Build log

Build Log

Every phase, in the order it actually happened.

269
Phases so far

July 2026

  1. Phase 1 – Foundations 24 Jul
  2. Phase 2 – Servers, Packages & Security Tooling 24 Jul
  3. Phase 3 – A Real Course Correction 24 Jul
  4. Phase 4 – The Core Loop Actually Works 24 Jul
  5. Phase 5 – File Manager, and a Security Issue Caught in Testing 24 Jul
  6. Phase 6 – The SSL Manager, and Two More Bugs Caught Live 24 Jul
  7. Phase 7 – A Real Database Manager, Then an App Installer Built On Top Of It 24 Jul
  8. Phase 8 – A Real Mail Server, and a Genuinely Hard Debugging Session 24 Jul
  9. Phase 9 – A Real Nameserver, and the Panel’s Own DNS Zone Editor 24 Jul
  10. Phase 10 – The First Full Security Audit 25 Jul
  11. Phase 11 – Closing Out the Audit Follow-Ups 25 Jul
  12. Phase 12 – Filling In the Services Section 25 Jul
  13. Phase 13 – Checked Against the Real Thing 25 Jul
  14. Phase 14 – A Second Server, a Real Install Script, and Multi-PHP Finally Working 25 Jul
  15. Phase 15 – Rethinking the Install Flow, Client-Panel Polish, and a Second Audit 25 Jul
  16. Phase 16 – The DNS Roadmap, Closed Out 26 Jul
  17. Phase 17 – A Real Mail Admin Toolkit 26 Jul
  18. Phase 18 – Ten Client-Panel Features, One Day 27 Jul
  19. Phase 19 – Knowing What’s Running, and Keeping It Current 28 Jul
  20. Phase 20 – A Real Webmail Client 29 Jul
  21. Phase 21 – Choosing Your Own Password on Account Creation 29 Jul
  22. Phase 22 – The Webmail Choice, Built Before There’s a Choice to Make 29 Jul
  23. Phase 23 – Our Own Webmail Client, Not Just a Reskin 29 Jul
  24. Phase 24 – KNJ Webmail Starts Looking Like a Real Mail Client 29 Jul
  25. Phase 25 – Your Own Folders, Filed by Dragging 29 Jul
  26. Phase 26 – Rules, and a Settings Page to Hold Them 29 Jul
  27. Phase 27 – Handling a Batch of Messages at Once 29 Jul
  28. Phase 28 – Rich Compose, and a Sanitizer That Had to Earn Its Keep 29 Jul
  29. Phase 29 – Contacts, and the Original Scope Is Now Complete 29 Jul
  30. Phase 30 – Track DNS, Server Settings, and Raw Log Download 29 Jul
  31. Phase 31 – Resolver Config, Server Contacts, Reboot, CSR Generator, Contact Import 30 Jul
  32. Phase 32 – Modify an Account, Suspend/Unsuspend, and a Real Bug Hunt 30 Jul
  33. Phase 33 – Disk Quotas That Actually Block Writes, and Bandwidth From Real Logs 30 Jul
  34. Phase 34 – The Second Full Security Audit 30 Jul
  35. Phase 35 – FTP, Built the Same Way Mail Already Was 30 Jul
  36. Phase 36 – FTP Settings, and a Sandbox Gap That Predated It 30 Jul
  37. Phase 37 – Backups, and Locking In a Real Path to v1.0 31 Jul
  38. Phase 38 – Locking the Front Door: Brute-Force Protection and 2FA 31 Jul
  39. Phase 39 – Cron Jobs, the Boring Way (Which Is the Right Way) 31 Jul

