جدول التغييرات — رقم واحد، حساب واحد

What the change is	What happens today	What will happen instead	Phase	Risk	Status
Teach the search index that «business» means a company, exactly as «dealer» does.	The search index decides «is this a showroom» by looking for the word «dealer». The site writes «business» when a company publishes. Today the filter still looks fine, be…	Both words are accepted, so a company ad lands under «معرض» whether it was published from the old app or from the site. «فرد» returns the rest, the two sets do not overlap, and together they…	—	low	—
Add one rule to the database: refuse to create an account when the phone already has one.	One phone can hold both a personal and a business account. Nothing at the database stops it — the interface merely does not offer it, and anything that talks to the datab…	The database itself refuses. Creating an account when the phone already has one is rejected, whoever asks and however they ask.	—	low	—
Make the world field write-once: settable while empty, never changeable afterwards.	An approved car showroom can quietly change its own record to say «property» and appear in the offices directory, with no new approval.	The world is set once, at approval, and can never be changed afterwards from the outside.	—	low	—
Write «keep this, and here is why» next to four items whose labels would send a later pass off deleting or rebuilding something.	Four items are described in a way that invites needless work. Two were labelled «delete this» — the rule that lets anyone read the public directory, and four database ind…	All four are marked KEEP, in writing, with the reason attached — so a later pass cannot act on the old description.	—	low	—
Give the rules tests four kinds of user and a section for accounts, so both new rules are proven before they ship.	The suite tests listings only, from a single signed-in user. It cannot express «this user already has an account».	It gains account cases and several different kinds of user, so both new rules are proven before either reaches the live site.	—	low	—
Replace the stored «which account is active» flag with one function that resolves the single account, and delete the flag.	The site asks «which of my two accounts is active right now?» and answers it from a stored flag. Every screen that shows your ads, your wallet or your name goes through t…	There is one account, so the question disappears. One function resolves it, and the flag is deleted outright.	—	low	—
Delete the path that adds a second account, and reword the signup screen to say the choice is final.	The three cards — person, car showroom, property office — appear only on a brand-new phone. A signed-in person can still add a second account through another path, and «أ…	The choice is made once, at signup, and it is final. The add-a-second-account path is deleted, and the wording says plainly that the choice cannot be changed later.	—	low	—
Repoint the free-ad gate and the coin purse at the account, on the server and in the browser, in one release.	Whether you may post free, and which coin purse is charged, is decided from the active-account flag — in two hand-copied places, one on the server and one in the browser,…	Both read the account. Both change in the same release.	—	low	—
Make both publish paths read the account when they stamp the owner, the lifetime, the bumps and the payment channel.	Publishing a car and publishing a property each read the active-account flag to decide four things: the owner type, how long the ad lives, how many bumps it gets, and whi…	Both read the account. A person's ad and a company's ad are decided by what the account IS, not by what was last selected.	—	low	—
Make the go-live decision read the account instead of the stamp on the ad, and keep its refuse-rather-than-guess behaviour word for word.	One place decides whether an ad appears at all, and it is the only place a free coin is spent. It reads the owner stamp on the ad to choose between the company rules and…	It reads the account. Everything else about it — including that it refuses rather than guesses when something is unclear — stays exactly as it is.	—	low	—
Turn three money checks from «is it not a company» into «is it the kind I require», and refuse when the account cannot be resolved.	The check that stops a company buying a person's package works by reading the flag we are deleting — so once it is gone, the check ALLOWS instead of refusing. And two mor…	All three refuse, positively — they check what the account IS rather than what it is not.	—	low	—
Make repost, extend, reactivate and restore read the account when they pick the price list, the lifetime and the cap.	Re-posting an expired ad, extending it, reactivating it and restoring it from the archive each branch on the active-account flag to pick the price list, the new lifetime…	All of them read the account.	—	low	—
Remove the account filter from «إعلاناتي» and from its per-row buttons, and keep the world filter.	The list filters your ads by the active account, and the per-row buttons decide what to offer from the same flag.	It shows your ads. There is no other account to filter against.	—	low	—
Stop the buyer tools splitting by account, keep them split by world, and narrow the write check instead of deleting it.	Each is stored under the active account, so the same person has two separate favourites lists depending on which account was selected. One list is reachable at a time.	One person, one favourites list, one saved-search list, one history. The WORLD split stays — you decided that on 2026-07-28 (E2 «separate») and it is already built and live, so the tools kee…	—	low	—
Delete the «switch to my personal account» control from the company dashboard and repoint both page guards together.	/business shows the account you selected, and carries a «switch to my personal account» control.	It shows the company, because that is the only thing the account can be. The switch is deleted.	—	low	—
Stop writing the account tag on notifications, delete the classifier that guesses it, and leave the three alert jobs untouched.	Notifications are labelled with the account they belong to. Three background jobs — saved-search alerts, price drops, and «the thing you favourited sold» — find the right…	Notifications belong to the person. The three jobs keep working exactly as they do, untouched.	—	low	—
Make approval take the world as a required input, save it, record it in the audit log, and refuse without it.	Approval flips a status and does not look at the world at all. A company can be approved without one.	Approval takes the world, records it, and refuses to approve a company that has none.	—	low	—
Make the public person page query both worlds, and delete the misleading world stamp from individual accounts.	/seller/{id} lists cars only, hardcoded. A person who posted a flat has it missing from their own public page, and the headline count is wrong.	It shows everything the person has for sale, in both worlds, with a true count.	—	low	—
