Live Change Log

**************** is the teeth behind the export service's refusal to re-issue. A second committed file for one pay period double-pays an entire company, and the...

Tables come from ddl-auto; this runner supplies only what Hibernate cannot -- the partial unique indexes on one open primary assignment and one open pay-rate wi...

TrainingSchemaMigration @Order(43) has been aborting EVERY KamoInitializer run, silently withholding all 29 runners ordered after it (orders 45-112). Observed i...

Found by running it. YugabyteDB performs online schema change, so a CREATE UNIQUE INDEX issued while Hibernate's ddl-auto pass is still settling can lose the ra...

Three runners: BillingGroupRosterMigration creates billing_pay_group_members — whom a group means to pay for, before it has bought anything. org_id is denormal...

Registers com.kamo.z.shared.hr.training in the explicit @EnableJpaRepositories list — @EntityScan is broad so the entities are found either way, but repositorie...

Creating it in a migration rather than leaving it to ddl-auto, which produced a half-built table when the entity was pointed at the pre-existing billing_groups.

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

past_due_since and suspension_notified_at, both nullable. Null means paying and not-yet-told respectively.

Finds the constraint by shape rather than by name — Hibernate generated it and the name is not stable across environments, so any unique constraint on account_m...

Order(0), nullable, no backfill — a null amount reads as "we do not know what this price was created with" and the reconciler treats it as unknown rather than a...

The add-on described an organization-wide shared pool and was then priced USAGE_BASED at $4 with "25 GB" stated only in prose. Nothing ever submitted a storage ...

SupportAssignmentStrategyType is @Enumerated(ORDINAL), so Hibernate emitted CHECK (assignment_strategy >= 0 AND assignment_strategy <= 2) on CREATE TABLE rather...

Hibernate cannot add this one itself: ddl-auto emits it NOT NULL, which CockroachDB refuses on a table that already has rows. So it is added nullable here, back...

Calendars and events were owned by an account and carried no organisation. This attaches each to its owner's earliest membership — the organisation the account ...

CockroachDB spells the text type STRING; PostgreSQL and YugabyteDB use TEXT. 25 casts across native queries were still emitting CAST(x AS STRING) and ::STRING, ...

EmailService now scopes every contact read to contact_books.owner_id, which leaves the contacts already sitting in an ownerless organisation-default book unreac...

img_dat_derivatives records, per stored file, the real byte size of everything Kamo generated from it. It replaces img_dats.THUMB_FILE_SIZE as the source for th...

object_storage_days records what a sweep reads back from MinIO for the two things that carry no size in the database: branding assets and the docs workspace. Bu...

**************** holds, per mailbox and per arrival day, the RFC822 bytes that mailbox is holding. Storage accounting had no honest source for mailbox bytes: th...

Mirrors OrgStorageSnapshot as explicit DDL, per the house style — ddl-auto creates the table first, so the CREATE is a fallback and the SET DEFAULTs are what ac...

The backfill only ever filled a plan row that was missing — deliberately, so it could not silently move a tier — which left apps that had never been priced wher...

Owning subscription plans was treated as proof of being an entitlement root. It is not: a customer org runs its own commerce markets and sells its own plans whi...

resolveAll() has no entry for a deprecated alias sharing an id with a live app, so looping ServiceType.values() and dereferencing the result would have thrown m...

CockroachDB refuses <timestamp(6)> < <varchar> rather than casting, so the app-config repair threw on its first statement every boot: 'unsupported comparison op...

**************** is @Enumerated(STRING) and holds RoleRightType names, so a default role granting mortgage stores "LOS_VIEW_PIPELINE". That is the third place t...

The repair matched on the string alone and ran on every boot, so it stopped being idempotent the moment anyone granted the personal-loan app: a row holding 'LOS...

provisionMaxedOutMasterModel force-enables every app for the platform org, and that breadth is deliberate — pre-launch dogfooding is what the model is for. But ...

ServiceType is persisted in two places and the 2026-08-08 rename only accounted for one. ORG_FEATURES.FEATURE_TYPE stores the numeric id, so keeping mortgage at...

Nine apps — POS, Marketing Tools, Calculator, Club, Inventory, Legal, Games and the two origination systems — had no catalog representation at all: no pricing r...

Gating MORTGAGE behind MLOS made the gate unsatisfiable for tenants: MLOS is still PLANNING, and FeatureController.enable refuses a non-COMPLETED app for a chil...

Two defects found by checking prod before flipping kamo.entitlement.fail-open. Sign Pink is a second entitlement root (isPlatformProduct, with its own FREE/BUS...

Entitlement now resolves on a typed service_type column, but no catalog row carried one, so every plan still resolved to 'everything included' via the fail-open...

DEPTS.MAILBOX_ID and ORGS.CONTACT_MAILBOX_ID, both plain UUID with no FK to email_provider.mailboxes: mailboxes sync from external providers and can be removed ...

Adds MANAGER_ID to member_team_member, a nullable self-reference for the reporting line. Nothing is backfilled: no manager is a complete answer, both at the top...

Nullable with no backfill -- null means top level, which is what every existing department was and most will stay. Declared plain UUID with an explicit DROP DE...

Mirrors com.kamo.z.shared.commission. ddl-auto would create these from the annotations anyway; the explicit DDL is the house convention and is what makes the sh...

ensure() caught Exception and logged, so a failed CREATE UNIQUE INDEX reported success and the service booted with no uniqueness guarantee at all — the one outc...

Adds com.kamo.z.shared.hr.legal to the repository scan list and ensures the uniqueness and lookup indexes the entity mapping cannot express safely.

The My Docs DocManager never passes an assocObjectId prop, so it always resolves and queries (3, ''). BACKFILL_EMPTY_SQL was scoping empty binders to (3, member...

CockroachDB rejects ADD COLUMN ... NOT NULL without a DEFAULT on a populated table, so Hibernate's ddl-auto attempt fails (logged, non-fatal) rather than no-opp...

Derives the scope from the first DOC item's Img; empty binders fall back to the owner's My Docs. Applies NOT NULL only after the backfill.

**************** never existed. EmailService's own V1__email_metadata_schema.sql declares it, but that migration never ran -- the table came from this service's...

Clears what the old company-address rule wrote before it read org_domains. Live production was purged by hand at the time (126 rows, 6 leads, one org); this exi...

Hibernate creates the three new tables from the shared-lib entities; this adds what it cannot express — the partial unique index that keeps at most one open con...

Creates **************** and org_meeting_oauth_tokens, adds the provider-identity columns to MEETING_RECORDS and MEETING_RECORDINGS and the Zoom/Teams-capable s...

PRIMARY_AGENT_MEMBER_ID is who holds the opportunity now; REQUESTED_BY_MEMBER_ID is left untouched forever. Nullable with no backfill on purpose — null means "n...

Six nullable columns: the overall commission agreed on a reserved opportunity, and the market default that pre-fills it at approval. NUMERIC(19,4) to match the ...

The lead holds the client's name, address and phone; snapshotting them on the quote duplicated a record edited elsewhere. The columns existed only briefly and c...