- Shipped
- September 23, 2026 at 11:55 AM UTC
- Author
- Kamo
- Commit
- b1d7aef
addLine/updateLine relayed memberId (normalized to Long in 789c544) but never who was making the call — unlike openDraft, send, voidLine and every Stripe-config endpoint here, which already stamp actorMemberId from the session via actorPayload. CommissionProcessorService's self-crediting refusal (the paired commission-service fix) depends entirely on that value actually arriving with the line, so its absence here would have made the refusal a no-op regardless of what commission- service checked. Both endpoints now merge actorPayload(req) into the relayed body the same way their neighbours do; a client sending its own actorMemberId in the body is overwritten by the session's, as actorPayload's own javadoc already promises.