Invoice links keep working after a resend or reminder; a late-sent invoice is not chased the same hour
Every send and reminder minted a new view-online token and replaced the old one, so the link in the first email Harmony received read "no longer available" once...
Invoice checkout sessions are unkeyed, like every checkout Session
A stable idempotency key would hand a returning customer the same, possibly expired, payment page ****************
Cap only add-ons the organization holds
An add-on it does not hold is left to the existing entitlement gates, as before caps existed - paying organizations running a phone server without the add-on co...
The owners' invoice link opens on the workspace host the org can actually reach
Built internal.<domain> by hand, which OrgDomainRuleGuardTest forbids: an org whose own domain is not finished would get a link to a host that answers nothing. ...
Approving a card order grants paid access too
AUTO_BILL orders waited for a Stripe checkout that subscription invoicing no longer uses; the ledger charges the saved card on each billing day instead.
The billing job takes each subscription and invoice in its own transaction
Its first run raised Harmony's October invoice and lost it when one audit insert failed, because the whole prepare step was one transaction.
Subscription events store JSON states; billing steps run one row per transaction
**************** are jsonb, and every caller wrote a bare status like ACTIVE - an invalid JSON insert that rolled back whatever it was auditing (order activatio...
The POS proxy passes a PDF or an empty reply through instead of failing it as JSON
The invoice PDF and any 204 went through response.json() and became a 500.
Stripe bills add-on licenses held, not mailboxes or extensions in use
Every add-on now takes its quantity from AddOnLicenses, the rule the order calculator and subscription invoices share: licenses bought, defaulting to the seat c...
Read subscription invoices, events and agreements under the keys the server sends
The server answers invoices/invoice, events and agreements/agreement; posApi read subscriptionInvoices, subscriptionEvents and subscriptionAgreements, so the In...
Catalog edits reach only the caller's organization; own-order callers cannot comp or price themselves
Every update and delete of a subscription plan, price, feature, add-on, bundle, volume discount, promotion or agreement template now checks that the row belongs...
Name the organization that owns a subscription catalog row
The catalog update/delete methods take a uid alone, so a caller holding the catalog right in any organization could edit another organization's plans, prices, a...
A missing locale file renders English instead of throwing
i18n/request.ts and message-locales.ts imported messages/<locale>.json bare, so a build made while the dictionary had no file for a locale turned that locale's ...
Read Stripe events from any API version, and replay the ones that failed
The live webhook endpoint renders events at 2026-03-25.dahlia; stripe-java pins 2024-12-18.acacia, so every invoice, payment and subscription event since has fa...
Write Romanian with comma-below s and t
The model mixes the legacy cedilla forms into Romanian (6 of 90 such letters in the chat widget's regenerated file) and the dictionary's earlier Romanian did to...
One pod translates an article, not every pod at once
The sweep's fleet-wide lock is held only while it queues work, which takes milliseconds, so each pod ran its own sweep a minute or two apart and queued the same...
Never send an engine a text longer than it takes
IndicTrans answers a request over 20,000 characters with a permanent HTTP 413, so a long help article could never be translated into Tamil; a LibreTranslate wor...
Translate an article's words, not its Lexical JSON
contentJson was sent to the translation engines as if it were a sentence. On 2026-10-22 one sentence of it came back from Russian with the sentence gone and the...
Memory limit 14Gi -> 20Gi, request 10Gi -> 12Gi
Seven-day peak working set was 13.8 and 13.1 GiB against the 14Gi limit, so the kernel reclaimed the mmapped argos models and en->ru on a help article paid cold...
Creating a MORTGAGE market gives the organization its lender profile at once
A MORTGAGE market's lender profile (and its five config rows) was only created by the boot-time self-heal, so a market created while SecurityService was running...
Open deals are always expanded, the loan officer shows their photo, and the loan count reads one way
- Open view: every deal shows its loans, with no expand/collapse control. Past and All stay collapsed by default and expandable. - The loan officer avatar was...
Back from a loan returns to the screen it was opened from, and a loan always shows its full number
- The loan page's Back was hard-coded to /commerce, which opens the first market's home. Every opener (Pipeline, Board, document queue, applications tab) now ...
A tool menu stays selected on any of its pages and the pages beneath them
The last change lit a tool menu (Mail, Docs, Support, IoT, Settings, Cameras) only when a row's href was exactly the page open, and most rows carried no href at...
Numbers and addresses open their popups, unseen records in plain words, plain labels, rights cases
Approval follow-up 2026-10-21 (controller review of the approvals pane). - The headline draws every phone number and email address the card names (card.conta...
Declare every right a tool's service enforces; plain words for unseen records and numbers
Approval follow-up 2026-10-21 (controller review of the approvals UI). Rights (item 4): an audit of every tool's declared rights against the rights its downstr...