Repoint the last scattered readers of the old flag at the account, so the flag can finally be deleted.	A long tail of smaller places — an account settings page, a promo redemption, an edit screen, a couple of API routes — each read the flag for their own small reason.	They read the account.	—	low	—
Make the subscription-plan lookup require a world and stop merging the two markets' catalogues.	When the site looks up subscription plans it merges the car plans and the property plans into one list, at about twenty places. Every plan id is therefore reachable from…	The lookup takes the company's own world and returns only that market's plans.	—	low	—
Add one world check at the single function every subscription door passes through, and refuse a foreign plan by name.	Starting a plan, upgrading, renewing, scheduling a downgrade, cancelling one, claiming the welcome offer, and an admin grant — each resolves a plan from the merged list w…	Each one refuses a plan from the other market, with a named reason.	—	low	—
Make the ad-count and stock-count functions require a world, with no cars default.	The ad limit and the stock limit are counted without the market, so a property office's allowance is measured against its car ads — of which it has none.	Both are counted inside the company's own market.	—	low	—
Make the company dashboard read the live per-world settings instead of a fixed car list compiled into the site.	The plan list the cockpit displays is built from a fixed car list compiled into the site, so a property plan resolves to nothing and shows zeros.	It reads the live settings for the company's own market.	—	low	—
Delete the extra owner-type filter from the public pages and the seller queries behind them.	Public pages carry an extra filter whose only job was to keep a company's ads off a person's page, and vice versa, while one phone could be both.	The filters go, and the pages become simple again — one owner, one page.	—	low	—
Fix the nightly job so it cannot create an account path without an account, then resolve the five demo showrooms.	Five approved showrooms have nobody who can sign into them, and they own 25 live ads. Twenty account paths exist that hold data but no account — and a nightly job keeps r…	The demo showrooms are resolved, and the job that creates ghost paths is fixed so cleaning them up actually lasts.	—	low	—
Delete the owner-type field from the ads, its four database indexes and the dead code around it — each in its own deploy.	The owner-type stamp on ads, the database indexes that support querying it, and a scattering of code that only existed to keep two accounts apart.	Gone, once nothing reads them.	—	low	—
Repoint every money button on «إعلاناتي» at the account, pass the purse of the ad's own world, and delete the dead old copy of the page.	On your ads page, every money action — republish with a package, extend, clone, buy bumps — first asks «which of my two accounts am I standing in» and reads the ad's own…	Every one of them reads the one account, and the coin purse follows the world of the ad being acted on. The old copy of the page is deleted, not carried along.	—	low	—
Make the wizard's money step read the account, take the world for its wording, and derive «is a package required» from the same answer.	The last step before publishing is where «a person buys a package / a company publishes under its subscription» is decided. It asks the switch, not the account. Two other…	The step reads the account, the company wording follows the company's own world, and the «is a package required» rule comes from the same single answer.	—	low	—
Make the welcome-coins card pass the world when it claims, read that world's settings and purse, and never show itself to a company.	The card that hands a new user free coins reads only the CAR settings, watches only the CAR purse, and claims without saying which world — so it always fills the car purs…	One card per world, reading that world's settings and purse, claiming for that world, and never offered to a company.	—	low	—
Delete the six private copies of the same company filter, and note on screen that the old daily numbers stay mixed.	Six screens in the company dashboard each filter the ads down to «the business ones» with their own private copy of the same check — including the live لوحة القيادة and t…	All six read the one account, so the private copies disappear. The mixed numbers fix themselves — but the figures on screen WILL move the day it lands, so that is expected, not a bug.	—	low	—
Add one audited dashboard action that changes a company's world and, in the same moment, erases every listing, draft and everything else it owns — keeping only the account information. Show exactly what will be erased before it runs.	Nothing anywhere can change an account: no way to move a business from cars to property, no way to close an account, no way to free a phone number. Support's only tools a…	An admin changes the world from the dashboard. Every listing, every draft, everything the company owns is erased in the same action — only the account information survives: the name, the pho…	—	low	—
Add one read-only panel to the dashboard with four counts, each opening onto the records behind it.	Nothing tells you when the new rules have been violated. A business with no world, an ad whose world disagrees with its owner's world, an ad whose owner has no account —…	One panel on the dashboard, four counts, each one clickable to the exact records. Zero on all four means the rules are actually holding.	—	low	—
Stamp the account type and world into the sign-in token — after fixing the three places that wipe tokens instead of adding to them.	The security rules cannot tell a company from a person. The type lives in a document they cannot cheaply read, so every check that needs it happens in code the browser ca…	The type and the world are stamped into the sign-in token at signup and at approval, so the database rules enforce them directly instead of trusting the browser.	—	low	—
Mark four live strings as replaced by «one phone, one account», and leave the stored answers exactly as he gave them.	Two of your own decisions are still written on live pages in their old form: A2 «one phone number can hold both categories», and E1 whose recommended answer reads «the sa…	All four are marked as replaced, naming the rule that replaced them and its date. The old text stays visible — a decision you can see being overruled is worth more than a decision quietly re…	—	low	—
Refuse an ad whose world is not the business's own world — in the database rules, at the moment it goes live, and on repost — and stop showing the other world's «اعرض» button and flow to a business at all.	NOTHING STOPS IT. I searched every publish path, the free-ad gate and the security rules: there is no check anywhere that an ad's world matches its seller's world. The cr…	Refused in three places on the server, and never offered on the screen. A business sees the «اعرض» button for its own world only, wherever it is browsing.	—	low	—

