v0.7.02026-09-22

Features

  • —119-01: cost, spend & billing integrity remediation (t1-t11)
  • —119-05: test coverage, RAG re-sync & dev-doc hardening
  • —129-07: page on stalled cadence lanes and spent recovery budgets
  • —129-07: select due users from the obligation ledger, not the clock
  • —130-01: close app traffic during restores
  • —130-01: complete reset verification and auth fencing
  • —130-01: dispatch reset outbox with leases
  • —130-01: erase providers in canonical reset
  • —130-01: erase support history before local deletion
  • —130-01: harden resume file admission
  • —130-01: harden resume upload and account restart
  • —130-01: journal and fence account resets
  • —130-01: make resume ingestion recoverable
  • —130-01: protect reset obligations outside user cascades
  • —130-01: refuse reopening on stale restore evidence
  • —130-01: verify Google credential revocation
  • —130-01: verify reset identity and residue absence
  • —42L-831: publish cover letter templates goodie
  • —42L-834: rendered resume examples for the Career Hub, 4 locales
  • —admin: unify staff console + fp create-partner modal
  • —sim kill-switch + real batch-unit abort (300s sigkill fix)
  • —sim safety kill-switch + delivery-mode observability for big-sim
  • —model-comparison SIM harness + gateway alias contract sync
  • —transactional email hardening — sender domain, beta-gate off, LD 2.8.0, digest consolidation
  • —real abort for batch AI calls + adapter fetch timeouts
  • —staff manual run and non-production spend guard
  • —real global staging model floor + manual test-batch button
  • —staging model floor + manual test-batch button
  • —resume language fidelity + model routing fixes
  • —admit language before persistence and accounting
  • —bind the async contact queue to its language claim
  • —bind the whole pipeline to the user's chosen language
  • —generate the source disposition and gate omissions in CI
  • —make language final after onboarding, in the database
  • —persist language facts and require the pipeline claim
  • —refuse downstream AI spend under a stale caller claim
  • —unblock Italian on the lookup and referral surfaces
  • —multilingual staging fixtures — four-locale cohort owned by schema
  • —partition fair rotation by role family and channel
  • —durable batch execution, eligibility and cadence evidence
  • —language-incident repair pipeline
  • —converge the app shell on Design System 2.3.0
  • —move the pin to DS 2.4.1 and fix the --input drift
  • —colour-format unification + DS pager + segmented filter
  • —brand: adopt the licensed Cosmata wordmark
  • —brand: swap the app onto the new Hiresling lockup
  • —brand: swap the hiresling share cards for the org template
  • —career-hub: Cover Letter Examples assets and footer link
  • —dashboard: add V2 app-faces dashboard + editorial console experiment
  • —dashboard: app-faces V2 dashboard + editorial console experiment
  • —dashboard: app-faces v2 dashboard enhancements (flag-gated)
  • —dashboard: close v2 parity with legacy dashboard
  • —dashboard: make v2 the default, v1 kept as escape hatch
  • —dashboard: opt-out confirmation toast + accurate modal
  • —dashboard: sent-confirmation toast after single approval
  • —dashboard: settings v2 chrome, DS type pass, activity stats
  • —dashboard: swiss mono app-surface retrofit + full i18n
  • —delivery: monthly-guarantee delivery curve (behind DELIVERY_MODEL)
  • —ds: adopt 42labs design system 0.9 tokens app-wide
  • —fence reset identities and verify deployed residue
  • —i18n: detect locale on first visit, cookie-absent only
  • —i18n: single-plan cleanup + localize help-center
  • —infra: self-hosted Railway to Slack deploy relay (drop Pipedream)
  • —landing: gauge-free component pass + pricing polish
  • —landing: lead the demo CTA with a play glyph
  • —landing: localise the review-gate stage labels
  • —landing: locked LP copy — steps, fictional cast, 12 features, single-plan FAQ
  • —legal: membership naming + 30-day ceiling disclosure on the up-to-100 claim
  • —link admin version pill to changelog
  • —login: DS-scoped login reskin
  • —migrate support escalation from Plain to Libredesk
  • —onboarding: join links set a 30-day cookie for the offer paywall (t3)
  • —onboarding: join links set a 30-day cookie for the offer paywall
  • —partnerships: localize /partnerships to all four locales (42l-826)
  • —partnerships: move partner-terms note below the hero ctas
  • —partnerships: PT-only affiliate + partnership page with enquiry intake (42L-826)
  • —pipeline: openings sourcing + scrape-leg repair (adhoc-openings ,)
  • —reach: measure landing-page reach across all sources
  • —spend: data guardrails ( +) — dormant until armed
  • —spend: t6 — global data ceiling computed live
  • —staff: finalize test batch toast copy
  • —start language-bound pipeline safeguards
  • —subscribe: single-plan checkout + EU consent + welcome email

