All Posts

Some messages you don't want landing in a user's inbox at all — block ones with a certain attachment, divert mail to a departed account, keep a copy of a category for the record. You don't need an agent for this: Domino's server mail rules apply while the message is still in MAIL.BOX, as the router handles it. This piece covers where you set them (the Configuration Settings document's Router/SMTP → Restrictions and Controls → Rules), when they run (as the message lands in MAIL.BOX, each message evaluated once — unlike the client-side rules in a user's mailbox), how conditions work (contains/is operators, no wildcards, AND/OR, case-insensitive), the six actions (Journal to keep a copy, Move to database to quarantine, Don't accept to reject outright, Don't deliver to silently delete or send an NDR, Change routing state to HOLD, Stop processing to skip later rules), and two things to know: Domino doesn't notify the sender or recipient by default, and mail rules are not an anti-virus solution.

A user sets an out-of-office auto-reply, comes back and forgets to turn it off so the system keeps replying, or the replies always lag — which of these you get depends on which Out of Office type your server runs: Service or Agent. This piece covers how the two differ (the Service runs inside the mail router, so replies are instantaneous, failover is supported, delegation is integrated with calendar management, it disables itself when the period ends, and it allows periods shorter than a day; the Agent runs on a schedule four times a day by default, must be disabled manually, delegation isn't calendar-integrated, and its minimum period is a day), where you set it (the Server Configuration document's Router/SMTP → Advanced → Control, defaulting to Agent), why you should use the Service today, and two operations: seeing who's out via the Out of Office column on the Files tab, and listing mailboxes with an active Service via Tell router O.

A Domino server goes down, or gets overloaded, and users barely notice — that's a cluster doing failover and workload balancing. But failover isn't magic: its hard prerequisite is that another cluster server holds a replica of the database — no replica, nothing to fail over to. This piece covers how the cluster components work together: each server's Cluster Manager probes the others for availability and load and finds membership by watching the Domino Directory's ClusterName; cldbdir.nsf (a replica on every server, one document per database and replica); the event-driven, near-real-time Cluster Replicator (checks about every 15 seconds, replicates only among cluster members, while the regular REPLICA task handles replication outside the cluster); how failover works (the Cluster Manager builds a list of servers holding a replica, sorts it by availability, and sends it to the Notes client, largely transparent to the user); how workload balancing uses an availability threshold to mark a server BUSY and route requests to other replicas; and the Internet Cluster Manager (ICM) for HTTP clients.

To apply one setting — a password rule, a mail quota, a desktop feature toggle, an ECL — to every Notes user at once instead of machine by machine, you use a policy. This piece explains how Domino policies work: the two assignment types (organizational policies apply automatically based on the OU used at registration; explicit policies are assigned by hand to individuals or groups); the policy settings document types (registration / desktop / mail / security / archive, plus the deprecated setup that merged into desktop); what the effective policy is — the settings a user actually gets, dynamically computed at execution time from OU-level, explicit (including groups), and inherited parent-policy values; the crucial How to Apply modes (Don't set value / Set initial value / Set value whenever modified / Set value and prevent changes = locked), which decide whether users can change a value; and how an exception policy lets specific users override otherwise-mandatory settings.

Server trouble is usually 'the users complain first, then you find out.' DDM (Domino Domain Monitoring) is Domino's built-in, proactive-leaning monitoring: it runs probes on a schedule to check the health of databases, the directory, messaging, the operating system, replication, security, the server, and the web, records events into ddm.nsf, and gives you a top-down, feature-oriented view of the whole domain in the Domino Administrator — often with a probable cause and suggested corrective actions. This piece covers what a probe is (and that its configuration documents live in EVENTS4.NSF and take effect immediately), how ddm.nsf stores events, how the collection hierarchy lets one collection server consolidate the whole domain (the collection interval is a fixed 5 minutes), the difference between enhanced and simple events, and how an event handler notifies you — by logging, mail, running an agent, running a program, sending console commands, or an SNMP trap — when an event fires.

A user logs into Domino in a browser and then clicks around without logging in again — that's session-based authentication: the server issues a token, puts it in a cookie, and the browser carries it on every request. Letting a user log into one server and reach several others (SSO) relies on a Web SSO Configuration document in the Domino Directory holding a shared secret key. This piece covers how basic and session authentication differ, single-server cookies vs multi-server SSO, that the Web SSO Configuration document must replicate to every participating server, the hard conditions that make SSO fail (the DNS domain must start with a period, URLs must use the FQDN, cookies can't cross TCP/IP domains, only Domino servers can be listed, and all SSO servers must use the same Internet-access method), an easy trap — enabling Internet Sites in the Server document automatically disables an existing SSO configuration — and the caveats for sharing LTPA with WebSphere (importing WebSphere keys removes the idle-timeout option, and the LTPA realm must match).

You change a Domino web setting and nothing happens — often it's not a wrong value, it's the wrong place: Domino's Internet-protocol configuration comes from two sources, the older Server document (Web Server Configurations / virtual servers) and the newer Internet Site documents (stored in the Domino Directory and managed centrally). Which one a server reads is decided by one switch on the Server document's Basics tab. This piece covers how the two models switch, which protocols an Internet Site document configures (Web/IMAP/POP3/SMTP Inbound/LDAP/IIOP), why edits don't need a restart, an easy-to-hit all-or-nothing rule (if one protocol on a server uses Internet Sites, all protocols must), what the Web Site document's Basics/Configuration/Domino Web Engine/Security tabs each control, which settings (TCP/IP port, SSL port, server access) always stay in the Server document, and how to confirm from the HTTP startup message which source the server is actually using.

You schedule an agent to run hourly, and it doesn't run, runs late, or gets killed mid-run — usually it's not the agent that's broken, it's the Agent Manager (AMgr) server task's settings governing it. This piece covers how AMgr schedules: the Server document's daytime/nighttime windows (default day 8AM–8PM, night 8PM–8AM) and the most common trap — if the two periods leave a gap, AMgr doesn't run scheduled agents during it; Max concurrent agents (1–10, default day 1 / night 2) and Max LotusScript/Java execution time (default day 10 min, night 15 min — over it, the agent is terminated and logged in the Agent Log); why document/mail triggers aren't instant (AMgr_DocUpdateEventDelay, AMgr_DocUpdateAgentMinInterval default 30 min, and other notes.ini throttles); what 'Agent scheduling is paused' means; and using Tell Amgr Schedule / Tell Amgr Status from the console to see whether it was even scheduled. Ends with a step-by-step checklist for a scheduled agent that won't run.

A user clicks Send — where does the message actually go? In Domino, every message first lands in a database called mail.box, and the Router task reads the recipients one by one and decides 'deliver locally' or 'transfer to the next server.' This piece lays out the chain: what mail.box is (and why one server can run several mail1.box/mail2.box), how the Router periodically checks it and consults its routing table, the two transfer protocols (default Notes routing / NRPC moving the message hop-by-hop into the next server's mail.box, and SMTP using DNS MX, port 25, MIME only, off by default and enabled on the Router/SMTP tab of the Configuration Settings document), how the message is delivered into the recipient's home-server mail file; and finally the two kinds of message stuck in mail.box — dead (stop-sign: can be neither delivered nor returned to the sender) and held (red exclamation: held by a mail rule or quota) — what causes each and how to handle them.

You hand a template to a customer or install it on their server, and you don't want anyone seeing or changing the forms, formulas, and LotusScript inside — that's what hiding a database design does. Once set, in HCL's words it 'disables all design operations and hides all formulas and scripts': View > Design disappears, forms/views/agents can't be viewed or changed, formulas and code are invisible, and the design can't even be copied. This piece covers how it's done (via Replace Design with 'Hide formulas and LotusScript,' or inheriting from a template whose design is hidden), what it disables, why it isn't an encryption lock (it's not a permanent barrier to Designer/Manager users — pair it with the ACL), the point with no way back — there is no 'unhide,' so you must keep an unhidden copy of the template — and how hiding blocks agent changes, so use @Command[AgentEnableDisable].

You change a form in a production database, and the next morning the change is gone — because that database has 'Inherit design from template' set, and the server's Designer task overwrote it overnight from the master template. This piece explains how Domino template inheritance actually works: what a master template is (an NTF with 'Database is a template'), how a database links to one via the Design tab's 'Inherit design from template,' how the design flows down through the server's Designer task (load design, runs daily at 1 AM by default, needs a replica of the template on each server), the difference between Refresh Design and Replace Design, and how to protect elements with 'Prohibit design refresh or replace' plus 'Propagate' — plus the practical traps: private agents/folders can't live in a template, and the icon/About/Using documents don't inherit by default.

An NSF bloats from two things: attachments (DAOS moves those out) and view indexes. NIFNSF (moving view indexes out of databases) handles the second — it moves a database's view indexes out of the .nsf into separate .ndx files, making the NSF smaller and backup/restore faster (an .ndx can grow to 1 TB). This piece covers what it does, why — like DAOS — it must have transaction logging enabled first, the ODS 51+ requirement, how to configure it on the Server document's NIFNSF tab in 12.0.2+ (versus the older notes.ini NIFNSFEnable / NIFBasePath / CREATE_NIFNSF_DATABASES), how to enable it per database with load compact -c -nifnsf on, and how to check with show dir -nifnsf — plus why enabling it with -c brings us right back to the DBIID rule.

The maintenance-commands piece walks you through compact, updall, and fixup one at a time; but nobody types those by hand at 2 AM in production — the old way was a pile of Program documents running updall nightly plus a separate compact. From Domino 9, dbmt (the database maintenance tool) folds them into one: HCL says it 'relieves the administrator of the need to run the Updall task,' doing compact + updall + (when needed) fixup in a single task, with thread counts, a time window, and a compact-every-n-days cadence to pace it. This piece covers what dbmt does, how to run it from a Program document, the key compact-side options (-ct / -cnd / -tl / -range / -force) and updall-side options (-ut / -ftiNdays), and the one special case — -ods, which does a copy-style compact that reassigns the DBIID — and why that ties back to transaction logging and ODS upgrades.

Before Domino 12, database-level backup and restore meant wiring up a third-party tool (via the C API Toolkit). From 12, Domino ships Backup and Restore as built-in server tasks: one dominobackup.nsf configuration database lets you schedule backups and restore a single database on demand. This piece covers what it is, why — like DAOS — it must have transaction logging enabled first, how to build a config from the platform default in the Configuration view (the Main/Backup/Snapshot/Restore/Prune/Notification tabs), how to run it with load backup's switches (-b/-t/-i/-s/-p), and how to restore from the Database Inventory — including an easy trap: restoring outside the data directory reassigns the DBIID and invalidates the earlier transaction logs.

The same attachment stored in dozens of documents, even across several databases, is how an NSF bloats. DAOS moves attachments out of the NSF and stores them, de-duplicated, as a single .nlo file on the server, leaving a reference called a 'ticket' in the document. This piece covers how it works (de-dup happens at save time, not in a later maintenance task), why you must enable transaction logging before it, how to set the Server document DAOS tab (base path, minimum size, deferred deletion) and add databases, and tier 2 moving cold attachments to S3; plus the reminder that after the attachments move out, you still compact the NSF to actually reclaim the space.

