Assemble the lead record instead of holding it behind a spinner
The Details tab's loading state was one card of fourteen grey MUI pulse rows — a shape the pane never takes, on a per-element clock, replaced wholesale by a lay...
Ask EmailService to back-fill a lead's past e-mail
Implements the shared library's LeadEmailBackfillTrigger, so ticking "Associate Past E-Mails w/ Lead" on a lead save reaches the only service that can read mail...
Scan the org's mailboxes for a lead's past e-mail on request
Serves the "Associate Past E-Mails w/ Lead" tick-box. Given a lead and the address just recorded on it, read INBOX and Sent of every mailbox in that lead's orga...
Let a lead claim mail that predates its e-mail address
Matching is point-in-time by design — a contact point only claims traffic inside its window, so editing a lead cannot retroactively rewrite history. The cost is...
Offer to associate past e-mail when a lead's address is set
Mail is matched to a lead strictly point-in-time: an address only claims traffic from the moment it is recorded, so that editing a lead today cannot rewrite who...
One agent picker for assignment, reservations and the filter
The Assigned Agent control on a lead's assignment pane was a local component in LeadViewClient. Two other places wanted exactly it, so it moves to *************...
Accept a reservation raised for another agent
POST **************** now honours onBehalfOfMemberId, gated on EDIT_OPPORTUNITIES — the right that gates managing opportunities on the reserved list, and alread...
Add ****************
Records who filed a reservation when that is not the agent it names, so somebody managing opportunities can raise one on a sales agent's behalf without the reco...
Let a manager raise a reservation for an agent
Somebody who manages opportunities can now file a reservation request on a sales agent's behalf. CreateReservationRequest carries onBehalfOfMemberId for it. Th...
Hide the balance controls that free-for-all cannot use
Credit Balance, Daily Allotment and Max Balance all act on a granted balance, and an FFA product has none — acceptance there mints and spends its own credit. Le...
Make free-for-all acceptance spendable, so it can be capped
FFA bypassed the credit system outright, which left a manager with no lever over it: Max Daily Spend sat behind if (!ffa) and could not cap an FFA product, and ...
Name the requestor, move the org line, shorten the Open Org button
Three adjustments to the support surfaces. "Open org as System User" is now "Open Org", sitting immediately after assign/reassign rather than at the end of the...
Say which clock the event dialog is on, and show the start time
Four things the composer got wrong, on /calendar and on the lead page alike. The zone was the browser's. That is a fact about the laptop, not about the member:...
Publish Hibernate statement counts to Prometheus
/actuator/prometheus already carried jdbc_* and hikaricp_* but no hibernate_*, because Spring Boot 3 only auto-configures those metrics when **************** is...
Show the requestor's photo on each support chat row
Every row in Chats → Support wore the same blue support glyph, which is no help at all when the list is what you scan to decide what to pick up. The face is now...
Put the requestor's face and name on each support chat row
A Chats → Support row showed the same support glyph on every line, so a queue of them was a wall of identical blue circles. The face people actually scan for is...
Pool count on the product header, accepted-today per member
Leads Available was rendered in every member row of a product group, but it is a property of the (product, market) pool — the same number repeated down the colu...
Resolve a member's photo URL from the shared library
The Chats → Support list is about to show the requestor's face, and a support requestor is — on the platform's own desk — always somebody else's member. Every o...
Return each member's accepted-today count per product
Manage-Credits shows Max Daily Spend but nothing about how much of it is used, so a manager could not tell whether a member was one lead from their cap or had n...
Count today's spend across a member's products in one query
Manage-Credits wants to show, per member, how many leads they have accepted so far today — the running total the Max Daily Spend cap is compared against. ******...
Count the assignable pool for every vendor product at once
countAssignablePool answers for one product, so a caller can only ask about products it already holds. Manage-Credits was iterating allotments to decide what to...
Composite indexes for geolite_locations
Country alone was the only index on an 80,429-row table. Measured on production: city resolution (country + subdivision) index-scanned all 18,870 US rows to kee...
Show the requestor's org, and offer the System User door to their agent
The support chat header now names the organization the request came from, to everyone working the conversation and to nobody else — the person who raised it wou...
Name the requestor's org, and end System User access when the ticket moves
Three things, all about a support desk that answers more than one tenant. The ticket detail now carries a per-viewer verdict on whether to offer "open the requ...
Mint a System User session for a support agent's open ticket
enter-as gains a second reason to say yes. SystemUserEntryPolicy turns the caller's *** into the facts the shared SupportSystemAccessResolver takes, and that re...
