Orbit 1.8.0: Fewer Dead Ends, More Things That Actually Save

A reliability update became a small urban-renewal project

This release started with editors that forgot their mode, pages that hid their save action, and a plan assignment table that existed in several slightly incompatible interpretations of reality. We fixed those. We then kept walking and found route collisions, stale revisions, half-finished Discord deliveries, invisible historical members, lonely announcement popups, module gates arguing with their own intents, and enough inconsistent form controls to open a museum. Orbit has now put the rake down and labelled the cupboard where it belongs.

The Dashboard now remembers what kind of Dashboard it is

Settings pages now share clearer sections, opaque surfaces, predictable spacing, Discord-aware colour and message previews, consistent resource pickers, and one understandable save/reset contract. Moderation Settings, Event Logging, Creator Notifications, Campaigns, Leveling, Access Requests, Custom Commands, Forms, Tickets and Reaction Roles all benefit. Phone layouts collapse deliberately instead of merely hoping the desktop grid will become emotionally flexible.

Saving twice on the same page no longer lets an older background read overwrite the first result. Clean editors adopt remote revisions live; dirty editors keep the local draft, retain the newer remote snapshot, block an unsafe stale save, and make Reset load the actual remote version. This is live collaboration without pretending that two people typing into one field is already a distributed-systems conference talk.

Product notices gained an inbox and some manners

Signed-in users can now receive route-aware announcements, mini changelogs and warnings that match the part of Orbit they are using. Ordinary automatic popups are limited to one per browser session, important warnings keep priority, and user-opened dialogs are not shoved aside by a marketing-shaped rectangle.

Missed and older notices remain available in the account Update Center with search, unread and warning filters, detail replay, read state and archived context. Published versions remain stable, acknowledgement history survives newer editions, and stored actions can navigate but cannot execute hidden mutations. Popups are now a delivery method, not a hostage situation.

Modules grew a proper workshop

Module teams now have a discoverable Developer Center workspace for module identity, editable release details, private Guild distribution, versioned Dashboard blueprints, bounded activity and genuinely useful statistics. Time ranges compare with the preceding period, outcomes are separated, latency is weighted correctly, installations are module-scoped, and approved product metrics remain delayed and privacy-protected.

Orbit-owned modules can expose dedicated maintainer workspaces without relying on a page-local module-name guess. Party Hub brings questions, localized content, songs, cue sheets, stages and policy into the module studio; Casino exposes its complete version-aware configuration and runtime blueprint. View access stays view-only, published manifests remain immutable, and existing Guild installations remain pinned to their chosen version.

Giveaway 1.0.0 joins the catalogue

The new optional Giveaway module supports scheduled and immediate giveaways, role and account-age eligibility, capped weighted chances, multiple prize tiers, draws without replacement, rerolls, templates, recovery and auditable fulfilment. Participation stays compact in Discord while the full workflow lives in the Guild Dashboard, where it can be inspected without asking a slash command to become spreadsheet software.

Public messages show counts, winners, rules and proof references without exposing a participant directory. Eligibility is rechecked before drawing, draw and fulfilment progress is resumable, and supported prizes can use permanent Discord roles or compatible module rewards. Global inventory grants, payments, direct-message prizes and external follow checks are deliberately not part of 1.0.0.

Tickets and Forms stopped making Discord configuration feel archaeological

A Ticket panel can now contain several independently configured ticket types and present them as buttons or a select menu. Each type owns its label, emoji, category, staff roles, ping roles, opening message and channel-name pattern. Managers publish panels directly from the Dashboard, keep up to three managed Discord messages synchronized, retry failed projections, and remove placements explicitly.

Forms once again expose role actions for submission, approval and rejection. Auto Review can also grant or remove roles for matching and non-matching answers, including calendar-aware age rules expressed in days, months or years. Discord DM forms use the Guild locale, validate each answer before advancing, respect rating and selection bounds, and keep failed submissions retryable.

