The General tab counts what the Organizations tab calls Active
6c8d789 moved the platform overview's organization count onto findAllLive(), which also drops orgs created by synthetic (is_fake) accounts — so the General tab ...
Binders and Uploads read as live buttons in the org's brand
The two tabs looked disabled because they were: a MUI Tab with no <Tabs> parent defaults to textColor="inherit", which draws the whole tab at 60% opacity unless...
Order sitemap <url> children as the schema does, and give each chunk one address
The sitemap XSD is a sequence: loc, lastmod, changefreq, priority, then extension elements. The hreflang links were written straight after <loc>, which Google t...
Count the files a document keeps only as old versions
A category that keeps versions holds every earlier file of a document in img_versions, each on its own content-addressed file. The storage meter, the quota and ...
Sharing a document works again, as someone who can read it
The share dialog sends a document id as a string — an img id is an int64 past 2^53, which a JSON number would round — and createShare cast it to Number. Every s...
The rim's lead current stays white-hot all the way round
Its gradient was pinned to the hexagon's box rather than travelling with the arc, so for a third of every lap the current was gold on the gold rim and simply va...
A window's scrollbars no longer show through the window on top of it
Maximizing a tool window left a column of scrollbar buttons from the window behind it floating in the middle of the pane, and two overlapping floating windows s...
MUI text is set in Geist, not Helvetica and Arial
I18nProviders handed the Geist font to createTheme as an overlay, and overlays are merged in after the theme is built. By then MUI has already written its Robot...
Every Chats sub-tab fits, with the same gap between each
The Interaction Center's Chats strip gave its seven tabs seven equal shares of the 550px pane, 78px each whatever they said. "Team Members" needs 91px, so it wa...
Drop the remaining third-party plan and cost wording
- zoho-mail, ecwid: the FAQ answering which of the vendor's plans, free or paid, the integration needs is removed. Both items take i18nKey "<slug>-r2" so no...
Quote and borrower-portal links only name a live domain
QuoteEmailClient settled for any active domain, verified or not, so an org still setting up its white-label domain had quote links mailed to sign.<that domain>....
Chat and bug emails link to the console the recipient can reach
ChatEmailNoticeService named the recipient org's first domain whatever its state. The reported case: Exec2Exec letters to makeitpopsigns.com, sent before its DN...
Template logos come from a live theme host
resolveLogoUrls built the logo URL from the org's first domain whatever its state, so an org still setting up its domain got a logo URL that could not be fetche...
Signing and document-manager links only name a live domain
**************** settled for any active root domain, so an org still setting up its domain had signing links mailed to sign.<that domain>, which answered nothin...
Legal, training and careers emails link only to live hosts
- Legal: the org's console (OrgLinkHosts.internalOrigin) and the member page's Legal & Compliance tab. It linked the bare apex, which serves the marketing s...
Link the steward to the console the org can reach
StewardRecipientResolver built the steward link from the org's first domain row whatever its state, so an org still setting up its white-label domain was mailed...
An organization's own domain is named in a link only once it is live
OrgLinkHosts is the one rule for the host a link to an organization may name: its own root domain once it is active, ownership-verified and SSL-confirmed ******...
An organization's .svg names show its own art, not the platform's
A new organization's folder is seeded from the base theme, so it starts out with KamoCRM's art under img/logo-full.svg and favicon/favicon.svg. An organization ...
Quote only our own price, never another company's
The comparison pages set each competitor's list prices, add-on prices, "a typical team pays" estimates, TCO and implementation figures, and "N% cheaper" verdict...
Strip identity headers on myloan.*/api/ before the portal BFF relays them
KamoMLOS's BFF routes under /api/ (the /api/proxy/* passthrough, /api/session/extend, /api/chat/routing, /api/chat/subject-state) copy every client header excep...
Rerun a webhook event whose first attempt died, and refuse one the SDK cannot read
A losing claim on an unprocessed row always answered 500, so an event whose first attempt failed (a unique-constraint race inside the invoice.created/finalized/...
Only a failed charge starts dunning, and Stripe must agree before dunning acts
invoice.finalized carries status=open with an amount due for every auto-charged invoice before the charge is attempted, and the invoice handler started the deli...
Never forward client-supplied identity headers upstream
forward(), forwardWebhook() and forwardCallback() copied every inbound header except Host (and, for the sessionless two, the credential headers) onto the upstre...
Delete identity headers at the edge before header-trusting backends
Add a strip-identity-headers Middleware. A customRequestHeaders value of "" deletes the header, so X-Org-Id, X-Member-Id, X-User-Id, X-God-Mode-Active, X-Member...
Stop a revoked executive's window; raise only chats waiting on the desk
- A MEMBER_REMOVED naming the viewer unsubscribes the transcript, empties it, disables the composer and says why. Revoking Exec2Exec Access used to leave th...
