Stop the sweep re-translating the twenty locales that already worked
An article holding 20 of its 21 locales is "incomplete", so the ten-minute sweep re-queued it — and the translator then re-translated all 21, paying twenty time...
Give the translation models room to stay resident, and refuse a scanner
libretranslate ran 4 gunicorn workers against a 12Gi limit, and each worker loads its own ~3GB copy of the argos model set — 11.8GB resident, 98% of the limit, ...
Map a provider's own folders onto the standard ones, wherever they sit
The last fix pinned a folder by the role the server gave it and still left a member on Google Workspace looking at "[Gmail]" among their own folders with their ...
Say whether a DAV server's credentials are already stored
The Apple iCloud / custom CalDAV panel shows four empty boxes whether or not a username and password are on file. It cannot do otherwise -- a stored password is...
Stop one member reaching another's calendar integration, and stop the endpoints handing out the credential
Two defects on the /settings/integrations/member endpoints, both live and both reachable by any signed-in member. The id was the only access control. Every /me...
Keep the folder in the path too, wherever it can survive there
The endpoints prefer the query parameter, but they are deployed separately from this code, and a browser that loads the new bundle a minute before EmailService ...
Stop a bad service-user JWT from disabling every member's softphone
Minting from a member's own JWT called configFactory.require(inst), which insists the phone server's SERVICE-USER JWT is present and well-formed. That credentia...
Create a subfolder under its parent, not beside it with a dot in its name
createFolder joined a parent to a new folder's name with a hardcoded ".". On Gmail, which separates its hierarchy with "/", that produced a top-level folder lit...
A role with no slot in the pinned block leaves the folder unpinned
indexOf answers -1, and -1 is not null, so a role that ever lost its place in PINNED_ROOT_ORDER would have pinned its folder ahead of the inbox rather than fall...
Bound the sign-in failure message carried back in the redirect
The RingCentral callback puts the server's own sentence in the query string so the member's tab can say what actually went wrong — nearly always an unregistered...
Take the folder from the query, so a Gmail folder can be addressed at all
The folder travelled as a path segment, and Gmail separates its hierarchy with "/" — its Sent folder is `[Gmail]/Sent Mail`. There is no way to put that in one ...
Revoke a reassigned member's RingCentral sign-in, don't just forget it
Offboarding deleted the member's credential row when they were moved off a phone server. That was the whole job while the credential could only be a JWT — Kamo ...
Make Gmail's folders open, and list them as folders rather than paths
Two faults, both from the client deciding for itself things only the mail server knows. **"Failed to load messages."** The folder travelled as a path segment, ...
Offer a RingCentral sign-in, not a JWT box, on every member
The per-member credential card had exactly one control: paste a RingCentral JWT. A RingCentral JWT is minted per user inside the developer console, by a user wh...
Let a RingCentral member sign in instead of minting a JWT
A member's phone-settings tab asked for a JWT credential, and that was the only way to connect them. A RingCentral JWT belongs to one user and is minted by that...
Report the folder separator and special-use role so Gmail's folders are recognisable
A member on Google Workspace saw every one of their folders listed under "My folders" with its raw path for a label — "[Gmail]/Sent Mail", "[Gmail]/Spam" — and ...
Make the scrollbar scroll the shell, because the scrollback is not here
The bar moved xterm's own buffer, and under tmux that buffer never grows: tmux sends the client only the lines that end up visible and keeps the history itself....
The terminal had no scrollback to scroll, so turn tmux's mouse on
for anything else. I built it against a bare xterm.js writing its own output and never against the real pipeline, which is the whole of the mistake. tmux is a ...
Make the startup fee findable — discreet is not the same as hidden
The note shipped at #8c8c8c with no spacing, wedged between the bright green term line and the plan description. That is DARKER than the body copy beneath it, s...
The end-terminal confirm was unreadable over the row behind it
Two things, both about the seam between a navigator and what is beside it. ## The confirm had no surface of its own A terminal row's actions sit OVER the row ...
Make the strike meter agree with its own caption, and read aloud
Three things the screen was getting wrong, all found by looking at it rather than by running it. The bar was a TALLY of failures, wrapping every five segments....
The lockout warning promised the wrong rung, and the wrong count
The strike meter on the sign-in screen was telling people something the server then did not do. tierFor starts the five-second delay at the SIXTH failure, but a...
Point the seat, payment-method and add-on calls at routes that exist
Four calls in posApi addressed REST-shaped URLs — /seats, /payment-method, /addons, DELETE /addons/{id} — and POSController exposes none of them. It has change-...
Remove the last "$0 setup" claim, and quote the fee only where it is fixed
Rendering the calculator turned up a claim the first pass missed: its "Included Free!" panel led with "Setup & Implementation — $0", struck through against a co...
