Changelog
What we're shipping.
Every release that touches the broker or borrower experience. Bug fixes + infrastructure work happen quietly between entries.
May 2026
Per-loan OG, tag autocomplete, pagination, audit actor filter, bulk archive, broker upload
Commit 198f75d(opens in new tab)
- Added handleLoanReminderDue placeholder so the dashboard's stale
- 3 new unit tests covering each reason variant
- app/(broker)/loans/[id]/opengraph-image.tsx + twitter-image.tsx
- Authorization-safe: PUBLIC by Next file convention, so the renderer
- TagsSection now takes a tagSuggestions prop sourced from the
- Native <datalist> for browser autocomplete + visible chip strip
- PAGE_SIZE = 50 per section (active + earlier independent)
- ?activePage= and ?earlierPage= URL params, both preserved across
Sentry + PostHog SDKs, dashboard search + loan tags, OG images
Commit 9542649(opens in new tab)
- Real captureException dispatch when NEXT_PUBLIC_SENTRY_DSN is set;
- Dynamic-import keeps the SDK out of the bundle when DSN is unset
- onRequestError hook in instrumentation.ts for request-error capture
- lib/analytics/track.ts: stable AnalyticsEvent union + lazy require()
- lib/analytics/posthog-browser.ts: init + identifyUser; session
- components/analytics/posthog-provider.tsx: client-mount once
- 2 funnel events wired: signup.completed + loan.created
- ?q=<term> searchParam, server-side filter
Onboarding checklist + status page + e2e tests + Renovate + domain script
Commit fd24966(opens in new tab)
- All 11 public marketing routes load with canonical headlines
- /signup form rejects invalid email (client-side)
- /login form rejects empty submit
- /security cross-links to runbooks
- /pricing renders all 3 tier cards
- /status renders subsystem grid
- /demo entry page lists both persona paths
- Demo broker + demo borrower navigation works
Signup throttle + CSP + login + delete brokerage + handoff email + digest preview
Commit f9080ad(opens in new tab)
- Six in one chunk — closes the security gaps the live URL exposes
- plus a handful of feature value-adds for the broker side.
Changelog + about + error.tsx + husky + Inngest pre-build + runbooks
Commit 2f85a96(opens in new tab)
- Last 7 of 12 in this round. Closes the marketing surface, locks in
- DX hygiene, pre-builds the Inngest handler bodies for the one-line
Signup + zip download + Resend webhook + notification prefs + live updates
Commit 7121f2c(opens in new tab)
- Five shipping in one chunk — closes the missing funnel link, adds the
- LOS handoff packet, wires the email-lifecycle audit trail, gives
Privacy + terms + 404/loading polish + 6 test files + loan handover
Commit 8a17e1c(opens in new tab)
- Six in one chunk — completes the marketing footer (no more 404s),
- locks in test coverage on the recent batch, and adds loan reassignment
Public security + pricing pages + team management completeness
Commit 1755e7a(opens in new tab)
- updateAppUserRole — promote/demote teammates. Last-owner
- deactivateAppUser / reactivateAppUser — soft lock-out.
- resendInvite — re-fires Supabase magic-link for teammates who
WISP ack + data export + retention + replies + notes + bulk approve + inline dupes
Commit 4dd8cd5(opens in new tab)
- Seven shipping in one chunk — closes the GLBA story, completes the
- two-way message thread, adds a real broker-only notes channel, lets
Lock-in tests + duplicate detection + checklist preview + rate limiting
Commit 55a2b0c(opens in new tab)
- Five shipping in one chunk — defensive coverage on what we just shipped
- 1. INTEGRATION TESTS (4 files, 23 tests) for the actions we shipped
Borrower message thread + loan templates
Commit 5b1a63b(opens in new tab)
- sendLoanMessage Server Action: 1000-char cap, trim-empty rejection,
- Broker UI: compose textarea + char counter + thread of past
- Borrower UI: italic-clay block above the checklist, only renders
- saveLoanTemplate / deleteLoanTemplate Server Actions with the
- /settings/templates: create form (name + loanType radio + flag
- Wizard prefill: a template-picker dropdown appears at the top
- Hidden when zero templates — no UI noise for new brokerages.
Stale-flagger, daily digest, phone validation, maintenance banner
Commit d4ba266(opens in new tab)
- createRealLoan (wizard)
- addCoBorrower
- updateBorrowerContact (borrower self-edit)
- updateBorrowerContactByBroker (broker edit)
Self-serve signup + LOS handoff + live portal
- Brokers can self-serve sign up at /signup — no more waiting list to demo.
- One-click loan packet zip for LOS handoff (per-category folders + manifest).
- Resend webhook wired — broker sees email delivered/opened/bounced events in the audit log.
- Borrowers can opt out of email categories from their portal.
- Borrower portal short-polls every 30s — new broker messages surface as a sticky banner.
Privacy + Terms + 404 polish + loan handover
- Public privacy policy + terms of service (draft, counsel review pending).
- Custom 404 + loading screens styled in Cinch Calm.
- Loan handover — broker reassigns a loan to a teammate from the action bar.
- Six new integration test files locking in the recent action surface.
Compliance closure + two-way thread + bulk approve
- WISP acknowledgement workflow on /settings — owner/admin one-click confirm.
- Borrower data export — JSON download of the borrower's own data.
- Audit log retention script — npm run audit:cleanup, 7-year window (Cinch policy).
- Borrowers can reply to broker messages inline in their portal.
- Loan-level internal notes — broker-only, never visible to borrowers.
- Bulk approve N validated requirements in one click.
- Inline duplicate detection in the wizard — debounced check on email/address.
Public security + pricing + team management
- Public security page (/security) with row-by-row GLBA Safeguards alignment.
- Public pricing page (/pricing) — Starter / Pro / Enterprise tiers.
- Team management: change roles, deactivate teammates, resend pending invites.
- Last-owner protection — can't deactivate or demote the only active owner.
Stale flagger + daily digest + phone validation
- Active loans with no activity in 7+ days get a STALE badge on the dashboard.
- Daily digest skeleton + /api/cron/digest endpoint (subject auto-tunes by exception count).
- Borrower phone format validated + normalized to E.164 across all surfaces.
- NEXT_PUBLIC_MAINTENANCE_MODE flag for sitewide banner before risky deploys.
Audit log browser + re-upload history + loan archival
- /settings/audit page — URL-driven filters, cursor pagination, CSV export.
- Re-upload history collapses into a per-requirement disclosure.
- Loan archival — distinct from withdrawn, soft-archive flag for terminal loans.
Per-borrower invite tokens + marketing polish
- Each borrower on a loan gets their own portal URL — uploads attribute correctly in the audit.
- Hero phone aspect cap + hover micro-animations on the marketing site.
- Pulsing clay accent dot in the hero headline.
Production-pattern foundations
- PII envelope encryption (AES-256-GCM, KMS-prefix dispatch).
- Audit log catalog: 21 documented action strings + integration tests.
- Postgres RLS for tenant isolation; CAS Server Action shape canonized.
- Sentry + Inngest skeletons; one-file swap when keys provision.