Teach the search index that «business» means a company, exactly as «dealer» does.

The search index decides «is this a showroom» by looking for the word «dealer». The site writes «business» when a company publishes. Today the filter still looks fine, be…

Both words are accepted, so a company ad lands under «معرض» whether it was published from the old app or from the site. «فرد» returns the rest, the two sets do not overlap, and together they…

—

low

—

Add one rule to the database: refuse to create an account when the phone already has one.

One phone can hold both a personal and a business account. Nothing at the database stops it — the interface merely does not offer it, and anything that talks to the datab…

The database itself refuses. Creating an account when the phone already has one is rejected, whoever asks and however they ask.

—

low

—

Make the world field write-once: settable while empty, never changeable afterwards.

An approved car showroom can quietly change its own record to say «property» and appear in the offices directory, with no new approval.

The world is set once, at approval, and can never be changed afterwards from the outside.

—

low

—

Write «keep this, and here is why» next to four items whose labels would send a later pass off deleting or rebuilding something.

Four items are described in a way that invites needless work. Two were labelled «delete this» — the rule that lets anyone read the public directory, and four database ind…

All four are marked KEEP, in writing, with the reason attached — so a later pass cannot act on the old description.

—

low

—

Give the rules tests four kinds of user and a section for accounts, so both new rules are proven before they ship.

The suite tests listings only, from a single signed-in user. It cannot express «this user already has an account».

It gains account cases and several different kinds of user, so both new rules are proven before either reaches the live site.

—

low

—

Replace the stored «which account is active» flag with one function that resolves the single account, and delete the flag.

The site asks «which of my two accounts is active right now?» and answers it from a stored flag. Every screen that shows your ads, your wallet or your name goes through t…

There is one account, so the question disappears. One function resolves it, and the flag is deleted outright.

—

low

—

Delete the path that adds a second account, and reword the signup screen to say the choice is final.

The three cards — person, car showroom, property office — appear only on a brand-new phone. A signed-in person can still add a second account through another path, and «أ…

The choice is made once, at signup, and it is final. The add-a-second-account path is deleted, and the wording says plainly that the choice cannot be changed later.

