Refuse to award a member whose security type excludes it
AchievementController checks VIEW_ACHIEVEMENTS on all four of its endpoints, and that read like the rule being enforced. It was not: it is the rule enforced on ...
The same-commit-rebuild guard could never fire, so every dispatch failed
Rebuilding this service without a commit of its own — a workflow_dispatch, a re-run, or a kamo-shared-library change it must pick up — has been failing at deplo...
A pane lock survives the editor alt-tabbing away
The client heartbeats its pane lock every 15s and the sweeper released any lock unheard from for 45s — three missed beats, which reads like a generous margin an...
Probes for the eleven derived easter eggs
Eleven of the fifty secrets are questions about durable data rather than about whether a member has SEEN something, so they are DERIVED and they backfill: a mem...
Award Loitering from the session that is still open
The measure is the age of the *** the member is holding, so the session had to start carrying the instant it was minted — nothing anywhere recorded it, because ...
Serve the three layers of the contact-effect stack
GET /api/security/contact-effects returns the platform, org and member layers in one round trip; PUT and DELETE on /{scope} write and reset one layer. The servi...
Baseline the single-action event endpoint
Same door and same reasoning as its sibling one line above: X-Internal-Auth, constant-time, fail-closed. Genuinely pre-session — a mobile sign-in is reported by...
Award and backfill the single-action achievements
Twenty-six of the thirty-five are questions the database can already answer, so they are awarded by asking it. SingleActionProbes holds one EXISTS per achieveme...
Award the six tracking-link achievements, and backfill them
**************** reads all six of a member's marketing counters in one row and settles all six tracks against them. Wired into /self and /self/pending beside th...
Baseline the growth-mission sync endpoint
**************** caught the new internal endpoint, which is what it is for: with anyRequest().permitAll(), a handler that resolves no caller is reachable throug...
An owner's storage position, carried on a payload that already exists
The launchpad is getting a storage meter, and the obvious way to feed it is a request of its own on every page load. The numbers do not deserve one: "used" come...
Award SPREAD_THE_WORD from the Growth Hub
**************** counts a member's APPROVED Growth Hub submissions and settles their SPREAD_THE_WORD level against that count. It RECOUNTS rather than being to...
The baseline award was two transactions, not one
`ensureBaselineFor` calls `ensureBaseline` on `this`, and Spring's transaction advice is a PROXY — a self-invocation does not pass through it, so the inner REQU...
Award Join The Team to everybody, without a backfill
SecurityService owns the member, so it owns the achievement. It awards, reads, acknowledges and publishes; MediaService only relays. EVERY MEMBER GETS JOIN THE...
A callback can carry the link to the call
The lead page composes a callback in the calendar's own dialog, and every field that dialog collects is meant to survive the trip through here. meetingUrl did n...
A callback can invite the lead it is with
Scheduling a callback told the lead nothing. The dialog said so outright — "The lead is not notified" — and the only way to get a customer the time in writing w...
Send To AI tells everybody on the thread, not just the reporter
The dispatch sends the same letter MediaService does, so its audience has to move the same way: every participant in the report's thread minus whoever acted, ea...
Wire the god guard into the identity-rights test's policy
UserAccountEditPolicy took a third constructor argument and this test still built it with two, so test-compile failed — and CI runs `mvn package -DskipTests`, w...
Only a god may administer a god, and no god is impersonable
MANAGE_USERS reached the break-glass identity. UserAdminController guarded only the System User, so a non-god holder could disable a god account and revoke its ...
Say which plan an organization is on, and who may change it
The console could tell that a trial was running and nothing else. entitlementSource is "TRIAL" or null, so free, expired-trial, paid and comped organizations we...
Keep the dispatch's status write in step with the denial reason
Two services move a system bug's status, and only one of them knew about the new denial_reason column. A dispatch applying IN_PROGRESS to a report that had been...
An administrator may grant a peer or a lesser, never a superior
MANAGE_PLATFORM_ADMINS is the right to administer the platform's access list, not a right to invent access. Without a ceiling it was silently every right at onc...
Sweep the dev machine for coder usage and publish what moved
Feeds the two meters the Linux Desktop menu now draws — how much of a member's A sweep rather than a push, because the numbers are born on the machine and stat...
Deliver ribbon wording, and generate favicons from a tab icon
Provisioning learns two things: what an organization wants its public corner ribbons to say, and which artwork its browser-tab icons should be cut from. **Ribb...
