Live Change Log

Three independent findings, fixed together because the first two share files and a class. 1. AiMcpController had zero right checks on create/update/delete/test...

Four related holes, all the same shape: a request carried an authenticated member, and that was treated as enough. - **************** SessionFacesController.fa...

DocsService's imaging endpoints (download/stream/list/delete) know an Img's id but have no reason to hold the MediaObj it was attached to — until they need to h...

The lead ledgers (securityservice create_lead_ledgers.sql, applied 2026-09-22) replace COUNT(*) over a 796k-lead pool and over lead_credits with maintained tota...

/leads/credits (GET /api/security/credits/manage) counted the lead pool once per allotment row — ~8 s apiece against one org's 796k-lead pool — then once more g...

"Leads available" was COUNT(*) over the assignable pool, and one org's pool holds ~796k leads: ~7.8 s per (market, product) count and ~11 s for the grouped one ...

CheckFileInfo was the only WOPI endpoint that both compared the access token's document against the request path and re-checked live access; GetFile, PutFile, P...

The last four surfaces that named a member with nothing to open, now that MediaService sends the ids (fa25989): - Reply quotes: the quoted author's name opens t...

RagSearchController read orgId/memberId/memberType from the JSON body on every path, including requests authenticated by a *** session rather than X-Internal-Au...

Generates a phone-server UUID when JustCall is selected and shows the webhook URL immediately. That same id is sent on create so the URL the member pasted into ...

The new-phone form generates a UUID before create so the member can paste the webhook callback URL into JustCall while requesting API credentials. Create accept...

The prior image build failed check-i18n-keys; the English strings now live in kamo-translation-dictionary.

Adds GET /api/voip/setup so the settings UI can show the exact per-instance webhook URL without hardcoding the deployment host.

Surfaces the per-instance callback URL on the JustCall new-phone and overview tabs so members know what to give JustCall when configuring APIs and webhooks. The...

Docker builds can still be settling after prerender workers finish; extend upstream and probe waits and surface child stderr when startup fails.

Reduce NAV_LOGO_RISE from 10 to 7 so the mark sits slightly lower while keeping shared chrome math in sync.

Body already reserves the preview strip; main padding now clears only the nav row and logo overhang so inner pages do not stack a second chrome band.

backdrop-filter on the header trapped position:fixed children so top and margin offsets never moved the mark; pin it to the viewport instead.

The dynamic top calc was not shifting the mark; mirror nav-row flex centring and pull it up 10px with marginTop.

Stop relying on translateY(-50%), which was not moving the rendered mark, and place the logo 10px above nav centre explicitly.

Anchor the mark 10px above nav center instead of shifting it down with a transform miscalculation.

Use fixed positioning so the mark escapes the nav header stacking context and paints over the red strip.

Replace the SVG wordmark with kamocrm-logo-full-v4 so the mark extends above the red strip and below the nav bar.

Draft batches keep totalAmount at zero until send — it is a post-send snapshot, not a running total — so the compose UI now sums line amounts for the KPI tile a...

The browser keeps member ids as strings to avoid IEEE-754 rounding on CockroachDB unique_rowids. Normalize to Long before relaying so the credit lands on the in...

EmailService now sends the member behind each change in an address's opt-out history (actorMemberId, text). On Settings → Email → Deliverability a colleague's n...

EmailService now sends the member ids on aliases and shared-mailbox access as text. As JSON numbers they were rounded past 2^53, so these tabs matched nobody on...

Four surfaces showed a member by name with no id beside it, so the console's member card had nothing to open. Each now sends the id as TEXT next to the name it ...

Settings → Email → Deliverability shows an address's opt-out history with who made each change, but HistoryView sent only the actor's name, so the page could no...

GET and POST /api/email/aliases (and /aliases/member/{id}) and GET and POST **************** answered with the entities themselves, whose Long memberId and gran...

EmailService now sends the member behind each address's last change (lastActorMemberId, text). The list cuts their name out of the "last changed by" sentence (a...

The opt-out list named who made each address's last change (lastActorName) but not who they are, so the settings page could not open their member card. Each row...

Wires the ids the services now send: - Document history (DocManager's changes and downloads, the marketing material drawer's history): the member by name (mem...

GET /api/billing/self/coverage named the billing group's manager (managerName) but not who they are, so the member's plan page could not open the manager's memb...

GET /api/voip/numbers wrote ownerMemberId as the entity's Long. A member id is an INT8 past 2^53, so the settings page read it rounded: the owner was never foun...

GET /customers/{uid} sent the primary member only as primaryMemberId, while the account view reads a primaryMember object — so its Primary member row read "---"...

kbservice answers /articles/{guid}/versions with a Spring Page of its entity. The history component read the body as a list and called .map on the Page, so it n...

A MemberHoverCard around a face alone was a focusable button with nothing to be named by. It takes an optional label, used only when the trigger has no text of ...

Three agents and the first sweep each taught the app the same trick — format a translated sentence with a mark where the name goes, split on it, draw the name a...

GET /imaging/history/changes and /history/downloads built each row with Map.of, which throws on a null — and a row with no IPv6 address, no prior data or no mem...

Every remaining member these screens show opens the member card. Ids are the strings the data carries, each checked on the server's origin/main. - History (Ent...

The owner's two: the Achievement Leaderboard and Affiliate Scoreboard widgets had the card on the 20px face only. MemberFace (BoardChrome) now takes the row's n...

Where a face already opened the member card and the name beside it did not, and on the lines that name people. Every id is the string the data already carries, ...

The header band now shows the member's own desktop wallpaper — their first photograph on air, or the organization's when that is what their desktop plays — unde...

GET /members/{id}/card gains "wallpaper" for the card's header, resolved the way the console backdrop and the profile hero resolve a member's desktop: none when...

kbservice answers GET /articles/{guid} with its entity, so authorMemberId is a JSON number, and JSON.parse rounds a 19-digit member id. The article route compar...

A name's trigger handled Enter and Space but let the key bubble on, so a list around it that acts on Enter itself — the timecard approvals queue opens the membe...

The member card now keeps the events that start something inside itself (a92b3cac), for every surface, so the chat row's own guard against a press from its card...

Presence and availability are provided inside AuthedChrome, but the ToolDock — every chat, ticket and social window, and the chats switcher — is mounted above i...

Every member these screens name now opens the member card. Ids are the strings the data already carried, except where noted. - PersonCell / PersonStack (HR att...