Changelog

What changed, newest first. Each line names its pull request (#N). Shop-facing changes come first each day; platform and operations work follows. The feature list says what exists now; the roadmap explains the stages.

Every merged pull request adds its line here, under the day it merged (keeping the docs current).

26 October 2026

Platform

• Dependabot’s first run proposed Astro 7.4 in the docs, landing and storefront trees past their pins, and CI’s three Astro builds went red as intended: the configuration now ignores Astro 7.4 until the server’s Node is upgraded, and the GitHub Actions updates arrive as one monthly group (dependencies) (#107).
• Security review. Every answer now carries the browser protections (a year of https for the platform and its subdomains, no content sniffing or framing elsewhere, no device permissions, a referrer policy), and the sign-in, onboarding and control-panel pages carry a Content Security Policy that allows only the application’s own scripts, each marked per request, so an injected script cannot run (response headers). On production a new password is also refused when it appears in a known breach, checked without the password leaving the server. A dependency policy says when libraries move: advisories within two working days, in-range updates weekly through Dependabot, majors quarterly one framework at a time, and never past the PHP and Node production runs (dependencies, ADR-023); the landing page and storefront pin Astro to the series the server’s Node can build, as the docs already did, and CI tests on production’s PHP 8.4 (#99).

Fixes

• Six control-panel details found while taking the landing screenshots: percentages use the interface language’s decimal mark (“54,15%” next to “1 190,00 грн”) on the flower, bouquet, order and Finance pages; the flower page shows margin and markup under their own names (price 160, cost 80 is a 50% margin and a 100% markup, not a “profit margin” of 100%); a batch carries one freshness label on every page, judged by the server from the flower’s shelf life; “1 партія” and “3 букетах” are pluralised; the order’s reservations name the flower before the batch code; and the supply pages were measured at 1440 px with a twelve-batch supply and no longer overflow (#98).
• The two checkout emails show amounts the way the shop’s website does: “1 190 ₴” in Ukrainian and “₴1,190” in English, without decimals when the amount is whole, instead of “1190.00 UAH”. Found on the production run (#97).

Platform

• Stage 3A’s last step: a real order request placed on production through a shop on its own domain, confirmed and paid in the control panel, with the runbook’s checks recorded on its page (production run) (#95).
• Search engines: the root domain has a sitemap at /sitemap.xml (the landing page in both languages and every docs page), robots.txt names it, and the sign-in, registration, onboarding and control panel pages say noindex. The docs site’s canonical links pointed at flowery.test on production; they now point at flowery.com.ua. A Lighthouse pass on the homepage (performance 96, SEO 100) and what would raise it are recorded on the landing page’s docs (search engines); the plate captions it flagged for contrast are darker (#94).

Fixes

• The documentation site builds again on CI and on the server: npm audit fix had taken the docs’ Astro to 7.4, which needs a newer Node than production runs, and the 25 October release stopped before switching over. Astro is pinned to 7.3 in docs/ and the deployment page records the Node bound (deployment) (#93).

25 October 2026

Platform

• Stage 3A closed: the offline checkout scenarios (a request submitted twice, confirmed and paid; a price change and forged or foreign input) run end to end as a named CI gate, a runbook explains how a shop switches checkout on and what to check before and after (switching checkout on), and the whole customer and staff journey was walked on the production build at desktop and phone width in both languages (improvement-plans/Stage-3A-Closeout.md). Phone-width screenshots now have a working recipe (browser testing) (#92).
• symfony/http-foundation 7.4.18 → 7.4.21 for CVE-2026-108082 (a slow regular expression on the Cache-Control request header), found by the Composer audit in the ship gate; npm audit fix in the app, storefront, landing and docs for new advisories on follow-redirects, vite, zod and their dependants (#92).

13 October 2026

For shops

• Homepage proposal v4 at flowery.com.ua/homepage-v4: the month on the shop wall as the first screen, every demo batch an ivory bar from 8 October to its use-by day, Saturday the 10th circled where the ranunculus reaches its use-by with 55 stems reserved, and the week’s stock sheet beside it; v2’s look, no auction (landing page) (#91).

12 October 2026

For shops

• Homepage proposal v3 at flowery.com.ua/homepage-v3: one day in the shop as the page’s first screen, the six steps of an order as the day’s stations on a forest band with their real screens, and a «зараз» mark at the visitor’s own time; v2’s look, no auction (landing page) (#90).
• The catalogue homepage is back at flowery.com.ua; the auction-hall page (v2) moved to flowery.com.ua/homepage-v2 as a proposal to compare, visible to signed-in users too and hidden from search engines. Proposals now have their own route pattern (/homepage-vN, /en/homepage-vN) (landing page) (#89).
• Homepage v2: flowery.com.ua now opens on the flower auction hall — one great dial counting the days a batch has left, with today’s real demo batch on the lot card beside it — instead of the printed-catalogue page. New display type (Unbounded), the same copy, screenshots and honesty rules; the small day-dials in Freshness show how long each demo batch has left (landing page) (#88).
• Own domain: one click also at every DNS provider that supports Domain Connect (the standard behind the “Sign in to Cloudflare” buttons elsewhere) — the page names the provider and sends you to its own sign-in to approve one record; nothing is stored on our side. Our template is in the public Domain Connect repository; Cloudflare lists it after its onboarding (ADR-022) (#85).
• An empty shop is offered the demo on every control-panel page, and the demo can be added even after a few flowers were entered by hand (it needs only no bouquets and no orders yet) (ADR-016) (#84).

