Index member_rights_applied, bound the intake claim, aggregate changelog stats
Three findings from an endpoint-by-endpoint audit, each measured against production rather than inferred. member_rights_applied declared no indexes at all whil...
An opt-in probe that executes the grid's SQL, not just its HQL
/leads went down on 2026-08-20 with 'missing FROM-clause entry for table a2_1' and no test caught it, because none of them could: the library compiles against H...
Remove the @EntityGraph that broke /leads on Hibernate 6.2
The grid page query failed in production with: ERROR: missing FROM-clause entry for table "a2_1" ... left join member_team_member a2_0 on **************** ...
Fetch one server-filtered page instead of the whole organisation
The grid fetched every lead in the org and narrowed it in a ~300-line useMemo. Measured on production 2026-08-20: 1,427 leads fetched so seven could be shown, 2...
Page the grid endpoint and take the PHI audit write off the request thread
GET /api/security/leads returned every lead in the organisation. It now takes page/size/sort plus the filters the grid actually uses, and returns a page with a ...
Filter and page the grid in the database, batch the PHI audit trail
Loading /leads took 23.3 s at 1,427 leads. 23.3 s of that was the HIPAA audit trail: recordLeadList writes one phi_access_log row per lead returned, and each on...
Composite lead indexes, and unblock the run that creates them
The /leads grid now filters and pages in the database instead of shipping the whole organisation to the browser. With only IX_LEADS_ORG_ID that would relocate t...
Mark payload outcomes by column, not through the entity
payloadRepo.save() on a detached payload makes Hibernate walk its graph — organization pulls in org_domains — and that read lands in a transaction that has alre...
Settle each backlog payload as it is processed
processBacklog mirrored the scheduled job's two defects: it mutated payload statuses in memory and saved them in one batch at the end, and it saved the whole en...
Record a payload's outcome by column, not by entity
Marking a payload IMPORTED with payloadRepo.save() makes Hibernate walk the detached entity's graph — including organization, which pulls in org_domains — and t...
Stop overlapping runs importing the same payloads twice
The trigger fires every minute and each run claims work by selecting payloads still in RECEIVED. A backlog that takes longer than a minute therefore still had R...
Bump the processed counter instead of rewriting the endpoint
The job finished a batch by mutating totalProcessed on the endpoint entity it loaded before the batch began and saving the whole row. Two consequences: - it ...
Never fail a submission because its counter update lost a race
storePayload no longer bumps the endpoint's received counter; the receive controller now calls recordReceipt separately, in its own transaction, and swallows th...
Prefer brotli on the theme host, and correct the previous rationale
Two things, one of them a correction to the commit before this. The previous commit justified `encodings: [br, gzip]` with a probe against api.kamocrm.com. Tha...
Prefer brotli, stop compressing what is already compressed
The shared `compress` middleware was `compress: {}`, which is three separate defaults and none of them is the one we want. Traefik picks gzip whenever the clie...
Stop losing payloads to endpoint-counter contention
storePayload saved the payload and then bumped totalReceived/lastReceivedAt by dirtying the endpoint entity — in the same transaction. Every submission to an en...
Every country flag in the app was a blocked image
Eight more screens had the defect found in the marketing visitor drawer. The app is served under img-src 'self' data: blob: https://theme.kamocrm.com https:/...
Compress every response, not just the document
server-nonce.js asks upstream for `identity` so the HTML can be stamped with a CSP nonce without a decompress/recompress round trip, then recompresses on the wa...
Drain deferred work one item per idle period
Four components waited for the main thread to go quiet before doing their work — the toast/consent bundle, the scroll chrome, the touch target sweep and the ref...
Read the scroll position from an observer, not from layout
The nav's scrolled/at-top state came from a scroll handler that read window.scrollY, and the mount effect called that handler synchronously during React's commi...
Flags are emoji, because the CSP blocks every flag CDN
The visitor drawer painted a broken-image glyph where each country flag should be. react-country-flag's `svg` mode reads like a self-contained component and is ...
Rebuild against kamo-shared-library 811db57
Picks up the createLead fix that moves the pool-availability recount to afterCommit. Before it, a read-after-write in the lead's own transaction hit YugabyteDB'...
Rebuild against kamo-shared-library 811db57
Picks up the createLead fix that moves the pool-availability recount to afterCommit. Before it, a read-after-write in the lead's own transaction hit YugabyteDB'...
Persist each payload's outcome as it happens, not in one batch
processEndpointPayloads looped over the batch mutating statuses in memory and saved them all at the end. createLead commits per lead, so any failure of that fin...
Move the pool-availability recount after commit
createLead saved the lead and then, in the same transaction, ran countAssignablePool to broadcast the new "Leads Available" figure. On YugabyteDB a read after a...