August 2026

  1. Phase 40 – Licensing, and Where the Line Sits 1 Aug
  2. Phase 41 – The Third Full Security Audit (and the First to Cross Three Servers) 1 Aug
  3. Phase 42 – The Release Pipeline, and the Three Bugs It Took to Prove It 2 Aug
  4. Phase 43 – My Profile Could 2FA and Nothing Else 2 Aug
  5. Phase 44 – The First Real Install, on a Server That Had Never Seen This Panel Before 2 Aug
  6. Phase 45 – The Fourth Full Security Audit (and Two Scripts That Modified Themselves) 2 Aug
  7. Phase 46 – Closing Out Service Configuration 3 Aug
  8. Phase 47 – Finishing Accounts, and Finding Two That Were Already Done 3 Aug
  9. Phase 48 – A Firewall Bug That Only Failed Through the Real App 3 Aug
  10. Phase 49 – API Tokens, and the Security Section Closed 4 Aug
  11. Phase 50 – The Fifth Full Security Audit 4 Aug
  12. Phase 51 – The SSL/TLS Section, Closed Out 4 Aug
  13. Phase 52 – The Databases Section, Closed Out 4 Aug
  14. Phase 53 – OS Package Management, and Software & PHP Closed Out 4 Aug
  15. Phase 54 – Packages & Resellers, Closed Out 4 Aug
  16. Phase 55 – Live Resource Monitoring, and Backup & Server Status Closed Out 5 Aug
  17. Phase 56 – Server Configuration, and What “Done” Actually Means Here 5 Aug
  18. Phase 57 – Everything Else, and a Dead Setting Found Along the Way 5 Aug
  19. Phase 58 – The Admin Roadmap, Verified Against the Real Code 5 Aug
  20. Phase 59 – The Client Email Section, and a Bug the Whole Phase Kept Hiding 5 Aug
  21. Phase 60 – The Client Domains Section, and Two Bugs Older Than This Build 5 Aug
  22. Phase 61 – The Client Files Section, and a Roadmap Row That Was Already True 5 Aug
  23. Phase 62 – The Client Databases Section, a CI Blind Spot, and a Real Remote Connection 5 Aug
  24. Phase 63 – The Client Metrics Section, Closed Out 5 Aug
  25. Phase 64 – The Client Security Section, Closed Out 6 Aug
  26. Phase 65 – The Client Advanced Section, Closed Out, and a Second Stale Roadmap Row 6 Aug
  27. Phase 66 – Team Access, and the 44-Controller Pass That Made It Real 6 Aug
  28. Phase 67 – Real phpMyAdmin, and Two Bugs Only a Live Server Would Show 6 Aug
  29. Phase 68 – Security Audit #07, and the Escalation Path a Fix Almost Opened 6 Aug
  30. Phase 69 – The App Installer Becomes a Real Catalog, and phpBB Takes Some Work 7 Aug
  31. Phase 70 – A Roadmap That Was Stale in Both Directions, and Two Cleanup Bugs 7 Aug
  32. Phase 71 – Five Quiet Days, Checked Properly Instead of Assumed 12 Aug
  33. Phase 72 – A Real Feature Audit, and the Feature That Said No to Itself 12 Aug
  34. Phase 73 – A Real Home Screen for the Account Panel 13 Aug
  35. Phase 74 – A Search Box That Lives Where You’re Already Looking 13 Aug
  36. Phase 75 – Working Down the Gap List 13 Aug
  37. Phase 76 – A Certificate Repository Instead of a Site List 13 Aug
  38. Phase 77 – A Feature That Wasn’t There to Build 13 Aug
  39. Phase 78 – A Feature Toggle That Actually Toggles 13 Aug
  40. Phase 79 – The Feature That Cost Nothing to Build 14 Aug
  41. Phase 80 – The Real Thing, Not a Reimplementation 14 Aug
  42. Phase 81 – Ground Truth Before a Single Line of Code 14 Aug
  43. Phase 82 – The Same Door, Reachable From Both Sides 14 Aug
  44. Phase 83 – Eight Packages, Verified One at a Time 14 Aug
  45. Phase 84 – The Smallest Gap on the List 14 Aug
  46. Phase 85 – The Update Mechanism Updates Everything, Except the Part That Updates It 16 Aug
  47. Phase 86 – Restoring the One File, Not the Whole Account 16 Aug
  48. Phase 87 – Closing the Loop on the Package-Install Fix 16 Aug
  49. Phase 88 – BoxTrapper Actually Releases Your Mail 16 Aug
  50. Phase 89 – Restoring a Real cPanel Account, Not a Reimplementation of Our Own 17 Aug
  51. Phase 90 – Restoring a cPanel Backup Into an Account You Already Have 17 Aug
  52. Phase 91 – Database Search & Replace 17 Aug
  53. Phase 92 – Transfer Tool 17 Aug
  54. Phase 93 – Convert Addon Domain to Account 17 Aug
  55. Phase 94 – Fix Everything, Then Audit It 17 Aug
  56. Phase 95 – Finishing What Audit #11 Left Open 17 Aug
  57. Phase 96 – Two Small Ones: User Manager and the Postfix Config Gap 17 Aug
  58. Phase 97 – Return to Admin, and Making 0.15.99 Real 17 Aug
  59. Phase 98 – First-Run Setup Wizard 18 Aug
  60. Phase 99 – DNS-Only Server Role 18 Aug
  61. Phase 100 – Install Script Fixes, a Login Bug They Uncovered, and a Licence Gap 19 Aug
  62. Phase 101 – Deploy from Git Rebuild, and a Real Subdomains Feature to Build It On 19 Aug
  63. Phase 102 – Two-Key Server Linking, Replacing the Shared Token 21 Aug