Bug Fixes

  • —119-01: keep t1 e2e sim_day marker within smallint range
  • —119-03-h1: add FK cascade so user deletion purges usage_tracking_monthly (OI-34)
  • —129-08: drop dead pipeline exports flagged by knip
  • —130-01: align generated types and export surface
  • —130-01: anonymize audit actors during reset
  • —130-01: anonymize detached audit email residue
  • —130-01: close staging reset inventory gaps
  • —130-01: enforce reset preflight ownership
  • —130-01: harden account reset target handling
  • —130-01: preserve localized upload errors
  • —130-01: provision admission hook with atomic identity trigger
  • —130-01: reconcile migration order and generated types
  • —a11y contrast on /dashboard + deterministic gate
  • —adhoc: hard deadline on batch pipeline steps to stop stuck-lease abandonment
  • —auth: redirect authed visitors off /login server-side
  • —auth: repair staging Sign In dead-end (/login?next= + clear dead session)
  • —pin purge_stale_places statement_timeout to 120s
  • —connector turn-on validation — registry timeout fix, MX DENUE load, dropcontact defect
  • —unbreak sim send leg + surface persona failures
  • —consolidated review remediation (pass 1 — partial, WIP)
  • —spell out ATS jargon, legal pronoun, connector-state docs, drop preview-app-faces
  • —unescape it consent privacy link (icu apostrophe)
  • —stale subscribe-heading E2E + affiliate portal link
  • —close the review findings and the two red staging e2e checks
  • —resolve the enforce-arm refusal instead of shipping a stale flag
  • —guarantee the opt-in-renewal arm so we never auto-renew
  • —localize the two model-free fit rationales and accept a localized yes
  • —stabilize dashboard e2e spec against live V2 drafts feed
  • —resume language guard, lifetime-counter read, eval call shape
  • —un-export unused LANGUAGE_LABEL/PromptLanguage symbols
  • —align drain counters with the row; pin the three bypass fixes
  • —allow-list the backfill target and close the row-skip window
  • —classify the new .in sites for the m13 chunking guard
  • —clear the knip dead-export and unlisted-binary findings
  • —close review findings CR-B5/B6/B7, SR-H3, SR-H5, SR-M2
  • —close review round 10 — two read-then-write races and a hole under the routes
  • —close review round 11 — expiry handed the bypass back, and a fan-out spent unchecked
  • —close review round 12 — a forgeable takeover, and counters that outran the database
  • —close review round 7 — my own SR-H5 fix was worse than the bug
  • —close review round 8 — a dead guard, a delete race, an orphan mock
  • —close review round 9 — a cap that still deleted, a lock only I respected
  • —close review-round-17 findings, including one I caused
  • —close round 13 — I guarded the takeover and left the front door open
  • —close round 14 — two more unguarded paid calls, and .2/.3
  • —close the language write boundary and the backfill loop
  • —close the remaining r17 HIGH findings
  • —give the playwright fixture its language evidence too
  • —give the staging e2e fixtures the language evidence the gate now demands
  • —give the staging e2e fixtures their language evidence
  • —guard the buffer SERP and promotion voted-eval
  • —guard the last three paid boundaries
  • —guard the SERP lookup, and a fixture that proved nothing
  • —make G12 prove the race, and correct the deletion docs
  • —make refusal telemetry truly unattributable; never delete an unwarned account
  • —make the English fallback asymmetric, by consequence
  • —per-CALL claim checks in the batch fallbacks
  • —re-check banked rows against language admission
  • —rebuild the chat rag index off the reworded kb
  • —retarget staging e2e off dropped language_revision
  • —scope the backfill completion claim to a DB snapshot boundary
  • —state language finality in the kb and locale copy
  • —state the backfill claim as an observation, not a guarantee
  • —state the four-language rule in the public chat kb
  • —fail the seed when contact writes are silently dropped
  • —repair the three defects critic round 9 disproved
  • —repair the two zero-output defects the critic found
  • —restore the staging probes after 's account guards
  • —a reaped first_batch run must keep first-run ordering (CR-M2)
  • —align staging e2e with the durable first-batch route
  • —close cr-m3, cr-l1, cr-l2, cr-l4 from the reaper review
  • —drop the temp table plpgsql_check can't see through
  • —give the wizard route its own wrapped colours
  • —re-vendor the token artifacts past a stale CDN edge
  • —repair mobile E2E + last dashboard contrast node
  • —repair staging E2E — nav tab→link role + settings chip contrast
  • —restate the four canon-finished dark tokens as triplets
  • —restore the keyboard focus ring on the dark app bar
  • —stop the 2.4.1 bridge repainting the onboarding wizard
  • —vendor the immutable versioned token artifacts, not `latest`
  • —scope fixture-pool AC2 counts to the canonical cohort
  • —track the cohort in the AC4 recycle test
  • —batch: close 129-07 completion-audit S7/S8/.1 gaps
  • —batch: record eligibility hold_reason on pre-run skip
  • —batch: refuse automatic recovery on top of output a run already delivered
  • —batch: serialize admin manual batch trigger under the per-user pipeline lock
  • —brand: give the app's brand svgs an intrinsic size
  • —brand: put the retraced mark on the app
  • —ci: read registry payloads from the private checkout, not the public host
  • —ci: run the app↔gateway alias drift gate for real in CI
  • —ci: stop third-party outages failing CI, and enforce MANIFESTO §9 for real
  • —close referral double-reward race, correct renewal-flip doc comment
  • —copy: capitalise the three english banner continuations
  • —covers: drop app-bundled cover PNGs — served from blob cdn now — TD-202
  • —dashboard: collapse draft card from header + hide recipient email
  • —dashboard: footer flows in-page, pinned to bottom, ruler contained
  • —dashboard: guard draft-card header keydown to currentTarget
  • —dashboard: localize the V2 "Request changes" dialog
  • —dashboard: pin footer to viewport bottom on short/empty pages
  • —dashboard: report fit_score shape drift once per signature, not per render
  • —dashboard: satisfy react-compiler lint in V2 tour/menu
  • —dashboard: theme-scope layout for preview + drop unused scaffolding
  • —dashboard: unify top-bar chips, frame staff pages, lock header size
  • —dashboard: use next/link for the Adjust-my-targets CTA
  • —deps: bump smol-toml 1.7.0 -> 1.8.0 for GHSA-7w5x-hrqm-74c2
  • —e2e-tester findings + dashboard gauge
  • —e2e: force HOME=/root for firefox in CI + gate mobile lane
  • —e2e: force HOME=/root in CI so firefox actually launches
  • —e2e: make e2e.yml fully green — pool sessions, self-heal fixtures, mobile lane
  • —e2e: make the mobile dashboard specs locale-proof and count visible tabs
  • —e2e: send consent to checkout in payments staging suite
  • —e2e: set HOME=/root in CI for firefox + gentler mint concurrency
  • —e2e: unblock firefox in CI + gentler mint concurrency
  • —enforce bounded resume extraction
  • —fonts: use Space Grotesk variable font (drop deprecated static weights)
  • —hard 404 on unknown company-fit via (shell) route group
  • —i18n,seo: audit 260824 — brand gender, canonicals, changelog disclosure
  • —i18n: apply glossary canon across es/pt/it catalogs and legal docs
  • —i18n: apply the i18n review to the stage copy
  • —i18n: number agreement in scoreboard stage labels (pt/es/it)
  • —i18n: one effective-date label per locale, lowercase months
  • —i18n: one name for the terms document in pt and es
  • —i18n: ration em-dashes across all four message catalogs
  • —landing: footer Security link, legal close navigation, pricing CTA
  • —landing: hero body wraps to two lines in every language
  • —landing: keep every localized footer destination in the visitor's locale
  • —landing: repoint partnerships + career-hub at live tokens after DS 0.9
  • —landing: stop the review-queue cards overflowing their card
  • —mobile landing-nav e2e assertion + idempotent company seed
  • —mobile-responsive fixes for public site (all mobile-audit findings)
  • —nav: header wordmark returns to the landing page everywhere
  • —never let the company-fit judge invent a match for a blank company
  • —onboarding: refuse a zero-row onboarding-completion write, not just an errored one
  • —onboarding: tone-picker lock, follow-up cadence step, comp scoring note
  • —partnerships: keep the footer link in the visitor's locale (42L-826)
  • —pipeline: bind repair replay to protected state and committed claims
  • —pipeline: bound the discovery cascade by the batch deadline
  • —pipeline: harden P129 evidence gates and alert boundaries
  • —pipeline: promote completed P129 safety and worker fixes
  • —pipeline: release finished leases before continuation
  • —pipeline: stamp account_generation on background user tokens
  • —proxy: put the app-faces preview mock behind auth
  • —reap an abandoned batch lease at claim time
  • —reject checkout for already-active subscribers server-side
  • —remove product pronoun from share text (en/pt)
  • —repair validation and bind location language evidence
  • —reset: clear reconciled operation errors
  • —reset: isolate protected log schema
  • —reset: key target fingerprints
  • —reset: make operator teardown resumable
  • —sast: resolve the 8 pre-existing high Semgrep findings blocking every staging PR
  • —scripts: unbreak the operator CLIs on staging
  • —scripts: widen test-user reaper to anderson+/ops+hs-test patterns
  • —security: block never-subscribed accounts in pipeline + send gates
  • —security: gate onboarding/first-batch on active subscription
  • —security: td-218 signup throttle + td-219 abandoned-account reaper
  • —self-heal orphan companies in e2e seed
  • —serp: capture recruitee ats tokens by blocklisting the apex host
  • —sitemap: drop /login (auth page, no search intent) — TD-204
  • —strip internal block IDs from changelog in every form
  • —td-215: italian /it/ref referral links skip middleware
  • —td-216: detect locale on every public page, not just the root
  • —test: match subscribe heading to membership copy
  • —types: regenerate database.types.ts against local stack, not --linked
  • —wrap legal-page tables so long-translation locales don't overflow mobile
v0.6.02026-08-27