Offer Company Name as a mappable import field
leadFields.ts is the list the mapping canvas draws from, and it must mirror the backend switch in LeadImportController — a path missing from either side is acce...
Map companyName so a spreadsheet can carry the business name
setDirectFieldOnCreateRequest had no companyName case, so the field was unreachable from the manual-import wizard even though CreateLeadRequest carries it and L...
Let a mapped payload carry companyName and source
The intake job's direct-field switch stopped at vendorLeadID, so a mapping onto companyName or source was accepted by the UI, stored on the endpoint and then si...
Serve static assets as build-time brotli
The flagged chunk is react-dom, and I checked it properly before concluding anything: it is the production build (no dev markers, and the profiling hooks `injec...
Drop the unused preconnect, and fix the 565 ms of brotli I added
Two findings, and the second one was mine. THE DOCUMENT TOOK 1,259 ms BECAUSE OF THE NONCE WRAPPER. Measured against the live site: the HTML answered in ~900 ...
Put the headline's swept band back
Restored exactly as it was — same two-layer gradient, same 120deg band, same 9s/1.1s timing and easing — after removing it in the compositing pass. The cost is...
Move every looping animation onto the compositor
All 26 elements Lighthouse listed under "avoid non-composited animations" were the same mistake in four places: animating a paint property. Measured with Chrome...
Retitle Modified to Converted and fix two tab icons
Both tabs wore an icon that already means something else in this grid: the Modify tab used GetApp, the row-level download button, and Converted used EditNote, t...
Stamp every unread frame with the instant its counts were read
The four places that built a member's unread snapshot — the REST read, the frame sent when a message arrives, the frame sent when a session is marked read, and ...
Clear the unread badge for a conversation the member is reading
The badge was fed by two unordered sources — the REST unread read and MediaService's unread topic — and applied whichever landed last, with nothing ever re-read...
Choose which page a tracking link lands on
A code is not tied to a page — the marketing site captures it site-wide — so the only real question when sharing one is where the visitor should land. The produ...
Catch the silent version of "sound is not allowed here"
Follow-up to the still. Testing tap-to-play against the deployed site turned up a failure mode the muted fallback did not cover. A refused `play()` rejects, an...
Show the code as a handle, not 36 characters of hex
Moving the token to a UUID left the grid rendering the whole thing, which is correct in a URL and useless in a table: it cannot be scanned, compared against the...
The microservice count reads 64+, not 30+
The number is 64+ services now. Five untranslated surfaces still claimed 30+: the technology answer in the homepage FAQ JSON-LD (which is what a search result q...
Show a still of the reel instead of a grey pulse
Adds public/img/hero-still.webp — 1280x720, matching the aperture's 16/9 exactly — and makes it what the hero shows until someone presses play. This also fixes...
Cache CORS preflights for two hours, not 100 seconds
`accessControlMaxAge: 100` meant browsers re-ran the preflight roughly once per visit, so every page load on the marketing site paid two extra OPTIONS round-tri...
63 HTTP requests down to 22
Implements the request-budget report. Measured the same way it was written — Chrome over the debugging protocol, mobile emulation, sixteen-second window. 6...
Build the shared link as ?discount=<uuid>
buildTrackingLink emits the new parameter, and the link strip highlights the ?discount= segment it used to highlight as ?mrt=. The token itself is now an opaque...
Read the discount cookies and send the discount* fields
Follows the marketing site: kdsc_vid / kdsc_src, with ?discount= as the query-param fallback for a visitor who lands on the register form with the link still in...
The referral parameter is ?discount= and the token is a UUID
The link a member shares is **************** It used to be ?mrt=<memberId>.<iteration>, which put a real member id in every shared URL and let anyone enumerate ...
Accept the discount* signup fields, keep the mrt* ones working
The register site now sends discountVisitorGuid / discountCode. Both names are read, new first, because the two services deploy independently — for the minutes ...
Mint an opaque UUID token, in one insert
createCode generates the token itself, so there is nothing to read first and nothing for two tabs to collide over. That removes the whole apparatus the old sequ...
Make the shared token an opaque UUID
The public token was <memberId>.<iteration>, which was wrong on two counts. It published a real member id in every link anyone shared — on a business card, in a...
Retire ****************
Tracking codes are shared as ?discount=<uuid> now. The old <memberId>.<n> token published a real member id in every shared link and made the space walkable — on...
The reel was never using hls.js, and phones paid for it
Chasing "make fewer HTTP requests" found two real things, and the second is much larger than the audit that led to it. THE HLS BRANCH NOBODY WAS TAKING. HeroSt...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.