BestDealOn

Handbook

Changelog

Newest first. Times are EST (UTC−5), taken only from the Render deploy records of bestdealon.app (srv-dbkr24vb9u1s7387a3p0) and callbots-bdo (srv-dbl01inf3r2c7382v4c0): the deploy finish time, converted to EST. This is the single merged changelog for the platform and the phone side (the Callbots draft list was git-based and is replaced by this). RF Safe (main) changes are out of scope. Commits that were never deployed on their own (for example caller recognition 0d93d7d) went live inside the merge deploy that contains them. Deploy ids are Render ids. To add an entry, copy one line to the top of the right day:

- HH:MM — **service** — short summary (`commit`, `deploy-id`)

See the master feature inventory for what is live today.

2026-11-03

  • 23:43 — bestdealon.app — Handbook wiki live at /wiki/ (platform + Callbots section, merged changelog, settings, agents, diagrams), John approved 11:39 PM (e5896b8, dep-dblbfi5g1s2s73e7oes0)
  • 23:19 — bestdealon.app — ATTACH_OWNER_1188 one-time hook: business owner account for listing …1188 (John, Nov 3 11:16 PM ET) (678aabf, dep-dblb4hijnfac73ffc4og)
  • 23:12 — bestdealon.app — CALLER_DIAG: also list candidate owner accounts , masked, read-only (b14ac6e, dep-dblb1a6417fc7381chig)
  • 22:23 — bestdealon.app — Read-only CALLER_DIAG boot hook: masked caller-profile match facts for one number (no writes) (73716b9, dep-dblaa53bc2fs73dm9t5g)
  • 22:03 — callbots-bdo — Merge feature/bdo-caller-recognition into bestdealon (ee5b1f2, dep-dbla0lajnfac73fblnlg)
  • 22:02 — bestdealon.app — Merge bdo-caller-lookup: signed caller-profile endpoint (CALLER_LOOKUP gated) (068b4c7, dep-dbl9vqbm8hqs738ll02g)
  • 21:25 — bestdealon.app — Auth pages: homepage theme card, inline radios with hint lines, consent checkbox aligned (CSS only, same forms, consent text unchanged) (694e4c4, dep-dbl9emmgekts73fnf7r0)
  • 20:59 — bestdealon.app — Bizinator links: one-off UPDATE_BIZINATOR_LINKS hook listing the services the stack uses (draft, env unset) (8b0aeca, dep-dbl92eoae00c73bhegh0)
  • 20:19 — callbots-bdo — bestdealon tenant: rotate Twilio webhook shared key id (John, Nov 3 8:16 PM ET); RF Safe untouched (8a95614, dep-dbl8fo6tlv9c73babm2g)
  • 20:08 — callbots-bdo — bestdealon tenant: allow mention of owner-requested Verify-by-call code call only (John, Nov 3 8:02 PM ET) (b152a16, dep-dbl8am942hec739tqnl0)
  • 20:08 — bestdealon.app — Docs (design note, README, wiki) + local screenshots for Verify by call / Edit business / claims (3732d38, dep-dbl8am142hec739tqmj0)
  • 20:03 — callbots-bdo — BDO Verify by call (/bdo/verify-call dryrun/live, keyin gather) + inbound claim tools; flags default off, bestdealon tenant only, RF Safe untouched… (0e959ca, dep-dbl88igm7kps739isctg)
  • 13:39 — bestdealon.app — One-off REMOVE_QXT_BUTTON boot hook: drop the quantaxtechnology.com CTA button (marker-guarded, audited) + tests (23d5088, dep-dbl2k17b9u1s738pk1s0)
  • 13:33 — bestdealon.app — One-off FIX_LISTING_CONTACT boot hook: staff contact wording -> Best Deal On support (marker-guarded, audited) + tests (8a9b574, dep-dbl2hinf3r2c7388phm0)
