` that clips horizontal overflow. That is not "slightly cut off" — **API keys, Webhooks, Requests, Access and Email could not be opened on a phone at all**, and "Billing" was truncated mid-label. The secondary row had scrolled correctly for a while; the primary row now gets the same `overflow-x-auto`, the same scroll-the-active-item-into-view effect, and the same edge fade. `

` moved from `overflow-x-hidden` to `overflow-x-clip` as part of this. `hidden` silently makes the element a scroll container, and because `

` is never height-constrained it was a scroll container that could never scroll — which broke `position: sticky` for everything inside it. ### Fixed: billing sub-pages broke the nav when billing was off On `/applications/{id}/plans` — and payments, coupons, revenue, dunning, licenses, usage, portal — with billing disabled, the tab labelled **"Overview" carried `aria-current="page"` and linked to the page you were already on**. No sub-tab row rendered and there was no way back. It was one click from the default landing page: the application Overview's Configuration list and the get-started checklist both link into billing while billing is off. The cause was the Billing group collapsing to a single child while disabled, so `plans` matched no group at all and the `?? groups[0]` fallback marked Overview active. The group now keeps its full child list in both states; only the link target of the group pill changes. ### Fixed: a 404 rendered as a crash page `/applications//end-users` answered with "Something went wrong loading this page… contact support (ref …)" and a single "Try again" button that could never succeed. The UI could not distinguish "does not exist / not yours" from "we are broken". The panel API client now maps 404 to `notFound()` and 403 to `forbidden()` on read requests, so both get a real page that keeps the chrome and offers a way out. Mutations still surface a `PanelApiError` so server actions can re-render a form with the operator's input intact. The generic error card also gained a "Back to applications" link. ### Fixed: every primary button failed WCAG AA Measured in-page: `#ffffff` on `#14b8a6` is **2.49:1** at 14px, where AA needs 4.5:1 and even the large-text exemption needs 3:1. Light theme's `#ffffff` on `#0d9488` is 3.74:1, also failing. That was every primary CTA in the product — Create application, New API key, New end-user, Save changes, Enable billing, Mint key — while the destructive button passed at 4.83:1. The most-used control had the worst contrast in the app. The brand teal is unchanged. The label flips to ink (`--color-primary-fg`, `#0a0a0a`), giving **5.29:1** in light and **7.95:1** in dark. Because the label is now dark, light theme's hover step moves 600→500 rather than 600→700, so hover brightens in both themes instead of only one; hover measures 7.95:1 and 10.64:1. The publishable key in the application header also moved from `--color-faint-fg` to `--color-muted-fg`: **3.72:1 → 7.85:1**, on a value the operator is meant to read and copy character by character. ### Fixed: workspace deletion told self-hosted operators to email a vendor The deletion flow ended in "Email support@rekey.dev from the OWNER address" — hard-coded and unconditional. On a **self-hosted** deployment that instructs the customer to email Rekey about rows in a database Rekey has no access to and cannot touch. It is not merely unhelpful; it cannot be followed. The address now comes from `PANEL_SUPPORT_EMAIL`. Unset — the default, and therefore what every self-host sees — switches the copy to the truthful answer: deletion is an operation you run against your own database, with the exact `DELETE FROM tenants WHERE id = …` (everything under it cascades), a `pg_dump` warning, and a copy button. Rekey Cloud sets the variable and keeps the manual support path, where the friction is deliberate. ### Fixed: the audit log printed raw event keys for 44 of 54 event types The label map had 10 entries against 54 emitted types, so ordinary setup produced rows reading `app.plan_created / app.plan_created` — the key printed twice, once as its own label. The same 10 entries populated the Event-type filter, and a hand-typed `?type=` outside them was silently discarded. All 54 are now labelled, the filter is built from the same map, unknown keys are humanised rather than printed raw, and any syntactically valid `?type=` is passed through to the API instead of being dropped. ### Fixed: the audit log and Activity identified people by CUID Payments and Dunning show an email because their endpoints return one. The audit log and Activity showed a 25-character CUID because `GET /tenant/security-events` has