# Changelog

OpenBooks follows [Semantic Versioning](https://semver.org/) while its public
API and deployment format stabilize. Alpha releases may contain breaking
changes; each release documents required operator action.

## [Unreleased]

- Replace the migration history with one verified release baseline,
  `baselines/alpha35.sql`. Fresh installations apply the baseline and the
  forward migrations above it, which are numbered again from `0001`. The
  retired migration identities and their digests remain recorded in
  `schema/migrations/baseline.json`.
- Upgrade to drizzle-orm 1.0.0-rc.5. Query parameters are no longer included
  in database error messages.

Existing installations must first complete v0.1.0-alpha.34.3, then verify and
adopt the baseline with `scripts/adopt-migration-baseline.mts --check` and
`--apply` during a maintenance window with a verified backup, following the
[baseline cutover procedure](docs/operations/migration-baseline-cutover.md).
Adoption refuses an incomplete previous-release ledger or any catalog
difference and changes no tenant data. Older releases upgrade to
v0.1.0-alpha.34.3 first.

## [0.1.0-alpha.31] - 2026-10-13

- Add multi-book accounting, account mappings and translation, intercompany
  settlement, period-end journals, account merges and segment dependencies.
- Add prepaid amortization, compound assets, construction in progress,
  maintenance, insurance, recognition, renewal and rebate workflows.
- Add governed journal instructions, statistical measurements, typed FX
  adjustments, accounting preferences and GL audit numbering. Preserve posted
  history and published migration identities during upgrades.
- Add RBC STD152 payment and payroll artifacts with live authority checks,
  retained numbering and governed replacement. Improve payroll cheque design
  and preserve issued payee identity.
- Add processor receipt funding, saved settlement account review and native
  posting-effects recovery for payments. Require complete evidence before
  period-reopen decisions and independent reconciliation sign-off reviews.
- Keep till sales, reservations and drop cutoffs within the selected legal
  entity, including when several entities share a cash account.
- Correct Canadian separate-payment CPP exemptions and separate periodic and
  bonus tax bases. Retain the committed regular-income reference used for
  standalone bonus calculations without altering historical payroll.
- Preserve field-ticket revisions and exact crew hours. Review, correct and
  selectively submit pending time, including resubmission after withdrawal,
  without changing prior approvals or unselected entries. Use declared time
  classifications for billing adjustments and refuse missing pricing.
- Consolidate payroll navigation, lists and review actions; improve shared
  drawers, audit context, Setup help and localized financial reports.

Migrations 0568 through 0705 and 0707 apply forward through the native migration runner.
Run the release's read-only upgrade check and retain a verified backup before
applying them. Resolve exact schema or published-body drift refusals instead of
editing migration files or existing ledger identities. Enable new capabilities
through Company Settings and configure their native accounts and policies
before use. This release does not reprice or reconcile historical payroll,
issue incomplete separation records, or transmit payments automatically.

## [0.1.0-alpha.30] - 2026-10-05

- Add commerce channels: sales channels and channel orders, a Shopify
  connector with inventory sync, item families with price schedules,
  promotions and restocking, stored value, tenders, shipping, and order
  economics.
- Add payment-service automation: PSP payout pull and reconciliation,
  autopay with setup tokens, payment-run approval flows and reservation
  guards, revenue recovery, and Stripe billing history import.
- Extend revenue and billing: quote-to-cash, usage schedules, revenue
  contract scope, contract costs, payer hierarchies, SaaS entitlements and a
  customer portal.
- Add cross-border tax with evidence, marketplace tax commits, registration
  filing-period starts, and FX rate age policies.
- Extend payroll and workforce: benefit program identity and selected-hours
  components, entitlement bank drawdown, compensation packages and source
  cycles with approved compensation paid through native payroll under
  currency-aware caps, prior-provider period payments within annual payroll
  carry-in (native drawer, API and Data Import), optional governed rosters and
  device attendance, training delivery, business calendars, and component
  protection classes.
- Rebuild Analytics dashboards on shared scoped aggregates, add demand
  forecasting, configurable aging bucket policies and explicit department
  billable expectations.
- Expand global search: menu pages and workspace tabs, reports, settings,
  help articles, operational records (opportunities, activities,
  subscriptions, fixed assets, equipment, timesheets, custom records, files,
  dashboards, locations, warehouses), contact people, phone numbers,
  migrated-system ids, line descriptions, barcodes, and recently opened
  results re-checked against current permissions.
- Fence the subscription drawer and its customer picker to the reader's
  subsidiaries.
- Fix opening CRM opportunities, cash agent settlement statistics,
  compensation cycle access order, and report subsidiary policies for channel,
  contract cost and billing import entities.
- Upgrade an install that has not adopted the alpha.29 release baseline by
  replaying exactly the migrations and tenant-policy environment the baseline
  was verified with, adopting it, then applying later migrations forward.