In the maintenance-command rules, 'is transaction logging on?' is always the branch that decides which option you type — with logging, don't run fixup routinely, compact with -b to keep the DBIID, and take a fresh backup after anything that changes the DBIID. But what is transaction logging, and why does it flip so many rules at once? This piece explains it: it records database changes into one log and replays it automatically on a crash restart, so logged databases need no consistency check (and no routine fixup); the three styles (circular / linear / archived) and their trade-offs; and why operations that rebuild a database (copy-style compact, fixup on a corrupt database, enabling logging) assign a new DBIID, invalidate the old log, and force a full backup.

Drop a println in a computed value or a rendered formula, click a button once, and it runs five or six times — not a bug, but XPages running the whole JSF lifecycle on every submit, where a #{} (compute dynamically) value binding is re-evaluated every time it's read, adding up to several runs across the phases. This piece covers three knobs that cut that repetition: #{} (re-evaluated each time) vs ${} (computed once at load, static), rendered (in the tree, evaluated across phases) vs loaded (never built into the tree, skipped entirely), when to use each, and the ${} caveat.

In XPages SSJS you see both document1.getDocument() and document1.getDocument(true) everywhere, but what does that true (applyChanges) actually apply, when must you add it, and when is it just superstition? Getting the side wrong has real cost: omit it and you might save a document missing the values you just set in code; add it blindly and you don't really understand it. This piece sorts out getDocument() vs getDocument(true): true flushes the data source's pending changes (control input + programmatic setValue) into the backend document; in a normal submit the Update Model Values phase has already synced the on-screen values in, so it's usually redundant; you genuinely need true when you made programmatic changes or operate directly on the backend document. Plus the split with save() and getComponent().getValue().

A common XPages SSJS pattern: create a temp document, fill in parameters, save, call agent.runOnServer(noteid), and the agent writes results back to that document on the server. Then you read it back — and get the values from before the agent ran. It's not a bug: the document object you're holding is an in-memory snapshot taken at load time, and the agent saved the note on disk in a separate execution, so your object never syncs. The fix is to recycle the stale object and getDocumentByID a fresh one. This covers the pattern, why you read stale values, the standard fix, using the form's own document data source (the contextDocument) instead of a temp doc, and the cleanest option — runWithDocumentContext, which passes an in-memory document to the agent and skips both the save and the re-fetch (at the cost of requiring the agent to Run as Web user).

After moving Domino from Windows to Linux, a URL with the wrong case (the folder on disk is /FFH/ but you request /ffh/) sometimes 404s with 'File does not exist' and sometimes works — the same URL, flaky, and it always works by the time you go to check, so everyone assumes it's fine. The truth: Linux's filesystem is case-sensitive, and the Domino HTTP task caches successful path lookups, so the 404 only shows up when the cache is cold AND the very first hit uses the wrong case. This piece uses three rounds of curl tests on a real R12 (12.0.2 FP8) Linux server to reproduce the trap cleanly, explains why it stays hidden, and measures the symlink and directory-link workarounds.

The options for updall, compact, and fixup are all over the web, but the same compact run with -b vs -B — and whether transaction logging is on — produces wildly different results: one keeps the DBIID, the other reassigns it and breaks your backup chain. This piece turns HCL's own maintenance manual into a practical reference: three syntax rules first (parameter position, case-sensitivity -b≠-B, keyword options), then compact's three compaction styles, then the full command sequences for three scenarios — scheduled daily maintenance, corruption repair, and work-hours-no-downtime — each marked for whether transaction logging is enabled.

After upgrading to 12.0.2, a multi-level categorized view shows only the topmost layer — the documents under the sub-category are gone. You search the symptom, find a KB, add its notes.ini parameter, and it 'did not work' — because this isn't one bug, it's a whole family: four official KBs, two different parameters. The client-side @PickList and embedded views use EnableExtendedFindByKey=0 (fixed in FP1); XPages uses DISABLE_REFIND_IN_READENTRIES=1 (fixed in FP3/14.0). This piece maps all four KBs into one table so you match your interface first, then set the right parameter.

An XPages view categorized on multiple columns: you apply a filter, and where the next column is still a category, the screen shows the category but the documents under it disappear — in 12.0.2, though 12.0.1 works. It's an HCL-acknowledged regression (KB0102504 / SPR# MNIACMGKUV), introduced when 12.0.2 fixed another bug (SPR# PJONB7GRUL). The workaround is DISABLE_REFIND_IN_READENTRIES=1 in the server notes.ini; the real fix is 12.0.2 FP3 or 14.0. This covers the symptom, why it happens, the workaround and fix, and the wider family of 12.0.2 sub-category-display regressions (like the @PickList variant in KB0102042, which needs a different parameter and fix version) so you can match the right one.

You already have Formula logic — an @DbLookup, an @Name formatting call — and you don't want to rewrite it in SSJS. session.evaluate() runs a Formula string straight from SSJS and hands the result back. But it has sharp edges: it returns a java.util.Vector (not a scalar), field references need the document as a second argument, UI @functions (@Command/@Prompt/@PickList…) don't work in it, and it can't change a document — only compute a result. This covers the two signatures, the return and limits, and how to write the result back when you need to persist it.

To move design elements between databases, or snapshot documents as XML for diffing/backup, DXL is Domino's XML representation. In Java the two workhorses are DxlExporter (Domino→DXL, exportDxl returns a String) and DxlImporter (DXL→Domino, importDxl writes into a target DB). The catch: import isn't just 'load the XML' — you tell it how to handle design, documents, and ACL (create/replace/update/ignore) with setDesignImportOption / setDocumentImportOption / setAclImportOption, and whether the replica must match. This covers both classes, the import options, and the relationship to the LotusScript version.

SSJS in a script library is fine as glue, but logic gets unwieldy fast — no real types, hard to test, and serialization headaches when you stash it in scope. A managed bean lets you declare a Java class in faces-config.xml, and it becomes a top-level variable in SSJS and EL that you use just like database or session — bean.method(), #{bean.prop}. This covers how to declare one (the name/class/scope elements), the three class requirements (no-arg constructor, get/set, Serializable), the scope lifecycle, and when logic should move out of SSJS into a bean.

Want a button to pop 'Are you sure you want to delete?', or let the user pick a customer from a view? In Formula that's @Prompt and @PickList. @Prompt has a whole set of styles (Ok / YesNo / OkCancelList / Password / LocalBrowse…); @PickList opens a modal to select documents from a view and returns a column value, or to pick names from the Directory. But run the same formula on the web, or in a scheduled agent, and it silently does nothing — HCL states plainly, 'You cannot use this function in Web applications.' This covers the styles and return values, the client-only boundary, and which to use.

You click one button in XPages and a validator on a completely unrelated field blocks you — because by default the whole page runs a round of the JSF lifecycle, not just your button's area. XPages has two independent 'partial' knobs: partial refresh (refreshMode/refreshId) controls which HTML fragment goes back to the client; partial execution (execMode/execId) controls which components run the server-side lifecycle. This uses the six JSF phases to explain the difference, why partial refresh alone still recomputes the whole page on the server, and how partial execution scopes the server work down.

Want to run Domino local calls on a background thread in Java? A plain new Thread won't do — it has no Notes runtime. You either extend NotesThread and override runNotes(), implement Runnable handed to NotesThread, or call sinitThread()/stermThread() yourself. And every thread needs its own Session and its own recycle — you can't share across threads. This covers the three NotesThread patterns, the sinitThread/stermThread pairing rule, the one-session-per-thread law, and why a background thread can't get sessionAsSigner.

You compute a field, then call an @Command to do a UI action — and the action runs first, your computation second. Here's why: @Command mostly runs in the order you wrote it, but @PostedCommand always defers until after every other @function finishes, so a @PostedCommand at the top of your formula runs last. Worse, some @Command functions are themselves deferred. This uses the official order-of-evaluation rules to explain the difference, which @Commands are inherently deferred, and when to use which.

XPages gives you three global session objects: session is the current user, sessionAsSigner is the XPage's signer, and sessionAsSignerWithFullAccess is the signer plus full access. Using it to let a user do what their ACL forbids (write a restricted DB, bypass Readers) is handy — but 'who counts as the signer' is decided per design element, so a script library uses its own signer, not the XPage's, and mixed signatures give inconsistent elevation. This covers the three identities, how the signer is determined, and the setConvertMime / full-access traps.

XPages has four scopes — requestScope, viewScope, sessionScope, applicationScope — with lifetimes from a single request to the whole application. Pick the wrong one and values vanish or leak across users; but the sharpest trap is that scopes get serialized to disk, so stuffing a NotesDocument, NotesView, or an SSJS function into one eventually throws NotSerializableException. This covers how long each scope lives, how unqualified names resolve tightest-first, what's safe to store, and why you keep a UNID or view name rather than the object.

In panagenda's MakeNotesFaster webinar, Christoph Adler breaks HCL Notes 14.5.1 FP1 client performance on Windows down to two decisions: run the right version, configure it right. Here are the points most useful to admins — one brutal real-world customer number, why ODS quietly steals startup time on every open, whether you should delete cache.ndk regularly (he debunks the myth outright), keeping the data directory off network shares, the three traps in an antivirus exclusion set, and the Monday-morning checklist he closes with.

See dircat (Directory Cataloger) in show tasks and most people think 'directory catalog' — aggregating multiple Domino Directories into one lookup-friendly directory. That's its day job. But since Domino 12 the task quietly took a second one: aggregating each server's entitlement data into entitlements.nsf, a licensing-compliance audit with nothing to do with directories. This covers dircat's real job (condensed vs extended catalogs, and why DIRCAT5.NTF isn't CATALOG.NTF), its hidden second role since Domino 12, and how one task with two jobs bites.

An additional server cold-boots and floods the console every 5 seconds with 'Error connecting to server…', trying to reach every server in the domain. The culprit wasn't entitlement config at all — it was a single ACL setting that had quietly made this server the 'domain administration server.' This piece covers how many meanings 'administration server' has in Domino, what actually decides the domain-admin identity, which subsystems it silently drives (domain-wide entitlement aggregation, CertMgr, AdminP), and how to split those responsibilities apart.

Domino 14.5.1 FP1 added a Remote mode to RAG — the site's FP1 roundup already covered what changed. This piece doesn't repeat that; it fills in the wiring: how the Remote-mode configuration document is filled out, the HTTPS-only endpoint and API Key, and the step that trips people up — the remote AI server's trusted roots go into certstore.nsf, not the JVM truststore that the DRAPI path consumes.

To stash a setting from Formula or LotusScript, you've got a pile of look-alikes: @SetEnvironment, @Environment, session.SetEnvironmentVar, GetEnvironmentString. What they actually read and write is the notes.ini of the machine running the code — per-machine, not shared, not replicated. Plus a $-prefix rule that trips people up (Formula and LS prepend $ by default; reading a native notes.ini setting needs a flag). This piece pins down where they write, where the $ comes from, when to use them, and when to switch to a profile document instead.

A document goes bold with a star beside it — the unread mark looks like a field on the document, but it isn't. It's one of the few things in Domino kept per user: your having read it doesn't mean anyone else has. Driving it from LotusScript with MarkRead/MarkUnread, it's easy to mark for the wrong user (an agent runs as one ID and only touches that ID's unread state); and unread marks don't replicate by default, so the server and your local replica routinely disagree on what's read. This piece explains the mechanism and three traps.