  • 13:32 — callbots-bdo — BDO owner API: no-phone-bot and texting notes point to Best Deal On support (John, Nov 3); RF Safe unchanged (5d20384, dep-dbl2h6dg1s2s73e3i3e0)
  • 13:24 — bestdealon.app — Merge perf-listing-paint (03ed2ae, dep-dbl2deuk1f9s73eap3t0)
  • 12:54 — bestdealon.app — SEO: index every approved listing, including seeded/imported ones (was noindex + left out of sitemap); tests (d63b677, dep-dbl1vfc9v7es73flf0gg)
  • 12:34 — bestdealon.app — Homepage v2.1: Bizinator self-launch pitch, texting feature with carrier-approval note, feature comparison chart on / and /features/, tests (f1bcaab, dep-dbl1m15g1s2s73e1nnm0)
  • 12:33 — callbots-bdo — BDO bot: texting is a feature after one-time carrier approval; never offer texts yet (John, Nov 3) (56864d2, dep-dbl1lcbncjis73fk2bm0)
  • 12:13 — bestdealon.app — Homepage v2.0: sell the Best Deal On AI phone bot setup – call (727) 632-0002 hero, zero-person company section, refreshed responsive theme, tests (92899db, dep-dbl1c0lg1s2s73e12e50)
  • 12:10 — callbots-bdo — BDO: rotate Twilio webhook shared key id (John approved key rotation, Nov 3) (b98d82c, dep-dbl1armc6qcc73bmtc0g)
  • 11:40 — bestdealon.app — Web phone bot owner dashboard (/account/phone-bot): session-only server proxy to callbots-bdo /api/owner/v1, read-only one-phone web token, shared … (082dd89, dep-dbl0sk1srm7s73bd18a0)
  • 11:29 — bestdealon.app — One-off SET_BUSINESS_CITY boot hook (city/state only, marker-guarded) + tests (d61732a, dep-dbl0n9942hec73dhvkf0)
  • 11:24 — callbots-bdo — docs: owner API (3031385, dep-dbl0l5jbc2fs73ai9st0)
  • 11:16 — callbots-bdo — email guard: allow the caller's confirmed address on this call; scripted line on recipient_not_allowed (93fc899, dep-dbl0hf59fdbs73chmnqg)
  • 11:03 — callbots-bdo — test: PA_EMAIL_ALLOW_ONLY accepts a comma-separated allowlist (87f2f7a, dep-dbl0b37b9u1s738k9n7g)
  • 10:58 — callbots-bdo — readiness: shared-key tenants check webhook key secrets instead of the auth token (1f8bccb, dep-dbl08lk9v7es73fhkmn0)
  • 10:55 — callbots-bdo — Twilio: find tenant by shared-key id when To is absent; log verify failure reason (97a8f1c, dep-dbl07ljbc2fs73ah8ueg)
  • 10:53 — callbots-bdo — BDO: require Twilio shared key for webhooks (bfd7213, dep-dbl06irbc2fs73ah6j5g)
  • 10:49 — callbots-bdo — BDO: load Callbots KB draft (pricing -> take a message), call-script greeting, voice+email only rules, tenant loads from repo dir (2f616ed, dep-dbl0478ae00c73c83ipg)
  • 10:47 — bestdealon.app — Terms: no sharing of mobile/opt-in data with third parties or affiliates for marketing (fc9a807, dep-dbl03o2jnfac73a4k3k0)
  • 10:42 — callbots-bdo — PR5: Best Deal On take-a-message by email (no audio), tenant email sender, test-recipient guard (f713234, dep-dbl01j7f3r2c7382v5og)
  • 10:41 — bestdealon.app — Inbound SMS STOP/HELP/START webhook (/twilio/sms, signature-checked, opt-out table); START wording on privacy/terms (324d06e, dep-dbl013k9v7es73fh2p9g)
  • 10:08 — bestdealon.app — Publish Privacy Policy and Terms: remove DRAFT banner, indexable with canonical, add to sitemap (LEGAL_PAGES=on) (d8e37c0, dep-dbkvhkp42hec73deu5cg)
  • 10:04 — bestdealon.app — Phone ownership verification via Twilio Verify (voice only), legal pages + SMS consent behind LEGAL_PAGES (off), onboarding scaffolding, env script (0098543, dep-dbkvfodbedkc73em9np0)
