Changelog

Password forms on the web are safe to submit before the page hydrates. A click on submit before React attached its handler used to be the browser's native submit, a GET that put the email and password in the address bar and history. Sign-in, sign-up, password reset and password change, plus the two-factor and admin password dialogs, now post, and the four forms rendered by SSR keep their submit button disabled until hydration.

The mobile app is ready for iPhone Duo. On its outer display and in landscape, iOS moves the status bar and the native tab bar into a vertical rail on the camera's edge. Screens, the todo list, toasts, the update banner, the confirmation sheet and onboarding add the side safe-area insets to their gutters, so nothing runs under the rail; on other iPhones the layout is unchanged. The mobile AGENTS.md records the rule, the simulator checklist and a new rule for @expo/ui: a Host only wraps fixed-size controls, while steppers and segmented pickers are React Native.

The dependency round moves the assistant to TanStack AI 1.0 without code changes, oRPC to 2.0.0-beta.47 and Better Auth to 1.7.14 (owner-approved quarantine exceptions until 2026-10-29), Effect to 4.0.6, TanStack Start and Router to their latest patches and Expo to the latest SDK 58 patches, and re-resolves zod, body-parser, fast-uri and undici past new advisories. The Better Auth advisories published on 2026-10-27, including CVE-2026-114607, were already fixed in 1.7.7, so the template was not affected. The Worker is 31 KiB gzip smaller.

• Libraries
• Mobile app

Sources: password forms, iPhone Duo, TanStack AI 1.0, oRPC beta.47, Expo patches, advisories.

Matt Pocock's skills and pstack are installed again from their sources with the official skills installer, so skills-lock.json matches what upstream ships. pr is new from Matt Pocock. design-an-interface and resolving-merge-conflicts are gone because upstream deleted them, and writing-great-skills is gone because upstream renamed it to writing-for-agents, which the repo already had. domain-modeling keeps this repo's ADR header rules and was not reinstalled.

pstack adds correct, in-your-own-words, ketchup, principle-attack-the-premise, principle-explain-the-number and principle-test-behavior-not-implementation, and seven pstack skills follow upstream edits. pstack's teach and tdd stay out, so the names keep pointing at Matt Pocock's skills.

A new pull request opens with the /pr sections: Summary (a diff sketch, file tree or pseudocode, no Mermaid), Evidence (before and after) and Merge Danger (one-way or two-way door, blast radius). The checks list below them is unchanged. The template says that a merge to main deploys to production and that migrations, RLS changes, secret or env changes and feature removals are one-way doors. Skills that name GLOSSARY.md read this repo's CONTEXT.md.

• Review checklist
• Pull request template
• Domain docs for agents

Sources: Matt Pocock skills, pstack skills.

Ponytail is no longer a copy of six skills under .agents/skills. The project's .claude/settings.json declares the upstream ponytail marketplace with auto-update and enables ponytail@ponytail, so Claude Code loads the always-on plugin once a contributor trusts the folder and follows upstream releases. AGENTS.md lists the upstream install commands for Codex, Cursor and other agents, and says when to switch to /poteto-mode instead.

The template ships no verification skill. The README's "Using this template" steps now tell a new app to run /create-verification-skill once its first features exist, then /maintain-verification-skill on the team's cadence, and where the generated verify-<app> skill belongs.

• Agent instructions
• Using this template

Sources: official plugin, verification skill step.