Migrations 0482 through 0567 apply forward on the alpha.29 release baseline.
Migration 0567 builds search indexes with `CREATE INDEX CONCURRENTLY` outside
a transaction. Run the release's read-only upgrade check before deploying and
resolve any preflight refusal it names. No new operator configuration is
required.

## [0.1.0-alpha.29] - 2026-10-02

- Install new databases from one verified release baseline. Preserve historical
  SQL and migration identities for controlled upgrades of existing databases.
  Existing installations must complete historical migrations, verify schema
  equivalence and adopt the release baseline before deployment. See the
  [baseline cutover procedure](docs/operations/migration-baseline-cutover.md).
- Consolidate native Benefits contributions and employer vacation policies.
- Refine Talent recruiting, performance reviews and Conversations workspaces.
- Use native line action menus with structural editing and distribution controls.

## [0.1.0-alpha.28.3] - 2026-10-01

- Verify production PDF generation through the application's pinned Puppeteer
  driver, close the browser explicitly and check PDF structure with qpdf.
- Run native renderer verification before copying the application bundle so
  browser failures surface early in image builds.
- Include the Benefits wording, table-footer and patched native browser
  changes prepared in alpha.28.1 and alpha.28.2.

No additional migrations or operator configuration are required.

## [0.1.0-alpha.28.2] - 2026-10-01

- Pin the production PDF browser to the patched official native release on
  both AMD64 and ARM64. Verify archive integrity, browser version and actual
  PDF output during image builds, independently of distribution package lag.
- Include the English Enrollment wording and Benefits table-footer corrections
  prepared in alpha.28.1.

No additional migrations or operator configuration are required.

## [0.1.0-alpha.28.1] - 2026-10-01

- Use Enrollment consistently throughout English Benefits buttons, headings,
  empty states, enrollment-window drawers and report labels.
- Render Benefits record counts in native table footer rows to preserve valid
  markup during server rendering and hydration.

No additional migrations or operator configuration are required.

## [0.1.0-alpha.28] - 2026-10-01

- Consolidate Benefits into native Programs, Enrollments, Rewards, Incentives
  and Payouts workspaces. Manage insured plans inside Benefits and enrollment
  windows from the enrollment header, with one operational list per workspace.
- Make approvals optional per program. No approvals required is the default;
  employers may instead configure conditional, delegated and multi-level native
  Flows decisions. Pin the setting and decision evidence on each reward.
- Process cash rewards and noncash provider benefits through native payroll.
  Noncash valuation follows the earning component's statutory treatment without
  increasing cash pay, and posts to its configured prepaid or clearing account.
  Record provider fulfillment separately after payroll processing.
- Preserve precise approval thresholds, serialize concurrent decisions across
  policies, and refuse incomplete decisions, zero-value obligations and stale
  payroll calculations with actionable remedies.
- Edit recruiting availability, offer clauses and retention scope through
  native structured setup controls while preserving their stored evidence.
- Preserve verified currencies during account imports, report unavailable
  source denominations, scope HR scheduler work to each tenant and correct
  Sales reversal journal dates.

Apply migrations 0473 through 0475 using the native migration runner before
starting the updated application and worker. Existing programs receive the
audited No approvals required setting. Unprocessed pending rewards return to
draft for resubmission; posted payroll and fulfilled rewards remain unchanged.
Configure a noncash earning component and its posting account before issuing
provider benefits. Active program rules change through closure and creation
of a replacement program with a new code.

## [0.1.0-alpha.27.1] - 2026-10-01

- Correct the alpha27 worker's deferred startup: live authorization and
  shared validation schemas no longer initialize HTTP framework adapters
  in the standalone transfer worker.
- Verify deferred transfer dependencies in the final production image and
  load them before the worker starts publishing readiness.
- Require sustained worker readiness when verifying deployment completion;
  a live web process or a previous worker heartbeat cannot satisfy that gate.
- Preserve independent web and worker image pins during recovery, then
  repin both atomically after migration verification. Refuse if deployment
  configuration changed during verification.

This correction adds no migration. It preserves the immutable alpha27 tag
and all staged transfer data. Update both web and worker to alpha27.1 before
running background imports and exports.