  • 09:21 — bestdealon.app — Mailer: log Resend HTTP status (no body, no key) on failure (4c39f86, dep-dbkur85g1s2s73dr5010)
  • 09:15 — bestdealon.app — Email via Resend: signup confirmation (hashed single-use 24h, existing users backfilled as confirmed), text+HTML mails, default from Best Deal On <… (ed19436, dep-dbkuomajnfac73a13u30)
  • 09:10 — bestdealon.app — Caddy: onrender host public pages 301 to APP_URL when custom domain set (static files bypass PHP) (fc1df38, dep-dbkumd5bedkc73ek8md0)
  • 09:06 — bestdealon.app — Public launch: onrender public pages 301 to APP_URL (API/device/auth exempt); noindex + out of sitemap/llms/feed for 555 test numbers, untouched de… (d6b03d8, dep-dbkuk495efls73fnl3sg)
  • 08:51 — bestdealon.app — Custom domain: www.bestdealon.app 301 -> https://bestdealon.app; apex + onrender both served; test (cc60247, dep-dbkud3ajnfac73a03fhg)
  • 08:32 — bestdealon.app — Rebrand: Bizinator Backup -> Best Deal On Bot (Works with Grok Bot); app guide 2.2.0 + upgrade/reload note; footer brand line (Bizinator/Promptinat… (23489ef, dep-dbku4duk1f9s73e0madg)
  • 08:16 — bestdealon.app — Admin: delete user (typed confirm, CSRF, audited; tokens revoked, owned pages optional; hard refusals), search + A–Z + paging on Users and Subscrip… (86c52e3, dep-dbktsoh5efls73flkbm0)
  • 07:46 — bestdealon.app — bin/grant_admin.php (CLI-only, audited, idempotent) + one-off GRANT_ADMIN_EMAIL boot hook; launch checklist (ec7b63c, dep-dbktets9v7es73fardjg)
  • 07:35 — bestdealon.app — CORS: allow If-None-Match (ETag already exposed) + test (817895b, dep-dbkt9pei0phs73b85akg)
  • 07:08 — bestdealon.app — One token per install (install_id), public GET /api/v1/schema + docs/fields.json, AGENT_FILL.md, push_business dry-run default/--apply/ETag, qa_gua… (2bc1399, dep-dbkst4tbedkc73efuajg)
  • 06:42 — bestdealon.app — Device connect: keep the code through every sign-in path, Connected page after Approve, dashboard no-key note + pending banner (427b918, dep-dbksgue7bikc73fp7hmg)
  • 06:17 — bestdealon.app — Device approve: preselect the account's only business (5470c7e, dep-dbks55nb9u1s7389ub5g)
  • 05:58 — bestdealon.app — e2e: live check of extension device flow (prefill, approve, token, CORS, revoke self) (6fc5852, dep-dbkrs6p5efls73fg8aig)
  • 05:28 — bestdealon.app — Dashboard: owner status page with time estimate, admin self-declared-ownership warning + unverified phone flag, no Restore on created entries, favi… (9bf1fa4, dep-dbkre2lg1s2s73dir8g0)
  • 05:11 — bestdealon.app — Store::patch: a patch with only _modules (or {}) no longer wipes the document (c2f2adc, dep-dbkr6059fdbs73c4k1hg)
  • 05:08 — bestdealon.app — API: accept Caddy-encoded ETags (-gzip/-zstd, W/) in If-Match/If-None-Match; add live e2e script (a954359, dep-dbkr4rd9fdbs73c4gp0g)
  • 05:05 — bestdealon.app — Preview demo seed: SEED_DEMO=<phone> imports seed/<phone>.json once as approved (3c72cbb, dep-dbkr3ge7bikc73flqa80)
  • 05:04 — bestdealon.app — Docker: drop frankenphp file capability so it starts under Render's no-new-privileges (8ab7bc0, dep-dbkr31rbc2fs73a54pbg)