Run an agent, open a mail with a button, click a hotspot — and Notes pops an Execution Security Alert asking whether to allow it. That's not a virus; it's the ECL (execution control list) guarding your workstation. The ECL decides whether a given signer's code may run on your machine and what it can do; a signer not on the list, or one attempting an un-granted action, triggers the alert. This piece covers what the ECL is, why the warning fires, the difference between the workstation ECL and the Administration ECL, its relationship to signing, and how to set it.

You delete a document and days later it's back — not a haunting. In Domino a delete doesn't erase the document; it leaves a deletion stub, a marker that lets replication carry "this one was deleted" to the other replicas. Stubs get cleaned up on the purge interval (default 90 days). Documents "resurrect" for one of two reasons: the stub was purged before it replicated, or the same document was edited on one replica and deleted on another and the edit won. This piece explains the mechanism, both causes, and the settings that prevent it.

Domino's three database-maintenance commands are the easiest to reach for blindly: run fixup because a view is stale, run fixup because the file got fat, run compact because it won't open — and get nowhere. Each treats a different illness: updall handles indexes (views / full-text), fixup repairs corruption (documents / structure), compact reclaims space (bloat). This piece sorts them by symptom, plus the official escalation order for corruption: updall first, then fixup, then compact -c.

DRAPI 1.1.8 (2026-09-14) is out. This release brings experimental CalDAV/CardDAV/DXL Extension APIs (off by default), new PIM endpoints for mail attachment lists and calendar profiles, PIM reading mail from a cluster member when the primary is down, and fixes for Keycloak/OIDC key rotation. A few behavior changes are worth noting before you upgrade too — richTextAs defaulting to HTML, qrp/json requiring forms, the calendar-profile rename, and calendar entries needing date/timezone/duration — covered in the body.

Something's off with the server — a feature stopped working, a task looks stuck, memory or disk is tight. The reflex is to restart the whole server, but that's blunt and wipes the scene. This piece organizes the most useful Domino console commands by the problem you're facing: show tasks to see what's running/stuck, show server for overall health, restart task <task> to restart just the one misbehaving task (e.g. restart task http, not the whole box), tell http show thread state to find a stuck thread, and dbcache show/flush/disable for the database cache. Look first, then decide what to touch.

"Document has been saved by another user" — except no one else is touching the document, yet a save conflict shows up now and then anyway. This is an old XPages trap: mixing the dominoDocument data source's save with a back-end Document save on the same document makes Domino's conflict detection misfire and spawn a conflict document. Starting from the official conflict mechanism ($Revisions), it breaks down assono's classic reproduction and re-tests this 2013-era gotcha on both Domino 12.0.2 and 14.5.1.

An agent loops a view, tweaks each document, and gets slower and slower — sometimes even throwing 'Entry not found in index.' The culprit: NotesView refreshes itself by default, so when your loop modifies the very documents the view indexes, the view keeps re-sorting under your feet — killing performance and invalidating your navigation position. The fix is one line before the loop: view.AutoUpdate = False. This piece explains the mechanism, the correct 'grab the next handle before modifying' pattern, and three side effects to know (snapshot, current-code-only, must Refresh to see updates).

To point at a Domino document you might grab its NoteID, its UniversalID (UNID), or use @DocumentUniqueID in Formula — three that look alike and behave nothing alike. A NoteID only means something inside one database file and changes across replicas; the UNID is a 32-character identity that's identical across every replica; @DocumentUniqueID returns that UNID (but without @Text it's a doclink, not text). This piece pins down each one's scope, stability, and when to use it — including the 'change the UNID and it becomes a new document' and 'save a duplicate UNID and get error 4000' traps, and where that /0/UNID in web URLs comes from.

The XPages File Download control gives you one delete link per row — one attachment at a time — with no native 'check several, delete together.' Even a fully built production form lacks it. This piece first clears up something by testing: the native delete is actually 'commit on save' and well-behaved; then it adds multi-select batch delete with the same save-bounded official API (NotesXspDocument.removeAttachment), building a real check-mark, reversible, one-save implementation on a test server (Domino 12.0.2).

The XPages file upload control does nothing — no client-side error, the page is fine, the file just doesn't upload — while the server console throws IOFileUploadException 'The system cannot find the path specified'. The root cause: Domino's upload temp folder xspupload is gone, often because Windows Disk Cleanup (cleanmgr) wiped the temp files while Domino was running. This piece ties the official KBs to real practice: the symptom and root cause, why the folder disappears, and the fixes — from the 'cycle HTTP every night' band-aid to notes_tempdir, a programmatic check-and-recreate, and upgrading to 14.0 where the defect is fixed.

Drop a File Upload Control on a Domino web form, add a save button, and it works — but it looks crude: Domino dumps the attachments at the bottom of the page, and in edit mode adds a row of un-styleable 'mark for deletion' checkboxes. This piece covers the classic Domino web developer's toolkit: hide the default attachment area with $V2AttachmentOptions="0", draw your own download list with pass-through HTML and @AttachmentNames, and the rarely-explained delete mechanism %%Detach (roll your own checkboxes, or use WebQuerySave). Includes the gotchas: $V2AttachmentOptions is 0/1 only, and it's text not a number.

The earlier pieces were about users uploading from a UI; sometimes you move attachments programmatically over REST. Domino has two REST APIs: DRAPI (modern, KEEP) and DAS (legacy, Extension Library). A common misconception is 'DAS is read-only' — not so: DAS has its own dedicated attachment endpoints to create, read, update, and delete. The real difference is modern vs legacy, plus a DAS-specific trap: don't push a whole document with embedded attachment data through create/update (it returns 400) — use the dedicated attachment endpoint. This piece lines up both APIs' endpoints and differences.

The last piece covered attaching one file three ways; this one goes to 'many at once': a classic web form uses the HTML5 multiple attribute to select several files, XPages only got native multi-select by default in 14.5.1 (before that it was OpenNTF community controls), and the case you actually hit most but is thinly documented — deleting attachments by criteria: iterate EmbeddedObjects and Remove by a condition on .Source (with a runnable example). With a figure showing how the selected files land in one rich text field.

Attaching a file in the Notes client is so easy it barely feels like a feature — drag it into a rich text field, done. But move that same need to the web, or into XPages, and 'how do users upload a file' becomes three different answers: the client uses a rich text field, a classic web form uses the File Upload Control embedded element, and XPages uses xp:fileUpload paired with xp:fileDownload. This piece lines up the three front-end upload mechanisms and points out the reassuring part — all three land as an attachment on the same rich text field of the document, so the backend code to list, extract, and delete them is shared.

Yesterday's piece used LotusScript's CompletionStream to get past Domino IQ's 5-minute timeout; if your code is Java (an agent, a bean) or XPages (SSJS), you hit the same timeout. This is the Java version: LLMReq.completionStream with the CompletionStreamCallback interface (return Continue/Stop to control the stream), plus a key fact — SSJS has no native LLM class, but SSJS's session IS a lotus.domino.Session, so you call the Java API directly or wrap the streaming in a Java class and reference it from SSJS. With a three-language comparison table.

You build a long-document summary on Domino IQ; in testing the prompts are short and it's instant. In production someone feeds in a huge thread on a modest GPU, and you hit a 'network processing did not complete in time' timeout. You go hunting for a timeout setting to raise — there isn't one. Domino IQ requests time out at about 5 minutes, by design, and it can't be changed. This piece walks a real scenario: why it times out, how to switch from Completion to CompletionStream to get past it, and one important caveat — streaming keeps it from timing out, but doesn't make it faster.

Once a certificate is in certstore.nsf, developers hit two practical questions: how does my service — the Domino REST API especially — serve HTTPS straight from it? And when my own code calls out over HTTPS, does it validate the peer against certstore too? The second answer breaks a common misconception: on one server, certificate trust is actually split across three separate places. Part three of the certstore series, grounded in hands-on testing on Domino 12.0.2, covers DRAPI's keepconfig.d TLSCertStore config, what certstore's trusted roots are really for, and disentangles certstore / Domino Directory / JVM cacerts once and for all.

Manual certificate import still means swapping every 90 days, and still means forgetting. This piece (part two of the certstore series) covers CertMgr's real killer feature: requesting, configuring, and renewing free, trusted TLS certificates from Let's Encrypt automatically over the ACME protocol. Set up the two ACME account profiles (Staging/Production) and Global Settings, walk the request flow and the six things CertMgr does automatically after Submit, understand HTTP-01 vs DNS-01 challenges, and see why the micro CA is test-only, plus ECDSA and key rollover.

Since Domino 12, TLS certificates no longer live as .kyr keyring files scattered across each server's disk — one CertMgr server task plus one certstore.nsf database manages them all: certificates stored in TLS Credentials documents, private keys encrypted with 256-bit AES, protected by the database ACL, and readable only by the servers you choose. Part one of the certstore series: the model, how to stand certstore.nsf up, what a TLS Credentials document holds, and the full steps to import an existing third-party CA certificate.

The list functions (@Transform, @Explode…) handle a whole list in one line, but some jobs still need a real loop — accumulate state, build a string in order, reverse a list. This piece goes deep on @For: the four parts (initialize/condition/increment/body), a thing that trips people up (@For returns 1, not your accumulated value, so you return the variable on a separate final line), and a real need worked through — turning an A\B\C org hierarchy into C\B\A. Plus how @While/@DoWhile differ, and the infinite-loop guard.

Series finale. The first six parts covered what formula can do; this one covers two things you hit no matter what you write: what happens when a formula errors, and where and when a formula actually runs. Catch errors with @IfError and a fallback, test with @IsError — but remember @IfError hides the real error message, so drop it while debugging. @Eval runs a string as a formula at runtime. And 'which context a formula runs in' is the root of half the series' gotchas (@DbLookup not allowed in column formulas...). Part seven (final) of the Formula @function series.

A real formula branches, holds intermediate values, and occasionally loops. This piece covers structuring formulas: temp variables x := ... are the modern backbone (semicolon-separated, the last statement is the return value); @If chains up to 99 condition/action pairs — formula's switch; @Do evaluates in sequence and returns the last; and real loops @For/@While/@DoWhile exist but, because formula is list-oriented, are rarely needed. Part six of the Formula @function series.

Date math in formula isn't a big date library — it's a few @functions. Add or subtract with @Adjust (seven positions for year/month/day/hour/minute/second, positive or negative); get now with @Now (full timestamp) or @Today (date only); get document times with @Created/@Modified. This piece also flags two traps: @Now re-evaluates every run and hurts efficiency in column/selection formulas, and @Modified (modified initially) vs @ModifiedInThisFile (last modified in this file) differ once you have replicas. Part five of the Formula @function series.

In formula you constantly handle Notes names — comparing, displaying, extracting the OU. @Name is the Swiss army knife: [ABBREVIATE]/[CANONICALIZE]/[CN] convert among canonical/abbreviated/common, and [O]/[OU1]/[S] extract any part. Get the current user with @UserName (canonical) or @V3UserName (abbreviated) — but there's a trap: inside a server agent the 'current user' is the signer, and it isn't a security mechanism. Part four of the Formula @function series.