## [0.1.0-alpha.27] - 2026-10-01

### Durable import and export

- Add organization-scoped background transfers with bounded upload parts,
  record batches, live progress, resumable checkpoints, cancellation and retry.
- Bind approval to the immutable source, mapping, field definitions and
  legal-entity scope. Preserve native permissions, posting rules, precise
  amounts and atomic batch audit evidence; detect identities shared across
  worker batches before approval.
- Stream CSV, JSON and XLSX exports from a consistent database snapshot,
  support spreadsheet sheet rollover and resumable completed downloads,
  and preserve financial decimals without spreadsheet rounding.
- Keep import, export and history within the native Company Setup workspace,
  restore transfers after navigation, and correct Back navigation. Sample
  company provisioning remains a separate Company Setup action.

### Company and employee workspaces

- Standardize operational lists, local navigation, filters and drawers on
  shared registered components, including payroll, inventory, banking,
  property management, construction and administration.
- Add governed Benefits programs, eligibility and enrollment workflows,
  incentive settlements and payroll-linked awards with financial evidence
  and controlled reversals.
- Add employee-backed Sales planning, quotas, customer territory maps and
  performance charts. Reorganize Recruiting and Performance workspaces,
  succession plans and native review forms.
- Rework the HR organization directory and employee update policy; improve
  audit query indexes, asynchronous drawers, dashboard scrolling and module
  cockpit presentation.

### Upgrade requirements

- Update Next.js and DOMPurify to patched releases.
- Apply additive migrations 0467 through 0472 with the release's native
  migration runner before starting the updated application and worker.
- Run the updated worker for background import/export progress. Previously
  committed batches remain committed after cancellation or a later refusal;
  correct financial history through native reversals or adjusting entries.
- Plan database capacity for source files, staged rows, evidence and export
  artifacts, and temporary disk for spreadsheet decoding. No automatic
  transfer-evidence retention deletion is enabled.

## [0.1.0-alpha.26] - 2026-09-30

### Accounting and operational controls

- Add governed provision recognition and reassessment, including supported
  construction-contract loss forecasts and independent approval.
- Add native prepaid-rights breakage assessments, sales-agency accounting,
  partial assembly disassembly and controlled reversals, and consolidated
  net-investment FX attribution with correction lineage.
- Select registered Canadian goods taxes through native invoices and bind
  filing identity to the applicable registration. Add Canadian cumulative
  withholding with verified opening history and bonus pension deductions.
- Preserve atomic document corrections, exact overhead allocation, business
  clock ownership, and durable evidence for uncertain email deliveries and
  failed background work.

### Workspaces and demonstration companies

- Provide 11 verified industry demonstration masters, isolated demo copies,
  explicit capability coverage, idempotent native scenarios, and guarded
  provisioning that refuses an unverified source.
- Consolidate operational lists, journal drawers, setup child collections,
  shared table rendering, and role-sensitive dashboard defaults. Essentials
  workspaces prioritize everyday bookkeeping and setup actions.
- Compose Inbox search and filters in the standard list header. Navigation,
  Inbox tabs, and Home share unfiltered personal approvals and task totals,
  including signatures and unread notices. Failed task sources remain named.
- Complete the shipped locale catalogs for the new accounting controls.

### Verification and upgrades

- Require per-file test-registration receipts derived from actual registered
  test counts, including failed, skipped and pending tests. Empty or unloadable
  selected files fail verification.
- Scope conformance setup to its tenant and distinguish caught-error
  serialization from safe validation messages. Update dependency protections
  for glob expansion, URI parsing and IP-address validation.
- Align accounting, architecture and mutation documentation with measured
  evidence and declared capability limits. Passing conformance cases prove
  their stated scope; they do not certify every accounting standard.

This release includes forward schema migrations. Back up the database and
retain the matching data key before upgrading. Run the read-only migration
preflight and resolve its named refusals. The reference release rehearses
representative populated upgrades before publishing scanned, attested images;
production deployment backs up first, applies migrations, then updates both
web and worker services. An application rollback must remain compatible with
the migrated schema; do not reverse schema changes by deleting tenant data.

## [0.1.0-alpha.25.3] - 2026-09-29

The corrected alpha.25 release preserves existing organization role
configuration during bootstrap, including custom roles whose keys overlap
the built-in catalogue. Explicit role seeding still refuses collisions and
names the supported replacement-and-reassignment procedure. Order reads
preserve eight-decimal unit prices without relaxing monetary amount precision.
Non-posting orders retain a null open balance as not applicable, never as an
invented zero monetary amount.

