- Shipped
- September 5, 2026 at 5:34 PM UTC
- Author
- Kamo
- Commit
- b057dab
The public mortgage application page composed its legal footer out of nothing — a hardcoded California licence, an invented NMLS number, a fictional address — and served it under every tenant's logo. There was no data source that could have made it true. This is that source, plus the two policy addresses the same footer needs and had nowhere to read. **Organization** gains `privacyPolicyUrl`, `termsOfServiceUrl` and `appsLogoOverlay`, all nullable and all in `patchOrganization`'s allow-list — which is not optional: a column that method does not name is accepted with a 200 and silently never stored, and the only symptom is a setting that reverts on its next load. **`OrgStateLicense`** is the company's own licence-by-state registry. Distinct from `mlos.legal.StewardLicense`, which is per-MEMBER and answers "may this officer work this file" — no officer's licence stands in for the company's. The entity, its repository (in `dao.repos`, which every service already scans; a new package fails context startup in every service that has not added it) and `LenderDisclosureProfile`, which reduces an organization plus its active licences to the sentences a footer prints. Its governing rule: a missing value produces NO LINE, never a plausible-looking default. An empty footer is a gap somebody can fill; a fabricated one is not detectable. **`WebAddresses.normalize`** turns `www.example.com/privacy.html` into an absolute URL, and refuses `javascript:`/`data:`. The value lands in an `href` on unauthenticated pages, where a scheme-less host resolves as a RELATIVE path — present, styled, clickable, and 404 for every visitor. **`LOAN_APPLICATION_RECEIVED`** is the borrower's receipt, white-labelled from the same disclosure profile as the page, so the two cannot drift — nobody reads their own confirmation email, so a licence removed from the website would otherwise keep going out by post for months. Its blocks are pre-rendered in `LoanApplicationReceivedEmail` because the renderer has no conditionals, and the send key is the DOTTED **************** not the CANONICAL_KEYS constant — the split that shipped QUOTE_SENT undeliverable. 18 new tests, including one asserting that an organization which entered no licence states no licence.