Features

  • —114-02: wrap RLS auth calls in (select …) for InitPlan hoisting
  • —114-03: chunkedIn util for unbounded .in sites (M13)
  • —114-08: delete unreachable subprocess AI path (M23)
  • —114-12: d-4 un-suppression lock on contact_hashes (operator-ruled)
  • —115-01: MED/LOW code sweep — alerts/dropcontact/scripts/settings hygiene
  • —115-02: MED/LOW data sweep — normalize anon-lockdown + rls_auto_enable fail-loud
  • —119-01: cost, spend & billing integrity remediation (t1-t11)
  • —119-05: test coverage, RAG re-sync & dev-doc hardening
  • —42L-831: publish cover letter templates goodie
  • —42L-834: rendered resume examples for the Career Hub, 4 locales
  • —adhoc-lp-flip: nav/footer restructure — Career Hub anchor, Features dropdown, section reorder
  • —adhoc-lp-flip: promote landing to shared dir, wire i18n + flag mechanism
  • —adhoc-lp: header icons, scroll-aware border, and hero polish
  • —adhoc-lp: iterate on /lp prototype visual design
  • —adhoc-lp: rework footer, rename Blog to Career Hub, add How It Works nav item
  • —adhoc-lp: stage Figma landing page prototype at /lp
  • —admin: unify staff console + fp create-partner modal
  • —ai: provider-failure alerting + dead-provider fail-fast
  • —make Italian a permanent first-class locale
  • —bigdatacorp br contact connector + legal disclosures
  • —bigdatacorp br contact connector + t7 tests
  • —t6 legal — disclose bigdatacorp as paid br contact source
  • —argentina RNS company registry (firmographics cache + shared matcher)
  • —mx denue company registry
  • —es/latam contact finders — leadmagic, prospeo, denue on-demand
  • —italy contacts — dropcontact post-cascade verification pass
  • —refund & cancellation policy page + faq q27 + terms §5 neutralization
  • —b111-adhoc: reword faq q27 refund answer (4 locales)
  • —shadow-capture hook for fit-score pre-filter recall@K validation
  • —sim kill-switch + real batch-unit abort (300s sigkill fix)
  • —sim safety kill-switch + delivery-mode observability for big-sim
  • —model-comparison SIM harness + gateway alias contract sync
  • —data-leg spend control breaker — dormant by default (TD-190/TD-199)
  • —usage-ledger growth caps + write-amplification cuts
  • —career-hub routes + on-demand revalidation
  • —content fetch + parse layer for /career-hub
  • —design iteration — thumbnails, sticky footer, proxy bypass
  • —linear-style grid + fix wrong-scope tokens + fetch retry
  • —SEO blog — /career-hub
  • —seo plumbing for /career-hub
  • —career-hub RSS + anchor links + i18n scaffold + FAQ copy
  • —truth resume-step copy in Privacy + Terms (all locales)
  • —make career-hub locale-aware ((baseSlug, locale))
  • —transactional email hardening — sender domain, beta-gate off, LD 2.8.0, digest consolidation
  • —real abort for batch AI calls + adapter fetch timeouts
  • —brand: adopt the licensed Cosmata wordmark
  • —brand: swap the app onto the new Hiresling lockup
  • —brand: swap the hiresling share cards for the org template
  • —career-hub: add es-ES cover art for 19 articles
  • —career-hub: add generative covers for the 6 new articles
  • —career-hub: add it-IT cover art for 19 articles
  • —career-hub: Cover Letter Examples assets and footer link
  • —career-hub: generative covers + title-on-cover card treatment
  • —career-hub: localize article date and add pt resume-examples cover
  • —career-hub: polish RSS button and add in-field search magnifier
  • —ci: dependency-audit workflow, blocking at >=high (audit M25)
  • —covers: add hiresling-vs-loopcv article cover
  • —dashboard: add V2 app-faces dashboard + editorial console experiment
  • —dashboard: app-faces V2 dashboard + editorial console experiment
  • —dashboard: app-faces v2 dashboard enhancements (flag-gated)
  • —dashboard: close v2 parity with legacy dashboard
  • —dashboard: make v2 the default, v1 kept as escape hatch
  • —dashboard: opt-out confirmation toast + accurate modal
  • —dashboard: sent-confirmation toast after single approval
  • —dashboard: settings v2 chrome, DS type pass, activity stats
  • —data-sources: ES/LatAm openings connectors (Lever + Recruitee + SOC Catalonia)
  • —delivery: monthly-guarantee delivery curve (behind DELIVERY_MODEL)
  • —ds: adopt 42labs design system 0.9 tokens app-wide
  • —footer: add 42labs asterisk mark before wordmark
  • —help-center: new /help-center page with full two-column FAQ
  • —i18n: detect locale on first visit, cookie-absent only
  • —i18n: single-plan cleanup + localize help-center
  • —i18n: systematic "%s | Hiresling.ai" tab-title pattern
  • —infra: self-hosted Railway to Slack deploy relay (drop Pipedream)
  • —landing: add best cover letter format page + reorganize goodies footer column
  • —landing: add eyebrow + heading to the stats bar
  • —landing: add vs-AIApply article cover + link footer comparison
  • —landing: add vs-Jobright article cover + link footer comparison
  • —landing: add vs-LazyApply article cover + link footer comparison
  • —landing: add vs-Massive article cover + link footer comparison
  • —landing: add vs-WonsultingAI article cover + link footer comparison
  • —landing: best resume format cover + footer goodies link
  • —landing: Career Hub wiring + polish (balance, dark animated stats, FAQ grid, footer icons)
  • —landing: Cold Outreach Guide cover + footer Goodies link
  • —landing: copy pass + 3-pillar feature restructure
  • —landing: footer restructure, real FAQ, live stats, cleanup
  • —landing: gauge-free component pass + pricing polish
  • —landing: hero reach stats, demo overlay CTAs, link wiring, copy pass
  • —landing: interactive How-It-Works step carousel
  • —landing: lead the demo CTA with a play glyph
  • —landing: localise the review-gate stage labels
  • —landing: localize new landing copy (pt/es/it) + nav/OSS polish
  • —landing: locked LP copy — steps, fictional cast, 12 features, single-plan FAQ
  • —landing: resume examples cover + footer goodies link
  • —landing: trim footer comparisons to shortlist + link LoopCV article
  • —legal: membership naming + 30-day ceiling disclosure on the up-to-100 claim
  • —link admin version pill to changelog
  • —login: DS-scoped login reskin
  • —lp: pricing rebuild, DS token remap, dark-theme compliance, band alternation
  • —migrate support escalation from Plain to Libredesk
  • —partnerships: localize /partnerships to all four locales (42l-826)
  • —partnerships: move partner-terms note below the hero ctas
  • —partnerships: PT-only affiliate + partnership page with enquiry intake (42L-826)
  • —pipeline: openings sourcing + scrape-leg repair (adhoc-openings ,)
  • —pt: add 18 pt-BR Career Hub covers
  • —reach: measure landing-page reach across all sources
  • —spend: data guardrails ( +) — dormant until armed
  • —spend: t6 — global data ceiling computed live
  • —subscribe: single-plan checkout + EU consent + welcome email
  • —tooling: adopt Biome as formatter (audit M25)
  • —tooling: adopt knip for dead-export/orphan-file detection (audit M25)

