Invoice links keep working after a resend or reminder; a late-sent invoice is not chased the same hour
Every send and reminder minted a new view-online token and replaced the old one, so the link in the first email Harmony received read "no longer available" once...
Seat and add-on license changes mid-period, on a chosen date, prorated
SubscriptionChangeService records a change to a live subscription's seats and add-on licenses effective on any date from today. It previews the exact prorated c...
Track an invoice's pending online card payment
New nullable column **************** plus helpers to list and settle pending sessions idempotently (a payment carrying the same processor reference is never rec...
Negotiated add-on prices and a quote's discount carry into the subscription
Converting a quote now carries: - each add-on's agreed per-license price (when it differs from the catalog's) - the quote's or accepted option's discount, as a ...
Quotes convert into subscriptions; tenant orders never comp the seller
- A quote in a SUBSCRIPTION market, or whose accepted rows were filled from the subscription catalog, converts into a SubscriptionOrder (plan, seats from the ...
Turn renewal on or off for a live subscription; notes on any order
The console's auto-renew switch sent a field the draft-only order update did not have, so it never saved; and notes failed on any order past draft.
Approving a card order grants paid access too
AUTO_BILL orders waited for a Stripe checkout that subscription invoicing no longer uses; the ledger charges the saved card on each billing day instead.
Card auto-charge bookkeeping on subscription invoices
AUTO_BILL invoices are charged on their billing day once approved and retried every three days, up to four attempts. Each attempt is numbered before it is made ...
Subscription events store JSON states; billing steps run one row per transaction
**************** are jsonb, and every caller wrote a bare status like ACTIVE - an invalid JSON insert that rolled back whatever it was auditing (order activatio...
License-based add-on pricing and a real subscription invoice lifecycle
One rule for add-on quantity (AddOnLicenses): every add-on bills the licenses PURCHASED, like seats - per-user add-ons default to the seat count, storage to the...
Name the organization that owns a subscription catalog row
The catalog update/delete methods take a uid alone, so a caller holding the catalog right in any organization could edit another organization's plans, prices, a...
Standing permissions from an approval (Approve and always allow)
A member's own APPROVAL item may now name one tool (tool_name) and record the approval it came from, who granted it and when (item_origin APPROVAL). The resolve...
Index member_notifications by (source_type, source_id) for withdrawal across members (IoT close-out F15)
The withdraw-by-source read (findBySourceTypeAndSourceId) and the IoT alarm's withdraw-by-prefix (StartingWith -> LIKE 'x%') had only the member-led index, so b...
AiAutonomyModeTest pins CP07's RELEASE_PROPOSAL draft kind, and no @Immutable entity may carry a database-generated value
- **************** was red on main since KamoCollab CP07 Task 5 (8bd0f67c) appended **************** (spec D25, a disclosure_request's approval) without updat...
A dat's object key also asks the inbound MMS parts that hold it (SITP MMS)
VOIPService now keeps the pictures and files people text in (VOIP_MESSAGE_ATTACHMENT) through storeContentAddressed, with no Img row. storageExtension found a d...
GodPassesRightChecks — god eligibility alone counts only in the platform org (IoT R7 round 3)
Owner rule (2026-10-18): outside the platform organization god acts only through break-glass. **************** an open window always passes a tenant-right check...
Index loan_files.loan_transaction_id on LoanFile
The deal -> loans lookup **************** deal status, pipeline summary, and the retireIfEmpty check after an application is deleted) was a sequential scan. The...
GodWindows finds a member's open break-glass window among their sessions (IoT R7)
Pure (no stereotype, no Redis client): the caller reads ***UIDX<userId> and hands the sessions in. A window counts only in the member's own session (not imperso...
A god-mode window is open only until its stamped end (SessionPlatformFacts)
godModeActive() now also needs godModeExpiresAt (epoch millis, number or string) to be after now. SecurityService masks an elapsed window only for its own gates...