A charter item's tool is behavior; its grant provenance is not
CharterItem gained toolName and the standing-permission provenance (53e6e2cd6), so the compile-time check that every field is listed failed the build. toolName ...
An approval card sends every parameter its phrase names
next-intl refuses an ICU select or plural with no value, so a phrase about an argument the SI left out (a contact with no formatted name, a new document categor...
An approval about a record the reader may not see never leaves a dangling 'for'
Phrases that named a patient, a customer, a purchaser, an envelope or a document after a preposition now say 'for a patient' (or nothing) when the reader may no...
Desktop alerts go by e-mail only; the MediaService chat leg is gone
Owner, 2026-10-20 (IoT close-out F12): no chat sender. A chat thread needs a sender member besides the recipient and the platform organization has none by desig...
Approval cards say SI in every label, write phone numbers and choices as people do, and keep a note beside an action a field
A humanised field name said 'Ai companion…' (now SI, with a guard that no phrase, label, noun or risk sentence says AI); a US number reads (512) 555-0142 in the...
A carrier-only organization can hold text threads again (SITP CARRIERSMS)
VOIP_CONVERSATIONS.INSTANCE_ID was NOT NULL in production, although the entity and **************** both say an org that texts through a carrier and runs no pho...
Stop forcing a phone server onto every text conversation (SITP CARRIERSMS)
MultiInstancePhoneMigration runs on every KamoInitializer start. Its conversation step deleted each voip_conversations row without an instance (and that thread'...
Vendor sign-ins ask their settings, Sign in again keeps them, and the SP14 audit's web findings
- Link wizard: a vendor sign-in (SolarEdge app site IDs, Tuya region) asks the provider's declared settings before the vendor opens; a refusal to start reads ...
An MMS part is stored in one transaction of its own (SITP MMS)
Live check in sp00verify: the picture was fetched and its object written, then the dat's final 'published' save failed (JpaSystemException) because the backgrou...
Brand and state colours read at AA in both themes; grid header strips are not scroll regions; AgentSelector chips are not inside a button
- StateChip/Kicker (patients, knowledge base, attendance, chat policies): the ink is the tone's own hue with its OKLCH lightness capped (light) or floored (da...
The MMS part claim names its states as parameters, so Hibernate 6.2 can read it at boot (SITP MMS)
8eda899's deploy never rolled: Spring Data validates every @Query at startup and Hibernate 6.2 cannot interpret a nested enum's FQN literal **************** so ...
Restrict from Disabled says what it does; site modes article states the previous-mode return (IoT close-out F10, F9e)
- The platform connector dialog's Restrict confirmation, on a DISABLED connector (now offered for every provider with platform setup after a fresh test, iot-s...
KamoCameras in the entitlement catalog, on the platform's own plan only (totality test green)
KamoCameras (ServiceType 39, shipped 2026-10-13, TESTING) shipped without an AppEntitlementCatalogMigration entry, so **************** two totality checks have ...
The alert chat leg resolves its people per organization; an IoT alarm update is quiet on iOS
F12 (IoT close-out, SP14 routing): AlertChatService defaulted to organization 1 and the aliases "sage" / "kamo-monitor", which name nobody in production, so eve...
A dat's object key also asks the inbound MMS parts that hold it (SITP MMS)
VOIPService now keeps the pictures and files people text in (VOIP_MESSAGE_ATTACHMENT) through storeContentAddressed, with no Img row. storageExtension found a d...
God eligibility alone passes CONFIGURE_SYSTEM only in the platform org; elsewhere only an open window (IoT R7 round 3)
**************** let GD (eligibility, no window) pass every tenant right in every org, so the System User held CONFIGURE_SYSTEM (organization sounds) in every t...
God eligibility alone passes a right only in the platform org; elsewhere only an open window (IoT R7 round 3)
AuthHelper.hasRight / requireRight let GD (god ELIGIBILITY, no window at all) pass EVERY tenant right in every org (24 controllers: reports, social media, acces...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
Seventeen VOIPService gates (CallController, the VoIP admin controllers, the SMS inventory and bulk-text controllers, DoNotContactController, RecordingAccessSer...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
ViewerPlatformFacts (the ENTER AS SYSTEM USER verdict on support tickets) read GD && godModeActive itself. SecurityService masks an elapsed 30-minute break-glas...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
**************** read GD && godModeActive itself. SecurityService masks an elapsed 30-minute break-glass window only for its own gates, so this service, reading...
GodModeVerifier judges the god-mode window at its own clock (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). windowOpen(session, memberId, now) asked the shared reader at the system clo...
AiCaller judges the god-mode window at its own clock (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). AiCaller.fromSession(session, now) asked the shared reader at the system clo...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.