# Changelog

## Unreleased — initial experimental framework

- Made accounts and formsets standard project defaults; added offline `makemigrations` and `generatequeries` management commands from the shared model registry.
- Consolidated migration application, planning, verification, adoption and recovery on the recorded-history runner. Removed the separate `database.Migrate`/`Migrator` executor; existing Goose histories require verified adoption.
- Preserved first-party handwritten SQL with reviewed historical manifests and verified legacy serial/unique/timestamp-default support. Updated application guides and installable contracts to describe core defaults.


- Breaking: renamed Yutqin to Cicadel, including Go modules and packages, CLI executables, environment variables, generated artifacts, cache paths, and framework-owned database identifiers.

- Added typed installable runtime model catalogs with explicit app/table/type ownership, offline validation and isolated discovery. Recorded migrations remain authoritative.

- Completed application foundation tooling: all operational settings overrides and redacted diagnostics, sorted command help and exit statuses, structured/deployment checks, and safe component/CSS rebuild/restart through `cicadel dev`. Added generated-executable and reload acceptance tests; see `docs/foundation.md`.

- Added a green-and-black Tailwind default theme and optional `startproject --accounts` browser starter with compiled login/recovery/reset/account/password-change pages, CSRF protection, PostgreSQL cookie sessions and shared account revocation.
- Added SMTP with verified STARTTLS/implicit TLS, batch connection reuse, MIME alternatives and attachments, CC/BCC, reply-to and console/file/capture/discard backends.
- Added named logging configuration with levels, filters, propagation, JSON/text/custom handlers, file rotation, optional error email, grouped credential redaction, correlated panic records and private GORM timing.
- Reconciled current authentication, component, PostgreSQL migration, mail and logging documentation; administration remains a separate later battery.

- Completed standalone typed forms and accessible widgets; added revision-based stale-edit detection, bounded upload fields with compensating cleanup and multipart CSRF integration, and atomic model-form/formset administration. See `docs/forms-completion.md`.

- Added core `contrib/formsets`: bounded related-row collections with scoped identities, add/delete limits, parent locking, transactional hooks and atomic saves; added the core `Form.InTransaction` composition API.

- Added `forms/model`: explicit GORM field allowlists, typed binding, scoped relationship checks, authorized row-locked updates, safe constraint errors and transactional validation/save hooks. Verified with PostgreSQL concurrency and rollback tests; see `docs/model-forms.md`.

- Added the installable-app foundation: manifests, API/dependency compatibility checks, namespaced commands/checks/resources, route-scoped middleware and per-host startup/cleanup.
- Added `startpackage`, generated `project/apps.go`, `manage.go apps`, and `apptest.Check`; tested independent Go-module install/upgrade/removal and PostgreSQL migration/data retention.

- Implemented React/Cotton-inspired compiled component UI; retained legacy Go templates for compatibility and completed the component-engine acceptance checks.

- Added a source-linked Django battery inventory with explicit support decisions and completion criteria.
- Reclassified existing integrations as partial batteries; model-driven PostgreSQL migrations now have a documented supported subset, other database backends are excluded, and broader package-system contracts remain planned.
- Removed the experimental native `locale` package; i18n/l10n and GIS are third-party-only by design.

- Django-familiar project/app scaffolding, typed settings, explicit app registration and management commands.
- Standard HTTP routing with namespaced reversal, escaped embedded templates, response helpers and static assets.
- PostgreSQL/GORM integration and locked, versioned Goose migrations.
- Sessions, password primitives, CSRF protection, bounded forms and explicit authorization.
- Working articles and catalog/admin examples with real HTTP/database tests.
- API helpers, mail transport/capture, bounded storage/cache, observability hooks and River jobs.
- PostgreSQL integration/race tests, fuzz targets, generated-project validation, vulnerability checks and performance baselines.

Requires Go 1.26.10+ to incorporate standard-library security fixes. No upgrade migration is required from a prior Cicadel release because none has been published by this implementation.