Production image builds isolate Webpack compilation with a bounded JavaScript
heap, collect page data with one worker, and generate one page at a time to
reduce peak memory use on standard build runners.

Routine updates run static checks; comprehensive test matrices remain
available on demand. Release verification exercises real database-backed
financial controls and representative upgrades, followed by scanned,
attested images and backup-first, migrate-first deployment. Upgrade refusals
retain the underlying command error in their reports.

The deployment applies pending forward migrations automatically. Run the
read-only migration preflight and resolve any named refusals before upgrading
an installation outside the reference deployment. The maintenance corrections
above add no new migration and do not change published migration fingerprints.

### Backups

- **Operator action: none for new backups; old backups remain readable.**
  Organization backup archives are now encrypted: one JSON envelope line
  (format version 3, key id `v1`, nonce, content key wrapped by
  `OPENBOOKS_DATA_KEY`), AES-256-GCM ciphertext of the gzip stream, and the
  authentication tag as the trailer. A new backup object is opaque without
  the source data key and is not readable by `zcat`. Restore reads encrypted
  v3 natively and still reads unencrypted v1/v2 archives under the existing
  explicit `--allow-legacy-*` flags; the restore CLI prints a
  `backup-legacy-unencrypted` notice naming any file without an envelope. A
  backup refuses before writing anything when `OPENBOOKS_DATA_KEY` is unset
  or still the `.env.example` placeholder — set it from the secret manager;
  restore requires the same key. Keep the key with the same care as the
  archive.

### Bank feeds

- **Operator action: SFTP import schedules created before the expected-account
  binding need a one-time bind.** The scheduled-import identity check binds
  each schedule to the one external bank account it accepts, and schedules
  predating that check have no binding — every identified OFX, BAI2, MT940,
  or CAMT.053 statement in their watch folders refuses, so an active feed
  stops importing after the upgrade with only a per-file error to show for
  it. Affected tenants: any organization with an active SFTP import schedule
  in an identifying format (including `auto`) whose expected account was
  never set. CSV schedules are unaffected (CSV carries no account identifier
  and imports on folder isolation). What the operator must do: open the named
  notice (Notifications/inbox, linking the exact schedule) or Company
  Settings → Bank Feeds, where each affected schedule reads "Paused: expected
  account not set", and bind the expected bank account in the schedule
  settings — identified statements import on the next run. The binding is
  never guessed: nothing imports unverified, before or after this change.

### Engine

- **The engine namespace is bounded.** The 204 files that lived side by side at
  `engine/src` root now live in module directories (`engine/src/ledger/`,
  `engine/src/payroll/`, `engine/src/tax/`, …), each declared in
  `engine/src/modules.json` with the modules it may import.
  `npm run check:engine-boundaries` refuses a file at root, an undeclared
  cross-module import, a declared edge nothing uses, engine code importing the
  web app, and any growth of the pinned dependency cycles. Pure relocation: no
  file's behaviour changes. Every deep import path
  (`@openbooks/engine/src/<file>.ts`) changed; `scripts/engine-modules/moves.json`
  records every move.

### Permissions

- **Operator action: existing organizations must grant the new fund permissions
  explicitly.** Existing organizations retain their built-in role permissions
  byte-for-byte and receive no automatic `funds.read`/`funds.manage` grant, so
  the new nonprofit funds surfaces stay hidden until access is granted. An
  administrator must explicitly grant the needed permissions in
  Admin → Users & Roles before users can open the nonprofit module home,
  funds, releases, or setup. New organizations receive the current defaults.

### Sealed secrets

- **Operator action: no key change is required, but read this before rotating
  keys.** Stored secrets (connections, bank feeds, provider credentials,
  payroll identifiers, MFA factors, email credentials) now seal as
  `enc:v2:<keyId>:<nonce>:<ct>:<tag>`, bound to their tenant and purpose, so
  a blob copied into another row refuses instead of decrypting. The existing
  `OPENBOOKS_DATA_KEY` keeps working as key id `k1`. To rotate, list every
  live key as `OPENBOOKS_DATA_KEYS=k1=<old>,k2=<new>` with
  `OPENBOOKS_DATA_KEY_ACTIVE=k2`, run `npx tsx scripts/rotate-data-key.ts`
  (dry run, read-only) and then with `--apply`, and remove the retired id
  once every blob reports current. `node --import tsx scripts/bootstrap.ts
  --check` refuses a missing, placeholder, or wrong-length data key and names
  the fix (`openssl rand -hex 32`). Pre-`v2` blobs still open until rotated;
  email credentials sealed before the move keep reading through the same
  window.