Clinical audit rows keep purpose/basis/patient; updated_at stamped on every save (SITP TP23FU)
PhiAccessRecorder stamped occurredAt by rebuilding each event from a field list written before the clinical columns existed, and no caller sets occurredAt, so e...
Deleting a mortgage application no longer 500s, and a received one is kept (SITP TP21FU)
DELETE **************** failed for every application: AppMortgageService.delete removed the borrowers through the JPA cascade while borrower_declarations / borr...
The command audit and the activity say when god acted, and under which break-glass window (R7)
Owner 2026-10-18 (IoT master section 10 R7): god, the platform owner, has total control of IoT devices, and every god action outside the platform org is audited...
The kamo-iot host label is devices, not iot
DomainAliasType.IOT keeps its internal name but now carries the customer-facing label "devices" (owner 2026-10-18: "iot" is a technical term; URLs say devices)....
PREPARE_COMMISSION_PAYOUTS (570), compose a draft payout batch without sending it (SITP TP18)
MANAGE_ORG_FINANCES composes and sends a commission payout batch, and an SI can never hold it (AiRightsFloor), so a finance SI could prepare nothing for a perso...
SITP TP02 rights — MANAGE_ANALYTICS (440), VIEW_ORG_BILLING (441), MANAGE_ORG_BILLING (442)
MANAGE_ANALYTICS: Analytics signed every caller in as one shared analytics administrator, so VIEW_ANALYTICS let anyone create, edit and delete every tracked web...
SITP TP01 rights for formerly session-only endpoints (410-418)
Nine rights in the TP01 block for endpoints that answered any signed-in member of the organization: - MANAGE_PRODUCTS, MANAGE_INVENTORY, MANAGE_RETAIL_CUSTOMER...
An SI never signs, prescribes, orders, immunizes, breaks the glass, merges charts or bulk-exports patients
SITP TP00, owner decision 2026-10-18: in Patient Records an SI drafts only (and may post payments behind approval). Nine EHR rights join AiRightsFloor.NEVER_GRA...
IotConnectionCheck is append-only without @Immutable (every link failed with a 500)
Hibernate 6.5 reads the database-generated checked_at back after the INSERT and then sets a lock mode on the entry; an immutable entry refuses it **************...
KAMO_SIMULATOR, the 22nd provider type (test-only; SP14)
Appended last; the client catalogue JSON keeps the 21 program types (@kamo/iot-core is unchanged).
IoT Sharing Access report, registry guards, fifteen seed reports
IotReportSupport (SI clamp, vendor retention, lookups) and IotAlarmReportMapping
ReportDefinition.exportRight — a per-report export right on top of EXPORT_REPORTS
SP13 service-job link entity, repository and six activity kinds
On-device vocabulary and iot_on_device_links entity (SP10)
The link entity keeps only the SHA-256 of the phone's link secret, and that hash is @JsonIgnore so it never reaches a response or an event.
OPERATE_DEVICE and OPERATE_SECURITY_DEVICE charter classes (SP11-D2)
IoT SP11 (master §6.14, §10 SP11-D2): physical actions through the Tool Plane's iot_ pack are charter-approved per class. AiActionClass appends OPERATE_DEVICE (...
Keep hook-token and share-token hashes out of JSON; the OAuth secret prefix is a label
**************** was red on main: **************** and previousHookTokenHash, **************** and previousHookTokenHash, and IotShare.tokenHash had no @JsonIgn...
Alexa link, virtual sensor and endpoint entities; IotCommand.voiceLinkId; ALEXA_* activity kinds (IoT SP09)
OAuth server entities, repositories, read-only token verifier and access-log event types (IoT SP09)
Token generation, PKCE S256 and scope parsing for the Kamo OAuth server (IoT SP09)
**************** and **************** (SP04 Tasks 21-22)
The column exists in production (SP04 DDL, default TRUE).
Iot.share_link and iot.share_code canonical templates, IotShareEmail
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.