyframes file. All indicator colors
  now flow from currentColor and theme tokens, so light and dark mode
  need no per-indicator rules, and a single prefers-reduced-motion policy
  covers every indicator instead of just one.
• make help now lists the three release-flow verbs it skipped:
  changelog (dependency-bump audit), preview (render the notes as
  the release page will show them) and sweep (remove consumed
  fragments) — the notes-preview step was undiscoverable exactly when
  it matters, right before a tag.

Chores

• Dependency updates: Angular patched to 22.1.1 across the framework,
  compiler and language-service packages; test tooling caught up with
  @vitest/ui 4.1.10 (matching the vitest the suite already runs), jsdom
  30.0.1 and happy-dom 20.11.2; fs-extra bumped to 11.4.0.