—

low

—

Repoint the free-ad gate and the coin purse at the account, on the server and in the browser, in one release.

Whether you may post free, and which coin purse is charged, is decided from the active-account flag — in two hand-copied places, one on the server and one in the browser,…

Both read the account. Both change in the same release.

—

low

—

Make both publish paths read the account when they stamp the owner, the lifetime, the bumps and the payment channel.

Publishing a car and publishing a property each read the active-account flag to decide four things: the owner type, how long the ad lives, how many bumps it gets, and whi…

Both read the account. A person's ad and a company's ad are decided by what the account IS, not by what was last selected.

—

low

—

Make the go-live decision read the account instead of the stamp on the ad, and keep its refuse-rather-than-guess behaviour word for word.

One place decides whether an ad appears at all, and it is the only place a free coin is spent. It reads the owner stamp on the ad to choose between the company rules and…

It reads the account. Everything else about it — including that it refuses rather than guesses when something is unclear — stays exactly as it is.

—

low

—

Turn three money checks from «is it not a company» into «is it the kind I require», and refuse when the account cannot be resolved.

The check that stops a company buying a person's package works by reading the flag we are deleting — so once it is gone, the check ALLOWS instead of refusing. And two mor…

All three refuse, positively — they check what the account IS rather than what it is not.

—

low

—

Make repost, extend, reactivate and restore read the account when they pick the price list, the lifetime and the cap.

Re-posting an expired ad, extending it, reactivating it and restoring it from the archive each branch on the active-account flag to pick the price list, the new lifetime…

All of them read the account.

—

low

—

Remove the account filter from «إعلاناتي» and from its per-row buttons, and keep the world filter.

The list filters your ads by the active account, and the per-row buttons decide what to offer from the same flag.

It shows your ads. There is no other account to filter against.

—

low

—

Stop the buyer tools splitting by account, keep them split by world, and narrow the write check instead of deleting it.

Each is stored under the active account, so the same person has two separate favourites lists depending on which account was selected. One list is reachable at a time.

One person, one favourites list, one saved-search list, one history. The WORLD split stays — you decided that on 2026-07-28 (E2 «separate») and it is already built and live, so the tools kee…

—

low

—

Delete the «switch to my personal account» control from the company dashboard and repoint both page guards together.

/business shows the account you selected, and carries a «switch to my personal account» control.

It shows the company, because that is the only thing the account can be. The switch is deleted.

—

low

—

Stop writing the account tag on notifications, delete the classifier that guesses it, and leave the three alert jobs untouched.

Notifications are labelled with the account they belong to. Three background jobs — saved-search alerts, price drops, and «the thing you favourited sold» — find the right…

Notifications belong to the person. The three jobs keep working exactly as they do, untouched.

—

low

—

Make approval take the world as a required input, save it, record it in the audit log, and refuse without it.

Approval flips a status and does not look at the world at all. A company can be approved without one.

Approval takes the world, records it, and refuses to approve a company that has none.

—

low

—

Make the public person page query both worlds, and delete the misleading world stamp from individual accounts.

/seller/{id} lists cars only, hardcoded. A person who posted a flat has it missing from their own public page, and the headline count is wrong.

It shows everything the person has for sale, in both worlds, with a true count.

—

low

—

Repoint the last scattered readers of the old flag at the account, so the flag can finally be deleted.

A long tail of smaller places — an account settings page, a promo redemption, an edit screen, a couple of API routes — each read the flag for their own small reason.

They read the account.

—

low

—

Make the subscription-plan lookup require a world and stop merging the two markets' catalogues.

When the site looks up subscription plans it merges the car plans and the property plans into one list, at about twenty places. Every plan id is therefore reachable from…

The lookup takes the company's own world and returns only that market's plans.

—

low

—

Add one world check at the single function every subscription door passes through, and refuse a foreign plan by name.

Starting a plan, upgrading, renewing, scheduling a downgrade, cancelling one, claiming the welcome offer, and an admin grant — each resolves a plan from the merged list w…

Each one refuses a plan from the other market, with a named reason.

—

low

—

Make the ad-count and stock-count functions require a world, with no cars default.

The ad limit and the stock limit are counted without the market, so a property office's allowance is measured against its car ads — of which it has none.

Both are counted inside the company's own market.

—

low

—

Make the company dashboard read the live per-world settings instead of a fixed car list compiled into the site.

