Changelog - Dev - 07.23.2026

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

---

[Unreleased] - 2026-07-23

Fixed

• Ad network data layer: multi-angle review fixes (22 findings): A comprehensive 8-angle code review of the ad delivery pipeline (#692, #694, #695, #696, #697) surfaced and fixed, most critically: merchant analytics now scope to the minted merchant id linked via users/{uid}.merchantId (never the auth uid, which never matches rollup rows); client-submitted (client_untrusted) claim/redeem events are excluded from the billing-adjacent rollup; gated merchant totals are computed per cell in SQL so they stay exact under row-list truncation and cannot leak suppressed cells; the fill/impression dedupe window resets on account switch; ad click emitters carry the full attribution payload; the nightly MERGE defaults to a self-healing 3-day lookback with target partition pruning; and stale merchant data no longer lingers when an admin switches merchant portals. bug
• E2EE mailbox now requires a real connection: the to-device key-delivery endpoint refuses deposits between users who have no connection, closing the last deferred finding (M-E2EE-6) from the June E2EE review. A stranger can no longer place anything in another user's encrypted-key mailbox; every legitimate key-share path was traced and none can be dropped. A pre-existing rules softness found during review (connection creatable from a declined wave) is tracked in #700. (#701) security

Fixed (round 2, re-review of the fix diff)

• Second-wave review fixes on the ad data layer: the re-run of the 8-angle review over the fix diff surfaced and fixed: BQ reads now derive the environment tag from the project id like the write side (dev deploys set NODE_ENV=production, so the old logic read zero rows on dev); /api/merchants is now routed by the Cloudflare worker and Vite proxies (the merchant offers fetch previously dead-ended at the SPA fallback); the claim/redeem trust filter is a NULL-safe fail-closed allowlist requiring attributionSource='server_authoritative'; the telemetry dedupe window survives the first auth callback and guest-to-account conversion (clears only for a genuinely different user); the admin delivery cache is identity-keyed with a force-bypass on manual Refresh; feed and venue-detail ad slots emit the full fill/impression/click triplet (venue page credits placement inline); plus regression tests for all of the above. bug

Changed

• Ad delivery flip-on rides the deploy pipeline: the deploy-analytics-api job now idempotently creates the analytics.ad_delivery_daily table (day-partitioned, no expiry) and provisions the analytics-ad-delivery-daily Cloud Scheduler job (01:30 UTC) alongside the existing aggregation jobs, so merging to dev is the entire enablement; no manual gcloud steps remain. devops

• Shared delivery formatting + k-anon floor as the single source: Count/CTR formatting and the k-anonymity floor copy now come from @lantern/shared/ads/delivery (formatDeliveryCount, deliveryCtrPct, K_ANON_DISPLAY_FLOOR) across the admin dashboards, merchant portal, and web merchant page, replacing three per-file implementations; admin dashboards share dashboardFormat.js. CSV export now uses RFC 4180 quoting. Em dash display glyphs were replaced with the en dash and five files dropped from the em dash ratchet baseline. enhancement

---

Update - 2026-07-23 14:37 UTC

Fixed

• Gate E2EE to-device mailbox on existing connection: The E2EE to-device mailbox endpoint now requires sender and recipient to share a connection before allowing key deposits. This closes a security gap where any authenticated user could deposit into another user's mailbox. Non-connection attempts return a non-retryable error, while rate-limit drops remain retryable. (#701) bug

---

Update - 2026-07-23 19:58 UTC

Added

• Build ad network data layer with telemetry and dashboards: Introduces end-to-end ad delivery analytics: honest client telemetry (impressions and clicks deduplicated per page load and user), a durable BigQuery rollup table with 3-day self-healing idempotent merges, and gated dashboards in both the internal Ad Delivery admin portal and merchant-facing Overview. K-anonymity gates ensure privacy with a minimum floor of 3. (#703) enhancement