Checklist and checklist-item create, edit and delete routes accepted read-only board members because they checked only whether the caller could view the board. Every mutation now requires the canonical board write capability; read-only members retain GET access. See GHSA-5r4m-5xx6-96jf and ChecklistWriteBleed.

Checklist, checklist-item and comment routes had drifted from the role capability table: some mutations needed only read access, while comment creation required full write access and incorrectly rejected Comment Only members. Mutation routes now require write access and comment creation uses the comment capability. See GHSA-cp24-5m9m-wm97 and RoleBleed.

Card and checklist creation reused the comment permission, allowing Comment Only members to create board content. Both single and bulk card creation and checklist creation now require the canonical write capability. See GHSA-qf5c-63jx-mpv4 and CommentWriteBleed.

The board-creation route trusted the owner and role flags in the request body, so an authenticated caller could create a board attributed to another user. The authenticated caller is now always the initial active administrator and owner. See GHSA-6jvj-85q3-6q2m and OwnerBleed.

The administrator token endpoint could create a reusable login token for another user without producing the impersonation audit record used by the normal UI. It now requires a reason, verifies the target, records the administrator and target before inserting the login token, and rejects an unaudited request. See GHSA-5r57-9vj7-c64f and TokenAuditBleed.

Board and user routes returned raw Error objects as successful HTTP 200 responses, which exposed implementation details and made failures look successful. Shared response handling now preserves expected 4xx statuses while replacing unexpected 5xx details with a generic message. Regression tests cover both paths and ensure raw errors do not return from the affected handlers. See GHSA-h59p-76c3-8345 and ErrorBleed.

Source builds, Linux and Windows bundles, Docker, Snap and Sandstorm now derive Node and FerretDB limits from available host or cgroup memory while preserving explicit administrator overrides. Test and Go compiler floors no longer exceed small containers, Playwright installs repository-local browsers and uses a matching Docker fallback when immutable host libraries are missing, and build dependency stderr remains visible in both the console and timestamped log.

Runtime self-checks proactively report low disk space and V8 heap pressure in Admin Panel Problems. The database classifier now gives actionable reports for memory and file-descriptor exhaustion, read-only volumes, corruption and oversized documents. The remediation documents record which protections work on every platform and distinguish implemented FerretDB telemetry from follow-ups.

The first three Tests menu choices in both build.sh and build.bat now run the whole matrix. The default runs one stage at a time with two Playwright workers per browser for a safe speed increase; one-by-one minimizes memory use; and at-once runs WeKan jobs concurrently. Database backends and FerretDB stages stay sequential in every mode to avoid port conflicts and overlapping compiler load. The Windows helper forwards the selected mode to the shared shell implementation, and parity tests pin the menu order, mode mapping and Playwright worker limit.

Every EVERYTHING run now owns a repository-local process lock. Starting another one first stops the older run and all descendants, frees and verifies ports 3000 and 3001, and removes tagged Playwright and database-conformance containers. Ctrl-C uses the same cleanup for the interrupted run. Cleanup tries graceful termination before a bounded forced stop; if a process, port or container still survives, the replacement exits with an actionable error before creating logs, building WeKan or starting any new tests. PID start tokens prevent stale lock files from targeting an unrelated reused PID on Linux, macOS and Windows.

The agent instructions now treat the repository-local, ignored .tools tree as the installation root when the Flatpak sandbox lacks a required command. Node.js and npm versions are read from Dockerfile, Meteor from .meteor/release, and other tools from their repository-owned version sources instead of stale copied examples. The instructions link the tested sandbox bootstrap, keep environment overrides scoped, and document a local RapidOCR virtual environment for reading timestamped screenshots when bubblewrap prevents the normal image viewer from creating a user namespace.

Fedora screenshots showed available memory falling from 28.6 GiB to 371 MiB while the CPU-exec negative regression created a large group of short-lived bash processes. The test now captures stdout and stderr from one direct helper invocation instead of launching a duplicate nested shell. The following FerretDB stages limit Go package compilation to two through four workers with a separate managed-heap target, and conformance no longer downloads the root, integration and tools module graphs before building its single binary. Focused positive and negative regressions pin these resource boundaries.

The adaptive 8-16 GiB heap ceiling needed while Meteor compiles WeKan was also inherited by the long-lived bundle server and every Node, E2E and Playwright process. A leaking test could therefore consume nearly all workstation RAM and swap before Linux killed it. Runtime processes now use a separate quarter-RAM allowance clamped to 2-4 GiB, while Meteor compilation retains the larger heap. WEKAN_TEST_NODE_OPTIONS provides a test-only override. Regression coverage pins both the bounded processes and the deliberately unbounded compiler.

Host-side dependency installers now choose Fedora’s dnf commands and package names, including Fedora 44’s 7zip, gcc-c++, glibc-langpack-en and snapd socket setup. Debian/Ubuntu continue to use apt and macOS continues to use Homebrew. Mocked installer-path tests cover both Fedora and Debian selection.

Host-facing shell installers now identify Linux families through /etc/os-release and select apk, pacman, dnf, yum or apt-get with each distribution’s package names. Shared compiler and archive setup covers bundle conversion, docs, Sandstorm, release downloads, Snap prerequisites and forge tooling. Alpine and Arch report the manual Snap prerequisite instead of incorrectly running apt. RHEL and Oracle Linux configure their respective EPEL repositories before installing snapd. Mocked detection tests cover Alpine, Arch, Fedora, RHEL, Oracle Linux and Debian, and every migrated script is syntax-checked.

Host-facing Bash scripts now hand direct zsh invocation to macOS’s system Bash before parsing Bash-specific syntax. The shared installer detects Darwin without depending on the caller’s shell and maps command names to the correct Homebrew formulae for Python, GNU awk, GCC, 7-Zip and Node.js. Regression tests cover the handoff, Darwin detection and every differing formula name.

Shell and Windows batch scripts now use .tools/wekan.fi for the website companion checkout and .tools/log for build and test output. This removes the legacy sibling ../w/wekan.fi and parent ../log assumptions while preserving the CI environment-variable overrides.

A fresh shell did not include .tools/.meteor on PATH, so EVERYTHING stopped before building with meteor: command not found even though setup had installed the exact release there. build.sh now prefers the repository-local Meteor and the Node version and architecture named by the release configuration. The companion FerretDB test runner also generates current version metadata before unit packages initialize and writes standalone logs under .tools/log. Its unit, vet and SQLite integration stages pass together.