You are viewing @bulleted.app’s public outline

This repository is larger than Bulleted indexes. Some bullets are missing. See what came loose.

1. Fixed: a bullet written while zoomed into a section is saved inside that section. It looked right until a reload, at which point it — and everything else written that way — was sitting at the root of the outline
2. The save mark says "Saved" only once the writing has landed, rather than whenever the queue happens to be empty — which it also is while you are typing, and after a write that failed and is waiting to retry
3. Fixed: the first bullet of a new outline no longer sits in a gap of its own, with its marker a column to the left of every other row. Thanks to @isaaccorbrey.com for the report.
   Reported by @isaaccorbrey.com at https://userinput.app/d/did:plc:zviscnpwyvj6y32agi5davn5/3msrjeddvuc2o — from Firefox on Android on the evening of the 10th, with a screenshot that made it obvious. The report also asked for a compactness setting for a denser display, which is not done and is worth doing.
4. Typing no longer scans the whole page three times per keystroke, which is what a large outline felt as lag
5. Background work that crashes is restarted and counted, instead of quietly stopping for the life of the process while the health check stayed green
6. A page full of mirrors no longer spends a query on each repository it had already decided not to read
7. The handle cache is swept hourly — it was the one table that grew with the whole network rather than with this service
8. Fixed: ordinary parallel writes no longer sign you out. A refresh's result was thrown away the moment nobody was waiting on it, so requests still carrying the pre-refresh cookie went back and spent a refresh token that had already been used — which an authorization server reads as a stolen token, and answers by ending the whole session.
9. A session whose refresh keeps failing now backs off, instead of asking the authorization server again on every page view, every image, and every write for the rest of the cookie's life.
10. A failed sign-in says that it failed, without saying whether it was DNS, TLS, a refused connection, or a timeout. The handle is chosen by whoever types it, so the detail was a way to probe somebody else's server. What you typed is still named, because it is the part you can act on.
11. Fixed: a bullet named in an abuse report stops rendering as a page. The deny was honoured by the API from the day it was written and by nothing on the HTML side, so the same record was refused over XRPC and served as a page, with its comment thread and its children alongside it.
12. Two sign-in defences that anybody could switch off by editing their own request are now unconditional: the issuer check RFC 9207 makes mandatory refuses a missing parameter rather than skipping it, and the CSRF exemption for a request carrying a Bearer header is gone — every route behind it took its identity from the session cookie.
13. A blob fetched from somebody else's server keeps the locked-down policy its own handler states, rather than leaving with the one every page gets. Both were well-formed headers, so nothing failed and nothing logged.
14. Space credentials are bound to a key. The amended proposal 0016 makes a credential carry a proof rather than travel as a bearer token, so a host handed one so it could serve its own repository can no longer replay it against every other repository in the space. Subscribing to a space moved to the new scheme in the same change that adopted it, so nothing was ever served by the old one.
15. /api/lxm is gone. Minting authority signed with your account's key now needs a scope this app deliberately does not ask for, and no page ever called the endpoint — widening what every user consents to, in order to keep an unused route answering, is the wrong direction.
16. !copy is measured against the 200 record operations a single commit may carry, now that the limit is enforced rather than implied. Copying 100 bullets that each carry a note builds exactly 200 — the ceiling, with nothing to spare — so the number is written down and tested instead of being met by luck.
17. Operational: the documented list of indexed collections matches the code — it was missing comment policies, and anyone who uncommented that line would have quietly reverted every bullet to the default comment permission — CI builds against the committed lockfile, and a service DID naming a host this deployment does not serve is refused at startup instead of answering 404 for as long as it runs.