Live Change Log

Two findings, and the second one was mine. THE DOCUMENT TOOK 1,259 ms BECAUSE OF THE NONCE WRAPPER. Measured against the live site: the HTML answered in ~900 ...

Restored exactly as it was — same two-layer gradient, same 120deg band, same 9s/1.1s timing and easing — after removing it in the compositing pass. The cost is...

All 26 elements Lighthouse listed under "avoid non-composited animations" were the same mistake in four places: animating a paint property. Measured with Chrome...

Both tabs wore an icon that already means something else in this grid: the Modify tab used GetApp, the row-level download button, and Converted used EditNote, t...

The four places that built a member's unread snapshot — the REST read, the frame sent when a message arrives, the frame sent when a session is marked read, and ...

The badge was fed by two unordered sources — the REST unread read and MediaService's unread topic — and applied whichever landed last, with nothing ever re-read...

A code is not tied to a page — the marketing site captures it site-wide — so the only real question when sharing one is where the visitor should land. The produ...

Follow-up to the still. Testing tap-to-play against the deployed site turned up a failure mode the muted fallback did not cover. A refused `play()` rejects, an...

Moving the token to a UUID left the grid rendering the whole thing, which is correct in a URL and useless in a table: it cannot be scanned, compared against the...

The number is 64+ services now. Five untranslated surfaces still claimed 30+: the technology answer in the homepage FAQ JSON-LD (which is what a search result q...

Adds public/img/hero-still.webp — 1280x720, matching the aperture's 16/9 exactly — and makes it what the hero shows until someone presses play. This also fixes...

`accessControlMaxAge: 100` meant browsers re-ran the preflight roughly once per visit, so every page load on the marketing site paid two extra OPTIONS round-tri...

Implements the request-budget report. Measured the same way it was written — Chrome over the debugging protocol, mobile emulation, sixteen-second window. 6...

buildTrackingLink emits the new parameter, and the link strip highlights the ?discount= segment it used to highlight as ?mrt=. The token itself is now an opaque...

Follows the marketing site: kdsc_vid / kdsc_src, with ?discount= as the query-param fallback for a visitor who lands on the register form with the link still in...

The link a member shares is **************** It used to be ?mrt=<memberId>.<iteration>, which put a real member id in every shared URL and let anyone enumerate ...

The register site now sends discountVisitorGuid / discountCode. Both names are read, new first, because the two services deploy independently — for the minutes ...

createCode generates the token itself, so there is nothing to read first and nothing for two tabs to collide over. That removes the whole apparatus the old sequ...

The public token was <memberId>.<iteration>, which was wrong on two counts. It published a real member id in every link anyone shared — on a business card, in a...

Tracking codes are shared as ?discount=<uuid> now. The old <memberId>.<n> token published a real member id in every shared link and made the space walkable — on...

Chasing "make fewer HTTP requests" found two real things, and the second is much larger than the audit that led to it. THE HLS BRANCH NOBODY WAS TAKING. HeroSt...

The build failed on: npm error code ERR_SSL_CIPHER_OPERATION_FAILED ossl_gcm_stream_update:cipher operation failed That is a GCM authentication-tag mi...

Diagnosed with Chrome over the debugging protocol rather than by reasoning, collecting exactly what Lighthouse's errors-in-console and inspector-issues audits c...

Clears both remaining High findings on script-src: the 'unsafe-inline' one and "host allowlists can frequently be bypassed". Only a nonce with 'strict-dynamic'...

Clears the "No Content-Security-Policy header with Trusted Types directive found" finding by moving require-trusted-types-for into the enforced policy. This is...

Three things from the console, one of them much bigger than the other two. THE BIG ONE. Chasing the "Fetch failed loading" lines led to the prefetch payload, a...

The report-only console showed two violations, and one of them was the policy component's own doing: This document requires 'TrustedScript' assignment. Thi...

The timeline gains ATTRIBUTION_MOVED, in the warn tone — not a conversion and not a failure, but the moment this visitor stopped being this member's to earn fro...

The ingest worker now calls reattributeWhileAnonymous after the traffic bumps. The repository method carries the entire rule, so there is nothing to check here ...

Attribution was frozen at first touch, which gets the common case wrong: someone who follows member A's link in March and member B's in June, and only then sign...

Both are Guacamole targets that share one credential between everybody, which makes them operator tooling rather than a member's own workspace. They were top-ba...

Re-lands the security headers after I took the site down with them, minus the one directive that did it, plus a build guard so it cannot happen again. WHAT BRO...

This reverts commit ****************

Adds the three headers the Trust and Safety audit asked for, plus Referrer-Policy and Permissions-Policy. Every origin in the policy was taken from what the sit...

Opening an assigned Linux instance always landed on Guacamole's generic "An error has occurred and this action cannot be completed" modal, and always worked aft...

A tool window — the email composer, a support conversation, a chat, the softphone — would sometimes simply not appear, and be fine after a reload. Three silent ...

Two scroll listeners on the homepage read `scrollHeight` per event. That is a layout query, and this page is the worst place to make one repeatedly: its section...

"Your tracking link" showed exactly one link while a member can hold any number of them, so the strip silently rendered whichever code the sort put first and ga...

The homepage renders 94 elements carrying `backdrop-filter: blur(20px)`. Every one is a separate compositing layer that has to read back everything painted behi...

Three changes, all removing work from the window where the page is being judged. `(pages)/layout.tsx` carried `"use client"` and never needed it — no state, no...

The LCP breakdown is where the remaining time is, and its two loading subparts — 270 ms of resource load delay, 500 ms of load duration — are a priority problem...

Fallout from the framer sweep, caught before it could matter. The rewrite maps entrance animations onto `.reveal`, which is driven by `animation-timeline: view(...

Framer was the chunk Lighthouse named. GSAP is the one it did not, because it arrives late enough to fall outside "unused JavaScript" — but it is 69 KB in its o...

Unrelated to the performance work — found while reading the homepage's inline payload, where the string turned up in the FAQ answers. CockroachDB was retired f...

"Reduce unused JavaScript" has named the same 35.4 KB chunk in every report, and it is Framer Motion. It is not an eager script on the homepage, which is why it...

Lighthouse named theme.kamocrm.com as an unconnected origin worth 300 ms while also reporting no origins preconnected, and last round I read that as a stale com...

Completes the change 48493ae shipped half of. That commit swept four in-flight files — layout.tsx, DynamicMetaLoader, TouchOptimized and ThemedBackground — into...

Nine small corrections, each with a visible symptom. The drawer opened on ~0.4s of blank panel: `loading` started false, so the first committed render fell thr...

Two corrections to what shipped, both restoring the behaviour this feature was asked for. The beacon was gating itself on the analytics consent record. That re...

findVisitorsForCode and findTimelineForVisitor replace the derived finders, which now carry an id tiebreaker and NULLS LAST; the conversion consumer moves to th...