- Shipped
- October 18, 2026 at 8:02 PM UTC
- Author
- Kamo
- Commit
- bfeb18b
- POST /api/los/offers: the product must be the caller's organization's and the borrower a member of it (or of a child organization); a body naming another tenant's product or member used to draft an offer on it, which a send would then screen and disclose. Both refusals are 404s. - GET /api/los/reports/aging: the delinquency buckets walked every tenant's DELINQUENT loans (a global paged scan); they now count this organization's only. - A draw, a pay-now and an autopay enable/pause/cancel entered by someone other than the loan's borrower (staff, or an SI on the tool plane) are audited as ORG_USER with that member as actor; they were all recorded as the borrower's own act.