Changelog

Operator-facing contract history and documentation changes. Documentation describes current source behavior; an entry does not prove a feature is deployed or enabled for your operator. Entries marked Unreleased retain their rollout gate.

2026-11-11 — documentation refresh

Documented

• Dedicated API and dashboard guides for Market PnL, Cash Flow Triage, Operator Support, and Market Requests.
• Market PnL quoted fee fields quoted_fee_credits and quoted_fee_minor, separate from confirmed cash and failed-payout debt; included fees must not be deducted twice.
• Callback historical backfill/bulk resend, exact identity monitoring, endpoint history, selected-target confirmation, and durable receiver deduplication.
• Wallet response identity checks: non-null echoed user, key, currency, or amount must match the dispatched mutation; contradictions remain unknown for ledger reconciliation.
• Current dashboard/API permission boundaries, staging drills, Polyflight reporting/player guidance, safe support escalation, and month-end/rollback operations.
• AMM trade-fee rounding distinguished from wallet FX conversion floors; product result, cash outcome, callback acceptance, and settlement are documented as separate lifecycles.

Fixed

• Explicit Nuxt UI Content registration restores documentation navigation, search, table of contents, and styled prose when Content is resolved through Docus's peer dependency.
• Mermaid's automatic page scan is disabled before hydration; diagrams use a dedicated SVG container and follow the selected light/dark theme.
• Sitemaps use absolute URLs for the selected environment; robots declarations no longer add the production sitemap to staging.

Operator action

• Review the relevant guides and grants. This release updates documentation and its rendering configuration, not Mini App financial/API behavior or product enablement. Unreleased platform features retain their separate rollout and acceptance gates.

2026-11-11 — actionable cash-flow triage

Added

• Market PnL banners and row badges now link to filtered Cash Flow Triage, including old unresolved records without a default creation-date cutoff.
• Operator read-only drill-down endpoints and expandable redacted request/response evidence, attempt timestamps, and immutable resolution history. Reading these details additionally requires balance_operations:read.
• Polynion Admin cash triage with evidence-gated completed/failed wallet-outcome decisions, write authorization, CSRF protection, stale-state fencing, and an audit record. These decisions do not send money.
• Failed-but-unpaid payout counters remain visible after a terminal failed decision. Outstanding payout debt and settlement safeguards are not erased.

2026-11-11 — Market PnL loading

Fixed

• Fixed the server error when loading Market PnL: the timezone value in the database JSON summary now has an explicit SQL text type. Report amounts, grouping, permissions, and filters are unchanged.

2026-11-10 — resolved-market user PnL

Added

• Operator Dashboard Market PnL at /market-pnl: one row per user and resolved market, with balance spent, sale proceeds, redemption payouts, total returned, and user cash PnL.
• GET /api/operator/market-pnl, requiring both trades:read and redemptions:read. Supports market/user/date filters, stable pagination, sorting, and all-filtered totals. Monetary fields are exact integer strings in operator-currency minor units.
• Pending wallet operations are disclosed separately; only confirmed wallet movements contribute to cash PnL. This report does not replace monthly operator settlement.

Operator action

• No schema or scope migration. Staff need both existing reporting scopes (or *).

Unreleased — shared FX reference freshness

Changed

• Automatic Indodax USDT_IDR references now use one global 15-minute upstream cache through the Singapore fixed-IP broker. Opinion snapshots and fresh Polyflight comparison evidence preserve the original source timestamp and broker expiry; cache reads do not refresh their age.
• Expired current FX fails closed. Polyflight's disclosed historical comparison fallback remains comparison-only, and active manual overrides and manual/historical Finance rates remain authoritative.

Operator action

• None. No wallet amounts, fees, settlement terms, service-binding routes, or historical Finance evidence change.

Unreleased — operator-requested private markets

Added

• Staff-only Request Create Market workflow with a 50–500-share virtual depth, mandatory UTC opening/cutoff/resolve deadline, and explicit underwriting-risk consent.
• Operator-scoped request/status endpoints under /api/operator/market-requests and a dedicated Polynion Admin review queue. Publication revalidates all deadlines and atomically records permanent ownership.
• Private-market access restricted to the requesting operator's Mini App, including direct access and trade execution; other operators' visibility rules cannot override ownership.

Changed

• Requested private markets assign all principal gains, losses, sell proceeds, and winning redemption risk to the requesting operator. Existing platform trade-fee shares remain unchanged. Public-market historical principal accounting is unchanged.
• Private-market principal and payout cash are excluded from principal owed to Polynion and captured with immutable underwriting evidence for Finance.
• Admin and MCP market edits share the same transaction-locked private schedule guard; neither can clear mandatory dates or introduce estimated resolution.
• Approval retries revalidate active reviewer status before returning an existing publication.