Bug Fixes

  • —119-01: keep t1 e2e sim_day marker within smallint range
  • —119-03-h1: add FK cascade so user deletion purges usage_tracking_monthly (OI-34)
  • —a11y contrast on /dashboard + deterministic gate
  • —adhoc-pre-113 review remediation (blockers + urgent HIGHs)
  • —auth: redirect authed visitors off /login server-side
  • —auth: repair staging Sign In dead-end (/login?next= + clear dead session)
  • —eliminate lookup_br_company_by_name statement-timeouts
  • —admin client upsert, e2e spec, LIA header
  • —admin client upsert, e2e spec, LIA header (critic round-1)
  • —admin client upsert, e2e spec, lia header, structure.md entry
  • —fix ts type-cast errors + add intl-messageformat devdep
  • —update legal body oracle with bigdatacorp paragraph
  • —update legal oracle for §12 heading rename and bigdatacorp paragraph
  • —byte-bound cacheJobResults .in filters (SOC re-insert on re-run)
  • —chunk cacheJobResults queries+inserts to fix SOC cached:11
  • —one generic registry-etl worker runs all country jobs
  • —remove stray railway.ar-rns.json resurrected by merge
  • —resolve migration version collision, denue schema never applied
  • —connector turn-on validation — registry timeout fix, MX DENUE load, dropcontact defect
  • —capture the ensure_rls event trigger
  • —disable next-intl locale detection to fix return-to-EN
  • —reconcile staging schema drift (change_list + rls_auto_enable)
  • —unbreak sim send leg + surface persona failures
  • —b112: escape provider-controlled values in AI-failure Slack alert
  • —back-port BR matcher perf fix to AR + MX registries
  • —registry ETL dead-index audit — 3 dropped, NO-GO, verified
  • —registry ETL scratch cleanup fires on no-op/failed runs
  • —route-tier trace sampler for server + edge, prod-gate edge, drop stale client config
  • —repoint chrome imports after ADHOC-LP-FLIP promoted them
  • —session-end audit findings
  • —session-end audit findings — slug validation, focus ring, LCP
  • —sync pnpm-lock.yaml for gray-matter
  • —consolidated review remediation (pass 1 — partial, WIP)
  • —spell out ATS jargon, legal pronoun, connector-state docs, drop preview-app-faces
  • —unescape it consent privacy link (icu apostrophe)
  • —stale subscribe-heading E2E + affiliate portal link
  • —brand: give the app's brand svgs an intrinsic size
  • —brand: put the retraced mark on the app
  • —career-hub: balanced cover titles, no orphaned last word
  • —career-hub: key LCP fetchPriority hint off first image, not array index 0
  • —ci: reconcile 114-11 review-triad carries + lockfile-skew root-cause
  • —covers: drop app-bundled cover PNGs — served from blob cdn now — TD-202
  • —dashboard: collapse draft card from header + hide recipient email
  • —dashboard: footer flows in-page, pinned to bottom, ruler contained
  • —dashboard: guard draft-card header keydown to currentTarget
  • —dashboard: localize the V2 "Request changes" dialog
  • —dashboard: satisfy react-compiler lint in V2 tour/menu
  • —dashboard: theme-scope layout for preview + drop unused scaffolding
  • —dashboard: use next/link for the Adjust-my-targets CTA
  • —e2e API post-merge failures (places-purge FK + fixture-count drift)
  • —e2e-tester findings + dashboard gauge
  • —e2e: force HOME=/root for firefox in CI + gate mobile lane
  • —e2e: force HOME=/root in CI so firefox actually launches
  • —e2e: make e2e.yml fully green — pool sessions, self-heal fixtures, mobile lane
  • —e2e: send consent to checkout in payments staging suite
  • —e2e: set HOME=/root in CI for firefox + gentler mint concurrency
  • —e2e: unblock firefox in CI + gentler mint concurrency
  • —fonts: use Space Grotesk variable font (drop deprecated static weights)
  • —hard 404 on unknown company-fit via (shell) route group
  • —i18n,seo: audit 260824 — brand gender, canonicals, changelog disclosure
  • —i18n: apply glossary canon across es/pt/it catalogs and legal docs
  • —i18n: apply the i18n review to the stage copy
  • —i18n: number agreement in scoreboard stage labels (pt/es/it)
  • —i18n: one effective-date label per locale, lowercase months
  • —i18n: one name for the terms document in pt and es
  • —i18n: ration em-dashes across all four message catalogs
  • —landing: footer Security link, legal close navigation, pricing CTA
  • —landing: hero body wraps to two lines in every language
  • —landing: keep every localized footer destination in the visitor's locale
  • —landing: repoint partnerships + career-hub at live tokens after DS 0.9
  • —landing: stop the review-queue cards overflowing their card
  • —mobile landing-nav e2e assertion + idempotent company seed
  • —mobile-responsive fixes for public site (all mobile-audit findings)
  • —nav: header wordmark returns to the landing page everywhere
  • —onboarding: tone-picker lock, follow-up cadence step, comp scoring note
  • —partnerships: keep the footer link in the visitor's locale (42L-826)
  • —prospeo mid-loop credit lost at the find-contacts ledger emit
  • —proxy: put the app-faces preview mock behind auth
  • —remove product pronoun from share text (en/pt)
  • —sast: resolve the 8 pre-existing high Semgrep findings blocking every staging PR
  • —security: block never-subscribed accounts in pipeline + send gates
  • —security: gate onboarding/first-batch on active subscription
  • —security: td-218 signup throttle + td-219 abandoned-account reaper
  • —self-heal orphan companies in e2e seed
  • —serp: capture recruitee ats tokens by blocklisting the apex host
  • —sitemap: drop /login (auth page, no search intent) — TD-204
  • —strip internal block IDs from changelog in every form
  • —td-215: italian /it/ref referral links skip middleware
  • —td-216: detect locale on every public page, not just the root
  • —test: match subscribe heading to membership copy
  • —wrap legal-page tables so long-translation locales don't overflow mobile
v0.5.02026-06-23