Cutting strings in formula: many people only know @Left(s; 3), the count form — but @Left/@Right/@Middle also take a delimiter string: @Left(email; "@") is everything before the @. @Middle has four signatures, so 'grab what's between X and Y' is one line. This piece covers formula's string tools: @Middle's four forms, @Left/@Right's dual form, @Word to grab the nth piece by separator (-1 for the last, for surnames), and @ReplaceSubstring with parallel lists for multiple replacements. Part three of the Formula @function series.

Coming from LotusScript/Java, you'd loop over a list. But formula has almost no loops — because one formula already operates on a whole list at once. This piece treats formula as a functional list language: an operation on a multi-value field runs element-wise (implicit map), @Transform is the explicit map (with @Nothing for filter, a returned list for flatMap), @Explode/@Implode split and join, and @Sort sorts (with [CUSTOMSORT] using $A/$B). What's a ten-line loop elsewhere is often one line of formula. Part two of the Formula @function series.

To read another view or another database from formula, two functions do ninety percent of the work: @DbColumn grabs a whole column (keyword lists, dropdowns), @DbLookup finds a value by key (resolve a code to a label, pull a related field). This piece covers both signatures, the cache keyword (""/NoCache/ReCache), and the rules you must know — the first column must be sorted, equality-only matching, the 64KB cap, and where they can't be used. Part one of the Formula @function series.

Series finale. You can authenticate, expose a scope, CRUD, and query; before handing it to real users, a Domino developer must be sure of two things: does it bypass my Readers-field security, and what will bite in production? The answers: DRAPI is layered security (JWT + scope + Domino's own ACL/Readers underneath), so it doesn't leak — but there are real limits (rich text is one-way out, unconfigured fields are unreachable, same-name forms/views are ambiguous), plus CORS and the admin ports to close before going live. Part six (final) of the DRAPI series.

Last part fetched a single document by unid. What you usually want is 'the batch that matches' — all incomplete todos, all customers in a region. DRAPI gives two paths: GET /lists/{view} to read a view/folder, or POST /query to run DQL. DQL even supports parameterized queries (?VAR + variables, injection-safe). But there's a trap that follows from the last part's modes: a form without a dql mode is completely invisible to DQL. This part covers both query paths, pagination, the mode trap, and DQL access control. Part five of the DRAPI series.

The door is open (schema + scope); this part does the real work: create/read/update/delete NSF documents over REST. Create is POST /document with a required Form field in the body, and the response @meta carries a unid; read is GET /document/{unid}/{mode}. Every CRUD call carries dataSource — and that value is the scope name you made last part. It also covers two things that give Domino developers pause: why the Form field is required, and what a mode is. Part four of the DRAPI series.

Putting an NSF on REST isn't flipping a switch that exposes everything. DRAPI is secure-by-default: you write a schema (a whitelist of which forms, views, folders, agents, and fields go out), then create a scope (the REST mapping that activates it). A scope's name is the very name the JWT scopes claim recognizes from the last part — and underneath, Domino's ACL and Readers fields still apply. This piece separates schema from scope. Part three of the DRAPI series.

Almost every DRAPI call has to prove who you are. It doesn't use classic session/LTPA — it uses a JWT bearer token: POST to /api/v1/auth with Domino credentials for a token, then send it in the Authorization header on every request. This piece covers logging in for a token, what the scopes/aud claims control, where tokens come from (Domino-signed JWT, external OIDC, idpcat.nsf), and traps like the signing key changing on restart. Part two of the DRAPI series.

You want a modern front end, a Python service, or a Power Automate flow to read and write Domino data. The classic answers — XPages, DIIOP, a hand-rolled LotusScript web agent spitting JSON — all make the caller meet Domino on its terms. The Domino REST API (DRAPI, the KEEP project) flips it: a standard REST/JSON layer over your NSF that anything speaking HTTP can call. This is part one of a DRAPI series — what it is, how it differs from classic access, the three building blocks (scope/schema, JWT, OpenAPI/Swagger), and how to start.

A cross-database embedded view on a form worked fine in dev, then showed 'cannot start' the moment it reached the customer's test region. Nowhere in Designer's embedded-view UI is there a field to change the source database. Export the form to DXL and the reason shows up: the embeddedview element pins its source by the source database's replica ID — change environments and that ID no longer resolves. This is a field report: how to diagnose it, how to swap it in bulk with a NotesDXLExporter/Importer agent, and the faster way I found afterward — editing the DXL directly in Designer.

LotusScript error handling is On Error Goto, Err.Number, Resume. In Java, nearly every lotus.domino method throws a checked NotesException — the compiler forces you to handle it — and it carries .id (the Notes error code) and .text (the message). This piece covers Java exception handling: NotesException's fields, using .id against NotesError constants for targeted handling, and the rule that ties this whole Java data-layer series together — recycle belongs in finally, so it still runs when something throws.

In LotusScript you loop a DocumentCollection with Set doc = coll.GetNextDocument(doc) and never think about memory. In Java the same loop over tens of thousands of documents exhausts the agent's memory — unless you recycle each one inside the loop, in an order you can't get wrong: fetch the next document using the current one, then recycle the current one. This piece covers the correct Java iteration idiom: DocumentCollection's getFirstDocument/getNextDocument, the isValid deletion-stub check, when to switch to the leaner ViewNavigator, and the recycle ordering LotusScript never makes you think about.

To work with a Notes date in Java you can't just use java.util.Date — there's a lotus.domino.DateTime in the way. It's a heavyweight back-end object with a handle behind it, so it leaks memory in a loop if you don't recycle it; it stores dates as strings and throws on bad input; and toJavaDate() is the bridge that converts it into Java's own date type so you can reach java.time. This piece covers how Java's DateTime is created, read, and written, how it crosses into Java's time world, and the recycle burden LotusScript doesn't carry over.

In LotusScript, doc.GetItemValue returns a Variant array and you loop over it without a second thought. In Java, the same call returns a java.util.Vector — you have to know the element type, a missing item comes back empty instead of throwing, and if it holds DateTime objects it leaks memory. This piece covers reading and writing items on the Java Document: getItemValue and the typed getters and their missing-item behavior, what Java types replaceItemValue accepts and how it auto-creates an item, why appendItemValue quietly makes duplicate items, and three instincts LotusScript won't carry over.

The first Fix Pack for Domino 14.5.1 shipped quietly on 2026-07-16 with a one-line 'recommended for all customers.' Here's what actually matters to developers and admins: RAG gains a Remote mode (LLM on a remote endpoint, vector DB still local), a good chunk of the ~49 fixes are cleaning up regressions 14.5.1 introduced itself, the JVM moves to Semeru 21.0.11+10, two OIDC security fixes, and a few notes.ini toggles worth knowing.

LotusScript has no removeElementAt, so dropping one multi-value element means rebuilding an array. SSJS is the opposite — it runs on Java, a multi-value field reads in as a java.util.Vector, and addElement/removeElementAt/insertElementAt are right there, then you write it back with replaceItemValue. A field report on using Vector for multi-value work, why removeElementAt loops backwards, and the two traps you will hit (the empty field's [""], and getValue's type).

Removing one multi-value element is easy in SSJS/XPages — java.util.Vector has removeElementAt, loop backwards and delete by index. In LotusScript you hit a wall: no Vector, no removeElementAt, and Erase clears a whole array rather than dropping one element. This is a field report on the real options — figure out what your collection actually is first, then reach for Split/Join, an array rebuild, a List's Erase(tag), or Evaluate + @Replace.

The first three pieces assume the agent is already running — you can recycle, you have a Session, you run DQL. But how does a Java agent get triggered, whose rights does it run with, where does System.out go, and how do you debug it? This fills in the step before NotesMain(): the AgentBase skeleton, Trigger and unprocessedDocuments, the signer that decides an agent's rights, restricted vs unrestricted, and the System.out-to-log.nsf debugging path.

The site's DQL trilogy teaches the query language, but it runs DQL from LotusScript or the console. In Java, DQL goes through two classes: DominoQuery compiles, tunes, and runs; QueryResultsProcessor sorts, aggregates, joins across databases, and outputs JSON. And a common first-time trip-up: you get both from the Database, not the Session. A field report on how DQL actually runs from Java.

LotusScript's session is a global you never create; Java has no such thing. Before you touch a single document you have to obtain a Session yourself — and how you get one depends on whether your code runs as an agent, a standalone program, or remotely. A field report on NotesFactory's three paths, local (JNI) vs remote (DIIOP), the who-creates-recycles rule, and the two traps: JVM bitness and one session per thread.

The same logic runs forever in LotusScript, then blows up the agent's memory the first time you loop it over tens of thousands of documents in Java. The reason is that every Java Domino object is backed by a native handle the garbage collector can't see. A field report on the mechanism, the four official rules, the loop leak pattern and its fix, NotesThread's role, and how local vs remote sessions change the cost.

You compare a name to session.EffectiveUserName and it's never equal, even though it's obviously the same person. Or you write a user into a Readers field and they still can't see the document. Same root cause: a Notes name has three text forms — canonical, abbreviated, common — and you compared two different ones. A field report on NotesName: what each format is, which one Notes stores internally, and why every name comparison should normalise through NotesName first.

You need to count documents by category, dedup a set of names, or build a code-to-label lookup. The Domino reflex is two parallel arrays and a linear scan, or a throwaway view. But LotusScript has had a native keyed collection all along and almost nobody reaches for it: the List. A field report on the built-in associative array — its keyed access, ForAll + ListTag iteration, Erase, and the two gotchas (guarding reads with IsElement, and tag case sensitivity following Option Compare).

OpenNTF hosted HCL's Brian Arnold for a deep session on Domino IQ RAG. We've already covered how the pipeline works under the hood; this is the field-report layer — the 30-character limit for RAG-enabling short fields and the concat-field way around it, vectorization in three steps, the three knobs to tune, the fact that Readers/Authors-field security only really started working in Domino 2026 FP1, and the citations, side panel, and MCP still under development.

You update a keyword document, reload the form, and the dropdown still shows the old value. Or a keyword list quietly stops growing at a few thousand entries. Both are @DbLookup / @DbColumn behaviours hiding in the argument most formulas leave empty: the cache keyword. A field report on the three cache options (default / NoCache / ReCache) and the hard 64KB limit on what these functions can return — with the classic-web cases where each one bites.

Your agent works perfectly when you run it — because you're the admin who signed it. Deploy it as a web agent, or schedule it signed by a service ID, and it fails with Error 201 or silently sees no documents. The cause is identity: a Domino agent runs as someone, and that someone isn't always you. A field report on the signer vs the effective user, how session.EffectiveUserName flips on 'run as web user', the runtime security level behind Error 201, and the Readers-field trap that makes documents vanish.

A custom room-booking or meeting form has the embedded scheduler control — the busy-time grid where you add attendees and see everyone's free/busy. NotesUIScheduler is how you drive that control from code: get it by name off the UI document, add or remove participants, refresh the schedule data, and read back the interval the user picked. A field report on the one front-end scheduling class, its GetScheduleData refresh, and the two events you hook.

Open the LotusScript help for Button and you expect properties and methods — there are none. Same for Field, same for Navigator. All three are empty on purpose: they exist only as event entry points, the typed Source parameter that tells a front-end event handler which element fired it. A field report on the three classes you never call anything on — what their events are (Click, Entering / Exiting / OnChange), and why the real work always goes through NotesUIDocument.