## [0.1.0-alpha.17] - 2026-09-19

Three forward migrations (0180-0182). The swarm release script migrates before
it swaps, so no manual step is required.

**Operator action, multi-country payroll only.** An organization running BOTH
the United Kingdom and Ireland packs shared ONE `PAYE` component between them
(see below). Ireland now seeds its own `IEPAYE`, which starts unmapped, and a
pay run refuses by name until someone maps the Irish PAYE slot in Payroll setup
→ Accounts & posting. The refusal is loud and names the remedy; the remedy is
to map the slot and recalculate. An organization running only one of the two
packs is unaffected.

### Payroll

- **No Dutch employee could be paid at all.** The pipeline hands packs money in
  the canonical 4-decimal ledger form — even `"0.0000"` for an empty base —
  and the Netherlands and Singapore packs each hand-rolled a parser accepting
  one or two decimals, so every NL calculation died on its own money-parse
  refusal. The money contract is now written on the shared statutory compute
  context and both packs converge on it. The four per-employee Dutch inputs
  (age class, AWf low, AOf high, and the employer's own Whk beschikking
  percentage) also had no entry surface anywhere, so no NL employee could be
  configured even once the parse defect was gone; they are pack-declared
  certificates on the profile, and the German and French row-backed forms light
  up on the same surface.
- **France over-withheld from every employee, twice over.** The prélèvement à
  la source was applied to gross rather than to the net imposable — the assiette
  is gross less deductible social contributions plus the non-deductible 2,4
  points of CSG (CGI art. 204 A–M; BOFiP BOI-IR-PAS-20-10-10) — which
  over-withheld roughly 30,58 € a month on a 3 400 € salary. And allocations
  familiales were charged at the flat 5,25 % with no taux réduit: 3,45 % applies
  at or below 3,5 SMIC (CSS art. L241-6-1, D241-3-1).
- **Ireland had no PAYE component of its own.** `pay_components` is unique on
  (org, code) and on (org, system_key, kind), so installing Ireland after the
  United Kingdom hit `on conflict do nothing` and Irish runs pushed onto the
  British component — each country's account mapping erasing the other's.
  Ireland seeds `IEPAYE`/`ie_paye`; withheld payroll tax is wired through a
  new `payrollDeductions` chart ROLE rather than any hardcoded account number.
- **A statutory rate could save successfully and resolve to nothing.** A rate
  written with a scope key the slot does not declare stored cleanly, returned
  `{ok}`, and then resolved to `null` forever — so the engine priced the levy
  as unconfigured, refusing or accruing zero, with a rate visibly on file. The
  write now refuses a scope point the declaration does not admit, and an update
  matching zero rows throws instead of reporting success.
- **Remittance bills posted to the wrong legal entity, in the wrong currency.**
  The bill stamped the root subsidiary unconditionally and took that root's base
  currency, while the accruals it clears were credited on whichever entity ran
  the payroll — so the liability never cleared per entity. Remittance groups
  now carry per-entity slices: the consolidated totals remain the worksheet
  reading, the slices are the write path, and a group spanning two entities
  raises one bill per entity. A filing account registered to a different entity
  than the accruals refuses, naming both.
- **A partially-refused pay run committed and posted silently.** Calculation
  refusals are persisted per employee, and a commit is gated on them unless the
  refusals are explicitly acknowledged against the run's digest.
- **Canadian employees were unpayable in any period containing a statutory
  holiday**, and the attestations that answer the eligibility question are now
  persisted rather than re-demanded on every recalculation.
- **Two currencies were added together and labelled with one symbol.** A mixed
  currency sum is now refused or translated, never added as raw units.
- Live-but-unconfigured employer levies refuse BY NAME rather than accruing
  0.00 in silence, and Québec-only rate slots no longer demand a Revenu Québec
  account from an Ontario-only employer.
- **Pay runs could be scoped to the wrong subsidiary.** The wizard asks, drafts
  are discardable, and re-scoping re-resolves rather than inheriting.
- **Trace factors rendered as raw codes.** One flat 49-entry label map, keyed by
  bare short codes and shared by every country, covered 543 codes the packs
  actually trace; the rest fell through to the raw key beside a UI that already
  prints it, so an unlabelled factor rendered the code TWICE — a Maryland admin
  auditing a run read `MD_PA_LOCAL_EXEMPT   MD_PA_LOCAL_EXEMPT`. The flat
  namespace was itself the defect: `CA_TAX` is California while `CA` is
  Canada's country code, and `DE_WITHHELD` is Delaware while `DE` is Germany's.
  Labels are now a pack-declared channel resolved through the registry, with a
  guard that derives the traced set rather than restating it.
- **Saving a payroll profile on a freshly created employee returned "employee
  or pay schedule is not available."** Creating a person leaves the party
  inactive until the record is saved, and one message covered four distinct
  causes — no such party, inactive party, inactive employee role, and no such
  schedule — so the refusal was undiagnosable from the outside. Each cause now
  names itself, and the draft case says what to do.
- Employee identifiers are pack-declared rather than a hardcoded nine-digit
  SIN/SSN shape, which had made ten countries' employees unsaveable.
- Per-item payroll expense routing: an earning line posts to the service item's
  own expense account where one is set, so direct labour can reach cost of
  sales, and item accounts join the staleness digest so an account edited after
  calculation refuses the commit rather than posting a stale mapping.
- German Konfession help text no longer tells administrators church tax is not
  withheld, and the payroll setup write path accepts every country its own
  picker offers.