Features

  • —llm cost reduction — caching, batching, rerank gate, JD normalization
  • —llm cost reduction
  • —synthetic full-run audit harness + M1 live-usage tap
  • —deterministic resume-link guarantee + per-source company attribution
  • —discovery wiring proof + paid-contact precision + per-source attribution + pre-flight gate
  • —pre-flight source-validation harness (PASS/DEAD/EXHAUSTED/UNPROVISIONED)
  • —authoritative per-source cost map + completeness gate
  • —daily source-value report (cost × yield × outcome per API)
  • —digest daily-total header, non-API grouping, 09:00 UTC
  • —source-value rollup RPC + daily Slack digest (/)
  • —stamp specific data-source API on user_companies.source
  • —phase A — import-maximal, cost-aware acquisition model
  • —phase B — delivery + buffering on existing tables
  • —phase C — two-lane queue + serialization + budget governor
  • —phase C — two-lane queue, per-user serialization, budget governor
  • —Phase A — pipeline_events cost/attribution ledger
  • —phase a ledger foundation — pipeline_events table + emit module
  • —phase b reproducible cost-report generator (t7/t8)
  • —phase b reproducible cost-report generator (/)
  • —phase c sim fixes
  • —phase d — parallel n-persona sim + behavior assertions + campaign report
  • —t4 payg billable units + t6 daily rollup/retention cron + tests
  • —wire ai-leg + data-leg pipeline_events emits (t2/t3)
  • —deterministic pipeline_events ledger reader for SIM reports
  • —add staging-only test-enqueue endpoint for prod queue path
  • —contact finders run cost-first, order read from the registry
  • —drive SIM through the real deployed queue (prod-mirror harness)
  • —order discovery cascade cost-first (+ cascade check tolerance/exclusions)
  • —order discovery cascade cost-first + cascade check tolerance/exclusions
  • —prod-mirror SIM harness — drive the real deployed queue
  • —propagate SIM prod-mirror to the deployed worker
  • —raise internal credit caps to unreachable (defer to provider 429)
  • —SIM fidelity — ledger spend + staging queue trigger
  • —single per-call cost registry — kill cost bands
  • —single per-call cost registry — real subscription costs, kill cost bands
  • —discovery funnel + cascade tolerance + AI-cost badge
  • —discovery funnel Returned→Unique→Net-new + cascade tolerance + AI-cost badge
  • —systemic feed ordering (cost→ROI) + provider-only spend control
  • —ledger-report correctness + parametrized generator + SIM-harness assertion fixes
  • —breadth-first draft distribution (favor unique companies)
  • —one-off staging→prod warehouse promote script (dry-run validated)
  • —author italian it.json + wire message data
  • —italian (it) i18n scaffolding — dark-launched
  • —italian legal pages — PrivacyIT + TermsIT (dark-launched)
  • —legal-page IT cross-links + PT/ES governing-language clause
  • —contact-leg funnel correctness — persisted net-new + dedup + delivered layer
  • —onboarding report — live-DB user/time mode + 42labs DS styling
  • —onboarding-cost SIM harness + prod-alias mirror
  • —close // — wire outreach-90day prune + PP §7 fix + storage-only verify
  • —content, i18n & doc drift + max cap 350→300
  • —discovery & scoring yield core — obs, d2+d1, d3, d4, d7
  • —discovery & scoring yield core (OBS, D2+D1, D3, D4, D7, FLOOR)
  • —floor — cross-day catch-up delivery target
  • —remove wrongful discovery rejections + first-class broadening
  • —buffer-floor guarantee — chain banks 2-day buffer past floor
  • —continuation spine, delivery ordering+freshness, language gate (t1-t7, t8/d10)
  • —continuation/paced-promotion + floor-guarantee delivery (joint gate)
  • —d11 — out-of-spectrum opening kept as cold company (t8)
  • —geo political-ladder foundation — admin1 backfill, borders, ladder geo tail (t8)
  • —paced run-until-met ladder — rung-escalation + geo widening (t4/t8)
  • —t9 — re-enrich company only on stale enrichment (d13)
  • —govern contact-finder spend by billing model
  • —cost-validation sim harness + p1 executive-chef persona
  • —cross-persona pricing matrix html report (--matrix)
  • —full 12-persona matrix + ipv4 preflight probe + supply-exhaustion early-stop
  • —structured draft-feedback rule store
  • —resume scoring, improvement & keyword-tailoring
  • —rescale fit-score display to 5.0-10 gauge
  • —provider-value data gathering
  • —provider-value report mechanisms (slack v2 + email + cli)
  • —rfb brazilian company firmographics layer
  • —beta access provisioning — comp_beta_5d tier + public /beta overlay
  • —beta feedback gate starts day 2 (day 1 free)
  • —in-tool daily beta feedback gate
  • —b99-adhoc-brand-casing: recase product wordmark to Hiresling.ai
  • —b99-adhoc-comp-allowlist: comp grant on signup via email allowlist + Unlimited daily cap
  • —b99-discovery-guarantee: multi-source free-first discovery + always-deliver batch guarantee
  • —b99-renewal-banner: opt-in renewal default + 5-day countdown banner
  • —b99-source-ops: commercial-safe source lineup + free-plan quota alerts
  • —beta: streamline /beta intake — single atomic RPC, exact cap, device fence, SSR counter
  • —beta: streamline /beta intake — single atomic RPC, exact cap, device fence, SSR'd counter
  • —caps: lower Pro/Max monthly caps to 200/350 + grandfather mechanism
  • —changelog: restyle /changelog in onboarding card style
  • —dashboard: link company name to its site on drafts & sent items
  • —data-sources: uniform cap enforcement + per-source cap toggle
  • —i18n: skill PT/ES translations + search aliases + Settings i18n + hero sentence_10
  • —onboarding: prefill email-signature with Google account name
  • —onboarding: UI session — subheaders, score modal, referral card, landing counters
  • —parameterized comp trial tiers (comp_pro_7d) via COMP_TIER_CONFIG
  • —scripts: add set-admin + set-beta-tester operator provisioning CLIs
  • —scripts: operator provisioning CLIs (set-admin + set-beta-tester)
  • —security: security hardening (A2-F2)
  • —settings: rewrite Settings panel — referrals, compensation, email, targeting
  • —source-caps: enforce real paid monthly quotas