Let an open ticket grant its agent the requestor's org, and expire with it
A support agent needs to look inside the customer's tenant to answer the ticket they are holding. Until now the only way in was the blanket SYSTEM_USER platform...
Index member_rights_applied on (member_id, the_right)
The table had no indexes at all, while every finder on it filters by MEMBER_ID. At 10,524 rows a single member's rights lookup was a full sequential scan — meas...
Composite lead indexes, and unblock the run that creates them
The /leads grid now filters and pages in the database instead of shipping the whole organisation to the browser. With only IX_LEADS_ORG_ID that would relocate t...
Offer Company Name as a mappable import field
leadFields.ts is the list the mapping canvas draws from, and it must mirror the backend switch in LeadImportController — a path missing from either side is acce...
Map companyName so a spreadsheet can carry the business name
setDirectFieldOnCreateRequest had no companyName case, so the field was unreachable from the manual-import wizard even though CreateLeadRequest carries it and L...
Let a mapped payload carry companyName and source
The intake job's direct-field switch stopped at vendorLeadID, so a mapping onto companyName or source was accepted by the UI, stored on the endpoint and then si...
Put the headline's swept band back
Restored exactly as it was — same two-layer gradient, same 120deg band, same 9s/1.1s timing and easing — after removing it in the compositing pass. The cost is...
Retitle Modified to Converted and fix two tab icons
Both tabs wore an icon that already means something else in this grid: the Modify tab used GetApp, the row-level download button, and Converted used EditNote, t...
Choose which page a tracking link lands on
A code is not tied to a page — the marketing site captures it site-wide — so the only real question when sharing one is where the visitor should land. The produ...
Show a still of the reel instead of a grey pulse
Adds public/img/hero-still.webp — 1280x720, matching the aperture's 16/9 exactly — and makes it what the hero shows until someone presses play. This also fixes...
Build the shared link as ?discount=<uuid>
buildTrackingLink emits the new parameter, and the link strip highlights the ?discount= segment it used to highlight as ?mrt=. The token itself is now an opaque...
Read the discount cookies and send the discount* fields
Follows the marketing site: kdsc_vid / kdsc_src, with ?discount= as the query-param fallback for a visitor who lands on the register form with the link still in...
The referral parameter is ?discount= and the token is a UUID
The link a member shares is **************** It used to be ?mrt=<memberId>.<iteration>, which put a real member id in every shared URL and let anyone enumerate ...
Accept the discount* signup fields, keep the mrt* ones working
The register site now sends discountVisitorGuid / discountCode. Both names are read, new first, because the two services deploy independently — for the minutes ...
Mint an opaque UUID token, in one insert
createCode generates the token itself, so there is nothing to read first and nothing for two tabs to collide over. That removes the whole apparatus the old sequ...
Make the shared token an opaque UUID
The public token was <memberId>.<iteration>, which was wrong on two counts. It published a real member id in every link anyone shared — on a business card, in a...
Retire ****************
Tracking codes are shared as ?discount=<uuid> now. The old <memberId>.<n> token published a real member id in every shared link and made the space walkable — on...
Serve a real per-request CSP nonce with strict-dynamic
Clears both remaining High findings on script-src: the 'unsafe-inline' one and "host allowlists can frequently be bypassed". Only a nonce with 'strict-dynamic'...
Enforce Trusted Types, path-scope the script allowlist
Clears the "No Content-Security-Policy header with Trusted Types directive found" finding by moving require-trusted-types-for into the enforced policy. This is...
Show when a visitor's credit moved to another link
The timeline gains ATTRIBUTION_MOVED, in the warn tone — not a conversion and not a failure, but the moment this visitor stopped being this member's to earn fro...
Move credit on a newer link, and record the moment it moves
The ingest worker now calls reattributeWhileAnonymous after the traffic bumps. The repository method carries the entire rule, so there is nothing to check here ...
Credit the newest link until an account exists, then freeze it
Attribution was frozen at first touch, which gets the common case wrong: someone who follows member A's link in March and member B's in June, and only then sign...
Move Windows Desktop and Master Machine into Platform Admins
Both are Guacamole targets that share one credential between everybody, which makes them operator tooling rather than a member's own workspace. They were top-ba...
CSP and COOP enforced; Trusted Types report-only
Re-lands the security headers after I took the site down with them, minus the one directive that did it, plus a build guard so it cannot happen again. WHAT BRO...
Enforce a CSP, COOP and Trusted Types
Adds the three headers the Trust and Safety audit asked for, plus Referrer-Policy and Permissions-Policy. Every origin in the policy was taken from what the sit...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.