— continued
Suppliers can be added to contact lists as live-linked entries. Renaming a supplier or editing its contact details propagates to every list that includes it. The import modal now previews how many entries are new, already present, or missing required contact info before the operator confirms.
Both modules now share a stable reference scheme (IR-YYYY-NNN for incidents, equivalent for risk assessments), the same list column layout, identical filter chips, and matching detail-page hierarchy. The reference column is first and stays visible on mobile. Filtering by status, group, or owner now behaves the same in both modules.
Any incident can now be converted to a risk assessment in one action. The incident's basics, location, and reporter prefill the SJA edit form so the operator lands straight in editing. The original incident keeps a permanent link to the resulting SJA so the audit trail stays intact across both modules.
A public risk-assessment form is now available per account. The form steps through five phases (basics, hazards, controls, participants, readiness) with mandatory-field gating between phases. Hazard and control taxonomies group under six operational domains so every SJA pulls from the same vocabulary. Submitting from the readiness step lands the assessment in logged status without an extra approval click.
8 changes · 2 added · 4 updated · 2 fixed
UI 3 · Workforce 2 · Messaging 2 · Infrastructure 1 · Clockwork 1 · Forms 1 · +4 more
Documents review modal preview is capped so body, thumbs, metadata, and class list wrap into a single scroll region; the doc column drops the redundant "Verified: date (name)" line; delete-proof placement tightened; per-file × removal added on bundle thumbs in the public competence form.
When a group has a designated contact, outbound emails and the PDFs they carry now render in that contact's preferred language instead of the manager's session language.
Crew list actions are now exposed directly on the locations table, with sub-row buttons aligned on a single line so narrow viewports don't drop them onto a second row.
GPS is now pre-warmed when the form opens and times out faster, narrowing the gap between submit and server response. A loading-progress toast bridges the submit-to-modal handoff so the screen never looks frozen, and the verify→handout continuation survives a page reload. Post-action URL cleanup is now consistent across every clock-in/out entry point, and the "Clocking out…" toast clears immediately when there is no follow-up return flow.
Google Analytics now loads only after the visitor accepts cookie consent, and tracked URLs are stripped of tokens, signing keys, and workspace slugs before being sent. A new hrcTrack() helper standardises custom events across modules so feature usage can be measured consistently.
Adding a second photo from a phone camera no longer wipes the first. The file queue now accumulates across every pick and submits whenever items are pending, so multi-attachment uploads complete in a single round-trip and survive iOS Safari's per-tap input reset.
Every outbound email and the PDFs they carry now resolve language per recipient. Coverage includes group-contact emails, food-allergies summaries, and shift emails sent from the Clockwork QR pipeline. Saving a user profile no longer writes the actor's session language into the person's language preference, closing a long-running source of mis-localised mail. The email template loader now lives inside the with_lang() boundary so async sends pick up the resolved language even when no admin is in session.
Technical focus: resolve_recipient_lang() • with_lang() boundary • preferred_language default empty
Competence proof can now be uploaded as a bundle of multiple files, so a renewal upload doesn't replace the previous evidence. Each class on a multi-class certificate verifies, rejects, and resets independently in the review modal. Actions stay scoped to the class you clicked, not the whole bundle. Verifying the last outstanding class auto-approves the linked pending bundle, and the review modal's preview, body, thumbs, metadata, and class list now scroll as one capped region instead of stacking off-screen.
8 changes · 4 added · 4 updated
Workforce 4 · Infrastructure 2 · Clockwork 2 · Forms 2 · Locations 1 · Billing 1
App-node post-receive hooks now refuse to rsync if ops/required_migration.txt names a migration that hasn't been applied to the database. Worker nodes are exempt by hostname so non-DB-touching deploys still flow. Structurally enforces DB-first deploy ordering, so app code can no longer reach the apps before the schema it depends on.
Technical focus: ops/required_migration.txt • Pre-deploy schema check
Timing marks are now placed across the full clock-in/out timeline (form open, submit, modal visible, handout/return visible) so timing regressions can be caught from real-user metrics rather than hand-timing the flow.
Shift CSV imports get a helper card that shows the expected format, with column headers now matching the form labels exactly so renaming a field in the form doesn't silently break the import. Uploads are validated before any further processing.
The billing page separates the workspace plan tiers (Core / Pro / Enterprise) from operational add-ons such as Ops and module-level entitlements, so it's clear at a glance which line items are subscription tiers versus per-feature opt-ins.
Each location modal now exposes the crew list actions directly, so you can pull a roster or message attached crew without leaving the page.
Sending out request emails no longer blocks the page response. Requests are queued and dispatched asynchronously through the worker. The email copy now spells out that the worker should review and confirm even when they have no allergies to declare.
The summary PDF now includes a person-centric section listing related and overlapping crew with shared allergens or diet markers. Names of unrelated workers are never paired with their dietary data; the section is anonymised for GDPR. The detailed PDF's group filter now correctly includes subgroup members, and the section reads group membership from current account_users, not affiliation history.
Issued items can now be returned or transferred in bulk from the Open page, and Clockwork's clock-out flow captures returns alongside the session itself. Pool items configured to require an identifier at handout are supported, and the pool cap is enforced across concurrent handouts to several workers. Closes a race that could let a finite pool go over its cap.
11 changes · 2 added · 5 updated · 3 fixed · 1 security
UI 3 · Infrastructure 2 · Workforce 2 · Forms 2 · Security 1 · Contracts 1 · +2 more
GET /api/public/changelog now returns a `modules` array (locked taxonomy of 20 keys) and `technical_focus` (string or null) on every entry. Existing fields unchanged — purely additive. ETag bumped from v2 to v3 so cached clients revalidate cleanly.
Technical focus: ETag v2 → v3 • Locked module taxonomy • CORS allowlist
Outcome-first titles, type and module pills, optional technical-focus footer line on infrastructure and security entries. Module taxonomy spans 20 keys (Workforce, Clockwork, Infrastructure, Security…). The page is now English across all locales for terminology stability; surrounding workspace UI stays localized.
Employee preselected as default worker type on user import; phone and rate formatted in import preview; alert bullets indented; age shown inline beside DOB on user detail; phone country-code stripping unified across forms; platform switcher hidden when an account has only one platform enabled.
Selecting a project on the contract upload form now prefills valid_from and valid_to, mirroring the existing behaviour of the new-contract form.
Double-submit dedup is now applied consistently to every submission entry point. The food-allergies view reads the person's current group, and invoice reference is now properly optional rather than silently flagging a submission as incomplete.