The plan list the cockpit displays is built from a fixed car list compiled into the site, so a property plan resolves to nothing and shows zeros.

It reads the live settings for the company's own market.

—

low

—

Delete the extra owner-type filter from the public pages and the seller queries behind them.

Public pages carry an extra filter whose only job was to keep a company's ads off a person's page, and vice versa, while one phone could be both.

The filters go, and the pages become simple again — one owner, one page.

—

low

—

Fix the nightly job so it cannot create an account path without an account, then resolve the five demo showrooms.

Five approved showrooms have nobody who can sign into them, and they own 25 live ads. Twenty account paths exist that hold data but no account — and a nightly job keeps r…

The demo showrooms are resolved, and the job that creates ghost paths is fixed so cleaning them up actually lasts.

—

low

—

Delete the owner-type field from the ads, its four database indexes and the dead code around it — each in its own deploy.

The owner-type stamp on ads, the database indexes that support querying it, and a scattering of code that only existed to keep two accounts apart.

Gone, once nothing reads them.

—

low

—

Repoint every money button on «إعلاناتي» at the account, pass the purse of the ad's own world, and delete the dead old copy of the page.

On your ads page, every money action — republish with a package, extend, clone, buy bumps — first asks «which of my two accounts am I standing in» and reads the ad's own…

Every one of them reads the one account, and the coin purse follows the world of the ad being acted on. The old copy of the page is deleted, not carried along.

—

low

—

Make the wizard's money step read the account, take the world for its wording, and derive «is a package required» from the same answer.

The last step before publishing is where «a person buys a package / a company publishes under its subscription» is decided. It asks the switch, not the account. Two other…

The step reads the account, the company wording follows the company's own world, and the «is a package required» rule comes from the same single answer.

—

low

—

Make the welcome-coins card pass the world when it claims, read that world's settings and purse, and never show itself to a company.

The card that hands a new user free coins reads only the CAR settings, watches only the CAR purse, and claims without saying which world — so it always fills the car purs…

One card per world, reading that world's settings and purse, claiming for that world, and never offered to a company.

—

low

—

Delete the six private copies of the same company filter, and note on screen that the old daily numbers stay mixed.

Six screens in the company dashboard each filter the ads down to «the business ones» with their own private copy of the same check — including the live لوحة القيادة and t…

All six read the one account, so the private copies disappear. The mixed numbers fix themselves — but the figures on screen WILL move the day it lands, so that is expected, not a bug.

—

low

—

Add one audited dashboard action that changes a company's world and, in the same moment, erases every listing, draft and everything else it owns — keeping only the account information. Show exactly what will be erased before it runs.

Nothing anywhere can change an account: no way to move a business from cars to property, no way to close an account, no way to free a phone number. Support's only tools a…

An admin changes the world from the dashboard. Every listing, every draft, everything the company owns is erased in the same action — only the account information survives: the name, the pho…

—

low

—

Add one read-only panel to the dashboard with four counts, each opening onto the records behind it.

Nothing tells you when the new rules have been violated. A business with no world, an ad whose world disagrees with its owner's world, an ad whose owner has no account —…

One panel on the dashboard, four counts, each one clickable to the exact records. Zero on all four means the rules are actually holding.

—

low

—

Stamp the account type and world into the sign-in token — after fixing the three places that wipe tokens instead of adding to them.

The security rules cannot tell a company from a person. The type lives in a document they cannot cheaply read, so every check that needs it happens in code the browser ca…

The type and the world are stamped into the sign-in token at signup and at approval, so the database rules enforce them directly instead of trusting the browser.

—

low

—

Mark four live strings as replaced by «one phone, one account», and leave the stored answers exactly as he gave them.

Two of your own decisions are still written on live pages in their old form: A2 «one phone number can hold both categories», and E1 whose recommended answer reads «the sa…

All four are marked as replaced, naming the rule that replaced them and its date. The old text stays visible — a decision you can see being overruled is worth more than a decision quietly re…

—

low

—

Refuse an ad whose world is not the business's own world — in the database rules, at the moment it goes live, and on repost — and stop showing the other world's «اعرض» button and flow to a business at all.

NOTHING STOPS IT. I searched every publish path, the free-ad gate and the security rules: there is no check anywhere that an ad's world matches its seller's world. The cr…

Refused in three places on the server, and never offered on the screen. A business sees the «اعرض» button for its own world only, wherever it is browsing.

—

low

—