1.15.3 — A click that does work changes the screen; provisioning survives a partial teardown

2026-08-20

A patch release. The admin portal gets a shared responsiveness contract: a click that goes and does work paints a pending state, a panel whose data fails to load says what broke and offers a retry instead of leaving the previous screen in place, and a mutating action cannot be double-submitted. The Deploys tab — which could look completely inert when a request failed — is the first surface on it. Provisioning gets two fixes from a live run against an empty AWS account: a still-pending instance is a retry rather than a hard failure, and a stale Aurora subnet group left behind by a partial teardown is named in the first pass instead of fifteen minutes in. Plus invite re-issue, password-reset and modal-scroll fixes.

Added

• A shared responsiveness contract for the admin portal — pending state on the control, in-panel error state with a retry, and double-submit protection — applied to the action menu, lifecycle switches, section tabs, refresh controls and modal forms. A fast action does not flash, and a pending state that did appear cannot strobe.
• configure and admin resolve the generated SSH key themselves; --identity is no longer required for a bootstrap-provisioned environment.

Changed

• The domain detail — certificates, registrar settings, records and logs — is a page rather than a drawer.
• A tall modal pins its header and scrolls its body instead of clipping the last element.
• During elastic-IP association a still-pending EC2 instance is reported as "re-run apply" rather than a hard failure that also blocks the DNS step.

Fixed

• The Deploys tab could appear to do nothing at all: a failed request left the previous tab's content on screen with no error and no explanation. It now clears to a loading state before it fetches, and renders the failure with a retry.
• Re-inviting a user who had already redeemed their invite handed back a dead token until the 7-day expiry lapsed.
• A failed password reset — weak password, expired, or already used — left a spent token behind, so the next visit to the login page showed "already used" instead of a clean login form.
• A partial teardown that removed the subnets left an Aurora subnet group behind; the next run judged it satisfactory and spent fifteen minutes before failing with a message that named neither the group nor the staleness.
• The reveal-once deploy key's setup command was cut off below the fold of its modal.

Upgrade notes

• configure and admin now write the generated private key to ~/.ssh/<project>-<env>.pem at mode 0600 when it is absent or differs. An explicit --identity still wins, an imported key pair still falls back to the SSH agent, and the key itself is never printed — only the path.
• Existing ?inspector=<id> domain links redirect to the new ?domain=<id> page. Nothing to do, but bookmarks will change shape.
• The admin-portal responsiveness work landed as the first of three phases: the shared helper and the controls every page uses. Most individual feature buttons still await without feedback and are swept in a later release.