Fieldnotes: projects & tasks

The starter is a complete application, not a sketch: sign-in with sessions and CSRF, a project and task workspace, search, and pagination — all rendered on the server. Plain HTML forms work without JavaScript; HTMX upgrades the swap points.

What to steal

• Forms that degrade: the same submission works with and without HTMX.
• Queries scoped by the authenticated identity, never by a client-supplied owner.
• Honest status codes: a database outage is 503, not a fake sign-out.
• Business errors are generic; validation errors point at their fields.