Live Change Log

Tracking codes are shared as ?discount=<uuid> now. The old <memberId>.<n> token published a real member id in every shared link and made the space walkable — on...

Chasing "make fewer HTTP requests" found two real things, and the second is much larger than the audit that led to it. THE HLS BRANCH NOBODY WAS TAKING. HeroSt...

The build failed on: npm error code ERR_SSL_CIPHER_OPERATION_FAILED ossl_gcm_stream_update:cipher operation failed That is a GCM authentication-tag mi...

Diagnosed with Chrome over the debugging protocol rather than by reasoning, collecting exactly what Lighthouse's errors-in-console and inspector-issues audits c...

Clears both remaining High findings on script-src: the 'unsafe-inline' one and "host allowlists can frequently be bypassed". Only a nonce with 'strict-dynamic'...

Clears the "No Content-Security-Policy header with Trusted Types directive found" finding by moving require-trusted-types-for into the enforced policy. This is...

Three things from the console, one of them much bigger than the other two. THE BIG ONE. Chasing the "Fetch failed loading" lines led to the prefetch payload, a...

The report-only console showed two violations, and one of them was the policy component's own doing: This document requires 'TrustedScript' assignment. Thi...

The timeline gains ATTRIBUTION_MOVED, in the warn tone — not a conversion and not a failure, but the moment this visitor stopped being this member's to earn fro...

The ingest worker now calls reattributeWhileAnonymous after the traffic bumps. The repository method carries the entire rule, so there is nothing to check here ...

Attribution was frozen at first touch, which gets the common case wrong: someone who follows member A's link in March and member B's in June, and only then sign...

Both are Guacamole targets that share one credential between everybody, which makes them operator tooling rather than a member's own workspace. They were top-ba...

Re-lands the security headers after I took the site down with them, minus the one directive that did it, plus a build guard so it cannot happen again. WHAT BRO...

This reverts commit ****************

Adds the three headers the Trust and Safety audit asked for, plus Referrer-Policy and Permissions-Policy. Every origin in the policy was taken from what the sit...

Opening an assigned Linux instance always landed on Guacamole's generic "An error has occurred and this action cannot be completed" modal, and always worked aft...

A tool window — the email composer, a support conversation, a chat, the softphone — would sometimes simply not appear, and be fine after a reload. Three silent ...

Two scroll listeners on the homepage read `scrollHeight` per event. That is a layout query, and this page is the worst place to make one repeatedly: its section...

"Your tracking link" showed exactly one link while a member can hold any number of them, so the strip silently rendered whichever code the sort put first and ga...

The homepage renders 94 elements carrying `backdrop-filter: blur(20px)`. Every one is a separate compositing layer that has to read back everything painted behi...

Three changes, all removing work from the window where the page is being judged. `(pages)/layout.tsx` carried `"use client"` and never needed it — no state, no...

The LCP breakdown is where the remaining time is, and its two loading subparts — 270 ms of resource load delay, 500 ms of load duration — are a priority problem...

Fallout from the framer sweep, caught before it could matter. The rewrite maps entrance animations onto `.reveal`, which is driven by `animation-timeline: view(...

Framer was the chunk Lighthouse named. GSAP is the one it did not, because it arrives late enough to fall outside "unused JavaScript" — but it is 69 KB in its o...

Unrelated to the performance work — found while reading the homepage's inline payload, where the string turned up in the FAQ answers. CockroachDB was retired f...

"Reduce unused JavaScript" has named the same 35.4 KB chunk in every report, and it is Framer Motion. It is not an eager script on the homepage, which is why it...

Lighthouse named theme.kamocrm.com as an unconnected origin worth 300 ms while also reporting no origins preconnected, and last round I read that as a stale com...

Completes the change 48493ae shipped half of. That commit swept four in-flight files — layout.tsx, DynamicMetaLoader, TouchOptimized and ThemedBackground — into...

Nine small corrections, each with a visible symptom. The drawer opened on ~0.4s of blank panel: `loading` started false, so the first committed render fell thr...

Two corrections to what shipped, both restoring the behaviour this feature was asked for. The beacon was gating itself on the analytics consent record. That re...

findVisitorsForCode and findTimelineForVisitor replace the derived finders, which now carry an id tiebreaker and NULLS LAST; the conversion consumer moves to th...

Both paged queries ordered on a column that ties, with no tiebreaker, so the database was free to return tied rows in a different order per page fetch — which s...

Lighthouse's 103 KiB of "unused JavaScript" named four chunks, two of them essentially 100% unused. None of them appear in the homepage's HTML — they are other ...

Two findings, both of which were doing something other than what the code said. THE BACKDROP WAS FETCHING THE 1920 CANDIDATE. 149 KB, for a decorative picture ...

/marketing/discounts was a ComingSoon stub; it is now /marketing/tracking, a working workspace, with the old path kept as a client redirect so existing bookmark...

The marketing site tags a referred visitor with kmrt_vid and kmrt_src on the shared apex, so register.<apex> can read them; handleFinish sends both in the reque...

A visitor who follows https://www.<apex>?mrt=<code> gets two first-party cookies from the edge middleware — an opaque GUID that lasts two years and the code its...

The register site now forwards the marketing visitor GUID and tracking code in the request body — not a header, because the proxy strips Cookie and the ingress ...

Both paths that stamp BillingSourceType.PAID now publish marketing.visitor.paid, because hooking only one silently misses half the traffic — AccountSubscription...

Clones forwardPublicWebinar rather than the generic forward(): that method prints every URI, header map and body length to stdout with no level, and a visitor b...

MediaService already backs the other marketing tabs, so it takes both halves of tracking codes: the authenticated CRUD and stats surface at /api/media/marketing...

A member mints a code, shares **************** and the six totals on the Tracking Codes tab answer what that link actually did: unique visitors, visits, page re...

Marketing tracking codes credit a partner for the signups, organizations and paid accounts their link produced, and those three moments happen in services that ...

Images. Every quality setting on the page goes down a step, and the allow-list in next.config.ts goes to [30, 50] so nothing can quietly ask for more: hero...

Step C. Neither GSAP nor Framer Motion is on the homepage any more, and the `home` message namespace is no longer sent to the browser at all. JS 24...

Step B. TrustBar, WhatReplacesWhat, HowItWorks, UseCases, Features, CTAStrip and Pricing are server components now. They render to HTML and ship no JavaScript. ...

Step A of the hydration work. Framer Motion is gone from the homepage's eager bundle: 798,723 -> 687,593 bytes raw, 245,367 -> 209,422 gzip. That is 35,945 fewe...

The playlists were the last entry in Lighthouse's cache-lifetime audit — 300s originally, then an hour, still reported. Everything else in the ladder was alread...

LCP was 4.4 s, and its breakdown said where: 120 ms to first byte, 290 ms of load delay, 390 ms actually downloading the image — and then 1,810 ms of "element r...

The last two rounds took the score from 87 to 67. Total Blocking Time went from 80 ms to 460 ms and LCP from 3.9 s to 4.4 s. Two of my own changes did that, and...