no relations to join and no email in its serializer. "Who is `cmsa91v4c000nv5h5txnjvvry`?" had no answer inside the product. The panel now resolves actors a page at a time — operators from the members list, end-users by id, deduped and capped — and links end-users to their page, falling back to the CUID when a lookup fails. ### Added: per-user auth events, and an honest account of what isn't recorded The end-user page showed "Failed sign-in attempts: 7" with no threshold, and that user's events appeared nowhere: Activity is application-wide and had no filters. The counter now reads "7 of 10" with the lockout duration, a **Recent auth events** panel lists that user's last 20 events with reason codes and IPs, and Activity gained an email filter. Both surfaces state plainly that **failed sign-ins and lockouts are never recorded as events** — the API increments a Redis counter and discards the detail — so nobody concludes from an empty list that a locked-out user did nothing. ### Added: webhook endpoint health, delivery detail, and bulk retry An endpoint with 12 of 12 deliveries failing rendered "● Enabled" in green, identical to a working one; finding it meant opening Details on every endpoint in turn. The list gained a **Last 24h** column ("12/12 failed", amber/red) and a banner when any endpoint is failing. Delivery rows are now expandable, showing the delivery and event ids, response status, error and next attempt — and the stored `payload` and `responseBody` whenever the API serves them. **It does not yet:** the tenant delivery route loads both fields and then drops them from its response, so the expanded row explains that rather than showing an empty box. **Retry all failed** replaces twelve individual Retry clicks. ### Fixed: access-control placeholders read as configured values On `/applications/{id}/access`, empty IP-allowlist and CORS fields showed example values (`10.0.0.0/8`, `https://app.example.com`) in the same mono face as a real entry at 7.4:1 — indistinguishable from configuration, on a security page. Placeholders are now dimmed and italic, prefixed "e.g.", and each field states its live effect affirmatively the way the API-keys page already did: "No IP allowlist set — secret keys may be used from any address." ### Added: a sticky save bar with a dirty guard on Auth methods and Access Auth methods is 14 controls over ~1970px with one Save at the very bottom and no dirty state; navigating away discarded everything silently. Both pages now share a sticky footer that shows "Unsaved changes", promotes the Save button when there is something to save, and confirms before an in-app link or a reload throws the edits away. ### Fixed: the get-started checklist ticked billing with zero providers "Enable billing and add a provider" was satisfied by `billingConfig.enabled` alone, so the checklist reported production-ready on a state where checkout fails with `BILLING_CREDENTIALS_NOT_CONFIGURED`. It now requires a configured provider too, and says so when billing is on but unconfigured. ### Added: scopes and expiry on panel-minted API keys The API has always accepted `scopes` and `expiresAt` on this endpoint; the panel sent neither, so every panel-minted key was full-access and never expired. The mint modal now offers both. Note that the API turns an empty `scopes` array into `['*']`, so the panel omits the field entirely rather than posting `[]` — the UI never says "no scopes" while minting a full-access key. ### Fixed: hydration mismatch on every page with a Modal The dialog id came from a module-level counter, which does not agree between a server process that has rendered other modals and a freshly loaded client: server emitted `rekey-modal-2-title`, client `-3-`. React logged "This won't be patched up" on every page containing a Modal. It now derives from `useId()`. ### Fixed: the slug field was a dead end Typing "Northwind Store" left Slug empty and disabled the submit with nothing naming the blocking field; a click during "Checking availability…" hit a disabled button and did nothing at all. The slug is now prefilled from the name (and stays linked until you edit it), the submit is never disabled — a blocked submit focuses the field and says why — and a click during the check is held and released when the answer arrives. ### Fixed: inconsistencies between comparable surfaces One `` replaces the divergent status rendering that showed uppercase `FAILED` on /payments and title-case `Failed` on /revenue from two separate tone maps. Empty states on /team use the shared ``, and /coupons gained the CTA that /applications already had. Confirm dialogs and the create modal now render the same `