The "mess" part is the broken PHP. In C, where you can tell what happened, the behavior is all reasonable.

Unsure how to reproduce this.

I think this is reasonably well-covered between arc anoid and arc weld. Once T5055 comes online, third-parties can presumably fill in more titles for the arc game library.

These have existed for a while and recently got support for customizing sub-object behaviors in 2018 Week 50 (Mid December) and are being extended to Projects in 2019 Week 5, so it looks like they're here to stay.

Here's a script which can hit these behaviors without cloning 9000 working copies in a loop:

uhoh

State of the world on the instance changes:

See PHI1015 for a slightly meatier explanation of this issue.

~o.o~

PHP 7.3.1 is exiting abruptly for me (no error message, return code 0) on preg_match('(\\G\s+)sS', '');. This occurs in the daemons. I can't reproduce this in a separate test script. I have no idea what's going on.

Let's compile Gentoo nine times (Gentoo flavor is macOS Mojave 10.14.2):

PHI1010 could use more detailed triage around whether we can squeeze anything from transaction.search without hitting a bunch of other messes. This is adjacent to a lot of other work.

Success! D20046 worked to fix the "profiler not sticking across form posts" issue on secure. 🐈

Some guidance about "configure captchas if you're a public-facing, password-login install" would be good here too

D20049 introduces a piece of code which could be simplified if the minimum version was 5.4.0 or newer, so PHP_QUERY_RFC3986 is available for http_build_query().

@nochum, if you want to try replacing 'pygmentize ... with 'exec pygmentize ... near line 25 of PhutilPygmentsSyntaxHighlighter.php and that fixes it, I'll upstream it. exec will stop dash from leaving an sh -c process running.

PHI979 is a specific issue where we could use better instance controls (around worker count) in the short term. An alternative approach is to hard-coded if ($instance === 'X') { ... } for now. admin could also probably use more workers, I think we get saturated by backups occasionally.

Yeah, I think the issue is:

The "keep the profiler on across form submissions" code isn't working on secure.phabricator.com, even though it works locally and __profile__=page appears on the "Request" tab.

• PHI979 describes a case where we'd like to automatically increase the worker task limit based on instance size. admin should also get an increased limit.
• Now that MFA can be disabled completely, I want to disable MFA on admin (pretty much everyone adding it is adding it by accident) by deprecating the provider.
• T13178 is adjacent to a lot of this.

Continued in T13242.

After T13222, this is more relevant:

From T13222, MFA on related flows should generally be updated.

From T13222, this should also revisit MFA around Conduit tokens. In particular: