{debug $order} writes the value where the tag stands, as a <details> box with its type and size in the summary - array(3), string(12), int - and nested arrays as a tree you can fold open. Unlike {dump} the request goes on: the rest of the page renders as usual, so several {debug} tags can follow a value through a loop.

The items are read raw, the way {attrs} reads them. A plain $name is looked up as a field or a page array, and when it does not exist the box says missing instead of ending the request under the strict syntax check. Any other item - $price * 2, count@items - is evaluated as an expression, and total=$price * 2 puts the label total on the box. Values whose name looks like a credential (passwords, tokens, keys) show redacted, as in the debug toolbar.

{debug} without items shows two boxes: fields here - the rows of the enclosing levels, innermost first - and application variables, every global that is not the engine's own.

Only a local request gets anything: the command line, or a loopback request with nothing forwarded. Every other visitor gets an empty string, and $padDiagnostics = FALSE switches it off for every web request. A page or a {cache} section holding a debug box is never stored in the page or fragment cache, so no later visitor is served what a local request was shown.