A catalog-version bump must not read as "this host has no organization"
Org resolution funnels every lookup through one query helper that swallows the exception and answers Optional.empty(). For an organization that genuinely is not...
Retire the SMS provider's test verdict when its credentials change
The same defect as the phone server's Overview tab, one screen across: saving new credentials left the previous Test Connection result on display, so a "Test fa...
Restore SpfAdvisoryService, which main no longer compiles without
45829a6 deleted this file. Nothing in that commit wanted it gone — it was a staged deletion of mine that a concurrent `git add -A` picked up, and the same commi...
Catch the app credentials pasted into RingCentral's JWT box
Two things went wrong on the same screen, and together they produced a settings page showing a green "Credentials complete" chip above a red "RingCentral instan...
Tell a RingCentral JWT from the app credentials pasted into its box
An org pasted its RingCentral app's credentials JSON — the {"clientId": …, "clientSecret": …, "server": …} blob the developer console shows on the same page as ...
Point the integrations proxy at the path EmailService serves
The Manage Sources dialog forwarded to /api/settings/integrations, which EmailService does not map — its controller is at **************** Every request from th...
Drop the /api/settings forward, which pointed at nothing
EmailService serves the sync-integration controller at **************** not /api/settings/integrations — so that forward reached a path the service does not map...
Say why a mailbox sync failed, and what key is on file
Two silences that made a working Google Workspace connection read as broken. The mailbox sync caught the provider's rejection and dropped it. Google refuses th...
Stop a provider config save from discarding another form's fields
Every config panel posts only the fields it owns, flat, alongside the provider type -- the Google Workspace panel sends nothing but serviceAccountJson. PUT /api...
Route /api/contacts, /api/calendar and /api/settings to EmailService
KamoMobile's contacts and calendar screens 404'd on every request. Neither path was routed at the api host, so nothing reached EmailService and the service logg...
Send To AI must not open a tab in sage's editor
A Send-to-AI hand-off is hosted in a Remote Terminal the operator is already watching in the console. On top of that, the agent also handed the session to VS Co...
Restarting the agent must not kill every member's shells
mid-work today, and would have taken every other member's terminals with it. systemd's default is KillMode=control-group: on stop or restart it SIGKILLs every ...
Name the constructor Spring should use, or the context will not start
My own regression, and the second context-startup break on this service today: Error creating bean with name 'terminalTicketRegistry': Failed to inst...
Let Spring pick the terminal registry's constructor
SecurityService has been crash-looping on every new pod since the shared handoff store landed: "No default constructor found" for TerminalTicketRegistry, which ...
Tell the server which organization the resend is for
The verification screen's Resend button has been reporting success and sending nothing for every organization except the platform's own. `host` already rides i...
Resend the verification e-mail under the organization the member is actually on
Nobody at a white-labelled organization has been able to ask for a second verification e-mail. The screen said the letter was on its way every time, and no lett...
Stop a Yugabyte read restart from silently killing a transactional send
EmailTemplateService.sendToUser is the endpoint behind every service-to-service transactional email on the platform, and it was @Transactional over three reads:...
Share terminal tickets across pods, or half of them are refused
Opening a terminal fails about half the time with "The server refused the terminal connection. Your ticket may have expired", and the log says: Terminal ha...
Stop a password reset asking the operator to type ERASE
ConfirmationDialog described every action as a deletion. Left to itself it picked the type-to-confirm word at random from DELETE, REMOVE, DESTROY and ERASE, dre...
Answer "who owns this account" about the member, not the reader
The member payload now carries accountOwnedByThisOrg. The console used to work this out for itself by comparing the READER's securityOrgId to the current organi...
Restore the @Lazy that stops the context depending on itself
Every SecurityService pod built since 4bd25e7 fails to start: The dependencies of some of the beans in the application context form a cycle: ┌──->──┐ ...
The rollout-safety settings had to go where CI actually reads them
kamo-register is the only service on the platform whose CI generates its Deployment inline, with a heredoc, instead of applying k8s/deployment.yaml. Two consequ...
Stop redirecting kubelet's probe into a port nothing serves
This service exists to redirect, and a redirect is exactly what a health check must never get. kubelet probes the pod IP, so the Host header is something like ...
Share the delivery consumer, so a second pod is not refused
Caught in production the moment services went to two replicas on 2026-09-04. Every pod carrying this class logged, once, at boot: [Webhook] Failed to subscri...
The operator write must answer in the same shape it was asked in
The console adopts this response as its new state. It returned the address and `canChange` but not `mode` or `isSelf`, so after a successful operator write `mod...
A god may fix their own address from any workspace
The tenancy rule refused a god-eligible caller on their OWN record whenever their session was in an organization other than the one that owns the account. That ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.