What we shipped

What shipped: The /pricing tier CTAs now create real Stripe Checkout sessions. When a visitor clicks Starter or Growth, a lightweight modal collects a work email + company name + seat count, the server mints a Stripe Checkout session, and the visitor goes straight to Stripe. On checkout.session.completed, we provision a fresh tenant + admin user, stamp the subscription, fire the activation drip, and email the temp password.

Why now: Marketing generating zero MRR was the loudest gap. Self-serve closes the loop between click and paid tenant.

Scope: Starter (1–25 seats) and Growth (2–75 seats). Scale stays mailto: sales-routed per existing plan. Cancel anytime — no setup fees — live in minutes.

What shipped: Sable joins Dash, Mark, Lena, Shield, Rex, and Knox as HatchOS's seventh AI employee. She runs every */6 cron tick: pulls FMCSA authority status, checks insurance expiration dates, flags safety ratings, and auto-blacklists carriers who fail compliance thresholds.

Why now: Carrier vetting was the largest remaining line item in our manual-ops closeout. Sable removes it from the human queue entirely — dispatchers get a cleared carrier list, ops gets a daily compliance digest.

Scope: Proving Grounds tenants first, general availability after 7-day soak.

What shipped: Free public lane rate check at /tools/lane-rate-check. Pick a Van / Reefer / Flatbed / Power Only equipment, type origin ZIP and destination ZIP, and we calculate great-circle distance and apply published DAT/Truckstop per-mile contract averages to surface an indicative rate range.

Why: Brokers and dispatchers Google "lane rate [origin] to [dest]" constantly. We wanted a clean answer with no login, no email gate, and a direct funnel into /start with prefilled UTM.

What it costs: Free — 20 checks/hr per IP, no login. Real contract pricing, splits, and margin tracking on your live loads is what HatchOS is for.

What shipped: Free public FMCSA MC/DOT authority lookup at /tools/carrier-lookup. Type any MC number (e.g. MC-1515151), USDOT number (e.g. USDOT 80321), or company name and we hit the FMCSA SAFER / QCMobile API, normalise the response, and show authority status, insurance on file (BIPD + cargo), safety rating, and out-of-service date.

Why: Freight brokers and dispatchers look these up daily. The official safer.fmcsa.dot.gov surface is slow, the third-party clones are ad-riddled, and we wanted a clean answer loaded with the HatchOS brand and a direct funnel into /start.

What it costs: Free — 20 lookups/hr per IP, no login. Higher volumes (and continuous FMCSA + RMIS monitoring) are what HatchOS Sable is for.

What shipped: Nia owns collections end-to-end. She generates weekly aging reports, sends tiered reminder cadences (3-day, 7-day, 14-day), and matches incoming ACH/wire/wave receipts against open invoices.

Why now: AR follow-up is the most-skipped ops task in mid-market brokerages. Nia makes it the most-rigorous.

Demo: Available now in tenant #1, rolling out to Proving Grounds this week.

What shipped: Quinn reads inbound RFQ emails, pulls carrier + lane benchmarks, applies the tenant's contracted margin floor, and drafts a quote reply with three tiered options. Dispatchers review and send — they no longer author from scratch.

Result: Quote turnaround on inbound RFQs dropped from 4h → 22min median across the pilot.

Where: Live in tenant #1 since 2026-07-30, expanding to Proving Grounds this week.

What shipped: /trust aggregates the audit closeout into a single readable surface — multi-tenant isolation, auth hardening, payments, data protection, infrastructure hardening, audit trail, AI safety, and the 8 commitments we publish in writing.

Plus: security/summary.pdf (54 pages) for IT teams who won't open a browser tab.

Why it matters: The 34/34 audit closeout generated 54 pages of internal documentation. Now it's a public asset, not a private one.

What shipped: /pricing now shows a 10-seat scenario with seat-vs-seat comparison against Turvo PowerBroker and MercuryGate. Numbers are sourced to the published list pricing on each competitor's site, with a reproducible calculation surfaced in the calculator.

Why it matters: "We're cheaper" is a weak claim. "We're $47k cheaper at 10 seats with the same load volume" is a strong one.

What shipped: 5 emails (Day 0 / 3 / 7 / 10 / 14) per tenant, each tied to a specific conversion blocker — first shipment, carrier setup, team invite, billing, expansion frame.

Hard guardrail: HTG and god-mode tenants are skipped automatically. No internal seat gets dripped.

Measurement: Each tenant's conversion-by-step view in admin funnel.

What changed: The CSRF token is now rendered into server HTML on every response via a synchronous middleware that reads from the session at request time. The previous client-side fetch on /csrf left an 80ms race window that admitted unverified POSTs in the rapid-login stress test.

Audit: Item #18 in the Jun–Jul 2026 closeout — closing it removes the last form-submission attack vector that survived the session-rollout changes.

Closed: 34/34 items. Includes multi-tenant isolation (9), auth hardening (11), payments (6), data protection (3), infrastructure (3), and AI safety (2).

Audit methodology: The full report, the line-number references for each fix, and the not-passing-yet list (now empty) are all in /security/summary.pdf.

This is the audit-closeout the /trust page is built on top of.

What changed: Pool size capped at 20 connections (from unbounded). Statement timeout set to 15s for tenant-facing reads, 30s for admin queries. Slow queries now fail loudly with 57014 query_canceled instead of pinning connections.

Why: Three production wedges in Q1 traced to a single slow aggregation holding connections during traffic spikes. This is the structural fix.

Monitoring: /admin/system-health surfaces pool saturation as a first-class metric.

What shipped: GET /__healthz returns 200 + {started_at, port_bound, db: ok|down, csrf_secret_present, csrf_secret_state}. GET /__startup-log returns the boot log tail with sentinels on each step.

Use: Your monitoring stack hits /__healthz every 60s. If it returns anything other than 200, the boot log points at which step regressed.

Security: No secrets in either endpoint. No data. Pure liveness.

What shipped: Postgres row-level security policies on 17 tables — dispatch_shipments, dispatch_carriers, dispatch_invoices, crm_accounts, crm_contacts, crm_activities, and 11 KPI/aggregate views. Even raw pool.query(...) calls outside the request middleware cannot return cross-tenant data because app.current_tenant_id is set per connection.

Phase 2: Remaining operational tables (warehouse, vendor, factor) — Q3 work.

What shipped: GET /api/reports/:id/pdf renders report data through branded-HTML → headless Chromium → PDFKit-compatible output. Header (logo + tenant name) and footer (page X of N + generated timestamp) on every page via displayHeaderFooter.

Stack: @sparticuz/chromium + puppeteer-core in production. Same render path for HTG, Proving Grounds, and god-mode diagnostics.

Auth: Tenant-scoped. Cross-tenant access returns 403.

## Beta Program Is Now Open

HatchOS Beta is accepting applications from brokerages ready to move off legacy TMS platforms like Turvo, MercuryGate, or AscendTMS.

What Beta members get:
- 12-month price lock — your rate at acceptance is your rate for the first 12 months
- White-glove onboarding — dedicated setup session, data migration, first-run configuration
- Direct product access — private channel with the engineering team; your feedback ships, not into a backlog
- 48-hour review — applications reviewed within 48 business hours

Apply at /beta

The calculator uses TMS-specific benchmarks to estimate time savings, error reduction, and carrier rate improvements. High-value leads (≥10 seats or white-label interest) trigger an immediate God Mode alert.

Admin dashboard: /admin/roi-calculator (stats tiles, by-TMS breakdown, conversion-to-demo rate, CSV export).

What shipped: /book-demo — public 3-step scheduler (contact → slot picker → confirm). HMAC-signed prefill links from marketing emails so prospects don't re-enter their info. Unbooked leads get a +24h, +72h, and +7-day follow-up sequence. Booked leads are suppressed from nurture immediately.

God Mode admin: /admin/leads funnel dashboard with source breakdown and nurture stats.

Each component shows current status (green/amber/red), latency, a 90-day uptime sparkline, and a running incident feed. Operators manage incidents from /admin/status.

Machine-readable: GET /status.json. Email subscribers get incident notifications and resolution updates.

Why live data: Case studies with static numbers go stale within a quarter. Pulling from the production tenant means every pageload reflects the actual current state.

What shipped: Server-rendered case study page with live seat count, total loads, and 30-day load velocity. JSON-LD Article + Organization schema. Source-tagged conversion tracking.

Deep-link: /customers/htg.

The page lives at /ai-employees and is indexed by search engines. Each employee card shows their domain, what triggers them, and sample output. JSON-LD markup for rich results.

CTA: Book a demo → /book-demo?source=ai-employees.

The switching problem: Carriers have your number in their old TMS. Loads in-transit can't be migrated mid-stream. Finance needs a clean cutover date. Most platforms give you zero guidance.

What shipped: Three migration playbooks (Turvo, MercuryGate, AscendTMS), available at /vs/turvo, /vs/mercurygate, /vs/ascendtms. Each covers: what data migrates automatically, what needs manual work, parallel-run checklist, and go-live criteria.

Pricing was the last blocker for self-serve signups. Starter is ideal for solo operators; Growth unlocks analytics and commission automation; Scale is for multi-office operations with advanced reporting.

Annual pricing: 2 months free on any tier.

Why it works: Freight brokers are skeptical of software promises. Showing a dollar figure tied to their actual volume is more credible than a generic ROI claim.

What shipped: Inline form on /pricing, 3-page PDFKit report with platform-specific projections, Polsia email delivery, and operator alert for high-value leads.

Deep-link: /pricing.

What changed: New-IP detection compares each login against a per-user IP whitelist. First time from a new location triggers an email alert with a signed session-revoke link. Rate limiters on /login, /signup, /otp, and /forgot-password log lockouts to a permanent security event log.

Security events are visible to admins in the God Mode panel.

Why it matters: The old name (HatwayOS) was a placeholder that stuck. HatchOS is shorter, easier to say, and survives domain availability. The rebrand touches every customer-facing surface.

Domain redirect from hatchwayos.polsia.app → hatchos.polsia.app is a 301 — existing links continue to work.

The workflow: Add your domain in Settings → Custom Domains. Point your CNAME. HatchOS verifies DNS, provisions SSL via Render, and activates your domain — all automatically, with email alerts at each step.

What shipped: Full state machine (pending_dns → dns_verified → provisioning → active), a CNAME/TXT copy UI, Recheck DNS button (60s cooldown), and God Mode panel showing all domains by status.

Deep-link: /admin/domains.

Why it matters: Onboarding time is a direct cost. The longer a new dispatcher takes to become productive, the more senior time gets burned on oversight.

What shipped: Training modules with progress tracking, a knowledge quiz at the end of each module, and a per-tenant sandbox that mirrors production data without touching live records.

Deep-link: /training.

The problem with freight ops: High-volume tasks like carrier cert expiry checks, load board monitoring, and account follow-up drain human bandwidth without generating margin.

What shipped: Six AI employees (Dash, Mark, Lena, Shield, Rex, Knox) each own a specific domain. They run on a schedule, surface findings to your dashboard, and hand off exceptions to your human team.

Deep-link: /ai-employees.

Before: Dispatchers emailed PDFs back and forth, versions got lost, carriers asked for documents that already existed somewhere in an inbox thread.

After: The Document Center gives every shipment a permanent document drawer. Drag-and-drop upload, template generation (BOL, rate con), and full audit history of who touched what and when.

Deep-link: /documents.