Live Change Log

The card printed "Up to 5 users" from plan.maxSeats, directly above its own feature list reading "Users (25)" and a comparison column reading 25 - the same card...

Included-in badge named the wrong plan. All four per-seat modules are included in Business and Enterprise, and the badge picked the FIRST id in includedInPlanId...

PER_EXTENSION already renders as "extension/month" - addOnUnitLabel handles it and needs no change. The icon map does: it is keyed on the lowercased catalog cod...

PER_MAILBOX fell through to the default arm, so the public pricing page advertised the two e-mail add-ons as "/user/month" against a per-mailbox price. PER_EXTE...

The theme folder was derived from the hostname — kamocrm.com became kamocrm-com — which is where branding was written until a domain became optional and the org...

Removes "Running Your Business without Kamo is a Mistake." from the fixed top banner, as reported. Confirmed live before the change — the running pod served it ...

A member checking that their own tracking link works is the most common first visit any code ever gets, and it is worse than useless: it inflates the number the...

Additional Storage is $2.50 per 10 GB block, and the catalog stores that as a number — so 2.50 arrives as 2.5 and rendered straight into the card it read "+$2.5...

Quotes around the banner line, as asked — but rendered from CSS (`open-quote`/`close-quote` against `quotes: auto`) rather than typed into the string, for two r...

e67f59b renamed previewBanner.nowLive -> previewBanner.headline and was pushed before the matching kamo-translation-dictionary commit (f4627d31). The build step...

The top banner led with a six-character pill — bordered, uppercase, pulsing — and put the actual message after it. The pill now carries the message itself: "Run...

The homepage cards read the month-to-month rate out of the catalog and printed it above a line saying "billed annually", so Starter advertised $34 and Business ...

server-nonce.js asks upstream for `identity` so the HTML can be stamped with a CSP nonce without a decompress/recompress round trip, then recompresses on the wa...

Four components waited for the main thread to go quiet before doing their work — the toast/consent bundle, the scroll chrome, the touch target sweep and the ref...

The nav's scrolled/at-top state came from a scroll handler that read window.scrollY, and the mount effect called that handler synchronously during React's commi...

The flagged chunk is react-dom, and I checked it properly before concluding anything: it is the production build (no dev markers, and the profiling hooks `injec...

Two findings, and the second one was mine. THE DOCUMENT TOOK 1,259 ms BECAUSE OF THE NONCE WRAPPER. Measured against the live site: the HTML answered in ~900 ...

Restored exactly as it was — same two-layer gradient, same 120deg band, same 9s/1.1s timing and easing — after removing it in the compositing pass. The cost is...

All 26 elements Lighthouse listed under "avoid non-composited animations" were the same mistake in four places: animating a paint property. Measured with Chrome...

Follow-up to the still. Testing tap-to-play against the deployed site turned up a failure mode the muted fallback did not cover. A refused `play()` rejects, an...

The number is 64+ services now. Five untranslated surfaces still claimed 30+: the technology answer in the homepage FAQ JSON-LD (which is what a search result q...

Adds public/img/hero-still.webp — 1280x720, matching the aperture's 16/9 exactly — and makes it what the hero shows until someone presses play. This also fixes...

Implements the request-budget report. Measured the same way it was written — Chrome over the debugging protocol, mobile emulation, sixteen-second window. 6...

The link a member shares is **************** It used to be ?mrt=<memberId>.<iteration>, which put a real member id in every shared URL and let anyone enumerate ...

Chasing "make fewer HTTP requests" found two real things, and the second is much larger than the audit that led to it. THE HLS BRANCH NOBODY WAS TAKING. HeroSt...

The build failed on: npm error code ERR_SSL_CIPHER_OPERATION_FAILED ossl_gcm_stream_update:cipher operation failed That is a GCM authentication-tag mi...

Diagnosed with Chrome over the debugging protocol rather than by reasoning, collecting exactly what Lighthouse's errors-in-console and inspector-issues audits c...

Clears both remaining High findings on script-src: the 'unsafe-inline' one and "host allowlists can frequently be bypassed". Only a nonce with 'strict-dynamic'...

Clears the "No Content-Security-Policy header with Trusted Types directive found" finding by moving require-trusted-types-for into the enforced policy. This is...

Three things from the console, one of them much bigger than the other two. THE BIG ONE. Chasing the "Fetch failed loading" lines led to the prefetch payload, a...

The report-only console showed two violations, and one of them was the policy component's own doing: This document requires 'TrustedScript' assignment. Thi...

Re-lands the security headers after I took the site down with them, minus the one directive that did it, plus a build guard so it cannot happen again. WHAT BRO...

This reverts commit ****************

Adds the three headers the Trust and Safety audit asked for, plus Referrer-Policy and Permissions-Policy. Every origin in the policy was taken from what the sit...

Two scroll listeners on the homepage read `scrollHeight` per event. That is a layout query, and this page is the worst place to make one repeatedly: its section...

The homepage renders 94 elements carrying `backdrop-filter: blur(20px)`. Every one is a separate compositing layer that has to read back everything painted behi...

Three changes, all removing work from the window where the page is being judged. `(pages)/layout.tsx` carried `"use client"` and never needed it — no state, no...

The LCP breakdown is where the remaining time is, and its two loading subparts — 270 ms of resource load delay, 500 ms of load duration — are a priority problem...

Fallout from the framer sweep, caught before it could matter. The rewrite maps entrance animations onto `.reveal`, which is driven by `animation-timeline: view(...

Framer was the chunk Lighthouse named. GSAP is the one it did not, because it arrives late enough to fall outside "unused JavaScript" — but it is 69 KB in its o...

Unrelated to the performance work — found while reading the homepage's inline payload, where the string turned up in the FAQ answers. CockroachDB was retired f...

"Reduce unused JavaScript" has named the same 35.4 KB chunk in every report, and it is Framer Motion. It is not an eager script on the homepage, which is why it...

Lighthouse named theme.kamocrm.com as an unconnected origin worth 300 ms while also reporting no origins preconnected, and last round I read that as a stale com...

Completes the change 48493ae shipped half of. That commit swept four in-flight files — layout.tsx, DynamicMetaLoader, TouchOptimized and ThemedBackground — into...

Two corrections to what shipped, both restoring the behaviour this feature was asked for. The beacon was gating itself on the analytics consent record. That re...

Lighthouse's 103 KiB of "unused JavaScript" named four chunks, two of them essentially 100% unused. None of them appear in the homepage's HTML — they are other ...

Two findings, both of which were doing something other than what the code said. THE BACKDROP WAS FETCHING THE 1920 CANDIDATE. 149 KB, for a decorative picture ...

A visitor who follows https://www.<apex>?mrt=<code> gets two first-party cookies from the edge middleware — an opaque GUID that lasts two years and the code its...

Images. Every quality setting on the page goes down a step, and the allow-list in next.config.ts goes to [30, 50] so nothing can quietly ask for more: hero...

Step C. Neither GSAP nor Framer Motion is on the homepage any more, and the `home` message namespace is no longer sent to the browser at all. JS 24...