  64. Phase 103 – Closing Out DNS-Only Feature Parity 21 Aug
  65. Phase 104 – Mail Only, Stage 1: Linking, Role Gate, Bootstrap 21 Aug
  66. Phase 105 – Mail Only, Stage 2: The Dispatcher, and a Real Selector 21 Aug
  67. Phase 106 – Mail Only: Syncing Existing Accounts to a New Mail Server 21 Aug
  68. Phase 107 – A Webmail Login Bug With Two Separate Causes 21 Aug
  69. Phase 108 – Mail Only Stage 3 Begins: Webmail Routing, and a Bug Three Levels Deep 21 Aug
  70. Phase 109 – Mail Only Stage 3 Continues: the Rest of the Dispatcher Migration 21 Aug
  71. Phase 110 – Mail Only Stage 3 Wraps Up: Service Status Stops Lying About Where Mail Runs 21 Aug
  72. Phase 111 – Mail Only Stage 4: Cross-Server Admin SSO 21 Aug
  73. Phase 112 – Mail Only, fully closed out 22 Aug
  74. Phase 113 – Audit #12: The Setup Wizard’s Missing Invariant 22 Aug
  75. Phase 114 – Audit #13: DNS Only, Reviewed as a Role Not a Diff 22 Aug
  76. Phase 115 – Audit #14: A Secret Worth More Than It Should Have Been 22 Aug
  77. Phase 116 – Line-By-Line Bug Sweep: Correctness, Not Security 22 Aug
  78. Phase 117 – DNS-only comparison audit 22 Aug
  79. Phase 118 – webmail.domain and domain.com/webmail 22 Aug
  80. Phase 119 – ftp/account/controller shortcuts, and closing the www SSL gap 22 Aug
  81. Phase 120 – DNS zone file import/export 22 Aug
  82. Phase 121 – Mail client autoconfiguration 22 Aug
  83. Phase 122 – Email Disk Usage cleanup 22 Aug
  84. Phase 123 – Per-mailbox quota and suspension 22 Aug
  85. Phase 124 – Off-site backup destinations 22 Aug
  86. Phase 125 – Virus/malware scanning 22 Aug
  87. Phase 126 – Email archiving 22 Aug
  88. Phase 127 – Subscribers & Marketing Email, and a Blade Bug Hiding in Plain Sight 24 Aug
  89. Phase 128 – Web Application Firewall (ModSecurity + OWASP CRS) 24 Aug
  90. Phase 129 – CalDAV/CardDAV (Calendars & Contacts Sync) 24 Aug
  91. Phase 130 – Audit #15: A Toggle That Didn’t Do What It Said 25 Aug
  92. Phase 131 – Alerting: The Part That Was Missing From Every Health Check 25 Aug
  93. Phase 132 – File Manager Gets a Real Code Editor 25 Aug
  94. Phase 133 – One Page for Every Alert 25 Aug
  95. Phase 134 – Audit #16: Verifying Every “Live” Row Is Actually True 26 Aug
  96. Phase 135 – A Morning of Bug Reports, and One That Took Two Passes 28 Aug
  97. Phase 136 – The Placeholder Logo Nobody Had Replaced 28 Aug
  98. Phase 137 – The Half of a Server Switch Nobody Had Built 28 Aug
  99. Phase 138 – The Dashboard Mail Only Never Got 28 Aug
  100. Phase 139 – Real Nameserver Management, and DNS That Actually Follows Mail 29 Aug
  101. Phase 140 – The PTR Check Was Looking at the Wrong Server 29 Aug
  102. Phase 141 – Roundcube Was Installed on Mail Only, Just Never Wired Up 29 Aug
  103. Phase 142 – A Webmail Key That Was the Wrong Length 29 Aug
  104. Phase 143 – When the Fix Runs Clean and the Bug Doesn’t Care 29 Aug
  105. Phase 144 – The Directory Roundcube Could Never Write To 29 Aug
  106. Phase 145 – Trusting the Guard Less 29 Aug
  107. Phase 146 – One of Two, and Only One of Two 29 Aug
  108. Phase 147 – Not Explaining It, Just Ending It 29 Aug
  109. Phase 148 – The Fix That Broke Itself 29 Aug
  110. Phase 149 – Asking Instead of Guessing 29 Aug
  111. Phase 150 – The Log That Was Never Being Written 29 Aug
  112. Phase 151 – Array First, Finally Last 29 Aug
  113. Phase 152 – Guarding What Should Never Have Needed Guarding 29 Aug
  114. Phase 153 – The Quota Plugin That Needed a Friend 29 Aug
  115. Phase 154 – A Mail Setting That Was Never Switched On 29 Aug
  116. Phase 155 – The Self-Heal That Healed Nothing 29 Aug
  117. Phase 156 – The Uniqueness Check That Didn’t Understand the Point 29 Aug
  118. Phase 157 – The Autofill Nobody Asked For 29 Aug
  119. Phase 158 – The Nameserver That Couldn’t Vouch For Itself 29 Aug
  120. Phase 159 – Dogfooding the Deploy Button 30 Aug
  121. Phase 160 – Three Things the Real Servers Wanted 30 Aug
  122. Phase 161 – The Address Bar Problem 30 Aug
  123. Phase 162 – The Save Button Nobody Knew They Had to Click 30 Aug
  124. Phase 163 – A Report Nobody Has to Remember to Check 30 Aug
  125. Phase 164 – The Account That Wouldn’t Leave 30 Aug
  126. Phase 165 – The Box Was Too Small For Its Own Text 30 Aug
  127. Phase 166 – The 4GB Limit That Was Never Real 30 Aug
  128. Phase 167 – The Save That Ate Its Own Response 30 Aug
  129. Phase 168 – Closing the Loop on the Body-Size Fix 30 Aug
  130. Phase 169 – The Upload That Vanished 30 Aug