Unicode and Guild emoji now use one searchable picker across supported editors. Ticket type fields retain focus while their labels change, placeholder icons are visible again, duplicate Ticket-number aliases are hidden, and Announcement authors can insert a selected member name or explicit mention without hand-writing Discord syntax and hoping the brackets are feeling cooperative.

Leveling and AutoMod learned the difference between simple and simplistic

Leveling now offers Basic and Advanced modes, clearer progression presets and recurring daily or weekly Bonus Challenges for messages, XP and bounded keywords. Rewards are granted exactly once per member and period, challenge progress appears in personal-data exports, and compatible predecessor bonus rules can become real Orbit challenges during import.

AutoMod also gains Basic and Advanced modes. Light, Balanced and Strict presets manage only their own rules and preserve custom work. Invite rules can resolve the destination Guild and apply current-Guild, allowlist, blocklist, default and unresolved-invite policies with explicit precedence. Raid protection can raise thresholds conservatively from aggregate join history, but it never lowers the configured floor.

AutoMod and AutoMod AI log actions now flow through Event Logging's moderation history, retention and optional Discord destination instead of owning a second log-channel setting. Enforcement remains independent: disabling Event Logging stops the record and projection, not the rule. Apparently one logging system was enough after all.

Plans, permissions and modules now agree before saying no

Built-in plan grants have explicit ranks again, partially created plan-history tables repair forward, and Plan & Limits shows effective features and modules instead of a nearby approximation. Module inclusion, required intents and an optional module-level plan floor now resolve through one rule, so Setup, Store readiness and runtime checks stop producing different answers to the same Guild.

Roles & Permissions keeps the catalogue and selected editor independently reachable on desktop, returns to a natural single column on narrow screens, and reliably marks role changes dirty. Revoked Discord roles stop granting protected Guild access on the next request; stale OAuth management flags or cached member snapshots are not accepted as authority. During a Discord outage, protected Guild access may therefore fail closed rather than trusting yesterday's permissions.

Moderation remembers people after they leave

Moderation history now resolves identities from durable Guild projections and case snapshots instead of contacting Discord for every row. Member search includes present and departed people as well as historical case identities, with clear present, departed, kicked, active-ban and former-ban states. A rejoin correctly outranks an older kick; a later unban correctly ends an older ban.

The moderation workspace uses fewer reads, internal comments live in a focused dialog, the drawer keeps a compact recent-context summary, timeline entries are readable event cards, and terminal labels no longer repeat themselves. Optional Member Profile panels fail independently, so one unavailable source produces a named warning instead of turning the rest of the profile into a convincing empty lie.

Sentinel handoffs from eligible ban cases are reliable, subject lifecycle dates and appeal state are clearer, and scheduled, active, removal, expiry and appeal updates can reach the affected account or Discord user. Trust & Safety conversations now project assignments and participants consistently, replies drive normal case states, participant cancellation remains participant-controlled, and resolution uses one final message with optional linked completed actions.

Crashes, retries and releases leave less unfinished business

Moderation actions, campaign sends, Ticket commands, access-request roles and subscription welcomes now recover stale work instead of remaining permanently in progress. Discord delivery uses stable identities where supported, retries are bounded, and external calls have deadlines. A failed Discord projection stays visible and retryable without pretending that the underlying definition failed to save.

Dashboard releases now reload the current route without deleting sessions, drafts, local storage, IndexedDB, caches or service-worker registrations. Public pages ship a smaller stylesheet, authenticated navigation waits for pointer or keyboard intent before prefetching routes, and the public Health page is emitted as an actual indexable public document rather than a private fallback wearing a public URL.

Known limitations

• Privacy-protected module product metrics remain empty until their definition is approved and enough delayed aggregate data exists.
• During a Discord outage, protected Guild pages may be unavailable because Orbit will not use stale role evidence as authority.
• AutoMod enforcement continues when Event Logging is disabled, but no AutoMod log record or Discord log projection is created.
• A Ticket panel above a newly lowered type limit remains readable but must be reduced before it can be saved again.
• Route-aware announcements and the Update Center are available to signed-in accounts; public visitors do not receive account-targeted notices.
• Giveaway 1.0.0 deliberately excludes payments, temporary prize roles, direct-message prizes, external follow checks and global Inventory rewards.
• Realtime collaboration refreshes whole authorised resources; it is not character-by-character shared editing.
• Invite targets that Discord cannot resolve follow the Guild's explicit unresolved-invite policy.

A setting is not finished when it has a toggle. It is finished when it saves, survives another tab, reaches the right Discord surface, respects the current permission, and explains what happened when any of that fails.

Our release rule

Technical change inventory

The chapters above cover the large changes. The deliberately long inventory below covers the smaller visible behaviours, edge cases and public contracts that did not need an essay of their own. It is also evidence that 'a few UI fixes' remains banned from our estimation vocabulary.

Dashboard, layout and editor details

• Moderation Settings uses five clearly bounded sections.
• Transparent Moderation cards now resolve to opaque Orbit surfaces.
• Settings rows collapse cleanly on narrow containers.
• Discord colour fields combine a picker, validated hex input and presets.
• Discord previews support content, embeds, fields, authors, footers, media and timestamps.
• Preview links and media accept safe HTTP or HTTPS URLs only.
• The global save bar respects mobile safe areas.
• Shared form actions wrap instead of escaping their cards.
• Discord channel pickers use one-column controls on phones.
• Discord member pickers preserve readable selected values on narrow screens.
• Page sections use consistent headings, descriptions and action placement.
• Layouts own the document main landmark instead of nesting dozens of them.
• Event Logging panels no longer stretch to match unrelated card heights.
• Event categories group into responsive controls.
• Creator Notification source cards have explicit loading, error, empty and data states.
• Provider icons are centred consistently.
• Announcement empty states now describe the active filter.
• Forms review and conflict explanations use accessible information tooltips.
• The removed Forms template shortcut no longer competes with primary creation.
• Role Menu panel editing keeps its own explicit save flow.
• Form Studio keeps route-leave protection without registering a duplicate global save.
• Workspace navigation preserves usable touch targets.
• Reduced-motion and forced-colour presentation is preserved across shared controls.
• The Public Web build ships only the PrimeVue styles used by public routes.
• Authenticated navigation prefetches after hover or keyboard focus rather than visibility alone.

Saving, revisions and realtime

• Authoritative mutation responses update the initiating editor immediately.
• Older in-flight reads cannot overwrite a newer mutation result.
• A mutation during an active read schedules one trailing refresh.
• Repeated refresh requests share the same trailing read instead of forming a storm.
• Clean editors adopt remote revisions automatically.
• Dirty editors retain their local draft when a remote change arrives.
• Dirty editors retain the latest remote snapshot for comparison and reset.
• Stale saves remain blocked by optimistic revision checks.
• Reset loads the remote version without requiring a page reload.
• Guild configuration subscribes to its exact realtime topic.
• Module configuration subscribes to module-scoped invalidation.
• Setup and Store refresh after relevant module changes.
• Permissions refresh after mapping changes.
• Command Access refreshes through its own topic.
• Campaigns refresh after draft and lifecycle writes.
• Access Requests use a dedicated permission-scoped topic.
• Sentinel uses a dedicated Guild topic.
• Creator Notifications refresh Guild and provider views separately.
• Experience notices refresh after published campaign changes.
• Moderation and issue views keep their existing live refresh.
• Realtime envelopes contain invalidation metadata rather than protected records.
• Every refreshed resource passes through its normal API permission check.

Modules and Developer Center

• The Developer Center has a dedicated module-pages index.
• Supported first-party workspaces are discovered from a server-owned registry.
• Module identity can be edited with revision protection.
• Editable release metadata can be changed before submission.
• Private distribution supports owner-only and selected-Guild access.
• Private-distribution changes require an exact final-action reason.
• Module activity history is bounded and omits sensitive payloads.
• Versioned Dashboard pages can be inspected before release.
• Module actions and record collections are visible in the blueprint inspector.
• Statistics support explicit range and resolution controls.
• Statistics compare against an equal previous period.
• Outcome timelines distinguish successful and failed activity.
• Latency uses weighted aggregation instead of averaging averages.
• Traffic totals are scoped to the selected module.
• Active and total installation counts are module-scoped.
• Approved product metrics remain delayed and thresholded.
• Raw metric contribution rows are never exposed to module teams.
• Party Hub data panels fail independently instead of reporting false access denial.
• Party Hub view-only access disables every mutation.
• Casino configuration search includes advanced nested fields.
• Casino table timeouts recover abandoned Hold'em buy-ins.
• Casino refunds use table-generation-specific idempotency.
• Party prediction retries resume only missing winner awards.
• Conflicting Party winner selections are rejected during payout.
• Existing installed module versions remain pinned until explicitly upgraded.

Giveaway 1.0.0

• Giveaways can start immediately or at a scheduled time.
• Scheduled giveaways recover if the original start signal is missed.
• Giveaways can require specific Discord roles.
• Giveaways can reject selected Discord roles.
• Minimum account-age and Guild-tenure checks are supported.
• Every participant receives one base chance.
• Role bonuses can raise chances up to the configured cap.
• A member receives one entry record per giveaway.
• Eligibility is rechecked before a winner is accepted.
• Draws select winners without replacement.
• Multiple prize tiers can use independent winner counts.
• Rerolls operate on open prize slots rather than rewriting history.
• Draw proofs retain the inputs needed for review.
• Public messages avoid exposing a participant directory.
• Discord role prizes use idempotent fulfilment.
• Compatible Casino and Quest Board rewards can be fulfilled through module functions.
• Blocked fulfilments remain visible for manual resolution.
• Giveaway templates can be saved, duplicated and archived.
• Active giveaways can be updated through an audited action.
• Cancellation preserves the giveaway's history.
• Recovery scans resume overdue starts, draws, messages and fulfilment.
• Participant data is included in the module's personal-data contract.
• Mixed draw records redact third-party winner and seed details from subject exports.
• The module is optional and disabled by default.

Tickets, Forms and Discord authoring

• Ticket panels support between one and the effective policy limit of ticket types.
• The default Ticket type limit is ten.
• The hard Discord component ceiling remains twenty-five.
• Existing oversized panels remain readable after a policy reduction.
• Ticket panels can render independent buttons.
• Ticket panels can render one Discord select menu.
• Each Ticket type can choose its own category.
• Each Ticket type can choose staff access roles.
• Each Ticket type can choose explicit ping roles.
• Each Ticket type can define its opening message.
• Each Ticket type can define its channel-name pattern.
• Each opened Ticket snapshots the selected type.
• Private channel overwrites include the opener and configured staff roles.
• Ticket panel messages are published from the Dashboard.
• A panel can own up to three managed Discord placements.
• Panel edits synchronize every managed placement.
• Missing Discord messages expose a republish recovery state.
• Failed synchronization remains retryable.
• Placement removal also removes the Discord message when possible.
• Ticket publication validates the Bot's channel capabilities.
• The shared emoji picker searches Unicode and Guild emoji.
• Forms, Access Requests, Reaction Roles and Tickets use the shared emoji value.
• Ticket type input focus survives label and key edits.
• One canonical Ticket-number placeholder replaces duplicate aliases.
• Form submission, approval and rejection can grant or remove roles.
• Auto Review can apply role actions on matching answers.
• Auto Review can apply different role actions on non-matching answers.
• Date-age rules use exact calendar days, months or years.
• Discord DM forms validate the current answer before advancing.
• Failed DM submission retains a retryable session.

Leveling, AutoMod and Event Logging

• Leveling mode persists across saves.
• Leveling drafts survive navigation within the Leveling workspace.
• Basic Mode presents outcome-based progression presets.
• Advanced Mode preserves exact numeric settings.
• Preset highlighting reflects the live configuration.
• Applying a Leveling preset saves it immediately.
• Challenge targets scale from the selected XP pace.
• Daily message challenges are supported.
• Weekly message challenges are supported.
• Daily and weekly XP challenges are supported.
• Bounded plain-keyword challenges are supported.
• Keyword challenges never accept regular expressions.
• Keyword matching stops when Message Content access is unavailable.
• Challenge rewards are granted once per member and UTC period.
• Challenge XP updates the normal Leveling member record.
• Role rewards reconcile after challenge XP changes.
• Level-up announcements continue after challenge rewards.
• Challenge progress appears in personal-data exports.
• AutoMod mode persists across saves and tabs.
• AutoMod drafts survive navigation inside its workspace.
• Light, Balanced and Strict presets preserve custom rules.
• Managed preset ownership is marked server-side.
• Duplicating a managed rule creates an independent custom rule.
• AI-only navigation is hidden when no model is available.
• The AI Policy tab has a distinct label.
• Invite rules can allow the current Guild explicitly.
• Invite rules support target-Guild allowlists and blocklists.
• Unresolved invites use an explicit allow-or-block policy.
• Explicit target blocks win over general allow rules.
• Raid history can only raise an active threshold.
• New Guilds use the configured static raid threshold during warm-up.
• AutoMod hits use Event Logging's moderation category.
• AutoMod AI hits use Event Logging's moderation category.
• The duplicate AutoMod log-channel field has been removed.

Plans, permissions and Guild setup

• Free, Premium and Pro grants use explicit authoritative ranks.
• Plan presentation order no longer determines grant precedence.
• Plan assignment preserves an immutable grant snapshot.
• Partially created plan-history tables repair without discarding history.
• Plan & Limits shows effective feature access.
• Plan & Limits shows effective module access.
• Long module lists collapse into a localized remainder count.
• Module installation and activation are separate Store actions.
• Store activation rechecks plan access.
• Store activation rechecks required capabilities.
• Store activation rechecks lifecycle and capacity policy.
• Setup removes duplicate module selections.
• Setup hides modules that cannot be selected.
• Selected locked modules remain removable.
• Setup completion rechecks every selected module server-side.
• Required module intents derive one effective plan floor.
• Optional intents do not raise a module's required plan.
• A module-specific plan floor can replace inherited intent plan requirements.
• Module dependencies also respect the effective floor.
• Plan access never substitutes for Discord capability access.
• Independent authorised overrides remain independently evaluated.
• Permission categories and selected details scroll independently on desktop.
• Permission filters include category, source, status and search.
• Narrow permission layouts return to normal document flow.
• Role selections update counts and dirty state immediately.
• The shared floating save bar persists the complete permission snapshot.
• A failed role refresh does not destroy an already loaded mapping draft.
• The API revalidates current Guild roles during permission saves.
• Internal Notes is no longer mislabeled as a destructive permission.
• Current Discord role evidence is required for protected Guild requests.

