Live Change Log

- freepbx: the FPBXCONF here-document closing delimiter was indented (8 spaces); bash requires <<WORD delimiters at column 0, so startup.sh died with 'unexpec...

After the cluster migration the Forgejo repos were recreated lower-cased (securityservice), but historical rows and the public-projects filter use canonical cas...

New-document creation hung ~5 min and the new tab stayed at about:blank. Root cause: DocsService pods scheduled on k3m1 read the blank template from MinIO at th...

generateAndUploadFavicons() gated on minioService.exists(), which only stats the current MinIO host. When the simple logo was written to (or only replicated ont...

DynamicMetaLoader injects the org globals.css only once on mount, so after a color save (which correctly re-provisions globals.css + bumps themeRevision) the pa...

SSL errors: kamo Traefik is a LoadBalancer with externalIPs 192.168.4.22 (k1m1) + externalTrafficPolicy=Local, so it MUST run on k1m1 — the pod rebalance moved ...

CRDB is NULLs-distinct, so the single (lender_profile_id, market_id) WHERE status='ACTIVE' index did NOT backstop the org-wide (market_id IS NULL) grain — two c...

DaemonService binds EXCLUSIVE JetStream durable consumers (daemon-sync-trigger, **************** [the §2.8 breach loop], daemon-recording-received) in @PostCons...

DaemonService activates the MLOS transactional outbox (mlos.outbox.enabled) and produces events (the compliance-timer breach emitter), but lacked @EnableSchedul...

Enabling mlos.outbox activates OutboxWriter, which requires MlosOutboxEventRepository (+ ProcessedEvent /DeadLetter) from com.kamo.z.shared.mlos.event — add tha...

Test-only import fix that was breaking shared-lib compilation (caught by the now-required local mvn install). Main code was unaffected (OutboxRelay ignores the ...

The startup.sh block scalar embedded 5 shell heredocs (rtp.conf, http.conf, an SQL block, WebRTC endpoints, freepbx.conf) whose bodies sat at column 0 — less in...

The Docs-online image host was the bogus **************** (Redis DNS, never a registry), so every DocsService deploy re-applied an unpullable image. Point it at...

The Services tab read as incomplete for two stages that are actually done: - edt showed an empty 0% bar though EDT4 (hydro) supersedes the EDT2 base and the p...

The runner stage installed script deps (semver/chalk/prisma/...) BEFORE copying the Next.js standalone output. Next traces a partial, index.js-less semver into ...

Unpinned 'npm install -g pnpm' now resolves to pnpm 11.8.0, which dropped **************** in favour of allowBuilds. The repo's review lists were therefore igno...

The deps stage only copied package.json+lockfile, so pnpm could not see the **************** review lists (they live in pnpm-workspace.yaml). With strictDepBuil...

Newer pnpm fails the build with ERR_PNPM_IGNORED_BUILDS when prisma's postinstall is ignored. Only @prisma/engines was allow-listed, so every image build since ...

Progress read status.have first, which the initial 'running' event sets to 0 — and `0 ?? count` keeps 0, so the live count never showed (and hydro mis-counted a...

The Universe page was registered on the settings landing cards but not in the SettingsStatusWindow slide-out that NavPri actually opens, so it didn't appear und...

The session stores the GD flag (KSessionService) but /user-info never returned it, so kamo-universe's KamoIdentity always deserialized is_god=false and the god/...

NoReply is a send-only address with no mailbox, but every transactional send still attempted an IMAP append to its Sent folder, producing a noisy AUTHENTICATION...

Password recovery lowercased the input but findByEmailEmail does a case-sensitive match against the stored email (e.g. Sage@KamoCRM.com), so the user was never ...

The /api/recover proxy defaulted to api.kamocrm.com, which Traefik routes to APIService (no recover controller) → 404 → "Something went wrong" on /reset-passwor...

Maildirs were on hostPath /mnt/shared-files/email/mail — the rclone FUSE mount backed by MinIO object storage, which can't safely host a maildir (no atomic rena...

The mail MySQL datadir (and maildirs) were on hostPath /mnt/shared-files, an rclone FUSE mount backed by MinIO object storage, which cannot durably or consisten...

GET /api/email/mailboxes returned the raw entity (providerStatus, lastSyncedAt, no member count). The settings UI reads **************** so status was always un...

When the caller is already an impersonation session (a god admin acting as another member, carrying SUDO_MEMBER_ID), entering another org from /network minted t...

resolveForMailbox only granted access via a direct MemberMailbox assignment, so mailboxes surfaced through **************** rights threw NoSuchElementException ...

proxy.ts (Next middleware) redirected every page request with no *** cookie to /logout. Since the session id now lives in sessionStorage — which a document requ...

Rip out all the legacy-cookie clearing/migration. The token lives in sessionStorage (key ***) and travels as the X-***-Token header, which the backend already p...

Right after the sessionStorage switch ships, every browser still has its old *** cookie. The migration adopted that value into sessionStorage (and the server co...

hasPlatformAdminAccess is derived client-side (owner-of-session-org AND host-org-is-top-level). A child-org owner whose session lands on the top-level host is m...

EsignMeterSubmissionService needs EsignUsageRecordRepository, but @EnableJpaRepositories didn't scan com.kamo.z.shared.esign.repos, so the context failed to sta...

Stripe (>= 2025-03-31.basil) rejects the legacy usage_type+aggregate_usage metered model ('metered prices must be backed by meters'), so USAGE_BASED add-on pric...

KamoCRM owns several markets **************** so resolveProductMarket must pick the SUBSCRIPTION-type (platform-access) market rather than the first active one....