A LotusScript web agent has no request object and no response object — it has Print, whose output becomes the HTTP body, and DocumentContext, a special document holding the CGI variables. A field report on the two halves: how the first Print line sets Content-Type so you can return JSON instead of HTML, how to read the query string and POST body from DocumentContext, the CGI-fields gotcha that leaves them empty, and how it all fits with a top-level error handler.

You export documents to DXL, import the DXL into another database, and end up with copies carrying brand-new UNIDs instead of the same documents updated in place — because the importer creates by default and only matches on UNID when you tell it to. A field report on the DXL round-trip: the DocumentImportOption that decides create-vs-replace, why default rich text isn't binary-identical (and when to switch to RAW), and the stale-handle trap that hides the whole thing.

Two habits sink most LotusScript error handling: treating On Error as if it were global (it's per-procedure, and uncaught errors climb the call stack), and reaching for On Error Resume Next as a blanket 'ignore errors' switch (it hides the bug, it doesn't handle it). A field report on doing it deliberately — the per-procedure scope, the Err / Error$ / Erl lifecycle, the difference between Resume, Resume Next, and Resume label, and the clean-error pattern a web agent actually needs.

In the Notes client a user can delete a document from any view, with the Delete key, a cut, or a drag to the trash — you can't guard each path separately. NotesUIDatabase is the single chokepoint that sees all of them: its QueryDocumentDelete event fires once, database-wide, before anything is marked for deletion. A field report on the front-end database class — the Database bridge, the delete/archive events, and the soft-delete guard you hang off the one event that catches every path.

Two processes touch the same document — a web agent and a user with the form open, or a scheduled agent and a replica. One save wins, the other's edit either vanishes or turns into a mysterious $Conflict. Which one happens is decided entirely by the two booleans you passed to NotesDocument.Save. A field report on force and createResponse: last-write-wins vs the conflict document the replicator makes, why Save(True, False) quietly loses data, and how to pick on purpose.

A view action button is supposed to act on the rows the user highlighted — but the back-end NotesView has no concept of a selection. That gap is exactly what NotesUIView fills. A field report on the front-end view class: its Documents property (the live selection), the bridge back to the back-end View, the QueryOpenDocument / QueryClose events you hook to intercept the user, and the hard boundary that keeps all of it out of web and agent code.

NotesDOM implements the full W3C node model, which means four node types exist for the DTD corner most XML developers never touch: DocumentType, Entity, EntityReference, and Notation. A short map of what they are, which one you can actually create (EntityReference), which are read-only reflections of a parsed DTD, and why in 2026 you can usually walk past all of them — plus the one case where knowing they exist saves an afternoon.

You built a NotesDOMParser pipeline for element and text nodes. Then you parsed XML with a comment, a CDATA block, and a processing instruction, changed one value, serialised it back — and the comment and PI were gone. A field report on the rest of the NotesDOM node family: NodeList's 1-based GetItem (not the W3C 0-based item()), DocumentFragment for batch inserts, and the CDATA / Comment / ProcessingInstruction nodes you have to create yourself to preserve on the way out.

"I assumed Start=31 meant the 31st row. Then I was wrong." A debugging field report on the ?OpenView Start parameter in categorized classic views: a plain number jumps to the Nth top-level category, dotted values like 1.1.1.1.6 are hierarchical coordinates, the last segment clamps but middle segments don't, and you can't URL your way to the absolute last page. Plus three practical uses — an in-category serial, @DocNumber("") (with its must-be-alone landmine), and ReadViewEntries breadcrumbs.

Inherit an old classic-web Domino view and you'll often find the column headers sitting one cell to the right of the data — and nobody knows why. A field report on the passthrough-HTML tricks hiding in twenty-year-old view designs: square-bracket HTML in column values and titles, spacer columns, per-row checkboxes, and the real culprit — an intentionally unclosed <input tag that swallows the </td><td> boundary and merges two columns into one cell, shifting every header after it.

A DQL query fails and you get "Domino Query execution error:" followed by a wall of text. A field report on reading that message: the number 4854 you'll find in Err is useless for diagnosis (every DQL failure returns it), and the answer is always in the detailed-reason line. Covers the four-segment message structure, a three-rung ladder (catalog / view-never-built / partial TIMEDATE), the design-catalog corruption that makes queries work intermittently, and the 0-docs-no-error checklist.

"Converting the column to a date, some documents match and some don't — weird." A field report: a DQL view-column date query that returned inconsistent results turned out to have three independent causes. DQL never auto-converts types (so the column's output type must match your query term), the source field held mixed text/date values, and @dt without a time-zone offset is UTC — which corrupts boundary documents without changing the total count. Two verified fixes, tested 6/6.

NotesXSLTransformer applies an XSLT stylesheet to XML or DXL and writes the transformed result — the last piece of Domino's XML toolkit alongside the DOM and SAX parsers. This article covers session.CreateXSLTransformer and its three sources, the stylesheet-must-be-a-stream rule, the pipelining model that chains DXL export → transform → import with no temp files, and the error handling that works through the Log property and On Error, not events.

Before Domino 10.0.1, parsing JSON in LotusScript meant Evaluate tricks or hand-rolled string surgery. NotesJSONNavigator replaced that with a real parser: session.CreateJSONNavigator gives you a typed tree you navigate with GetElementByName, GetNthElement, and JSON Pointer paths. This article covers the navigator, the element/object/array classes, the type constants, and the naming surprises (GetFirstElement not GetFirstItem; AppendElement takes value-then-name).

FTSearch needs a full-text index to be fast — and to support wildcards and relevance ranking — and NotesDatabase can create, update, and remove one from LotusScript. The catch is a split almost nobody expects: CreateFTIndex / UpdateFTIndex / RemoveFTIndex work on LOCAL databases only, while FTIndexFrequency is server-only, and server indexes are actually managed by the Updall task (updall -X rebuilds, it doesn't create). This article covers the options bitmask, the create-vs-update distinction, and that split.

Domino can lock a document so two users don't edit it at once — Lock, LockProvisional, UnLock, and LockHolders on NotesDocument. But the methods raise an error unless locking is enabled on the database (IsDocumentLockingEnabled) and a master lock server is configured, persistent vs provisional locks depend on that server being reachable, and locks don't work in web apps at all. This article covers the API and every prerequisite.

ComputeWithForm runs a form's default-value, input-translation, and input-validation formulas against a back-end document — the programmatic equivalent of a user saving on the form. But three things surprise people: it returns a pass/fail flag it never enforces (it happily lets you Save an invalid document), input translation can rewrite your field values, and it silently falls back to the default form unless you pin the Form item.

Domino's parent-child document hierarchy — main document, responses, responses-to-responses — is built and traversed with a handful of NotesDocument members. This article covers MakeResponse (and the Save you must call after it), ParentDocumentUNID for walking up to the parent, and the Responses property, whose one load-bearing limitation is that it returns only immediate children — so a full tree needs recursion.

One NotesDateTime is a single instant you can read out three ways — as GMT, as the machine's local time, and as a converted zone. This article covers GMTTime vs LocalTime vs ZoneTime, the TimeZone integer's counter-intuitive Notes sign convention (positive means west of GMT), ConvertToZone and its DST gotcha, LSGMTTime for native date math, and why GMTTime is the only safe form to store and compare across machines.

Domino can sign a document to prove who wrote it and encrypt items so only key-holders can read them — both from LotusScript, and both with a gotcha. This article covers NotesDocument.Sign and the server-agent permission it needs, Encrypt with the mandatory flag-item / Encrypt / Save ordering, per-item opt-in encryption, and why EncryptOnSend is a completely separate thing from encrypting the stored copy.

A profile document is a hidden, view-invisible document keyed by name (and optionally user) — perfect for app configuration and per-user preferences, and fast because it's cached. This article covers GetProfileDocument, the IsProfile / NameOfProfile / Key properties, per-user profiles via the unique key, and the pitfall the caching creates: another process's write may not be visible to your already-open session, with no refresh API to force a re-read.

Domino's document-level access control isn't a special API — it's an ordinary item with a flag. This article covers creating Readers and Authors fields in LotusScript via ReplaceItemValue plus NotesItem.IsReaders / IsAuthors, the security model (no Readers item = everyone; an item with Readers = only those listed), and the lock-out traps: leave yourself and your agents out of the list and you can hide a document from everyone, including the code that made it.

In a single-level categorized view, GetAllDocumentsByKey('Belgien', True) correctly returns the 2 documents under that category. But add a second level of categorization — Form then Country — and GetAllDocumentsByKey('Customer', True) returns 3, not all the documents. It stops at the first sub-category. This article documents the empirically verified trap and the workarounds.

NotesStream reads and writes files, but the moment your text isn't plain ASCII, three things bite: which charset you opened with, whether a byte-order mark got written, and the fact that Position is a byte offset with 'no special support for multi-byte characters.' This article covers Open's charset argument, the EOL constants, exactly when WriteText emits a BOM (UTF-16 yes, UTF-8 no), and why Bytes never equals Len().

Attaching a file, listing what's attached, extracting it to disk, and removing it — all from code. This article covers NotesRichTextItem.EmbedObject with the EMBED_ATTACHMENT constant, the NotesEmbeddedObject class, ExtractFile, and the two traps that catch people: NotesDocument.EmbeddedObjects does NOT return file attachments (use GetAttachment or the rich-text item), and ExtractFile errors on anything that isn't an attachment.

HCL Sametime 12.0.3 — released in 2025 — is a point release worth a look if your shop hasn't upgraded: chat read receipts, mobile chat search, automatic meeting-recording transcripts, a full accessibility pass, and a UI rebuilt on HCL Enchanted + React. The most consequential change for Domino admins isn't a feature at all — it's that premium chat capabilities are now folded into the standard Domino Complete Collaboration Bundle.

The rarely-seen tier of the Domino DOM — the XML declaration, DOCTYPE, processing instructions, notations, entities — plus NotesSAXException on the SAX side. This article covers what each node actually gives you (mostly: not much), the AddXMLDeclNode flag you must set to even see the declaration, and how NotesSAXException is the one place you get rich, line-and-column error data when parsing goes wrong.

Once you're walking a parsed DOM, the actual data lives in the content nodes — text, attributes, comments, CDATA. This article covers the inheritance (CharacterData is the base of Text/Comment/CDATA; CDATA derives from Text; AttributeNode stands apart), the CharacterData editing methods, and the single biggest gotcha: the LotusScript binding reads content through NodeValue — there is no W3C-style Data, Length, Name, or Value property.

Once NotesDOMParser has parsed your XML, you navigate the result with a family of node classes. This article covers getting the root from domParser.Document, reaching the root element via DocumentElement, querying with GetElementsByTagName (which returns a NotesDOMNodeList), reading attributes through an element's NamedNodeMap, and the LotusScript-specific quirks: 1-based GetItem, no ChildNodes property (walk FirstChild/NextSibling), and no GetItemByName.

Two rich-text features you'd normally insert by hand in Designer — a doclink that jumps to a database, view, or document, and a collapsible section — are scriptable. But neither class is one you construct: you create the elements through NotesRichTextItem (AppendDocLink, BeginSection/EndSection) and read them back through NotesRichTextNavigator. This article covers that write-vs-read split, the doclink properties, the BeginSection/EndSection rule, and the gotchas.

