GUNNIE DEVLOG
Notes from real Magento work: bugs that took too long to find, decisions we would make differently, and things the documentation does not tell you. Written for developers, not for search engines, though we will not complain if one finds it.
CVE-2026-75650 is fixed, but Adobe’s own remediation list runs to fourteen steps and eight of them are credential rotations. The patch is the easy half.
The first shop confirmed backdoored by StyleSmuggler was fully patched. The check to run today, a Cloudflare rule that stops the scanning, and the application guard that actually holds.
Making a shop readable to AI assistants is about a day of work. Keeping it readable is the actual job, and the defaults are quietly working against you.
Report-only is a measuring tool, not a control. If nobody reads the reports it is a header that does nothing, and switching it on later is where the real work starts.
Nobody hands you the full bill in one place. Licence, hosting, extensions, integrations and the maintenance nobody budgets for, and which of them is usually the biggest.
Cloudflare rewrites robots.txt at the edge and blocks AI crawlers by default. None of it lives in your repository, so reading the file in git tells you nothing.
A customer ordering the same forty products every month is not shopping. Most B2B storefronts are built for discovery, which is the one thing that buyer never needs.
I put a number on Adobe Commerce licensing in public. Two people who deal with those contracts weekly told me it was too high. Here is the better answer, and why the range is so wide.
CI died on a package nobody had heard of. npm had quietly removed every platform variant except the one my Mac needed, and the fix everybody documents makes it worse.
When product data lives in a PIM, an ERP, the shop and a spreadsheet, you do not have a catalogue. You have four opinions, and the import quietly picks a winner.
A checkout that loses an order does not usually throw an error. It succeeds, returns 200, and quietly writes the wrong thing. Two ways I have watched that happen.
Two different ways a product import reports complete success while doing none of the work, and neither of them shows up in the exit code or the job table.
Slow carts, 503s, 524s, and not one error in any log. The integration client was configured to wait forever, and nothing else in the stack was willing to stop it.
A request to hide a product on one of several websites turned out to be unstorable. status and visibility had been changed to global scope, and the import deletes store-scoped values anyway.
Nearly two thousand attributes had the literal admin label "Unknown". The real labels existed the whole time, one table over, and fixing it in the database would have lasted until the next import.
The constraint says ON DELETE CASCADE. Removing nine attributes still left nearly a million orphaned rows, because setup:upgrade turns foreign key checks off.
Two API calls fired in parallel, each writing a different field on the same cart. One field kept coming back empty, and the cause is in how Magento builds its UPDATE.
A module documented a ten minute price cache. It was really running at twenty four hours, and nothing invalidated it when prices changed.