September 2026

  1. Phase 170 – The Password Nobody Should Be Able to Reuse 2 Sep
  2. Phase 171 – A Firewall Page That Actually Does Something 2 Sep
  3. Phase 172 – What a Real-World Restore Actually Breaks 2 Sep
  4. Phase 173 – Not Every Warning Deserves the Same Button 2 Sep
  5. Phase 174 – Scanning Whole Accounts for Malware 2 Sep
  6. Phase 175 – The Password That Broke Its Own Config 2 Sep
  7. Phase 176 – The Subdomain That Never Got Its Address 2 Sep
  8. Phase 177 – Your Domain, Your Port, Your Certificate 2 Sep
  9. Phase 178 – Closing the Loop on Two Patterns 2 Sep
  10. Phase 179 – The Address Book Nobody Went Looking For 2 Sep
  11. Phase 180 – The Page That Was Never Going to Load 3 Sep
  12. Phase 181 – The Filesystem Nobody Was Watching 3 Sep
  13. Phase 182 – What Else Were We Not Looking For 3 Sep
  14. Phase 183 – The Fix That Wasn’t the Whole Fix 3 Sep
  15. Phase 184 – Teaching the Restore Itself to Look 3 Sep
  16. Phase 185 – The Tool That Checked Itself 3 Sep
  17. Phase 186 – The Shortcut That Didn’t Ask 3 Sep
  18. Phase 187 – A Wrong Answer Beats a Random One 3 Sep
  19. Phase 188 – The Shortcut That Called Itself 3 Sep
  20. Phase 189 – The Page That Grew Instead of Scrolling 3 Sep
  21. Phase 190 – The File That Came From Somewhere Else 3 Sep
  22. Phase 191 – A Rule That Only Applies to One Kind of Asking 3 Sep
  23. Phase 192 – The Same Symptom, a Different Door 3 Sep
  24. Phase 193 – The List That Needed One More Name 4 Sep
  25. Phase 194 – Standing In Someone Else’s Shoes, Correctly 4 Sep
  26. Phase 195 – Two Doors, Both Assumed Open 4 Sep
  27. Phase 196 – Waiting in Line, Twice 4 Sep
  28. Phase 197 – Four Ways to Find Out 4 Sep
  29. Phase 198 – The Animation That Only Ran When Nobody Was Watching 5 Sep
  30. Phase 199 – The Menu That Wouldn’t Stop Growing 5 Sep
  31. Phase 200 – The Alarm That Only Covered Its Own Front Door 5 Sep
  32. Phase 201 – One Click Instead of One Account at a Time 5 Sep
  33. Phase 202 – The Folder That Was Never Really There 5 Sep
  34. Phase 203 – A Weekend of Someone Else Actually Using It 6 Sep
  35. Phase 204 – The Bar That Had Nothing to Measure 7 Sep
  36. Phase 205 – The Other Update Button Learns the Same Trick 7 Sep
  37. Phase 206 – The Answer That Never Got Asked Again 7 Sep
  38. Phase 207 – The Server That Wasn’t In Its Own Table 9 Sep
  39. Phase 208 – Completed Isn’t the Same as Nothing To Do 9 Sep
  40. Phase 209 – The Two Groups That Got To Fold Up 9 Sep
  41. Phase 210 – Nothing Happened, As Far As Anyone Could Tell 9 Sep
  42. Phase 211 – The Answer Nobody Asked For, Rejecting Itself 9 Sep
  43. Phase 212 – The App That Lived at Someone Else’s Address 9 Sep
  44. Phase 213 – The Tool That Would Only Add 9 Sep
  45. Phase 214 – The Address That Worked the First Time 10 Sep
  46. Phase 215 – The Address That Worked, Then Didn’t 10 Sep
  47. Phase 216 – The Tools That Forgot There Were Others 10 Sep
  48. Phase 217 – The Box That Had to Say Something 10 Sep
  49. Phase 218 – The Column That Could Only Mean One Thing 10 Sep
  50. Phase 219 – The Mailbox That Went Dark 10 Sep
  51. Phase 220 – The State Nobody Ever Entered 10 Sep
  52. Phase 221 – The Table That Only Ever Said One Thing 10 Sep
  53. Phase 222 – The Index That Was Secretly Load-Bearing 10 Sep
  54. Phase 223 – The Installs List That Only Showed One Answer 10 Sep
  55. Phase 224 – The Scan That Found Its Own Neighbours 11 Sep
  56. Phase 225 – The List That Remembered When, Not What 11 Sep
  57. Phase 226 – One Order, Everywhere 11 Sep
  58. Phase 227 – The Report That Couldn’t Say Zero 11 Sep
  59. Phase 228 – A Name Borrowed From Someone Else’s House 11 Sep
  60. Phase 229 – What Moving Out Forgot to Take 11 Sep
  61. Phase 230 – Database Access, Scoped to the Account 11 Sep
  62. Phase 231 – A Record of the Reader 11 Sep
  63. Phase 232 – One Door for Every Room 11 Sep
  64. Phase 233 – The Badge That Did Too Much Work 11 Sep
  65. Phase 234 – The Badge’s Quieter Sibling 11 Sep
  66. Phase 235 – A Cache With Nobody Left to Fill It 11 Sep
  67. Phase 236 – A Dropdown Standing in the Wrong Doorway 11 Sep
  68. Phase 237 – A Guard That Was Only Ever Hired Once 11 Sep
  69. Phase 238 – A Name Before Anyone Asked for One 16 Sep
  70. Phase 239 – What a Real First Day Actually Looks Like 16 Sep
  71. Phase 240 – The Reminder That Only Fires Once 16 Sep
  72. Phase 241 – The Address That Needed Two Stories 16 Sep
  73. Phase 242 – The Zone That Had To Exist First 16 Sep
  74. Phase 243 – The Broom That Didn’t Look First 16 Sep

October 2026

  1. Phase 244 – The Fix That Only Fixed Half the Door 5 Oct
  2. Phase 245 – The Repair That Measured Wrong Every Time 5 Oct
  3. Phase 246 – The Bug Hiding Behind the Workaround 9 Oct
  4. Phase 247 – The Backups That Lived on the Wrong Server 9 Oct
  5. Phase 248 – The Folder Name the Script Wouldn’t Accept 9 Oct
  6. Phase 249 – One Clock, Not Two 9 Oct
  7. Phase 250 – The Link That Was Fine 9 Oct
  8. Phase 251 – The Run That Had Already Happened 9 Oct
  9. Phase 252 – The Link That Trusted the Visitor 10 Oct
  10. Phase 253 – The Folder Inside the Customer’s Reach 10 Oct
  11. Phase 254 – The Server That Was Too Open to Its Own Customers 10 Oct
  12. Phase 255 – Two Lists, One Click 12 Oct
  13. Phase 256 – The Page That Showed Zeros Politely 13 Oct
  14. Phase 257 – The File the Panel Was Not Allowed to Touch 13 Oct
  15. Phase 258 – The File Manager That Learned to Forgive 13 Oct
  16. Phase 259 – The Fix That Passed Everywhere but Production 13 Oct
  17. Phase 260 – The Queue That Waited for a Backup Server 13 Oct
  18. Phase 261 – The Test That Found Nothing to Break 14 Oct
  19. Phase 262 – The Docs Site That Deployed Itself 15 Oct
  20. Phase 263 – The Tool Nobody Should Be Able to Find 15 Oct
  21. Phase 264 – The Script the App Could Edit 15 Oct
  22. Phase 265 – The Documentation Audit 15 Oct
  23. Phase 266 – A Support Desk, Built In 20 Oct
  24. Phase 267 – A New Look, and Pages That Stay Put 20 Oct
  25. Phase 268 – The Sign-Ups That Said Thanks 21 Oct
  26. Phase 269 – Mail That Left Unsigned 21 Oct