Live Change Log

byAlias took LIMIT 1 over orgs.alias, which has no uniqueness constraint: the create path checks it per security provider and PUT /org/{id} does not check it at...

The Presenters tab dropdown was empty for every organization, and always had been. GET **************** answers with { teamMembers, total }; the tab read data.m...

FeatureController now sends parent/children/isParent on every serialized app so the client can render children nested under their parent. Served rather than mir...

Both TS mirrors are now GENERATED from ServiceType.java rather than hand-maintained. They had drifted badly from Java and from each other: stale "RAG integratio...

The app-tree backfill turned out to already exist as **************** restricted to isGated() verticals. Dropping that restriction is the whole change. Records...

The bar beside the messages was 8px in the member chat and SMS, 6px in support tickets and social, and in the AI chat it was nothing at all: that list declared ...

internal.kamocrm.com failed to render with "Invalid organization data: missing 'id' or 'domain'". Organization has no `domain` field -- it has a `domains` colle...

internal.kamocrm.com failed to render with "Invalid organization data: missing 'id' or 'domain'". Organization.fromJSON refuses a record without a domain, and t...

Search now owns the whole left track of the toolbar, because the empty part of that track is exactly the room the field opens into. The scroll-to-bottom control...

public/favicon.ico now carries 48x48 and 32x32 layers instead of 32x32/16x16. The five logo-blu*/logo-blueleven* PNGs are referenced from nowhere in the app, so...

grandfatherExistingGatedMarkets already walked each org's active markets, resolved getRequiredService() and enabled the missing app — it was just restricted to ...

Every CommerceType now names its own child app under POS, so the isGated() short-circuit that waved retail, rentals, service, subscriptions and procurement stra...

Two gaps found by re-reading the original login tail against the new one, before enabling the picker. The form-encoded /login endpoint built its LoginRequest w...

The member chat carried a permanent search box across the top of the window — the width of the whole toolbar, spent on a control that is empty almost all of the...

The message list keyed each row on the message id, and a sent message's id changes exactly once — the optimistic row is appended under a local id, and the STOMP...

requiredService becomes total now that each vertical has a child app under ServiceType.POS, which deletes the "null means POS alone is enough" special case and ...

getOrgToken() took the first label of the current host, and its own comment said why: "so identically-named rooms cannot collide across orgs". On the shared hos...

The meet sidecar looks up an org's meet config to decide whether a guest needs a meeting password. It asked by hostname, which on the shared meet host resolves ...

Room isolation was the HOST. A member of org B could not present a *** cookie on meet.<org-A-domain>, so knowing org A's room name got them nowhere. Serving org...

Enabling a child enables its parent; disabling a parent disables every child; disabling the last child disables the parent. Enabling a parent leaves children al...

PhiTenantGuard runs at feature-enable time and nowhere else — three call sites, all in FeatureService. Now that PhiModule is capability-grained, an app whose co...

POS mapped to ECOMMERCE_SYNC (BLOCKED_NO_BAA) and the whole commerce surface hangs off POS, so an org with handlesPhi=true could not switch commerce on at all —...

Creating an org routed the creator to /setup/dns, and the reason was real: entering meant an OTK redirect to internal.<new-domain>, and a brand-new org has no D...

Six commerce children at new ids 26-31, wired to POS in a static block on the RoleRightType pattern (an enum constant cannot reference another from its own cons...

12 tasks across kamo-shared-library, KamoInitializerService, SecurityService, MediaService, VOIPService, kamo-internal and the translation dictionary. Ordering...

The guard read the host org's id with /"id"\s*:\s*(\d+)/ -- a bare digit straight after the colon. SecurityService's JsSafeLongSerializer writes any Long above ...

**************** walked org.getDomains() filtering only on isActive. That collection holds the org's root domain AND its alias rows -- api, login, theme and the...

The inventory called SignLinkBuilder's sign.sign.pink fallback a "foreign apex" and I recorded it as one. It is not: sign.pink is a Kamo-owned organization (id ...

Two specs from the pre-build analysis of ~30 repos and the 2026 ambulatory EHR market. The program design records the six decisions that bind every sub-project...

Entering an org meant navigating to **************** With no domain that URL rendered as the literal **************** so Enter was disabled and owners were rout...

kamo-internal's root layout reads the Host header, strips "internal." and fetches /org/domain/<that>. On a host serving one tenant that is the same question as ...

The description on **************** was a three-row textarea. It is the /kb/new writing surface now, minus pictures and the media library — those upload into KB...

A sign-in that names no organization now comes back with a list instead of a session. This is the client half: /api/login passes that payload through (before th...

The description is a Lexical document now, so the service stores the plain-text mirror the client sends alongside it and hands readers whichever shape they can ...

Mirrors the shared-lib entity change. Two things the table needs before MediaService maps them. The description column has to be unbounded: it holds a Lexical ...

The description on **************** is a Lexical editor state now rather than a line of prose, so the column has to be an unbounded TEXT bound as a long varchar...

Adds the second half of the split: a sign-in that names no organization authenticates the user, then asks which workspace. POST /api/security/session/select tur...

@kamo/chat-core 0.1.6. The conversation reducer now adopts the pending optimistic row when the member's own message comes back over STOMP, instead of appending ...

users.last_org_id backs the workspace picker. An organization is no longer named by the hostname, so a member who belongs to several chooses one after signing i...

Signing in was two questions fused into one query. "Are these credentials good" is answered by the users row -- the password lives there, so it was never org-sc...

OrgHostResolver.resolveByDomain filtered on od.is_dns_verified = TRUE, so a domain row that existed but had not finished verifying resolved to nothing and login...

The drop target was the composer surface alone — a few dozen pixels at the bottom of a window that is otherwise all messages. A screenshot let go over the conve...

Six phases, each independently shippable, because pushing deploys: the host path keeps working until Phase 6 removes it. Phase 1 is the crux and is additive --...

Org identity comes from the hostname today: OrgHostResolver.resolveByFqdn turns <alias>.<domain> into (orgId, providerId), and its SQL requires od.is_dns_verifi...

Two faults, both on the same hop, and each one hides the other. RingCentral rejects every scope value this app can ask for — "invalid_request / Parameter [scop...

Additional Storage is $2.50 per 10 GB block, and the catalog stores that as a number — so 2.50 arrives as 2.5 and rendered straight into the card it read "+$2.5...

Confirms the block size and rate as $2.50 per 10 GB rather than the $4 per 25 GB the production row had drifted to. The seeder, the catalog row, the Stripe pric...

Additional Storage is bought by the unit, belongs to no plan on any tier, and is not seat-based. The seeder still described it as $2.50 per 10 GB block, which i...

printStackTrace() writes to stderr directly, so 186 of them survived the println sweep untouched — still unconditional, still unattributed, and now detached fro...