From February through May 2026, I focused on Tenrankai’s tests, memory use, caching and permissions. These changes make the server easier to keep running.
Frontend tests. A frontend testing framework landed (Vitest + MSW with shared fixtures), joining the ~235 Rust tests, so the React viewer and the API stop breaking each other silently.
Bounded memory use. Batch image generation gained semaphores limiting concurrent processing — pregenerating thousands of AVIF files no longer eats all the memory — and cache invalidation became recursive, size-filterable, and actually correct about which files it matches.
Caching and navigation fixes. Proper cache-validation headers, a check that prevents the server from serving
half-generated previews, browser
back/forward navigation fixed in the SPA, and sequential display numbering
that finally matches the sort order. Speaking of which: per-folder image
sort order became configurable in _folder.md.
Security got recurring attention. Multiple cargo-audit passes, dependency updates for RUSTSEC advisories, and one real permissions fix — the default viewer role lost its download-original permission, correcting an overly broad default permission.
And some features snuck in anyway: grid display modes (variable columns,
square grid), a stateless URL shortener with type-prefixed shortcodes (no
database, naturally — the code is the reference), a DynamoDB backend for
config storage for cloud deployments, a hosted_mode flag that hides
infrastructure settings from managed users, and automatic per-site
sitemap.xml generation.
The series so far: Part 1 (the ten-day birth), Part 2 (the January push). Source at github.com/theatrus/tenrankai.