### Changed

- One account surface across the relationship lifecycle. Leads, prospects and
  customers are three stages of one record, but they had three list pages and
  two record flyouts — and `/entities/customers` inner-joined `customer_roles`,
  a row written only on promotion, so a real prospect could never appear there
  and its "potential customer" status could only ever mean a DEMOTED customer.
  `/crm/leads` and `/crm/prospects` are removed; the customer list now outer-
  joins both the customer role and the relationship profile and segments on
  lifecycle stage, carrying the retired lists' sub-status, owner, territory,
  qualification and last-activity columns. The CRM account drawer is gone: its
  fields are a Relationship tab of the party flyout, so a company has exactly
  one record. A customer with no profile can start one from that tab. With the
  CRM switch off — or without `crm.accounts.read` — the list collapses to the
  AR customer roll exactly as before.
- The Customers workspace gets the payroll-style route-tab strip: Overview,
  Accounts, Opportunities, Activities, Forecasts and Receivables, permission-
  and feature-filtered in one place rather than per page.
- The party flyout has ONE tab rail. The shared shell's Details / Attachments /
  Audit trail strip no longer sits above a second, record-specific strip:
  Overview, Pulse, Relationship, Invoicing, Pricing, Transactions, Activities,
  Contacts, Addresses, Attachments and Audit trail are peers.
- "Customer 360" is now **Pulse**, and it lives only on the customer record.
  The standalone `/crm/customer-360` page — which picked an arbitrary customer
  — is deleted. The panel was also entirely hardcoded English and formatted
  money as `en-US` USD regardless of locale or org currency; it now runs
  through the catalogs and the money formatter like every other surface.

### Added

- An Add button on the customer flyout's Activities tab, matching Add contact
  and Add address. It mints the activity already linked to the account and
  hands off to the activity editor with a return path, so closing lands back
  on the customer.

### Fixed

- Saved list views no longer sort by a direction chosen for a column they are
  not sorting by. Orgs are seeded with a snapshot of the system default view,
  so a snapshot naming a column that has since left the registry fell back to
  a different column while keeping the stored direction — which listed
  customers Z→A. Column and direction now move together, and the party-family
  record types declare `name ascending` explicitly.

### Fixed

- Insight charts over a time bin render chronologically. A card that stores no
  explicit sort fell through to the compiler's default, which ranks by the
  first measure descending — so "Revenue by month" drew twelve months in
  descending revenue order, a line that always slopes down. A binned temporal
  dimension now orders by that dimension ascending; an unbinned dimension
  still ranks by its measure.
- Chart category labels name the period rather than the instant it begins on
  (Sep 2026, Q3 2026), and survive the JSON round trip. The formatter tested
  `instanceof Date`, but every card fetches over HTTP and parses with
  `res.json()`, which delivers a string — so axes printed a raw
  `2026-09-01T00:00:00.000Z`.

### Payroll and tax

- Thailand's 7% VAT band renewed for 2026-10-01..2027-09-30 (Revenue
  Department release 18/2569, rate unchanged).
- Canada and the United States become country packs like the other eight,
  rather than object literals inside the registry. Behaviour-preserving: the
  canonical dump of both packs is byte-identical across 10,241 lines.