Fixes

• Landing page polish: on tablets the paired blocks (text and screen, catalogue and phone, FAQ, closing band) sit side by side instead of stacking with an empty right half; on phones the money section reads heading first and the swipeable steps row has a thin hairline scrollbar and is a tab stop only while it scrolls; two screenshots are cropped on a whole card (“Облік сходиться” and “Букети тижня”) instead of mid-sentence (#86).
• Settings → Domain: the “Also connect www…” and “Remove www…” buttons announced with #81 had not reached the page (a scripted edit matched nothing after formatting and said nothing); they are there now (#85).
• Settings → Domain: after removing a domain the page’s buttons stayed disabled until a reload (#82).

For shops

• Own domain: www is no longer added on its own. For a domain the form offers “Also connect www.…” (ticked by default); a subdomain such as shop.yourdomain.ua stands alone. The twin can be added or removed later from the same page; the main address and its redirect stay. Found in the first real connection, which produced www.shop.kolovsky.dev (#81).

Platform

• Design context for coding agents: PRODUCT.md (users, purpose, positioning, constraints and the facts still undecided) and DESIGN.md (Flowery’s own visual system, brand kit v1.0 as shipped on the landing page and in the control panel, with the control panel’s drift from the kit recorded) at the repository root (#87).
• The custom-domains runbook records the first two real connections through “Connect with Cloudflare”, their timings and what they taught (#83).

11 October 2026

For shops

• Own domain: if its DNS is on Cloudflare, “Connect with Cloudflare” adds the records for you — approve once on Cloudflare’s page, and the two CNAMEs are created; nothing is stored. Other providers are named on the page, with a link to their CNAME help where we know it (ADR-022) (#80).

10 October 2026

For shops

• Own domain, simpler: type it with or without www — both are connected, the website opens at the one you typed, and each address needs just one DNS record (no more TXT record). If your registrar cannot point the bare domain at us, a redirect to www there is enough (ADR-022) (#79).

Fixes

• Signing in on a shop’s address (where sign-out leaves you) showed that shop’s website in a popup instead of opening the control panel; sign-in now goes straight to your own control panel, whichever shop’s address the sign-in page was on (#78).

8 October 2026

For shops

• Your own domain: connect www.yourshop.ua in Settings → Domain, add the two DNS records it shows, and the website opens there with its own certificate once the records are seen (you get an email). The flowery.com.ua address keeps working for your team and sends customers to the new one; removing the domain puts the website back at once. Owner only (ADR-022, custom domains) (#77).

Platform

• Shops’ own domains: Storefront API rate limits now see each visitor’s address instead of Cloudflare’s edge, after the server took it from CF-Connecting-IP; the runbook records the Cloudflare and Forge steps as applied (#77).
• Groundwork for shops’ own domains (ADR-022): a request on a shop’s own hostname resolves to the shop once the domain is live, serves only the storefront and the Storefront API, and the subdomain’s storefront redirects there. GET /shop names the shop’s one address (domain), customer links follow it and staff links stay on the subdomain. The server files for Cloudflare-fronted custom hosts are in deploy/storefront/ (custom domains). Connecting a domain from Settings comes in the next pull request (#76).

For shops

• The landing page shows the product instead of describing it. It leads with stems tracked from the delivery to the bouquet. Real control-panel screens follow one order through six steps, and the AI section shows images Flowery actually generated, marked as generated, with what AI does not do. The page is shorter, has an action in the phone header, and drops the stock photo, the numbered sections and the drawn illustrations (landing page) (#74).

Fixes

• The landing page no longer says wrapping is costed at purchase price: packaging has no cost yet, so the money section names flowers only (#75).

Platform

• PROJECT_STATE.md lists the homepage’s open owner decisions and the control-panel defects found while taking its screenshots; the shipping checklist gains a landing-page step (#75).
• Homepage research: competitors in Ukraine and abroad, UX evidence and the open items, in improvement-plans/Homepage-Research-2026-10.md (#74).

7 October 2026

Documentation

• A feature list and this changelog, kept current by every pull request (#72).
• A checklist for shipping a major feature, in CLAUDE.md and on keeping the docs current (#73).

