Live Change Log

A flex item's automatic minimum size is its min-content width, which for wrapping text is its widest word — so a crowded bar squeezed these controls narrow enou...

Both summarize methods are @Transactional(readOnly = true). Each issues six or seven reads whose figures are cross-checked ACROSS query boundaries: countOverdue...

The wrong-path bug is fixed and the response shape is verified, but the CLASS of failure it belonged to was still open: if TimecardService renames `blocking`, d...

The rule carried BOTH a radial-gradient and a box-shadow. The gradient filled its own box while the box-shadow painted a separate ring outside it — two concentr...

Every BreadcrumbJsonLd and ItemList URL was hardcoded to /en, so the structured data on /fr/terms told crawlers its breadcrumb parent was the English page — 19 ...

Every figure on the masthead and the four pillar cards was its own stacked box — Operator Label above, value below. Operator Labels are uppercase with 0.12em tr...

attendanceState() marked every member 'clear' whenever blockingExceptions was 0 and timecardState wasn't 'SUBMITTED' — true for every member under a caller lack...

With FINALIZE_PAY_PERIODS held, a 5xx/404/unparseable close-readiness response left awaitingApproval sitting at its initial 0 — the WARN log fired but the HR Ov...

SecurityService now withholds the approval half of the summary from a caller without FINALIZE_PAY_PERIODS — resolveRole never admitted MANAGE_TIMECARDS to appro...

Pointing the composer at close-readiness widened privilege. That relay's own mapping guards with FINALIZE_PAY_PERIODS, and resolveRole does not admit MANAGE_TIM...

The masthead percentage mixed units and could only flatter. `complete` summed org-wide ASSIGNMENT counts while `open` counted MEMBER-DOMAINS off memberRows, cap...

Both summary services built members[] with .overdue(0). The Overview's matrix branches on that field, so legal and training could only ever render amber or gree...

summarize() asked TimecardService for **************** That is the name of the SecurityService MAPPING, not of any downstream route. TimecardService has no such...

OverviewPillars.tsx hard-coded **************** instead of deriving them from **************** the way AttentionLedger.tsx already does — same name-indexed patt...

**************** was loading the org's entire non-hidden HR_RESOURCE Img collection into memory to filter trashed, sum bytes and take 5 recent rows in Java — un...

Key coverage is not translation. TranslateService returns the source text when no provider supports a direction — ProviderRouter logs "No provider supports en->...

Interrupting the IDLE thread cannot end an IDLE: it is parked in a blocking socket read that only sees the flag once the read returns on its own, up to Dovecot'...

Every non-English page carried a hardcoded canonical to its /en twin — `export const metadata` is module-level, so it could not vary by locale and 28 pages ship...

Both replicas sat pinned at 1997m/1999m against a 2-core limit for ~47h. That starved /languages enough that the liveness and readiness probes timed out (443 an...

Both providers gated supports() on "en".equals(sourceLang), so every inbound pair was decoderd before a provider was ever asked. ProviderRouter treats "no provi...

Drops the immediate flag from the client entirely — there is no longer a way to ask for access to stop today, because there is no good reason to want one. The g...

Cancel no longer takes an "immediate" flag, and no customer-facing route can ask for one. Passing it true ended the subscription the same day while asking Strip...

TrainingSchemaMigration @Order(43) has been aborting EVERY KamoInitializer run, silently withholding all 29 runners ordered after it (orders 45-112). Observed i...

The self-pay and seat-coverage panels were on /settings/account?tab=billing. That page redirects anyone without CONFIGURE_SYSTEM or a finance right back to /set...

Found by running it. YugabyteDB performs online schema change, so a CREATE UNIQUE INDEX issued while Hibernate's ddl-auto pass is still settling can lose the ra...

1b3553f staged its two new test files and nothing else, so it landed asserting a nullable FolderManager.setFlags that did not exist yet and cannot compile on it...

IMAP flags are independent, so "mark this read" must say nothing about the star. EmailImapService.setFlags has always taken nullable Booleans and skipped the nu...

The backend now streams to 3 GiB, but three things in the browser and the BFF made that unreachable, each fatal on its own. The upload proxy did `await request...

Chat attachments have run at 3 GiB through this same imaging pipeline for a while; documents were capped at 500MB. The difference was not a policy, it was that ...

A durable JetStream consumer keeps the filter subject it was created with for the life of the stream. When the owning code later changes that subject, jnats ref...

SettingsView declares an 8px primary-tinted scrollbar on the white card, but that card never overflows — every ancestor down to TabPanel is flex:1 with minHeigh...

The console rendered flush against the settings card on all four sides. Nothing in the container chain pads a tab child — SettingsView's card, its inner Box, Ta...

Loading the console makes four calls, and any one of them throwing produced "Couldn't load your billing" with nothing else on screen. The subscription list is t...

BillingGroup was mapped to billing_groups. That table already existed — one of a seven-table subsystem (billing_group_members, _subscriptions, _licenses, _invoi...

MINIO_SECRET_KEY was moved into the minio-app-credentials secret, but the envFrom supplying it was only applied live and never committed, so a CI reconcile woul...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

StorageQuotaService took its five repositories as required constructor arguments. Services in this estate component-scan com.kamo with a wildcard but declare an...

The object-storage key sat in k8s/configmap.yaml, which kubectl will hand to anyone who can read the namespace, and the same string was hardcoded as the SSH pas...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...