Bug Fixes

  • —adhoc: stop daily prune from wiping the fixture template user
  • —adhoc: wipe-user prod guard accepts the custom auth domain
  • —parallelize fit-canary candidate scoring
  • —free-source health — careerjet retry + direct-HTTP pre-flight liveness
  • —default --out resolves to the real sibling hiresling-meta (4 ups, not 3)
  • —make pipeline_events breadcrumbs throw-proof
  • —correct the 3 SIM behavior assertions (cascade/contact/buffering)
  • —split SIM run-id off batchRunId so user_outreach inserts stop 22P02-ing
  • —best_first_delivery assertion checks draft order, not send order
  • —day-1 queued batch uses first-run order (drafts on day 1)
  • —day-1 queued batch uses first-run order so it drafts
  • —drop redundant server-only from source-costs so the SIM harness loads
  • —preserve outer SIM context through processBatchForUser
  • —raise batch worker maxDuration for cold real first-batch
  • —read sim spend from pipeline_events ledger, not /spend/logs
  • —SIM enablement — harness import + raise internal caps to defer to provider 429
  • —source-value digest reads the single per-call cost registry
  • —company-leg yield = net-new inserts, not opening rows
  • —emit company-leg yield from net-new inserts, not opening rows
  • —zero rows_new on google_places self-emitted cost row
  • —clean multi-run report titles (N personas)
  • —tag scrape contacts-report total as AI cost
  • —use ASCII apostrophe in IT close-button aria-label
  • —isolate contact-emit test from real dns/https i/o
  • —per-source funnel monotonicity + generic_inbox rows_distinct + HTML delivered line
  • —exclude orphaned routes from cost model + correct stale caps/docs
  • —onboarding-cost SIM run fixes + measured workflow.md numbers
  • —rename ttl migration off the version collision
  • —wire contact-ttl-prune e2e into staging suite + hook timeouts
  • —staging validation (places-rpc version + dup-draft e2e)
  • —drop pipeline e2e cases for the removed /api/chat route
  • —drop pre-seed cleanupE2EData in places-purge beforeAll
  • —retire drafts change_list + atomic prospect→draft flip + skip trail
  • —make stale-subject sweep cli runnable
  • —make stale-subject sweep CLI runnable (react-server condition)
  • —outreach subject-line language (PT/ES/IT bodies must not get EN subjects)
  • —pin outreach subject to user language + stale-subject sweep
  • —faithful joint-sim contact_guarantee + best_first assertions
  • —keep batch terminal write within worker budget + round-aware best-first sim
  • —make joint-sim contact_guarantee + best_first assertions faithful
  • —bank-not-fill — one natural discovery pass per tick
  • —gate discovery import on monthly cap only, pace enrichment
  • —per-tick fetch bound + sim monthly-counter preservation
  • —bound the heavy pass by the soft-budget deadline
  • —chain-aware terminal batch status
  • —continue the chain while a deliverable backlog remains
  • —deliver the floor on continuation links
  • —lane-split buffer build — chain stops at bank-built, refill lane resolves
  • —negative cache + paid-call ceiling + marginal stop + completion gate
  • —reserve re-fire headroom in the soft-budget start-gate
  • —spend-ceiling breaker counts AI-leg spend only
  • —onboarding ux hardening + comp model reshape + flow-integrity fixes
  • —onboarding UX hardening + comp model reshape + flow-integrity fixes
  • —cost-report ledger pagination + run-id scoping (+ sim matrix/serp-skip)
  • —declare undici devdep for ipv4 preflight probe
  • —decouple discovery import budget from delivery cap
  • —decouple discovery import budget from delivery cap + cost-validation SIM harness
  • —drive sim month by monthly deliverable cap, not fixed days
  • —paginate ledger fetch + run-id scoping for cost report
  • —calibrate dedup/conflict thresholds to live voyage embeddings
  • —re-version resume-scores migration off 20260616120000 collision
  • —rescale chat-bot KB fit copy to 1-10 + drift guard
  • —rescale residual 0-100 fit copy to 1-10
  • —rescale residual 0-100 fit copy to 1-10 (faq, tour, privacy, support kb)
  • —derive provider-value window cost from recorded ledger spend
  • —atomic single-statement swap + post-swap live-count assertion
  • —connect to DB late (no idle conn across the ~1h download)
  • —decode ISO-8859-1 → UTF-8 via iconv (DuckDB latin-1 reader fails)
  • —download completeness + scratch cleanup + monthly cron
  • —lift the 2-min statement_timeout for the bulk load
  • —minimal worker image (own package.json, not full app tree)
  • —point rfb etl at the nextcloud share (live source moved)
  • —re-assert rfb registry table ownership to rfb_etl
  • —revoke firmographics lookup rpc from anon (data-critic f1)
  • —revoke firmographics lookup rpc from anon (data-critic F1)
  • —stream-count transform output (avoid Node 512MB string cap)
  • —type stream chunk (tsc)
  • —drop dropped-column write + always-render drafts footer
  • —report purgedUsageRows from hourly-batch cron response
  • —update 2 stale test assertions for the prospecting + footer fixes
  • —buffer readiness probe at depth-1 (contact-cost claw-back pt 2)
  • —b99-discovery: careerjet api is http-only, not https
  • —b99-renewal-banner: calendar-day countdown (staging-walk off-by-one)
  • —b99-renewal-banner: count renewal countdown by calendar day, not elapsed ms
  • —b99-review-fixes: consolidated R9 code/data/security fixes
  • —beta: add point-of-collection privacy notice on /beta intake
  • —changelog: move theme-light to layout per theme-scope invariant
  • —chat-kb: drop email export path, sync settings/fit-score/pipeline copy
  • —comp: extend users_tier_check to allow comp_pro_7d
  • —cost-ledger: units-driven cost + persisted yield + report fidelity
  • —dashboard: drop empty-drafts subtext, keep 'No drafts pending'
  • —dashboard: drop empty-drafts subtext, keep core 'No drafts pending'
  • —e2e: seed GoTrue token columns on fixture-template auth row
  • —hero: add APIs sentence, fix PT/ES overflow, drop discovery badges
  • —hotfix: add user_resumes.change_list missing on prod
  • —hotfix: add user_resumes.change_list missing on prod (Drafts tab empty)
  • —i18n-smoke: map locale pt -> pt-br for users.language CHECK
  • —i18n-smoke: scope EN-leak check to multi-word phrases
  • —outreach: widen body_language to 'it', reserve PS budget, guard resume link
  • —pipeline correctness + spend guards
  • —reconcile: back-merge main hotfixes into staging (unblock prod promotion #973)
  • —reconcile: back-merge main hotfixes into staging for prod promotion
  • —release: staff recipients + graph-clean release-email module
  • —release: strip component prefix from release tag for email version
  • —release: wrap send-release-email TLA in async main
  • —scripts: set-beta-tester --reset clears pipeline only, not onboarding
  • —security: critic-followup — ssrf ip-pinning + comp-grant orphan revoke
  • —typst: ship linux binary to all batch render routes
v0.4.12026-06-11