Log a referral code that arrives with no visitor guid
A signup carrying a marketing code but no visitor guid had its referral dropped in complete silence — the branch that publishes the attribution event is gated o...
Record the advert for a candidate who signs in instead of registering
Registration already wrote recentlyAppliedForId when an account was CREATED. This is the other half of the same funnel: plenty of people who press Apply on the ...
Record the advert a candidate registered for, and welcome them when hired
Registration on the /team path now accepts appliedJobId — the uid kamo-register parked when the careers board sent the candidate to /team?jobId= — and writes it...
Publishing an application opens its chat key to the page it is on
The support widget on a published application loaded with Kamo's default config instead of the org's: it auto-opened on desktop with auto-open turned off, wore ...
Publish an application deliberately, and give its page a chat key
`PUT **************** publishes or retires a product's public page and records which web chat its support widget speaks through. Enabling without one is refused...
Close the last two catalog-bump gaps, and stop echoing exceptions
Two reads and nine response bodies, both halves of the same report. SessionRefreshController loaded the member one statement before the rights read that was fi...
Stop handing the database's own error text to whoever is signing in
The catch-all at the end of login() put e.getMessage() in the response body, and that body is rendered verbatim on the sign-in screen. On 2026-09-05 the excepti...
Send the application receipt after the commit, not inside it
The submit handler is @Transactional, and it was calling EmailService inline — blocking HTTP into blocking SMTP with a 30-second read timeout, while holding a d...
Serve the public mortgage application, addressed by product
Three unauthenticated endpoints under **************** plus the CRUD behind the organization's own state licences. **The organization is named by the PATH, nev...
Stop stranding phones on a rotation they never received
KamoMobile was signing itself out at random, most visibly across app updates, and the exchange endpoint was doing it. Three separate ways: The secret rotated F...
Merge the digest output instead of declaring a second outputs block
The previous commit added an `outputs:` key to a job that already had one. Forgejo's parser rejects a duplicate mapping key and skips the workflow entirely, so ...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
The lockout warning promised the wrong rung, and the wrong count
The strike meter on the sign-in screen was telling people something the server then did not do. tierFor starts the five-second delay at the SIXTH failure, but a...
Expose what a seat change will cost before it is made
Raising a subscription's seat count now raises an invoice — a per-seat startup fee follows the person, so ten hires on a $99 plan is $990 and a large account ru...
Record which domains authorize us, so their mail can go out as them
Transactional mail currently picks its From address by asking who hosts an organization's MAILBOXES. That is the wrong question. Whether we may send as chinilaw...
A catalog-version bump must not read as "this host has no organization"
Org resolution funnels every lookup through one query helper that swallows the exception and answers Optional.empty(). For an organization that genuinely is not...
Carry a terminal's activity state to the console
TerminalSummary gains `state`: busy, or waiting for its member. Read off the session's transcript — neither of which is knowable from here, which is why it trav...
Restore SpfAdvisoryService, which main no longer compiles without
45829a6 deleted this file. Nothing in that commit wanted it gone — it was a staged deletion of mine that a concurrent `git add -A` picked up, and the same commi...
Carry the member's model and effort to a coder session
and deliberately not examined here. `coder_flags` on the agent is the one thing that decides what a session runs with — its own comment calls it "the security ...
Refuse a sign-in whose host names no organization
Such a host could sign in until now. It fell through to the workspace-choice path and succeeded on membership alone, which made it a door where none of the tena...
Name the constructor Spring should use, or the context will not start
My own regression, and the second context-startup break on this service today: Error creating bean with name 'terminalTicketRegistry': Failed to inst...
Let Spring pick the terminal registry's constructor
SecurityService has been crash-looping on every new pod since the shared handoff store landed: "No default constructor found" for TerminalTicketRegistry, which ...
Progressive sign-in lockout, escalating to a permanent IP block
A wrong password now costs something, and the cost climbs. Counted since the subject's last successful sign-in: the first five failures are free, the sixth and ...
Resend the verification e-mail under the organization the member is actually on
Nobody at a white-labelled organization has been able to ask for a second verification e-mail. The screen said the letter was on its way every time, and no lett...
Say out loud when a registrant is left with no verification token
The register endpoint caught a failed verification send and logged warn(e.getMessage()). For the fault it kept hitting — EmailService raising a Yugabyte read re...
Share terminal tickets across pods, or half of them are refused
Opening a terminal fails about half the time with "The server refused the terminal connection. Your ticket may have expired", and the log says: Terminal ha...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.