Draw the search icon down from the full-size mark instead of doubling the small one
The 192px icon Google lists was the 96px export with every pixel doubled. It is now downscaled from the 820px master, so its edges are drawn rather than stepped...
Give Google a canonical it can read, and stop redirects outvoting it
Search Console began excluding pages as "Duplicate without user-selected canonical", "Duplicate, Google chose different canonical than user" and "Alternate page...
Publish prices search engines accept, and the ones the page actually shows
Search Console's product snippet report flagged "Invalid price format" on both `price` and `priceSpecification.price`. The cause was Enterprise going out as "pr...
Raise the conversation when a customer writes, and on a reply
An executive's message reached nobody at KamoCRM: nothing on the console read an Exec2Exec frame. Exec2ExecDeskOpener now raises that customer's window — named,...
A customer's message reaches the desk, not only the thread
An executive wrote into their Exec2Exec chat and nobody at KamoCRM heard. announce() told the session's own members, and an operator is only a member of a conve...
An announce that throws must not roll back the buy-in
`announceToConversation` runs INSIDE the transaction that seats the host and charges them — unlike `announceTable`, which the controller calls after the fact. T...
The nudge the inviter could never send, and a chat invite that rejoins
**Nudge.** The rail hid the button unless it was the opponent's turn, which reads as a rule about fairness and is a rule about nothing — the server has never ha...
One "on" colour, and a retry that does not cascade
Two things left over from the categories table. The allow swatch was tinted by whether the setting is locked — primary for locked, a green for unlocked. The lo...
Colleagues in the invite list, and an invitation from a chat that arrives
Two reported defects, both in who a table can reach. **The invite dialog offered accounts.** `invitableFor` read `members.findByOrganizationId`, and an organiz...
Publish the packages from CI, with a token that can actually publish
The secret exists now — a Forgejo token scoped to `write:package`, added to this repository — so `publish_packages` does the publishing instead of a person doin...
The certificate must not claim a disclosure nobody was shown
Verified against a real completed envelope on the cluster, and the closing paragraph read "Each signer was shown, and accepted, the consumer disclosure required...
Stop asserting an eIDAS assurance tier this product does not implement
`buildSession` reported `stepUpRequired ? "AES" : "SES"`, so requiring a one-time passcode made every signing session assert an ADVANCED electronic signature — ...
Publish the packages from a job of their own, and never nest a second pdf.js
The publish steps sat inside `build`, so run 12014 failed and took the image with it — and `pnpm install --frozen-lockfile` was clean locally, which is the tell...
The envelope dashboard could not tell "not emailed" from "not opened"
The warning naming an undelivered invitation lives in the send response, so it is gone the moment the dialog closes. After that the dashboard is all there is — ...
A rename answered with no Url skips Docs's rename callback
Docs shares one client-side callback between RenameFile and Save As, and **************** skips its whole body — the File_Rename event the embedding page listen...
Losing the race to store identical content is not a failed save
The look-up before the ImgDat insert is not a lock, and kamowsdocs runs two replicas behind one gateway — two documents whose bytes are identical (two members c...
Every e-signature email was a silent 403, and a Signature Date field
**No e-sign email had been leaving the cluster.** EmailService gates /api/email/templates/send on the cluster-wide internal-auth secret (mlos-internal-auth -> I...
A Save As that changes format is not the source document's type
uploadDocument refuses an upload whose claimed MIME type disagrees with what it detects from the bytes, and saveAsNewDocument claimed the type of the row it was...
A Docs save could not store bytes the platform already held
Saving a document twice, and renaming one, both ended in "Document cannot be saved, please check your permissions" — and after five retries Docs gave up and dis...
The offer countdown could not hydrate, so React threw the banner away on every load
The homepage has been throwing React #418 — "the server rendered text didn't match the client" — on every load, in production as well as locally. The mismatch i...
An org without the app must not accrue achievements either
The award gate asked for VIEW_ACHIEVEMENTS and stopped there. Rights are not entitlement-filtered, so that right stays granted — and keeps answering true — in a...
The particles ran at the monitor's speed, and the chips were unreadable on two denominations
Two deferred things finished, both measured rather than eyeballed. THE PARTICLE LOOP IS TIME-STEPPED. `PixelParticles` advanced physics once per FRAME — every ...
Four things about the celebration only a browser could say
Measured in Chrome against the real component, not reasoned about. The headline was sized at a flat 13cqw, which is right for a number and wrong for a word: CH...
Refuse to award a member whose security type excludes it
AchievementController checks VIEW_ACHIEVEMENTS on all four of its endpoints, and that read like the rule being enforced. It was not: it is the rule enforced on ...
Rank only members whose security type includes achievements
The leaderboard grouped every member holding an achievement row, so a member whose role denies VIEW_ACHIEVEMENTS — who cannot open the page, the trophy or the w...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.