Bug Fixes

  • —default --out resolves to the real sibling hiresling-meta (4 ups, not 3)
  • —release: staff recipients + graph-clean release-email module
v0.4.02026-06-11

Features

  • —beta: streamline /beta intake — single atomic RPC, exact cap, device fence, SSR counter

Bug Fixes

  • —release: wrap send-release-email TLA in async main
v0.3.02026-06-10

Features

  • —adhoc-tour-restyle: match onboarding DS for tour + fold referrals into settings
  • —ai: idempotency keys — in-flight double-spend guard
  • —llm cost reduction — caching, batching, rerank gate, JD normalization
  • —llm cost reduction
  • —synthetic full-run audit harness + M1 live-usage tap
  • —deterministic resume-link guarantee + per-source company attribution
  • —discovery wiring proof + paid-contact precision + per-source attribution + pre-flight gate
  • —pre-flight source-validation harness (PASS/DEAD/EXHAUSTED/UNPROVISIONED)
  • —authoritative per-source cost map + completeness gate
  • —daily source-value report (cost × yield × outcome per API)
  • —digest daily-total header, non-API grouping, 09:00 UTC
  • —source-value rollup RPC + daily Slack digest (/)
  • —stamp specific data-source API on user_companies.source
  • —phase A — import-maximal, cost-aware acquisition model
  • —phase B — delivery + buffering on existing tables
  • —phase C — two-lane queue + serialization + budget governor
  • —phase C — two-lane queue, per-user serialization, budget governor
  • —Phase A — pipeline_events cost/attribution ledger
  • —phase a ledger foundation — pipeline_events table + emit module
  • —phase b reproducible cost-report generator (t7/t8)
  • —phase b reproducible cost-report generator (/)
  • —phase c sim fixes
  • —phase d — parallel n-persona sim + behavior assertions + campaign report
  • —t4 payg billable units + t6 daily rollup/retention cron + tests
  • —wire ai-leg + data-leg pipeline_events emits (t2/t3)
  • —deterministic pipeline_events ledger reader for SIM reports
  • —add staging-only test-enqueue endpoint for prod queue path
  • —contact finders run cost-first, order read from the registry
  • —drive SIM through the real deployed queue (prod-mirror harness)
  • —order discovery cascade cost-first (+ cascade check tolerance/exclusions)
  • —order discovery cascade cost-first + cascade check tolerance/exclusions
  • —prod-mirror SIM harness — drive the real deployed queue
  • —propagate SIM prod-mirror to the deployed worker
  • —raise internal credit caps to unreachable (defer to provider 429)
  • —SIM fidelity — ledger spend + staging queue trigger
  • —single per-call cost registry — kill cost bands
  • —single per-call cost registry — real subscription costs, kill cost bands
  • —discovery funnel + cascade tolerance + AI-cost badge
  • —discovery funnel Returned→Unique→Net-new + cascade tolerance + AI-cost badge
  • —systemic feed ordering (cost→ROI) + provider-only spend control
  • —ledger-report correctness + parametrized generator + SIM-harness assertion fixes
  • —breadth-first draft distribution (favor unique companies)
  • —one-off staging→prod warehouse promote script (dry-run validated)
  • —author italian it.json + wire message data
  • —italian (it) i18n scaffolding — dark-launched
  • —italian legal pages — PrivacyIT + TermsIT (dark-launched)
  • —legal-page IT cross-links + PT/ES governing-language clause
  • —contact-leg funnel correctness — persisted net-new + dedup + delivered layer
  • —close the settings i18n + lift skipped suite
  • —t2/t3/t4 + server-side outreach consent + ui polish
  • —tier-aware action caps + per-draft revision cap + monthly ai budget
  • —tier-aware action caps, per-draft revision cap, monthly ai budget
  • —pipe why_next calibration signal into draft prompt
  • —staging fixture pool expansion — 50 cos + recycling + fair rotation + E2E
  • —faq + public-kb drift proofing + email length caps
  • —chat streams + send-failure alarms to Slack, drop 3 admin panels
  • —gmail send-failure schema guardrails + aggregate alarm + atomic compensation
  • —support-chat KB drift proofing + comprehensive coverage refresh
  • —b92-adhoc-alpha1-coverage: t1 gmail referral + t2 picker coverage + t3 badge
  • —b92-adhoc-design-polish: full design-polish pass (15 tasks)
  • —b92-adhoc-target-roles: hard-filter target_roles at every pipeline path
  • —b92-adhoc-token-naming-standardize: dual-naming layer + partial scope sweep
  • —atomic approve_send_outreach rpc + send-time email_sent cap
  • —restore landing SSG + locale-prefix /ref + /how + FAB i18n + ICU plural
  • —i18n leaks sweep + email body_language stamp
  • —b93-adhoc-fixture-role-family-coverage: expand fixture pool to 25 role families
  • —b93: onboarding polish + dashboard launch modal + tour DS alignment
  • —per-user user_contacts + contact_hashes cost-dedup (.5)
  • —t11 + t12 + t13 — digest lane split + EMBEDDINGS_GLOBAL_KILL + docs
  • —t11 + t12 + t13 — digest lane split + kill switch + docs
  • —t2 + t3 + t4 — voyage gateway aliases, embeddings utility, pgvector schema
  • —t2 + t3 + t4 + t4.5 — voyage gateway aliases, embeddings utility, pgvector, prospect-bifurcation collapse
  • —t4.5 collapse runprospecting/runstagingprospecting bifurcation
  • —voyage embeddings adoption — ship +++++
  • —per-day outreach_drafted cap on draft generation
  • —dashboard tour V1 — 13-step walkthrough + anchor refactor
  • —beta access provisioning — comp_beta_5d tier + public /beta overlay
  • —beta feedback gate starts day 2 (day 1 free)
  • —in-tool daily beta feedback gate
  • —b99-adhoc-brand-casing: recase product wordmark to Hiresling.ai
  • —b99-adhoc-comp-allowlist: comp grant on signup via email allowlist + Unlimited daily cap
  • —b99-discovery-guarantee: multi-source free-first discovery + always-deliver batch guarantee
  • —b99-renewal-banner: opt-in renewal default + 5-day countdown banner
  • —b99-source-ops: commercial-safe source lineup + free-plan quota alerts
  • —caps: lower Pro/Max monthly caps to 200/350 + grandfather mechanism
  • —changelog: restyle /changelog in onboarding card style
  • —data-sources: uniform cap enforcement + per-source cap toggle
  • —i18n: skill PT/ES translations + search aliases + Settings i18n + hero sentence_10
  • —legal: phase a — privacy + fit-scoring legal sweep (#637 follow-up)
  • —legal: phase b — terms §6 r1b controller/processor rewrite
  • —onboarding: prefill email-signature with Google account name
  • —parameterized comp trial tiers (comp_pro_7d) via COMP_TIER_CONFIG
  • —scripts: add set-admin + set-beta-tester operator provisioning CLIs
  • —scripts: operator provisioning CLIs (set-admin + set-beta-tester)
  • —settings: rewrite Settings panel — referrals, compensation, email, targeting
  • —source-caps: enforce real paid monthly quotas
  • —support: env-gated CC on Plain email fallback