## [0.1.0-alpha.16] - 2026-09-18

Nine forward migrations (0171-0179). The swarm release script migrates
before it swaps, so no manual step is required; operators running Compose
get the same ordering from the bootstrap one-shot.

### Payroll

- Ten installable countries: CA, US, GB, DE, FR, IE, AU, IT, NL, ES, each
  with agency-published goldens, hand-worked cases independent of the
  engine, and band-boundary sweeps. DE reproduces both official BMF
  Pruftabellen; AU reproduces the legislative instrument's own tables.
- A generic `credit` pay-component kind threaded through net math, GL,
  the deduction-protection pool, remittance netting and parallel-run
  attribution, with no country branches (0179).
- Employer-aggregate levies with their own opening balances (0174, 0177).

### Tax

- 41 country packs. Every source URL is now required to sit on an
  authority host or a named, reasoned exception.

### Product

- Notifications inbox replaces the header bell, as a first-class page.
- CRM phase 1 and 2: pipeline kanban, cost margins, and a customer-360
  cockpit (0178).
- Dashboard gains money and operational widgets, each permission-gated so
  a tile a caller cannot see never runs its query.
- Approvals worklist pages server-side with honest select-all.
- Expense lines carry an explicit settlement: out-of-pocket reimburses the
  employee, company-paid settles with the card issuer, personal is a
  receivable (0171).

### Correctness

- Posting effects claim exactly one due row per drain call; the previous
  `UPDATE..FROM` re-evaluated `SKIP LOCKED LIMIT 1` per outer row and could
  mark every due effect running while reporting one.
- Signing and encryption secrets are read live rather than from a snapshot
  taken at module evaluation, which could be taken before the value was set.
- Tenant isolation is enforced across the integration suite under FORCE
  row-level security as the constrained runtime role, not the bootstrap
  superuser.
- Lint warnings and explicit `any` are both zero, and both ceilings are
  pinned at zero rather than tracking the real count upward.

## [0.1.0-alpha.15] - 2026-09-17

Defect fixes on top of alpha.14. No new migration.

### Payroll, parties, and close

- Backdated wage rates persist, capped before their successor.
- Parallel-run net is attributed against stated gross; pay-run funding
  reads ledger balances including reversals.
- Party PATCH accepts stored customer/vendor/employee kinds.
- Close reporting-package slugs resolve to names and links.

### Gates, documents, and send

- Disabled features and refused permissions explain themselves instead
  of silent 404s and bounces; Scripts and REST API docs name the
  Features-switch prerequisite.
- Unset subsidiary stays unset; save and convert refusals pin as
  record alerts. Incomplete email config is a typed refusal; failed
  sends stay visible in the composer.
- Inventory Post refusals pin on the record; line-less budget submits
  refuse with a typed message.

### Inventory, fulfilment, assets, and approvals

- Standalone invoices refuse to post when stock-relief issue effects
  fail, so revenue cannot land without its matching COGS.
- Fulfilment is a sales-order conversion target; an approved order is
  no longer a dead end.
- Orders approved before line warehouse pickers existed name the
  warehouseless line and offer assignment instead of a generic
  conversion failure.
- Depreciation runs that post nothing name the next due line.
  Equipment activation names the missing charge item.
- Directly submitted budgets reach the approvals inbox.

### Banking, retainage, and CAM

- A first bank reconciliation counts the proven statement opening toward
  cleared, so it can reach zero and be signed off.
- Retainage Receivable has a Company Settings home; pay-application
  invoices are no longer blocked by an invisible control-account
  requirement.
- CAM finalize refusals pin on the pool card instead of vanishing with
  a toast.

### Inventory chain, billing provenance, and hygiene

- Order and invoice drawers have line-level warehouse pickers with
  save APIs, so stock relief can follow the line that will post COGS.
- Draft line replacement keeps billed-time/cost provenance, so a
  billing-request invoice can be saved.
- Project merge previews key by group and direction; refusals pin on
  the duplicates screen.
- Hygiene flags persistently credit-normal unreconciled bank accounts.
- Asset-category setup labels the default depreciation formula in
  every locale.

### Reports, analytics, purchasing, and tax

- Vendor drills and compliance open-payables read the shared open-items
  reader, never reversed entries. Purchasing recovers through the
  lenient scope and groups the hero off that same set.
- Registers keep capped-out parties with exact closings. The trial
  balance keeps zero-balance accounts that had activity. Statements
  print gross account balances so lines foot to section totals.
- The OpEx-to-revenue ratio shares one P&L operating-expense reader.
- Waiver forms are required while enforcement applies. Positive NOL
  and provision inputs measure as DTA, never DTL.
- PSP settlement drafts are postable, with typed import refusals.
- Dashboard money and AR tiles label the as-of cut-off.
- Empty field-ticket drafts can be discarded instead of orphaned.

