Every shipped change, dated.

Added

• Public /changelog page rendered from this file, with an RSS 2.0 feed at
• Time Clock for employees
• Migration: new staff_time_clock_entries
• Server actions (time-clock): clockIn, clockOut,
• Staff-facing Time Clock page (/[facility]/time-clock): big Clock In / Out
• Manager/owner hours report (/[facility]/time-clock/report): bookmarkable
• Sidebar nav entry: "Time Clock" added to Revenue group, visible to all roles.
• AI dynamic pricing engine — rule-based occupancy + holiday-aware rate
• State inspection compliance pack — owners and managers can generate a
• AI no-show prediction — nightly Inngest cron computes a deterministic
• Daily best-shot reels — an Inngest cron runs at 4pm in each
• Google Business Profile review-reply approval queue — settings page

Added

• AI front desk on SMS and voice — Anthropic-backed agent answers
• AI vaccine OCR — staff approve/reject expirations from a single
• Stripe Connect — facility onboarding, payouts, refund ledger,
• Bulk check-in plus CSV exports for customers, reservations,
• Staff management — invite, role updates, deactivation, with
• Facility CRUD — create, update, deactivate, with IANA timezone
• TCPA STOP/HELP/START keyword router — carrier-mandated replies
• Inbound MMS persistence — Twilio media URLs are pulled into our own
• 15-minute appointment alerts with a dedup ledger and prune cron.
• Pet parent portal with magic-link auth, online booking, vaccine
• Pet parent voice confirmations on staff tablets via the Web Speech
• Soft-delete + GDPR anonymize function for customer records.
• Per-tenant SMS budget cap with graceful-degrade fallback when a
• Daily kennel-manager morning brief Inngest cron — a single digest
• Marketing replay consumer for winback + vaccine-cron outbox so
• Auto-no-show cron — sweeps stale reservations past their end time.
• Stuck-campaign sweeper — catches campaigns hanging in sending
• Health endpoints — /api/health, Inngest watchdog, Telegram alerts,
• Switch from Gingr landing page in the primary nav.

Changed

• Renamed PawPilot to TailRoster across the product, marketing
• Homepage stripped of retired 3D scenes — new intro video, rotating
• Pricing card in the 3D landing scene now derives from the canonical
• Signup now detects facility timezone from the
• Marketing automation runs autonomously — lifecycle email + SMS,
• Inngest functions are wrapped with withFailureCapture so every
• SMS marketing sends now include the A2P 10DLC opt-out footer
• Anthropic client timeout capped at 60 seconds (was unbounded).
• `sendAndLog` returns a typed Result so SMS failures stop being

Fixed

• Concurrent refund race — refund ledger now serializes per
• Stripe payment-intent succeeded — dedup row written *after*
• Stripe payout reconciliation window corrected for weekly payouts;
• Stripe webhook signature ordering — verify signature *before* the
• Vaccine OCR auto-approval now requires a secondary signal beyond
• AI agent customer-scoping — front desk tools restricted to the
• Booking AI tools hardened against staff-side prompt-injection
• Marketing preview double-escape removed (the AI sanitizer is now
• `<mj-include>` disabled in marketing MJML to block tenant
• Subject-line rendering strips control characters before send.
• Inbound voice gather emits with a (callSid, speechHash)
• Vaccine cron auto-cancel uses CAS on status + tenant filter so
• MMS inbound idempotency namespace fix — MessageSid collisions
• R3F + GSAP landing scenes — seven unmount/cleanup leaks fixed.
• Mobile signature canvas scales to actual width via
• Service worker stopped routing every request through the main

Security

• Front-desk customer-scoping defense — AI tools cannot read or
• Cross-tenant PII guard on parent portal — explicit tenant scope on
• `audit_log` sweep — every PII / money / state-machine action now
• Raw Postgres errors are redacted at every API route boundary;
• Per-tenant rate limiting on auth, financial, and SMS routes via a
• Storage bucket size + MIME-type constraints on
• Upload size verified at confirm step so orphaned uploads can't
• SMS suppression gate runs inside sendAndLog — opt-outs can't be
• Staff outbound SMS gated by E.164 validation, opt-out check, and a
• 2FA scaffolding (Supabase MFA) ready to flip on per facility.
• AI persona validated server-side with a 500-character cap;
• Unsubscribe endpoint rate-limited against token enumeration and
• Marketing campaign mutations gated behind owner/manager roles +
• CSPRNG used for discount codes; CAS guard on redemption.
• Stripe Connect onboarding idempotency + CAS guard so a refreshed
• POS receipt lookup scoped to cart_id instead of broad tenant