The README and docs/ARCHITECTURE.md still named /langs/tala; they now name
/langs/c, /langs/cpp and /langs/objc and where /langs leads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Tala and its tools are no longer developed as of 2026-11-10; Progmasoft
puts its work into Tazel, a build system for C, C++, Objective-C,
Objective-C++ and Zig. ViGet follows:

- /langs/tala is removed. /langs/c, /langs/cpp and /langs/objc are the
  language catalogs (Objective-C++ packages belong to /langs/objc), served
  by one page, app/viget/langs/[language], which knows only these three;
  any other language is 404. /langs leads to the language list on the
  ViGet home page.
- lib/viget-catalogs.ts: three open language catalogs with their own
  title, description and empty state in en-US, de-DE, ru-RU and he-IL; the
  Tazel catalog describes Tazel as the build system for C, C++,
  Objective-C, Objective-C++ and Zig.
- The ViGet home, header, footer and metadata name C, C++ and Objective-C;
  "Explore Tala" becomes "Explore Tazel" (tazel.net), and the footer links
  Tazel instead of Tala. The sitemap lists the three catalogs.
- Tests: the catalogs, their texts in every language, no text naming Tala,
  and the proxy routes.

pnpm test (37), lint, check and build pass; next start answers /langs/c,
/langs/cpp and /langs/objc with their pages, /langs/tala and /langs/zig
with 404, and /langs with 308 to the language list.

Rate-limit sign-in by visitor behind Cloudflare and stop forwarding h2c

Remove Xide and ides.progmasoft.com

Cloudflare proxies the Progmasoft hosts, so Nginx saw a Cloudflare edge as
its peer and appended that edge to X-Forwarded-For. The API takes the last
hop as the client, so the account-auth limit (12 attempts in 3 minutes) was
counted per edge: 38 failed sign-ins from one address in a row were all
answered with 401, none with 429, and unrelated visitors behind one edge
shared a bucket.

- ops/nginx/cloudflare-real-ip.conf trusts CF-Connecting-IP only from the
  published Cloudflare ranges; a direct peer keeps its own address, so the
  header cannot be forged around Cloudflare. With it installed the 13th
  failed sign-in gets 429, a forged X-Forwarded-For changes nothing, and
  another address is not affected.
- Every proxied location forwarded the client's Upgrade header with
  "Connection: upgrade" on each request. Only a WebSocket upgrade is now
  forwarded; other requests carry no Upgrade and an empty Connection.
- c8 reached glob 13 (GHSA-3g3m-2fjr-6pw4) and minimatch 10
  (GHSA-g3hv-75wg-m249) through test-exclude; both are overridden to the
  fixed majors. pnpm audit reports nothing, coverage, lint and check pass.
- The CodeQL action pins carry their exact version comment (v4.38.2).
- ops/README.md describes the address handling and no longer names a
  script that left the repository with AI Support.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Xide is no longer developed as of 2026-11-08 (Progmasoft/xide#29), so
Progmaweb stops presenting it:

- product.progmasoft.com: Xide leaves the catalog, its card and its
  detail page; /xide on the product host is a 404 like any unknown
  product. The catalog's description in every language names the Tala
  language with its tools and Catch3.
- ides.progmasoft.com served only the IDE list and the Xide page, so the
  whole site goes: the pages under app/ides, its texts in every
  language, idesRoute and its host in the proxy, and both nginx server
  blocks. The certificate of progmasoft.com no longer has to name it.

Tests: the catalog lists the remaining products and refuses xide.

Ask for the Privacy and Security Policies at registration

AI Support is removed and will not be published (progmaweb#59 is
closed): it used every core of the second server for each answer, and
it stated commands and names that are not in the documentation. The
policy in every language no longer lists it among the services it
covers, and the paragraph about where its questions go is gone.