Bug Fixes

  • —adhoc-chat-escalated-styling: drop muted-foreground recolor on escalated messages
  • —adhoc-chat-slack-waituntil: wrap Slack fire-and-forget in after
  • —adhoc-fit-modal: full-breakdown modal canon + cursor + email language
  • —adhoc-pt-quality-sweep — apply 39 i18n findings + tone-tiered opt-out
  • —adhoc-support-chat-refund: bucket billing/refund as escalation
  • —adhoc: close every browser-console finding from 260520 staging audit
  • —adhoc: wipe-user prod guard accepts the custom auth domain
  • —ai-call-worker: nest cache_control inside content-block
  • —parallelize fit-canary candidate scoring
  • —free-source health — careerjet retry + direct-HTTP pre-flight liveness
  • —make pipeline_events breadcrumbs throw-proof
  • —correct the 3 SIM behavior assertions (cascade/contact/buffering)
  • —split SIM run-id off batchRunId so user_outreach inserts stop 22P02-ing
  • —best_first_delivery assertion checks draft order, not send order
  • —day-1 queued batch uses first-run order (drafts on day 1)
  • —day-1 queued batch uses first-run order so it drafts
  • —drop redundant server-only from source-costs so the SIM harness loads
  • —preserve outer SIM context through processBatchForUser
  • —raise batch worker maxDuration for cold real first-batch
  • —read sim spend from pipeline_events ledger, not /spend/logs
  • —SIM enablement — harness import + raise internal caps to defer to provider 429
  • —source-value digest reads the single per-call cost registry
  • —company-leg yield = net-new inserts, not opening rows
  • —emit company-leg yield from net-new inserts, not opening rows
  • —zero rows_new on google_places self-emitted cost row
  • —tag scrape contacts-report total as AI cost
  • —use ASCII apostrophe in IT close-button aria-label
  • —per-source funnel monotonicity + generic_inbox rows_distinct + HTML delivered line
  • —i18n the two strings the EN walk missed
  • —prune RPC keeps pending drafts in dormant threads
  • —drop orphan placeholder migrations
  • —orphan migration placeholders unblock staging-db-sync
  • —t11 max_budget sentinel + migration timestamp collision
  • —emit one surface per company in runStagingProspecting
  • —b92-adhoc-csp-pure-nonce: nonce-thread next bootstrap on protected routes
  • —b92-adhoc-e2e-findings: 11 backend / a11y / seo fixes from 2026-05-23 e2e batch
  • —b92-adhoc-language-overwrite-fix: single-writer language column
  • —b93-adhoc-language-picked-at-loop: remove dashboard gate, stamp at signup, backfill nulls
  • —b93-adhoc-security-review-r8: full r8 remediation + r7 carryover
  • —b93-adhoc-security-review-r8: r8-h5 same-class sweep + migration doc fix
  • —lazy-copy legacy contacts → user_contacts + repoint AC2
  • —slack mrkdwn whitespace, full-digest link, recordconsent silent error
  • —clear 3 lint errors blocking ci
  • —t4.5-2 enrichCompany — coerce null stage + use correct freshness column
  • —drop dropped-column write + always-render drafts footer
  • —report purgedUsageRows from hourly-batch cron response
  • —update 2 stale test assertions for the prospecting + footer fixes
  • —buffer readiness probe at depth-1 (contact-cost claw-back pt 2)
  • —b99-discovery: careerjet api is http-only, not https
  • —b99-renewal-banner: calendar-day countdown (staging-walk off-by-one)
  • —b99-renewal-banner: count renewal countdown by calendar day, not elapsed ms
  • —b99-review-fixes: consolidated R9 code/data/security fixes
  • —beta: add point-of-collection privacy notice on /beta intake
  • —changelog: move theme-light to layout per theme-scope invariant
  • —chat-kb: drop email export path, sync settings/fit-score/pipeline copy
  • —ci: wire staging E2E secrets + auto-apply fixture seed via staging-db
  • —comp: extend users_tier_check to allow comp_pro_7d
  • —cost-ledger: units-driven cost + persisted yield + report fidelity
  • —dashboard: adhoc — drafts/activity tabs froze on parent prop reload
  • —dashboard: drop empty-drafts subtext, keep 'No drafts pending'
  • —dashboard: drop empty-drafts subtext, keep core 'No drafts pending'
  • —e2e: align fixture pool count + tolerate 502 on ai routes
  • —e2e: bump t1+t2 timeouts to absorb real pipeline latency
  • —e2e: excellence path — SSR cookies for vitest + Playwright, fix landing CTA selector
  • —e2e: mint real user JWT via verifyOtp + add required users.name in AC9
  • —e2e: poll DB for [T] outreach instead of DOM in walk
  • —e2e: record signup consent + handle orphan auth users in session mint
  • —e2e: repair stale user shape on every mint + bump batch-completion timeout
  • —e2e: seed GoTrue token columns on fixture-template auth row
  • —e2e: skip 5 broken Playwright tests with TODO pointing at magic-link flow mismatch
  • —e2e: skip 7 broken authenticated API tests with TODO pointing at cookie/Bearer mismatch
  • —e2e: swap fixture-pool spec batch trigger to end-user first-batch route
  • —e2e: swap t1 batch trigger to end-user first-batch route
  • —email: adhoc bundle — header mojibake, sample salutation, batch copy, signature spacing
  • —hero: add APIs sentence, fix PT/ES overflow, drop discovery badges
  • —i18n-smoke: map locale pt -> pt-br for users.language CHECK
  • —i18n-smoke: scope EN-leak check to multi-word phrases
  • —landing: adhoc — explainer poster to true first frame
  • —landing: adhoc — explainer video poster
  • —outreach: widen body_language to 'it', reserve PS budget, guard resume link
  • —plain: tighten ticket-title prompt so LLM emits a label, not a bot reply
  • —plain: title-gen via callAI direct + drop meta-ticket cascade
  • —promote: resolve staging↔main conflicts for #675 promotion
  • —scripts: set-beta-tester --reset clears pipeline only, not onboarding
  • —typst: ship linux binary to all batch render routes
  • —usage: adhoc — checkLimit off-by-one undershoots tier cap by 1
v0.2.02026-04-14

Features

  • —SurveyJS onboarding questionnaire replacing Fillout (steps 1–10, EN/PT/ES inline translations)
  • —Dashboard onboarding tour (Shepherd.js, 8 steps, completion flag, admin reset)
  • —Onboarding tour admin reset button and per-user API endpoint

Bug Fixes

  • —Canny feedback widget replaced with Discord Forum Channel escalation path