Building rich text from LotusScript isn't just appending strings — margins, alignment, line spacing, tab stops, and colour are separate objects you stamp on before the text. This article covers NotesRichTextParagraphStyle (the layout), NotesRichTextTab (tab stops, born read-only from the style), and NotesColorObject (colour maths), the twips measurement system, the append-style-before-text rule, and the non-obvious bit: NotesColorObject doesn't colour text directly — you derive a Domino colour value from it.

NotesInternational is a read-only window onto the regional settings of whatever machine your code runs on — date order, separators, AM/PM strings, currency symbol and format, time zone, and the DST flag. This article covers getting it from session.International, the property groups worth knowing, a runnable example that detects the locale's date order, and the three traps: it reflects the host OS (not the end user), it's read-only, and its TimeZone sign convention is the classic counter-intuitive Notes one.

Renaming a user, deleting one cleanly, recertifying, moving a mail file, changing an Internet password — these are AdminP jobs you'd normally click through in the Administration client. NotesAdministrationProcess files those same requests from code into admin4.nsf. This article covers session.CreateAdministrationProcess, the request methods and their note-ID return value, the certifier properties, and the three things that trip people up: it needs unrestricted rights, it's asynchronous, and '*' means 'no change'.

Want to do something every few seconds on an open Notes client screen — auto-refresh a view, poll for new documents, update a status display? NotesTimer is exactly that: give it an interval in seconds at creation and it fires an Alarm event periodically. This article covers creating it, the Interval / Enabled / Comment properties, binding a handler with On Event, and the four limitations you must know: UI-only (not agents), declare it globally, the handler must finish within the interval, and it's enabled by default.

NSF ODP Tooling is an OpenNTF project that turns a binary NSF into a file-system On-Disk Project you can keep in Git, then compiles it back into a full NSF without Domino Designer — bringing real version control and CI/CD to Domino. Here's what it is, how the Maven plugin and container-based compilation work, and what the 4.1.0 release actually changed.

Composite Applications were a Notes 8.x feature — assembling several components (Notes components, Java/Eclipse components) on one screen and letting them pass values to each other. NotesPropertyBroker is the mediating layer; NotesProperty is the single property being passed. This article is honest about where these classes sit (fairly legacy), covers getting the broker with GetPropertyBroker, the GetPropertyValue / SetPropertyValue / Publish / HasProperty methods, InputPropertyContext, and what it actually means today.

You want to inventory a view — which columns it has, whether each is a field or a formula, what's sorted or categorized, what's hidden — without opening Designer. NotesViewColumn reads that from code. This article covers getting it from view.Columns, the Title / ItemName / Formula / Position / IsSorted / IsCategory / IsHidden / IsField / IsFormula properties, and how it lines up with the earlier NotesViewEntry's ColumnValues (the same Position index).

The ID Vault is Domino's policy-based facility for centrally storing user ID files. NotesIDVault lets you operate it from code — pull a user's ID file out of the vault, sync a local ID back, check whether someone's ID is in the vault, even reset a vault password. This article covers getting it, the GetUserIDFile / SyncUserIDFile / IsIDInVault / ResetUserPassword / PutUserIDFile methods, its relationship to NotesUserID, and the permission prerequisites for these operations.

You're assembling a rich text email or document in code with NotesRichTextItem and need a table to lay out a summary or report — NotesRichTextItem.AppendTable creates a NotesRichTextTable. This article covers creating one, RowCount / ColumnCount, AddRow / RemoveRow, SetColor / SetAlternateColor for striped rows, RightToLeft, and how to walk an existing table with NotesRichTextNavigator — plus a key limitation: you can't read a cell's contents unless you already know the rich text's exact structure.

After you export design or documents to DXL (Domino XML) with NotesDXLExporter, how do you push it back into a database? NotesDXLImporter is the reverse half. This article covers creating it, the three key import strategies (DesignImportOption / DocumentImportOption / ACLImportOption and their create / ignore / replace / update choices), the Import method and retrieving imported notes, and how it pairs with DXLExporter into a full DXL round-trip.

To read a few field values from every document in a view, many people loop the documents and GetItemValue each one — but that opens every document, and a few thousand rows is painfully slow. NotesViewEntry reads the view's already-computed ColumnValues without opening a document at all; NotesViewEntryCollection is the collection of those rows, skips category/total rows, and supports set operations and StampAll batch updates. This article covers the 'read the view fast' pair, why ColumnValues is the performance key, and an entry's identity and hierarchy properties.

You write LotusScript / XPages all day and probably never think about a database's ODS (on-disk structure) version — until a feature like LargeSummary needs a certain ODS, or you move an old database between servers and aren't sure whether its ODS follows. This article covers the ODS-to-release mapping from a developer's angle, the most counterintuitive point (upgrading the server version does not upgrade the ODS), and exactly what triggers an ODS change and what governs it — then answers a concrete case: an R9 ODS51 database, new-copied from an R12 client to an R12 server, does its ODS change automatically?

An XPages save failure: the message says '32K', but every field checks out under 32K (the biggest is 26K) and it still won't save. Because the number the error names is usually not your problem — the wall you actually hit is 'a document's combined summary data is capped at 64K'. This article builds the summary / non-summary mental model and the two size limits first, then explains why ODS and LargeSummary are two different things, then forks the fixes on one question: should this data be summary at all?

Sometimes the perfect tool in your head is an @function — @Name, @Unique, @Explode, @DbLookup — but you're in LotusScript. Evaluate is the bridge: pass an @formula as a string, run it at runtime, get the result back. This article covers the two call forms (with and without a document context), the trap everyone hits (the return value is always an array), and which @functions aren't supported (the UI ones — @Command, @Prompt, @PickList, and friends).

You're building rich text in code with NotesRichTextItem and want a span to be bold, larger, a different colour — that 'style' is NotesRichTextStyle. This article covers creating it, the Bold / Italic / FontSize / NotesColor properties, applying it with AppendStyle and SetStyle, and one crucial design point: a freshly created style has every property set to STYLE_NO_CHANGE, so you set only the ones you want to change and leave the rest alone.

You want a 'daily digest' or 'search-results notification' — take a set of documents matching some criteria, roll them into one email, and let each entry link back to its source document. That's exactly NotesNewsletter's job: it takes a NotesDocumentCollection and produces a doclink digest with FormatMsgWithDoclinks, or renders documents one by one with FormatDocument. This article covers creating it, the DoScore / DoSubject / SubjectItemName properties, the difference between the two Format methods, and the classic FTSearch-to-email example.

You inherit an undocumented NSF and want to figure out which forms it has, what fields each defines, and who's allowed to create documents — without opening Designer. NotesForm reads that design information from code. This article covers getting forms from db.Forms / db.GetForm, the Name / Aliases / Fields / FormUsers / Readers properties, GetFieldType and Remove, and how ProtectReaders / ProtectUsers relate to replication.

HCL released v10 of its low-code platform Volt MX, codenamed 'Darwin', back in August 2025. This isn't breaking news — it's a catch-up explainer that lays out the release for Domino developers: turning Figma designs straight into apps with GenAI, AIAD (AI Assisted Dev) where a RAG-powered Volt IQ helps generate code and retrieve docs, CarPlay / Android Auto support, Passkeys, iOS Live Activities, and more. It also explains the Domino connection: Volt MX Go is the Domino-bundled edition, and Volt IQ's RAG approach shares DNA with Domino IQ.

As of writing (2026-06), the latest HCL Nomad for web browsers / Nomad server on Domino release is 1.0.20. The standout new feature is Kiosk Mode — pin one database to run on startup, disallow closing it, and hide or lock the rest of the UI, turning an existing Domino app into a single-purpose terminal in the browser (reception desk, shop floor, self-service kiosk). 1.0.20 also adds file-export support on Firefox. This piece covers the 1.0.20 highlights and places them in the 1.0.18 to 1.0.20 Enchanted-design-refresh arc.

Want an agent that sweeps every NSF on a server and checks each database's ACL or size? That's NotesDbDirectory's job — don't confuse it with the earlier NotesDirectory (which looks up people and groups in the Domino Directory); both end in Directory but do completely different things. This article covers creating it with GetDbDirectory, walking databases with GetFirstDatabase / GetNextDatabase, the four file-type constants, Open / CreateDatabase / OpenDatabaseByReplicaID, and the trap that bites everyone: the NotesDatabase you get back is closed by default and must be Opened before use.

Jesse Gallagher rebuilt OpenNTF's home app from XPages into a Jakarta EE application, with DRAPI (the Domino REST API) as its entire data layer, then packaged it as a WAR and deployed it to Open Liberty — running outside Domino. The point isn't 'another rewrite': it validates a path where a Jakarta EE app written for Domino is genuinely portable — the data stays in NSF, but the runtime isn't tied to Domino. This piece covers what he did, the stack, why it matters, and the rough edges he flags himself.

You have a heavy processing agent and want another agent — or a button — to fire it on demand, not on a schedule but straight from code. NotesAgent is the class for that: db.GetAgent() gets the agent, then Run or RunOnServer executes it. This article unpacks the crucial difference between the two (runs on the client vs on the server), how to pass a document to the called agent via noteID, the IsEnabled / Trigger / Target properties, and the four constraints: no recursion, no debugging, no user interaction, output goes only to the Domino log.

You have 500 documents whose Body field needs every doclink counted, or one string replaced throughout — and just getting the field with NotesRichTextItem isn't enough. NotesRichTextNavigator walks rich text one element type at a time; NotesRichTextRange selects a span and then styles or removes it. This article unpacks the two Release-6 companions, the element-type constants, FindAndReplace's options and return value, and the rule that costs people hours: every navigation marker is invalidated after a FindAndReplace.

The classes covered so far — NotesDatabase, NotesDocument — are all back-end. But when you need to read the value a user typed but hasn't saved yet, pop a dialog to ask them something, or flip the open document into edit mode, you reach for the other half: NotesUIWorkspace and NotesUIDocument. This article unpacks the front-end pair, the crucial 'on-screen value vs back-end Document' distinction, FieldGetText/FieldSetText, the Prompt and PickList dialogs, and the rule that trips everyone: UI classes can't run in a background or scheduled agent.

Need to pull "John B Goode" out of CN=John B Goode/OU=Sales/O=Acme/C=US? Still doing it with Mid, InStr, or @Name? NotesName is Domino's built-in name-parsing class — one session.CreateName() call converts between canonical, abbreviated, common, and Internet (RFC 821/822) formats, and breaks a name into its O / OU / C / G / S components. This article covers every read-only property, the three-format conversion, how flat names and Internet names behave, and the easy-to-miss rule that an abbreviation is skipped when it would be ambiguous.

Classic LotusScript has no location API — but an app running on HCL Nomad can read the user's latitude and longitude. NotesGPS is Domino's client-side geolocation class for Nomad: start from NotesSession.CreateGPS(), authorise with RequestAccess(), fetch a NotesGPSPosition with GetCurrentPosition(), then read Latitude / Longitude off its NotesGPSCoordinates. This article walks the three-class chain, annotates the official example line by line, and covers the gotchas — error 4508, empty Speed/Heading on the first iOS call, and HighAccuracy failing indoors.

