The Dynamo part of it, the pure application server part, had a few genuinely decent features. I've never seen a dependency injection framework like Nucleus, despite the fact that it makes an awful lot of sense. And you got /dyn/admin!
The whole publishing thing - derive a versioned dual of your database schema, edit data in it using a reflective CMS, then automatically publish changes to your production database - is kind of amazing. Source control for databases. I haven't seen anything else like that. Apart from just putting databases in source control, i guess. It occasionally got absolutely screwed up, but the idea was cool!
But a lot of it was absolute garbage. Repositories, where database entities are mapped to these crappy dictionary things that you need to either wrap or go mad trying to customise to actually use. Form handlers, whole classes for what would be a single handler method in a modern framework. The wacky build and packaging stuff.
And then whole commerce layer of it. Pipelines where the majority of the steps are about doing cleanup and normalisation that's only necessary because of how weak ATG's data model is, and the real commerce value could have been a single 20-line function, and adding your own stages becomes and exercise in boilerplate-smithing. Catalogue maintenance, which you have to run sometimes, because apparently it's too hard to just keep the database consistent. Scenarios, the businessperson-usable customisation tool that isn't, in practice, usable by businesspeople!
However, publishing has always been a dumpster fire for me, from the very first time I've used it (around 2004-2005 IIRC) to 2015 when I stopped working with ATG. Deploying changes never worked reliably, full deployments could take days, if not weeks, and relying on RMI made for a very fragile system anywhere multiple network interfaces were involved.
Nucleus and /dyn/admin are incredible features, not only for development but for having near total control of your application in production. I can't count how many production incidents I've solved with curl and /dyn/admin alone.
Fun fact: Java (Apache) Struts 2 [2] is a vulnerability mess. It was used by Equifax on the breach:
> Struts 2 has a history of critical security bugs, many tied to its use of OGNL technology; some vulnerabilities can lead to arbitrary code execution. In October 2017, it was reported that failure by Equifax to address a Struts 2 vulnerability advised in March 2017 was later exploited in the data breach that was disclosed by Equifax in September 2017. [2]
They probably went with Java EE because it was "secure", little did they know Struts would enter the game. Equifax I am sure treats their developers good by how often their software was updated /s.