Moderation, members and safety

• Member search handles single and multiple Discord IDs correctly.
• Staff and self Member Profile routes render their intended workspace.
• Member Profile panels expose partial availability explicitly.
• Unavailable moderation data is not displayed as a false zero.
• Moderation Settings no longer conflicts with the Moderation index route.
• Eligible successful bans expose a dedicated Sentinel handoff.
• Sentinel handoff state is consumed once and removed from the URL cleanly.
• Historical moderation lists resolve durable identities without Discord fan-out.
• Historical cases retain readable names after a member leaves.
• Member search includes durable departed identities.
• Member search includes identities preserved only by moderation snapshots.
• Present members are labelled separately from departed members.
• Active bans are distinguished from former bans.
• A later unban ends an older ban state.
• A later rejoin ends an older kick state.
• Moderation queue and summary data use fewer database reads.
• Priority ordering has a supporting database index.
• Internal comments open in a focused dialog.
• The drawer shows a compact comment count and recent context.
• Timeline entries render as readable event cards.
• Duplicate terminal lifecycle labels render once.
• AutoMod enforcement remains independent of Logging availability.
• Sentinel lifecycle dates distinguish scheduled, active and terminal states.
• Sentinel appeal status remains visible after terminal entry states.
• One appeal is accepted per Sentinel entry.
• Subject-safe notifications cover scheduling, activation, removal, expiry and appeals.
• Participant read markers no longer invalidate their own resolve action.
• Trust & Safety assignment remains visible without an optional profile mirror.
• Ordinary staff replies move open cases to waiting for the participant.
• Participant replies resume cases that were waiting for them.
• A deliberate scheduled hold survives participant replies.
• Participant cancellation follows the case type's withdrawal policy.
• Resolution links only already executed actions from the same case.

Announcements, notifications and account updates

• Product announcement banners can be dismissed durably.
• Guild announcement drafts can be deleted.
• Completed announcements can be moved out of the active list.
• Cancelled announcements can be moved out of the active list.
• Archived announcements preserve delivery and revision history.
• Announcement member-name insertion stores the selected visible name.
• Announcement mention insertion stores an explicit safe user mention.
• Implicit Discord mention parsing remains suppressed.
• Authored Announcement mentions are capped at twenty-five users.
• Creator Notifications send the configured group embed on the first confirmed live observation.
• The synthetic Creator Notification route test remains available.
• The duplicate manual publish-current action has been removed.
• Route announcements can target one path segment with a single wildcard.
• Route announcements can target nested paths with a recursive wildcard.
• Query strings and fragments do not affect route targeting.
• Ordinary automatic notices use one popup budget per session.
• Required warnings do not consume the ordinary popup budget.
• User-opened dialogs can pre-empt automatic notices.
• Higher-priority warnings can pre-empt lower-priority automatic notices.
• The Update Center searches active and retired published notices.
• The Update Center can filter unread notices.
• The Update Center can filter warnings.
• Retired published notices remain available as history.
• Draft, paused and future notices are never exposed to account reads.
• Stored notice actions support internal paths and safe web URLs only.

Reliability, recovery and public pages

• Dashboard release recovery preserves authenticated sessions.
• Dashboard release recovery preserves unsaved local drafts.
• Dashboard release recovery preserves local storage and IndexedDB.
• Dashboard release recovery preserves browser caches and service workers.
• The current route reloads after a release marker changes.
• Public routes keep their script-free prerendered delivery.
• The public Health route receives a real public document.
• Private Dashboard fallbacks remain no-index.
• Moderation processing leases recover after a stalled attempt.
• Exhausted moderation actions receive a terminal failure state.
• Campaign sends recover stale claims.
• Ticket command work recovers after missed events.
• Access Request role phases reconcile from durable database state.
• Note-only Access Request events remain side-effect free.
• Subscription welcome delivery recovers stale work.
• Discord campaign sends use version-aware delivery identity.
• Ticket message sends use stable delivery identity where Discord supports it.
• External Discord requests abort after a bounded deadline.
• Module artifact runners are isolated per Guild and artifact version.
• Timed-out module runners are terminated before reuse.
• Module failure quarantine is scoped to the affected Guild artifact.
• Newly enabled modules clear stale command-ownership state before resync.
• Creator Notification polling retains durable observation state before fan-out.
• Role Menu duplicate actions clone plain editor data safely.
• The legacy Leveling import route no longer collides with the tRPC apply helper.
• Verification applications reject stale concurrent review actions.
• Verification approval cannot lower an already higher tier.
• Public static assets retain immutable release-specific caching.