Print statements only appear in the Designer debug window — a scheduled agent running on the server produces no trace at all. NotesLog is Domino's built-in logging class: a few lines of code and your agent's actions and errors are recorded to the agent log, a specified NSF, a file, or an email that arrives when the agent finishes. This article covers the four Open methods (OpenAgentLog / OpenFileLog / OpenMailLog / OpenNotesLog), LogAction and LogError call shapes, the NumActions / NumErrors counters, OverwriteFile for file logs, and a reusable production agent logging template.

Every Domino NSF carries a replication configuration — the same Replication Info you see in the database properties dialog. LotusScript's NotesReplication class lets you read and write that configuration programmatically: pause and resume replication, adjust priority, set cutoff filters, clear replication history. NotesReplicationEntry manages per-server-pair selective replication rules. This article covers obtaining the object (db.ReplicationInfo), the IsDisabled / Priority / Abstract properties, ClearHistory for forcing a full resync, GetEntry for per-pair rules, and why Save is non-negotiable.

The Domino Directory is the source of truth for every user, group, and server in your Notes environment. LotusScript's NotesDirectory provides a high-level query API — no need to open names.nsf yourself and walk a view. This article covers obtaining the object via session.GetDirectory, LookupNames for targeted field lookups, LookupAllNames for full scans, GetMailInfo for retrieving mail server information, CreateNavigator for walking cached results with NotesDirectoryNavigator, and the SearchAllDirectories / LimitMatches properties that control performance and result count.

Incoming Domino mail is a nested MIME tree — HTML body, plain-text fallback, attachments, and inline images each live in separate nodes. LotusScript uses NotesMIMEEntity for each node and NotesMIMEHeader for its header fields. This article covers the ConvertMIME=False prerequisite, identifying node types with ContentType/ContentSubType, walking the tree with GetFirstChildEntity and GetNextSibling, extracting body text with GetContentAsText, reading header values with GetNthHeader/GetSomeHeaders, building a MIME message from scratch with CreateMIMEEntity, and a practical pattern for distinguishing attachments from body content.

Domino calendar data isn't stored in ordinary documents — it lives in mail.nsf in iCalendar (RFC 5545) format, accessible only through three dedicated classes. This article covers NotesCalendar (the calendar object, entry point), NotesCalendarEntry (a single event), and NotesCalendarNotice (a meeting invitation or update notice): how to obtain them via session.GetCalendar, writing new entries with iCalendar-format strings, batch-reading a date range with ReadRange, fetching unprocessed invitations with GetNewInvitations, accepting or declining with NoticeAction, and the ConvertMIME=False prerequisite that will silently corrupt calendar data if you forget it.

Almost every Domino agent ends up holding a NotesDocumentCollection — but most code only uses GetFirstDocument and GetNextDocument then stops. This article covers the full picture: seven ways to obtain a collection, five navigation methods, the three in-place set operations (Intersect / Merge / Subtract), StampAll batch-write semantics and the walk-and-mutate trap, RemoveAll's force-parameter concurrency semantics, and the FTSearch + set-operations chaining pattern.

Wiring DRAPI (Domino REST API) up to a modern IdP like Keycloak, Azure AD, or Okta is widely assumed to require Domino 14, since most of the public documentation centres on the 14-era OIDC story. In practice, DRAPI's oidc mode works on Domino 12.0.2 — no server upgrade required. This article is the implementation notebook from reproducing the full setup locally: picking among DRAPI's three OIDC modes (jwt / oidc / oidc-idpcat), debugging the three-layer auth architecture (identity / mapping / authorization), and the four traps that ate the most time — the biggest of which is providerUrl using localhost failing across machines because Java resolves IPv4 by default. Full step-by-step lives in the companion GitHub repo and Pages site; this article doesn't repeat the setup, it focuses on decisions and pitfalls.

When upgrading from V11 / V12 to Domino 14.x, the structural changes that actually break existing deployments are surprisingly limited — concentrated in a few areas. This article organises the 14.0 / 14.5 / 14.5.1 differences along five dimensions: notes.ini location, Java / JAR environment, XPages editor (CKEditor → TinyMCE 6.7), new modules (Domino IQ / DQL @FTSearch / AdminCentral / AutoUpdate), and the complete deprecation list (iNotes UI, SNMP MIB, DCT, Server Load Utility, etc.). Each entry is tagged with its starting version and official source, plus a pre-upgrade checklist at the end.

Every Domino admin gets the same drumbeat — new hire onboarding, employee leave, departure notifications, all eventually landing as 'create / update / disable a Notes user' tickets. Clicking through Admin Client one user at a time scales badly. NotesRegistration is LotusScript's built-in answer: a single class that programmatically wraps user registration, certification, and ID-file management. This article walks through the practical HR-system-driven scenario, RegisterNewUser's 14 parameters, the required property setup, the server-context prerequisites, and a complete CSV batch example.

Starting with Domino 14, there are three technical paths for searching documents: FTSearch (full-text index), db.Search (@Formula full scan), and DQL (introduced in V12, structured query using the design catalog and NIF indexes). This article puts the three side by side in a multi-dimensional comparison table, walks a three-question decision tree, and digs into Domino 14's integration of `@FTSearch()` as a DQL term — which finally lets you express text + structured conditions in a single query. Three practical scenarios (one-off lookup, scheduled agent, high-frequency REST API) map to recommended paths, with cross-links to the full search series and the DQL trilogy.

NotesDatabase.Search is LotusScript's second search mechanism — no full-text index needed, just @Formula evaluated against every document. This article breaks down the three parameters (formula / dateTime / maxDocs) and how their semantics differ from FTSearch, why the result is unsorted, how the dateTime parameter doubles as a cursor for incremental processing, the truly-unlimited maxDocs=0 (unlike FTSearch's 5000 default cap), the @function subset that doesn't work in this context (UI / lookup / write-back), the snapshot-not-live-view gotcha that catches developers after StampAll, and a production-ready incremental scheduled agent example. Part 2 of a three-part series — the follow-up compares FTSearch / db.Search / DQL side by side.

FTSearch is a method on three different Domino classes — and each tier returns something different. This article walks through NotesDatabase.FTSearch (returns a new collection), NotesView.FTSearch (filters the view object in place, returns a Long count), and NotesDocumentCollection.FTSearch (in-place reduction, void), the sortopt and options constants, a query-operator cheat sheet, the five CreateFTIndex options-bitmask flags and their relationship to `load updall -x`, the silent gotcha that FTSearch on a non-indexed database still runs (just slowly), the default 5000-document cap, the wildcard `*`-only-at-end constraint, and the must-be-uppercase rule for AND / OR / NOT. First in a three-part series — db.Search comes next, then a decision article tying everything together with the DQL trilogy.

'Export this view to Excel for the user' is one of the most common asks in Domino dev. Four paths — CSV via NotesStream (recommended default), HTML-as-xls (legacy formatting trick), OLE Excel.Application (client-only ad-hoc), Apache POI via Java agent (production-grade .xlsx) — each with its sweet spot. This article walks the trade-off table, a complete CSV implementation (with UTF-8 BOM, CSV escaping, and NotesViewNavigator 5-10x speedup), when to use HTML-as-xls / OLE / POI, the web-download pattern, and the three traps most people forget (missing BOM, wrong escape rules, using GetFirstDocument instead of ViewNavigator).

Two of the most frequently touched utility classes in any Domino codebase — NotesDateTime represents a single point in time, NotesDateRange spans a start-to-end interval. This article covers instantiation (New vs session.CreateDateTime), the three time-zone property families (Local / GMT / Zone) and when to use which, the six Adjust* methods for date arithmetic, TimeDifference vs TimeDifferenceDouble precision, ConvertToZone's in-place mutate semantics, NotesDateRange's four-property flat shape (with zero methods), the SetAnyDate / SetAnyTime wildcards used for view searches, the timezone trap when reading from NotesItem.DateTimeValue, and two practical examples (a stale-document reminder agent + a cross-timezone meeting scheduler).

The earlier lotusscript-http-json article walked through NotesHTTPRequest + NotesJSONNavigator — the pairing that brings the entire 'call REST API, get JSON' loop inside LS. This article picks up where that left off, going deep on the three building blocks under the navigator: NotesJSONElement (name/value pair), NotesJSONObject (object node), NotesJSONArray (array node). Full method/property tables, tree-walking patterns for parsing, the reverse path for building JSON via Append* + Stringify, the version-sensitive 64K story (including the 10.0.1 FP2 fixes via SPR# DCONB8VMAV / ASHEB95LFR and the element-value > 64K trap still live on 14.5), and a complete POST-and-parse round-trip example.

Domino 14.5 introduced NotesLLMRequest and NotesLLMResponse — two LotusScript classes that expose Domino IQ's local LLM as a synchronous API for app developers. This article walks the full surface: the session.CreateLlmRequest() factory method, the Completion three-parameter signature, the CompletionStream streaming variant, the IsCommandAvailable / GetAvailableCommands defensive helpers, and the Content / FinishReason / Role fields on NotesLLMResponse. Why the API takes a commandName rather than a raw prompt — the Command document abstraction lets admins and devs each control their own layer. Includes two practical examples (auto-reply agent + conditional summarization) and the Java mapping to LLMReq / LLMRes.

HCL only ships container images for Domino 10.0.1 FP3 and newer — if you're still on 9.0.x and want to containerize for dev/test, migration rehearsal, or legacy preservation, the official path doesn't exist. This article walks through a community feasibility study: RHEL UBI 7.9 base, two-stage build, ~1.48 GB image that runs Domino 9.0.1 FP10, joins an existing Domino domain, and brings HTTP/NRPC/LDAP/IMAP/POP3/SMTP up cleanly. The PoC also documents 5 critical pitfalls HCL docs don't cover (Perl namespace bug / FP installer rejects -silent / J9 JVM heap too small / setup-complete marker uses the wrong variable / password-protected server.id stdin block), each with the actual error message and workaround. Full Dockerfile and troubleshooting live in the bryanHsiao/build-hcl-domino9-container repo.

Packaging Domino into a container is older than people often realize — the community was already doing it in the IBM V9 days, and HCL has officially shipped pre-built Domino container images for download since V10. Today HCL covers both ends: download a pre-built container image TAR from My HCLSoftware Portal and docker-load it for fast onboarding, or clone HCL's open-source domino-container project on GitHub and run the interactive build.sh menu to build your own custom image — picking exactly which modules (Domino / Traveler / Verse / Nomad / REST-API / Leap / Domino IQ / OnTime / C-API SDK / LP) plus add-ons you want baked in. This article explains how to choose between the two paths, how customizable build.sh really is, typical deployment scenarios, and how to get started.

NotesOutline is the Domino design element behind the navigation menu in a Notes application, made up of NotesOutlineEntry items in a tree. From LotusScript you can dynamically build, modify, and walk an outline — typical use cases are multilingual menus (updating Label per user locale), role-conditional menus (hiding entries by ACL role), and personalized navigation. This guide covers the NotesOutline ↔ NotesOutlineEntry relationship, 8 tree-walking methods, 6 manipulation methods, all 24 entry properties, the 4 Set* methods, the 4 entry type constants and 9 EntryClass constants, a complete CRUD example, five pitfalls, and Java/SSJS counterparts.

