The screens the backend was missing
An audit of every EHR endpoint against its frontend callers turned up surfaces that shipped server-side and could not be reached from the app at all. HEALTHCAR...
Stop the tracking-link strip clipping its own text
Marketing Tools -> Tracking Codes drew the member's link strip with the eyebrow cut through its capitals, the icon sliced top and bottom, and the line under it ...
Correct SW3's ServiceJob imports and pin the PROCUREMENT trap
Task 2 imported dao.beans.account.Account and dao.beans.organization .Organization. The real packages are accounts and orgs — it would not have compiled. Task ...
Fill ServiceLineItem and its four classification axes
ServiceLineItem shipped as an empty 18-line subclass whose only reference in the whole corpus was its own declaration, so a service sold through POS persisted a...
Give the text-conversations coder a tiebreaker so tied timestamps aren't dropped
lastActivityAt, so a conversation sharing that exact timestamp was excluded from the lost from the list permanently, not just misordered. Reachable in practice ...
Correct the SW3 plan's policy-template claim
Task 6 pointed at RetailInventoryPolicy as the implemented member of the policy family to copy an injection shape from. It is never instantiated and never injec...
Quality and Records office
Two sections for surfaces that had none. QUALITY. The rate is the headline; the care gap is the product. A practice shown "67% controlled" can do nothing with ...
Plan SW3, the Service Work domain core
ServiceJob 1..N ServiceVisit as a sibling of FulfillmentOrder, a filled ServiceLineItem, the four classification axes, and a status machine that throws instead ...
The patient portal — sign-in, records, and proxy access
The §164.524 right of access, made real: a patient signs in and reads their own problems, medications, allergies, immunisations and appointments, and can downlo...
The patient portal's identity model
A patient is NOT a Member, and this is deliberately not the workforce identity. Reusing the staff login would mean a patient held a principal that every interna...
Close out SW2
Four tasks, five departures from plan. The sharpest: the plan's own restrictionMask snippet filtered out null dayOfWeek, which means 'every day' — it would have...
Lift the free/busy engine out of the webinar feature
The interval arithmetic — expand, restrictionMask, candidateStarts, and the whole of AvailabilityInterval — was never webinar-specific. All the coupling sat in ...
Use the shared availability engine
MemberAvailabilityService keeps the CRUD and becomes a BusySource; the arithmetic it used to own now lives in kamo-shared-library. Call sites are unchanged — th...
The widget controls take the org's colour too
Follows 0c97c900, which did the masthead shortcuts. The same rule reaches the controls inside the panes: anything that carries a background wears var(--color-pr...
The new workspace opens once, ready, and as itself
Three faults with one cause, reported after creating Carl's Jr: the new tab said ?org=kamocrm.com, showed Kamo's logo and none of the org's colours — while its ...
Parse every core repository query against the real mapping
Spring Data validates an annotated @Query at bean creation, so a bad JPQL path ships green and crash-loops the consuming service instead of failing CI. The clin...
Delete findConflictingEvents, which never returned a row
Four independent defects, any one of which emptied the result set: it filtered e.user.id while both callers pass a member id and the two columns never coincide;...
Conflict detection now finds conflicts
Delegates to findBusyForMemberInRange and excludes the event being edited in Java, where a null exclusion cannot poison a SQL predicate. The test it replaces m...
Correct two errors in the SW2 plan
The rsync recipe used a bare 'rsync -a', which preserves mtimes — a file restored to an earlier version arrives older than the .class already compiled from a la...
Remove the recurrence control, which discarded what it collected
The switch, frequency select and occurrence count rendered on the calendar page and reached no payload: composeDraft never read them and onSave never sent them....
The record's Communications tab shows communications
It rendered the record's media stream alone — the internal notes people write about a job. Useful, and not what anybody means by "the communications about this ...
Commerce records as owners, and one place for the matching rules
The third owner the spine was widened for, and the one that was still defined and unused. A record's documents already hang off it through the document manager'...
Settle the loading gate on the gate, not on a "load started" flag
Two follow-ups to the session store, one of them a real defect. ensureLoaded decided foreground-vs-background from an `everLoaded` flag set when the first fore...
Plan SW2, the three calendar repairs
Research corrected the spec on one point: recurrence is not dead at both ends. The UI renders on the calendar page today and silently discards what the member e...
A push token may be claimed by one device row, not every past sign-in
Companion to MediaService 8a809b3, which stopped members getting the same chat message three-plus times on their phone. That change made dispatch collapse dupli...
