User shifts • cancelled assignments hidden
Cancelled shift assignments and cancelled sessions are now skipped on the per-user Shifts tab, so the list reflects what the worker actually has on their plate.
Cancelled shift assignments and cancelled sessions are now skipped on the per-user Shifts tab, so the list reflects what the worker actually has on their plate.
Editing a session's work status now clears any stale shift_id on linked sessions, so a session that's been re-categorised no longer claims an old scheduled shift.
reCAPTCHA Enterprise can now be toggled per account on the public signup, registration forms, incident submission, password reset, and PIN reset surfaces. The /login page enables an adaptive challenge after repeated failed attempts. The server is the single decision point — clients fail open so a CAPTCHA outage never locks legitimate users out.
Billing address is now editable directly from Settings → Billing. Changes update the next invoice automatically; no support request needed.
The payment details edit modal now has a country picker. Norwegian accounts auto-format as 4-2-rest, and Sweden, Denmark, and Finland get their own validation. Anything else is accepted as a free-text international account number. The Bank Review tab in Users surfaces accounts that are unset or set to OTHER for follow-up.
Contract templates now have shared global merge fields for the issuing company's legal name, organisation number, postal address, and bank account. They populate automatically from the account's details, so every contract carries consistent company info without per-template edits.
New contracts default to a 14-day signing deadline, and the sender's electronic signature is now applied automatically on send (default on, can be disabled). Signed PDFs reflect the actual signer count in their wording.
The template library now separates the account's own templates from the shared global templates, with search and an active/archived toggle on each list. Creating a new version can start from a global template instead of a blank document.
Managers can grant Items access to individual users from the access card on the user profile, without giving them broader admin or manager rights.
Each item can now define a max_quantity — the maximum number of concurrent issuances allowed. Once reached, the Issue modal blocks new issuances until something is returned. Useful for radios, harnesses, key sets, and any pool with a finite count.
Issuance and return emails now render as a receipt with the item name as the hero, the per-issuance identifier and description, a localised timestamp, and one row per item. Single-item batches still show what was issued instead of collapsing into a generic message.
A new Statistics tab on the Items module shows issued, returned, and outstanding counts by item, category, or month. Equal-height KPI cards highlight return-rate and active alerts; row highlights flag items with overdue or outstanding issuances; filters submit automatically as you adjust them.
A new step-by-step payroll export builds a CSV per period with a frozen snapshot of every session, rate, and adjustment at export time. Past exports are kept in an audit log so you can always re-download exactly what was sent to the accountant — even if a session is later edited or cancelled.
The verify-document prompt at clock-in is now always-on (no per-account gate), supports a 24-hour snooze that lasts until the next clock-in, exposes an audit-logged SSN reveal, and chains directly into Items handout after verification.
Every modal in the workspace now closes only via the X / Cancel button or Escape — backdrop click no longer dismisses, so you don't lose data by tapping outside on mobile. Modal heights respect the dynamic viewport and safe-area insets so iOS and Android Chrome no longer clip content behind the URL bar.
The user document and competence review modals merged into one surface. Image preview supports zoom (single-click toggles, with cursor states for pan), rotation persists per attachment, and a drop zone replaces the old upload control. Actions adapt to the document's current state so you only see what applies.
Items belongs to the Workforce platform — operational issuance to crew. Inventory becomes the Ops platform — asset, stock, and equipment-pool management. The Inventory stub now self-labels as "coming soon (Ops)" and points to Items for crew handout. The sidebar has a segmented Workforce/Ops switcher to move between the two platforms.
A new Items module tracks anything that gets issued to crew: radios, keys, vests, tablets, harnesses, cash floats. Catalog with categories and kits, multi-item issue modal, return + transfer flows on the Open page, full audit log per item, and per-user history. Wired into the Clockwork terminal so handout and return can happen at clock-in or clock-out.
When a worker selects a shift on a public signup link, the slot is held for 5 minutes while they finish the registration. Prevents the race where two people pick the same last seat at the same time.
When a user belongs to a subgroup, their profile and lists now show the parent group name alongside the subgroup, so you can see their full org context at a glance.
Manual session creation, terminal clock-in, and the new session_open() pipeline all use the same project resolution logic. The user's default project is applied consistently whether the session is started from a terminal, the manager's session create form, or the API.
The platform dropdown in the sidebar is now a segmented Workforce / Ops pill. One tap to swap between the two platforms; the visible module list updates to match.
Pricing tiers (now Core, Pro, Enterprise — Basic was renamed to Core) and the published changelog are available as JSON at /api/public/pricing and /api/public/changelog. Both respond with proper ETag and 304 Not Modified handling, are stateless (no session, no cookies), and can be consumed by the marketing site or external integrators.
A public status page at status.hrcluster.app shows current uptime and recent incidents for the platform.
The public contract-signing page and the public missing-info request page now require a CSRF token tied to the page's one-time URL token. These pages are accessed via tokenised links without a login session, so they needed their own CSRF mechanism — matching the protection the rest of the app has had.