The official HCL domino-container repo ships with 6 Language Packs (DE/ES/FR/IT/NL/JA). Issue #55 discussed how to install other LPs; the maintainer's position was that adding more LPs to build.sh would mean owning maintenance for every language — a reasonable engineering call for a personally-maintained open source repo. The community tool domino-container-lp-recipe fills that extension path: a 'dynamic patch' approach (not a fork) that ships an end-to-end verified Traditional Chinese (TC) patch, plus Simplified Chinese (SC) and Korean (KO) entries in language_registry.py as templates for the community to verify and extend. The patch surface is small (~50 lines across 4 files), and the recipe drifts cheaply with upstream. This article walks through the tool's background, the three-layer LP integration, the recipe-vs-fork design decision, quickstart, adding new languages, and a sync-trap caveat you must read before rebuilding an already-running server.

LotusScript offers three routes for XML processing: NotesDOMParser (whole-tree load), NotesSAXParser (event-driven streaming), and NotesXMLProcessor + NotesXSLTransformer (rule-based XSLT transformation). This guide compares the three at a fundamental level, walks five decision questions (file size / modification needs / traversal direction / memory budget / transformation scenario), gives practical scenario picks, code-style side-by-side, performance numbers, and a consolidated pitfalls table. After reading you'll know exactly which tool to reach for when an XML file lands.

NotesDOMParser loads the entire XML into memory as a DOM tree — with NotesDOMDocumentNode as the root and 14 Node subclasses (Element / Text / Attribute / Comment / CDATA / ...) representing XML constructs. You can walk anywhere, modify anything, and Serialize back to XML output. This guide covers the DOM tree model, CreateDOMParser, the 14 Node class relationships, NotesDOMNode's tree-walking API (FirstChild / NextSibling / NodeType), a complete parse → walk → modify → serialize example, five pitfalls, and Java/SSJS counterparts.

NotesSAXParser processes XML in SAX (Simple API for XML) event-driven mode — instead of loading the file into memory, it fires SAX_StartElement / SAX_Characters / SAX_EndElement and other events as it reads through. The right choice for large files, read-only access, or memory-constrained scenarios. This guide covers the SAX-vs-DOM distinction, CreateSAXParser initialization, On Event binding, when each of the 12 events fires, how NotesSAXAttributeList exposes attributes, a complete LotusScript example, five common pitfalls, and the Java/SSJS counterparts.

NotesACLEntry represents a single entry (person, group, or server) in a Domino database's Access Control List. This guide covers the NotesACL ↔ NotesACLEntry containment relationship, three ways to obtain an entry, the seven access-level constants from NOACCESS to MANAGER, the UserType property versus the legacy IsPerson/IsGroup/IsServer flags, all twenty NotesACLEntry properties for fine-grained permissions, the Roles mechanism, the mandatory acl.Save behavior, five common pitfalls, and complete CRUD examples — closing the Domino security loop alongside the 14.5 NRPC encryption and trust-store articles.

NotesSession is the class every LotusScript script reaches for first — it represents the current script's runtime environment and gives you CurrentDatabase, three user-name properties (UserName, EffectiveUserName, CommonUserName), Evaluate for running @Formula from LS, CreateLog for NotesLog, GetEnvironmentString for notes.ini reads. This guide covers the class's role, the one-session-per-script rule, key properties and methods, the three UserName variants and how they diverge under On Behalf Of agents, server-side vs workstation access-level differences, five common pitfalls, and a complete example.

NotesDocument is the core class LotusScript uses for any Domino document operation — but the details trip people up: GetItemValue always returns an array (even single values), Save's createResponse parameter is widely misread (it's not how you create response documents), Remove's force flag isn't a soft-delete switch (that's a database-level setting; use RemovePermanently to bypass it), the subtle difference between direct property syntax and ReplaceItemValue, and forgetting .Save is the most common silent bug. This guide covers every way to obtain a NotesDocument, the Item vs Field distinction, CRUD examples, the five must-know pitfalls, sibling methods, and the Java/SSJS counterparts.

Following yesterday's concept piece, this article walks through the official 10-step enablement procedure: upgrade the server address book design, sign the CheckPortEncryption scheduled agent, key Directory Profile fields, server ini values (DEBUG_MANDATED_ENCRYPTION, MANDATEDENC_ACTIVE_REFRESH_TIME), Desktop policy entries (DISABLE_MANDATED_ENCRYPTION), the portenc refresh / show console commands, and how to back out if enforcement breaks something. Pre-14.5 servers get their own behavior section.

After upgrading to Domino 14.5, admins see a new `?` icon in the rightmost column of the server view in the Domino Directory. It's not a bug — it's the compliance indicator for the new Mandated NRPC Port Encryption feature, sitting in its default disabled state. This piece walks the history of NRPC port encryption, what 14.5 actually adds (mandate + monitor), how to read the icons, and the three enablement modes. Hands-on enablement steps are in the follow-up article.

Starting with Domino 14.5, server-side LotusScript NotesHTTPRequest loads trusted root CAs from the Domino Directory by default, no longer from cacerts.pem in the data directory. The Notes client is unaffected, and a notes.ini fallback (NotesHTTPRequest_Use_CACerts=1) reverts to the old behavior — but long term, you should migrate self-signed CAs into the Domino Directory. This piece walks the change, scope, pre-upgrade checklist, and ties back to the 5/7 deep-dive on the NotesHTTPRequest toolchain.

GetAllDocumentsByKey is the LotusScript lookup method everyone uses — pass a key, get back the matching documents. But the small print — keys match the view's sorted column (not document fields), exactMatch defaults to False (so it's prefix-match unless you opt in), backslash-categorised columns silently break it, and the returned collection has no defined order — gets missed even by experienced devs. This piece walks the signature, the by-key family, five real pitfalls, and complete examples.

OpenNTF released a LotusScript Class Map for HCL Domino 14.5.1 in 2026 — 97 classes, 1,001 properties, 997 methods, 72 events laid out on one interactive visual map, every node clickable through to the HCL docs. This piece covers what the tool does, the open-source license and JSON data behind it, and why it's useful for picking topics, planning learning paths, and exploring the API surface.

Domino V12 added NotesHTTPRequest and NotesJSONNavigator to LotusScript, so calling an external REST API and parsing the JSON response is finally a self-contained LS workflow — no more ActiveX shims or shelling out to curl. This guide covers both classes' methods and properties, the PreferJSONNavigator property that wires them together as an official path, a complete example, and where Java / SSJS land in comparison.

NotesXMLProcessor is the abstract base class behind every LotusScript XML handler — DOMParser, SAXParser, DXLExporter, DXLImporter, and XSLTransformer all inherit from it. This guide covers the role it plays, the five derived classes and when to pick which, the inherited properties, the SetInput / SetOutput / Process trio, and the Release 6 / no-COM caveats that don't make it into most quick refs.

Domino 14.5.1 adds RAG (Retrieval-Augmented Generation) support to Domino IQ, running the LLM, embedding model, and vector database all on the Domino server itself — local execution, with NSF ACL and Readers fields enforced natively. This guide walks through prerequisites, the two-phase dominoiq.nsf configuration, updall vectorization, calling LLMReq from LotusScript, and why this is a different species from the OpenAI + Pinecone pipeline.

Domino 14.5 introduces Domino IQ — an AI inference engine baked into the Domino server backend, callable from LotusScript via NotesLLMRequest / NotesLLMResponse without ever leaving the box. This guide covers the architecture, hardware requirements, install flow, the two-phase dominoiq.nsf configuration, the Command and System Prompt document model, and why this trade-off works for existing Domino shops where bolting on OpenAI doesn't.

HCL Domino REST API's current latest release is v1.1.7 (shipped April 7, 2026), adding endpoints for calendar profiles, PIM unread state, and message updates, plus fixes for attachment download, Microsoft Entra ID auth, and meeting invitations.

The two real walls when shipping DQL to production: how the Design Catalog gets maintained automatically (bootstrapping brand-new NSFs, incremental refresh after design changes), and why regular users hit the 'You don't have permission' error — plus the sessionAsSigner / scheduled-agent solutions. The final pattern is verified against Domino 12 production logs, with a production-ready Java helper class to drop in.

NotesStream is the LotusScript abstraction for reading and writing files from a Notes/Domino agent. This guide walks through the real Open signature, the Truncate-before-write pattern, text vs binary I/O, and the gotchas the official documentation actually warns about.

Domino Query Language (DQL)'s syntax looks SQL-like, but writing real queries surfaces a whole set of Notes-specific traps — view selection silently scopes results, the `'view'.column` references the view column's programmatic name (not a doc field), comparison operators need whitespace on both sides, backslashes in view names need escaping, `@formula` is a separate Formula Language parser, and string-stored date fields need `@TextToTime`. Each trap below comes with the verbatim error message and a working fix.

NotesRichTextItem inherits from NotesItem, so every NotesItem property and method is already available — but it adds 22 methods of its own for paragraph styles, tables, embedded objects, and Navigator/Range traversal of existing rich-text content. This post catalogues construction, the 22 methods grouped by purpose, the inheritance contract, and the gotchas you hit in real code.

NotesNoteCollection is not a NotesDocumentCollection variant — it represents every kind of 'note' in an NSF, including data documents AND design elements (forms, views, agents, ACL, code libraries). This post catalogues the 32 properties, 14 methods, the True/False initialisation parameter on CreateNoteCollection, and its most common real-world use: feeding NotesDXLExporter.

NotesViewNavigator is the LotusScript tool for non-trivial view traversal: it returns ViewEntry objects (which carry view metadata GetFirstDocument doesn't), it can be built over a subset of the view (a single category, all unread, descendants of an entry, a max level), and it's faster than the naive document loop — provided you remember to switch AutoUpdate off first. This post catalogues the 4 properties, ~36 methods, 7 CreateViewNav* variants, and the caveats worth knowing.

Older Domino releases let you put exactly one HTTPAdditionalRespHeader in notes.ini — a second line silently overwrote the first. HCL added a numbered convention (HTTPAdditionalRespHeader01, 02, …) in V12.0.x so you can ship a full security-header baseline through notes.ini alone, which is the only path that still works when HTTP won't start and the Internet Site documents are unreachable.

NQRP is a LotusScript class added in Domino V12 that lets you re-sort, categorise, project, and serialise the results of a DQL query (or any NotesDocumentCollection) — straight to JSON or to a temporary view. Walks through the create flow, every method signature, the official examples, and the safety knobs.

Domino Query Language (DQL) gives you a near-SQL syntax for querying Notes documents directly, without designing a new view for every query shape. This is Part 1 of the 'DQL Trilogy': DQL's design rationale, writing your first query, calling DQL from LotusScript / Java / REST API, and a syntax cheat sheet. Query-writing pitfalls are in Part 2; shipping to production (catalog maintenance and permissions) is in Part 3.

This guide walks you through installing, configuring, and starting with the HCL Domino REST API, enabling access to Domino databases via a modern RESTful interface.

HCL Domino 2026 (version 14.5.1) was officially released on March 19, 2026, introducing new features like Domino IQ, AutoUpdate, and OIDC support.

A bilingual HCL Domino site — covering the latest news and technical deep-dives across the ecosystem.