The TEFCA responder — discovery, document query, document retrieve
The three operations a partner actually calls, expressed over FHIR rather than SOAP: IHE's XCPD and XCA shapes, on the QHIN Technical Framework's FHIR path, bec...
A real credential for exchange partners, and retrieved documents
The responder endpoints have no user session — the caller is another organization's server — so a bearer credential this practice issues at onboarding is the ON...
One phone, one alert — collapse duplicate push destinations
Members were getting the same chat message three-plus times on their phone. Registrations are unique on (device_token_id, org_id, push_kind), NOT on the push t...
A tab only names an organization it actually has
Opening TacoBell from /network put ?org=kamocrm.com on the new tab. The tab lands on /validate, which renders inside this shell BEFORE its session exists — so t...
The launchpad shortcuts wear the org's colour, not glass
The four controls in the launchpad masthead — My Widgets, My Wallpapers, the wallpaper switch wallpaper the member chose, and a translucent white pill over a ph...
One session snapshot for the tab, not one per hook instance
useUserInfo held its session in three useState cells. It has 187 call sites and roughly 27 of them are mounted for the whole session — the nav, every shell prov...
Five real quality measures, and the engine that runs them
Measures are Java rather than CQL, and the trade is worth stating. The eCQM specifications are published in Clinical Quality Language, and an engine would let a...
The quality measure model, and the row that makes it useful
MeasurePatientResult is the point of this commit. A practice shown "67% controlled" can do nothing with it; a practice shown the 41 NAMED patients in the denomi...
Recover a lost background count from the images themselves
commitBackgroundOrder writes the images to STAGING, and imageBgCount is only a record of how many it wrote — which made that one column a single point of failur...
Gate the nine Service Work endpoints on a right
They shipped checking only that the caller had a session, so any member of an org could read and mutate every work order in it regardless of role. ASSIGN_SERVI...
Drop the nine Service Work endpoints from the unguarded baseline
They are gated as of e6e1d02, so their baseline entries no longer match an unguarded endpoint and **************** fails on the stale lines. Requiring the remov...
Stop the customer **************** rights reading every tenant's rows
Every endpoint that accepted a VIEW_OWN_* right as an OR-alternative loaded its record by primary key alone, never checking who it belonged to: getSubscription,...
The org reference belongs in proxy.ts, not a second middleware file
Next 16 replaced middleware with proxy, and this repo already had proxy.ts — so adding middleware.ts alongside it failed the build outright: "Both middleware fi...
Mirror the Service Work rights into TypeScript
VIEW_SERVICE_WORK, VIEW_OWN_SERVICE_WORK, MANAGE_SERVICE_WORK, ASSIGN_SERVICE_WORK and COMPLETE_SERVICE_WORK land at ids 268-272, not the 265-269 the plan assum...
The signed-in session becomes per-tab
analytics.auth lived in localStorage, which every tab of this origin shares. Analytics is reached by an OTK handoff from a workspace and each handoff mints a to...
A member's identity and their org stop leaking between tabs
meet.<platform> is shared by every organization without a host of its own, and localStorage is per ORIGIN. The signed-in member's name, email and avatar were wr...
Bulk export, C-CDA, and one accounting that covers every channel
BULK EXPORT. Kickoff answers 202 with a Content-Location and no body; polling answers 202 while running and 200 with the manifest when done. Returning a friendl...
Theme assets come from a host that resolves
The sign-in screen paints an organization's branding from theme.<its own domain>. That domain may not resolve: an org can exist and be signed into before its DN...
One tab, one tenant — stop resolving the org from the shared cookie
Open KamoCRM in one tab and another organization in a second, refresh the first, and it rendered as the second. Close that tab, refresh again, and it came back....
Serve a tenant's assets from a host that resolves, and stop deleting its backgrounds
Two faults found while working out why a new org opened with no logo and no colours. THEME DELIVERY. Assets were requested from theme.<the org's own domain>. A...
Give Service Work its first five rights
ServiceType.SERVICE(28) shipped with zero rights, so its nine endpoints were gated only by whether the caller had a session. Ids start at 268 rather than the p...
Bulk FHIR export and C-CDA, and the rights that gate them
Two things a practice cannot operate without, and neither is a bigger version of reading a chart. BULK EXPORT (clinical/bulk). The FHIR Bulk Data model: a job,...
Notification-spine follow-ups, triaged
Deferred items from the 33-task plan, all raised by review and all non-blocking. The whole-branch review's four must-fix findings were fixed and are not listed....
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.