For shops

• Team: owners and managers invite staff by email from Settings → Team, with roles below their own. Admins and the owner change roles and remove members (ADR-021) (#70).
• “Opening soon”: a shop with nothing to sell yet shows its name and contacts instead of an empty catalogue, kept out of search results. Previews and order status links still work (#71).
• Onboarding reminders: one email per stalled step (confirm the email, create the shop, add flowers, turn on ordering), sent once each, with a one-click way to stop them (ADR-020) (#69).
• One-click setup: Getting started publishes the website as it is and turns on pickup ordering (cash or card on receipt) (#68).
• Quick bouquets: ready recipes from the shop’s own flowers, priced at the sum of their stems and created at once (#66).
• The Ukrainian interface, emails and landing page call the shop’s website «Сайт», no longer «Вітрина» (#67).
• The control panel uses the brand palette in light and dark, with contrast checked (#65).

6 October 2026

For shops

• Sign in with Google on sign-up and sign-in; a Google sign-up skips the confirmation email (ADR-019) (#64).
• Onboarding (#63):
  • three steps: the shop name and web address now share one screen;
  • the confirmation and password emails are written in Ukrainian;
  • a welcome email carries the shop’s addresses;
  • the confirm page shows the address, corrects a typo and continues by itself;
  • quick-add puts flowers in from the built-in list;
  • a supplier can be named on the first delivery;
  • sign-up uses the brand look and has no repeat-password field.
• Finance: sales, costs and profit per period, with the profit and loss statement, purchases and stock, payments and couriers, operating expenses and CSV exports (ADR-018) (#61).
• Ukrainian by default everywhere, the remaining control-panel English translated, and the website settings moved to the main sidebar (#57).
• A demo shop takes test orders, marked “Демо”, so the whole process can be tried (#58).
• AI works on the platform’s keys for shops without their own; Freepik is now Magnific (ADR-017) (#54).

Fixes

• Sign-out goes to the sign-in page instead of showing the website (#59).
• Removing a line from the website cart no longer fails (#56).
• Browsers fetch the new brand icons (#55).

Platform

• onboarding:funnel reports how far new owners get (#63).
• shell-quote raised past a critical advisory, through an npm override (#62).
• Project state brought up to date (#60).

5 October 2026

For shops

• Onboarding welcome steps (phone, address, hours), the “Getting started” checklist, and a demo shop removed in one click (ADR-016) (#52).
• The Flowery brand: logo, palette, icons, on the landing page and in the control panel (#51).
• The landing page at flowery.com.ua, in Ukrainian and English, with the AI florist section and owner benefits (#48, #49, #50).
• Uklon courier: live price at checkout, booking at dispatch, live courier status (ADR-015) (#46, #47).
• The staff side of website orders: new requests highlighted, offline payments with reversals, a new status link on request (#45).
• Checkout and status pages in the Bloom and Noir themes (#43).

Platform

• Runbooks: keep the nginx file whole; where Forge’s scheduler lives (#44, #53).

4 October 2026

For shops

• Guest checkout (Stage 3A):
  • checkout settings per shop;
  • one order-creation path for staff and the website;
  • the checkout API with quotes, order requests, status links and emails (ADR-014) (#39, #41, #42).
• The website platform (ADR-013):
  • the public Storefront API with occasion tags (#31);
  • versioned theme configuration (#32);
  • the Astro runtime with the Bloom and Noir themes (#33);
  • an editorial design pass (#34);
  • the production cutover (#35, #36).
  • An honesty hotfix came first (#30).
• Shop addresses follow one DNS-safe rule with reserved names (#37).
• An internal AI agent edits websites over MCP (#38).
• Onboarding fixes: email verification, its own layout, finished once by the owner (#22, #23, #26).

Platform

• Production on Forge with mail through Resend and a CI-gated deploy; the local deploy gate before launch (ADR-012) (#21, #25).
• The Stage 3 plan and its first follow-ups (#27, #28, #29); a flaky test fixed (#24); Boost MCP and a pilot demo shop (#20).

3 October 2026

Platform

• Server-side rendering became opt-in on its own port (#18); dependency advisories cleared (#19).

11–14 September 2026: Stage 2, business-rule validation

For shops

• Exact order totals with the delivery fee and a currency on every order (#7).
• Immutable order revisions (#8).
• An inventory ledger as the only stock writer (ADR-011) (#9).
• Reservations first-expiring-first-out on confirmation (#10).
• A transactional order lifecycle (#11).
• Amendments and cancellation with atomic reallocation (#12).
• Supply corrections and spoilage (#13).
• Honest costing, margin and markup (#14).
• Reconciliation and the Attention page (#15).
• Server messages translated (#13).

Platform

• The documentation site (#3); single-use dev login links (#4).
• The Stage 1 closeout patch (#2); the Stage 2 baseline, contract and closeout (#5, #6, #16, #17).

Before September 2026

The product surface (catalogue, supplies, orders, the first storefront, AI generation) was built up to February 2026. Stage 1 (6 September 2026) made it verifiable: one database engine, clean types and lint, enforced authorization and tenant boundaries, encrypted credentials, zero dependency advisories and a check-only CI. See the roadmap.