Reform 2's single mutable form instance was the core design mistake

Nick Sutterer's main retrospective insight on Reform 2: having a single public form instance used for rendering, validation and persistence gave users too much freedom. People called validate multiple times and saw validity flip between calls, called save before or multiple times, overrode setters with context-dependent if/else code, and abused populators. Reform 3 fixes this at the API boundary by exposing only class methods that return immutable objects.