Operator action

• Await staging acceptance and deployment before relying on these unreleased endpoints. Grant existing markets:read/markets:write only to staff authorized to review/accept operator risk. No existing API-key privileges are expanded.

Staging rollout order

• Apply the additive migration before deploying consumers that query ownership.
• Deploy the updated public Web/core consumers, Mini App client/Beacon, trade and redemption processors (including the private web trade executor), and Finance consumers before deploying the Admin approval endpoints.
• Deploy Operator Dashboard and Admin last; do not approve any private request while an older discovery or execution consumer remains active. Rollback must preserve these access boundaries after the first private market exists.
• This change is unreleased; no staging acceptance or production deployment is implied by source compilation.

2026-11-02

Added

• Operator Dashboard Operator Support at /support-tickets, with operator-shared conversations, replies, and reopening of unresolved closed tickets.
• Staff-only support endpoints: GET/POST /api/operator/support-tickets, GET /api/operator/support-tickets/{id}, POST /api/operator/support-tickets/{id}/messages, and POST /api/operator/support-tickets/{id}/reopen. Machine API keys are not accepted.
• A dedicated Polynion Admin Operator Support queue, separate from user and partner support tickets.

Operator action

• No API-key or financial-scope migration. Sign in as operator staff and follow the support escalation guide; redact secrets and unrelated personal data.

2026-10-18

Added

• Opinion Settlement Reports at /settlement-reports, with the same own-operator monthly data and CSV, daily CSV, and PDF exports as Admin
• report and export endpoints: GET /api/operator/settlement-report?month=YYYY-MM&preview=true and GET /api/operator/settlement-report/export?month=YYYY-MM&format=csv|daily-csv|pdf, requiring settlements:read or *
• current operator-local month read-only preview; future months are rejected, and incomplete months, missing fee history, or unreconciled payouts block exports

Changed

• Resolutions UI, CSV, and copied HTML label the unchanged net_balance_minor field Net resolution exposure, distinguishing it from monthly settlement and realized P&L
• Dashboard session refresh now replaces the login-time permission snapshot with verified current operator permissions, so an approved rollout grant can reach a retained session without logging out; normal staff access edits still invalidate sessions.

Operator action

• explicitly grant settlements:read only to API keys/staff needing Opinion reports; existing restricted grants are not expanded, and Polyflight scopes remain separate
• reconcile actual wallet cash and heed pending-principal exclusions; pending principal alone does not block captured-closures exports, and a report/export is not proof of bank payment or final fully reconciled performance

2026-10-11

Changed

• sell finalization and processed-callback replay decode stored IDR amounts before matching immutable execution snapshots, avoiding false MINI_APP_FEE_SNAPSHOT_TRADE_MISMATCH holds for numerically equal amounts; actual mismatches remain blocked
• recovery keeps the original executed trade, payout, fees, FX snapshot, and credit idempotency key; an already-successful credit is not paid again

Operator action

• no API payload migration; reconcile held orders against their original wallet operations with Polynion, and do not independently repay a sell whose credit already succeeded

2026-10-09

Changed

• Mini App launch redemption returns 401 INVALID_LAUNCH_TOKEN instead of an unhandled 500 when a token is consumed concurrently or expires between lookup and redemption; single-use token enforcement remains unchanged

Operator action

• request a fresh launch URL for an expired or already-used token; no API payload migration is required

2026-10-05

Changed

• Opinion settlement now separates activity-date trade fees and successful reconciled payout cash from recognition-date immutable closed-market principal and realized trading P&L; Polynion owns Opinion principal profits and losses as well as its allocated fee share
• net due is Polynion activity-month fee share plus recognized closed-market principal minus activity-month redemption payout cash; principal removes all gross trade fees, and trading P&L is displayed separately without deducting payouts twice
• historical principal closures first recognized in October are October catch-up, not new October bets or cash received; prior and frozen Finance history is preserved
• reports disclose currently resolved markets awaiting principal closure, exclude open/unreconciled principal, and block exports for missing fee history or unreconciled period payout cash; an exported report is not confirmation of bank payment or final all-time performance
• current-month reports are read-only previews; completed-month export and Finance posting rules remain enforced
• committed sell/redemption payouts retain their original request identity and valuation; unknown/sent operations are held, succeeded operations are not paid again, and contradictory receipt fields are rejected
• Polyflight commercial terms, signed-position allocation, and native-IDR statements are unchanged

Operator action

• reconcile original Opinion execution, wallet-operation, and winning-share payout evidence before principal closure; never retry an unknown wallet credit with a new key
• compare all-time totals across activity and principal-recognition months using the Opinion economics formulas, rather than treating gross volume or closed-market P&L as an extra settlement amount

2026-10-03

Changed

• newly settled native operator-wallet Polyflight losses create durable zero-amount /credit deliveries with reason mini_app_polyflight_loss, ticket key mini_app_polyflight_ticket:{ticketId}:loss, metadata.operation: "loss", and metadata.result: "lost"; newly planned wins include metadata.result: "won"
• loss acknowledgements preserve balance and ticket context, use the existing idempotency/manual-reconciliation lifecycle, and create no monetary accounting entries or liabilities; outstanding loss delivery does not block flight financial settlement
• new loss ticket.resolved payloads include the delivery obligationId; ticket APIs expose the existing payment lifecycle with effect loss and amount 0
• the eight-event webhook catalogue is unchanged; no loss payout pending/processed callbacks are emitted
• the native wallet contract now includes complete Win and Lost credit request/response examples, exact case-sensitive won / lost values, and zero-safe parsing guidance
• simulator replay parameter conflicts surface as unknown wallet outcomes for manual reconciliation, rather than escaping the existing Opinion redemption review path or applying another credit

Operator action

• allow exactly zero only for the valid Polyflight loss-credit contract, durably record acknowledgements under the :loss key, and keep monetary mutation amounts positive; remote_reference remains optional
• distinguish loss acknowledgement from payout in support and reconciliation; the result remains final regardless of delivery status
• do not replay historical losses or rewrite older planned/dispatched request metadata, keys, amounts, transport, or evidence

2026-09-30

Changed

• dashboard callback endpoint editor offers ten Opinion and eight Polyflight subscriptions and preserves existing selections/secret when patching other fields
• callback settings show mixed recent rows only with polyflight:read; UAT selects the chosen product and external user, reports uncovered event subscriptions, and compares Polyflight ticket, wallet-operation, and callback evidence under their respective read scopes; omitted API product still defaults to Opinion
• simulator receiver setup synchronizes its signing secret without overwriting existing event selections or disabling other endpoint URLs; new simulator subscriptions include the canonical eighteen events
• simulator delivery monitoring falls back to Opinion attempts when its Beacon API key lacks polyflight:read and explicitly labels the limitation; previously accepted callbacks remain visible
• callback displays identify exact unscaled IDR minor amounts, distinguish included user ticket fee from operator commercial fee/position shares, full refund/compensation from fees, owed obligations from confirmed wallet credits, and reconstructed envelope previews from original signed bytes
• Polyflight lifecycle callbacks capture external-user identity, gross stake, included fee, net stake, potential payout, and admitted-ticket commercial terms when the event is created; old sparse events remain unknown rather than borrowing current terms
• Polyflight ticket and wallet-operation lists/exports accept an exact external_user_id filter so UAT evidence cannot mix users with similar IDs

Operator action

• review Polyflight event subscriptions, grant polyflight:read for mixed delivery inspection, and maintain durable event_id deduplication before replaying any previously accepted 2xx

2026-09-16

Added

• product: "polyflight" launch selection while omitted product remains Opinion
• native-IDR Polyflight wallet reasons, stable keys, and additive metadata on existing REST v1 paths
• eight mini_app.polyflight.* webhook events with camelCase data
• read-only Polyflight overview, flight, ticket, wallet-operation, terms, signed-statement, payment-history, and export routes
• scopes polyflight:read, polyflight_terms:read, and polyflight_settlements:read
• v5 mixed-money anonymous proof and comparison-only frozen Indodax evidence

Operator action

• update wallet allowlists/idempotency handling and webhook subscriptions before Polyflight enablement
• grant new read scopes explicitly; existing restricted grants are unchanged
• validate dashboard-hosted simulation and the separate real REST v1 contract in staging
• obtain separate production authorization before production deployment, enablement, or wallet activity

2026-07-11

Added

• GET /api/operator/trades/{marketId}/{externalUserId} for operator-scoped market/user trade-history HTML
• GET /api/operator/redemptions in the documented Operator API and Playground catalog
• required wallet mutation metadata matrices for buy, sell, compensation, and redemption flows

Changed

• ambiguous primary wallet mutations now require manual review instead of remote lookup or automatic replay
• buy compensation includes marketId and may retry only with its original idempotency key
• full-contract wallet testing keeps balance and mutation coverage without operation-lookup steps

Removed

• REST v1 operation-lookup configuration and runtime APIs
• staging simulator operation-lookup route

Operator action

• continue durable same-key mutation deduplication and stop implementing or calling lookup-by-key
• persist marketId from all trade mutation metadata
• use Balance Ops, operator wallet logs, remote_reference, and UTC timestamps for ambiguous reconciliation
• never replay the same business action with a new idempotency key

Initial release

2026-06-20

Added

• operator documentation app initial structure
• operator API reference
• wallet adapter reference
• webhook reference

Operator action

• use current pages as source of truth for v1 integration