### Aging, budgets, and bank setup

- Aging derives opens from stored base amounts and folds documentless
  control balances into a per-party residual, so the subledger ties to
  its control account.
- Budget variance is direction-aware: a revenue shortfall reads Under.
  Self-approval is refused with a typed reason.
- Bank-feed targets use the unified reconcilable-bank reader. Setup
  drawer edits write the keys the controls read, so a bank profile can
  be deactivated.
- True-cost explains an empty Assign picker when no burden categories
  exist.

### Pay runs, journals, and locale catalogs

- Pay-run posting failures persist per instruction and render in the
  activity feed.
- Closed-period Post refusals pin on the record. Journals warn when
  control legs post with no party.
- Journal counts read one scope across the setup guide, header, and
  list.
- Send-for-signature refusals pin as a dialog alert.
- All six non-English locales now carry the full product. The
  remaining keys are reviewed cognates, not gaps. Each namespace is
  pinned with placeholder-parity so English cannot be pasted back.
- All seven aging and statement precision suites now seed and read
  under the scratch org. That was test drift, not money: they had been
  asserting against zero rows because an imported web reader denied
  unscoped queries. Assertions are unchanged.
- Fifteen drifted integration suites now seed and read under the
  scratch org — MFA and reset, documents, orders, payroll, report
  drill and currency basis, account register, currency chain, partner
  statements, and draft columns. That was the same resolver drift, not
  product arithmetic. Assertions are unchanged.
- Lien-waiver project-required refusals pin on the record.
- The setup rail stacks below phone width. Readiness points at the
  chart of accounts. A blank tax-code percent falls through with a
  spoken refusal. Rate-card lapse uses the shared invoicing label.
  The book-policy custom-formula picker is labelled. Setup column,
  field, and filter keys must resolve to English labels; four orphaned
  keys are now labelled in every locale, and a dead allocations mode
  column is gone.
- Project list cells and filters resolve custom type names.

## [0.1.0-alpha.14] - 2026-09-17

Defect fixes on top of alpha.13. Requires migration 0170.

### Locale remediation

- Admin and analytics catalogs are fully translated in fr, es, de, ja,
  zh, and pt-BR, each namespace pinned so English cannot be pasted back.
- Payroll catalogs land in all six non-English locales (848 keys each).

### CRM, banking, drawers, and PDF

- Lead stage changes persist; new prospects start at the right stage.
- Forecast snapshots file at the displayed scope, including the whole
  organization (0170 relaxes the target CHECK).
- Banking overview uses one reconcilable-account reader even when
  consolidated rates are underived.
- Dirty document drawers keep a header Save and confirm before close.
- PDF template duplication no longer collides on default names; a taken
  name is a typed 409.
- Currency-mismatched postings refuse with a typed message, never raw
  SQL. Unapplied credits net against party open balance. AR customer
  search gives an honest empty state. Close review tasks offer start,
  evidence, and complete. Customer status facets count without group-by
  when CRM is off. Catalog placeholder-parity pins no longer match a
  literal backslash-brace.

## [0.1.0-alpha.13] - 2026-09-17

Defect fixes on top of alpha.12. No new migration.

### i18n, shell, and allocations

- `ar.collections` and `agents` catalogs backfill de, ja, zh, and pt-BR.
- The platform workspace switcher lives in the account menu.
- Allocation-rule wizard destination menus stay above the modal and
  match on any dimension, with codes in the option labels.
- Pre-flow vendor bank accounts can be submitted into the current
  approval flow; party payloads publish the canonical OCC token so
  Edit-then-Save no longer 409s.
- French and Spanish property type/status labels agree with the
  masculine building noun.

## [0.1.0-alpha.12] - 2026-09-16

Fixes across setup, banking, assistant, payroll, CRM, reports,
dashboard, documents, allocations, construction/AR, rates, assets,
payroll, i18n, drawers/search/mobile, expenses, compliance, invites,
agents/AI, and a11y UX on top of alpha.11. Requires migration 0169.

### Setup and shell

- Typed validation and duplicate conflicts with user-language messages;
  required fields persist errors and reset busy on transport failure;
  blank `keepDefault` fields are legal; time-classification option labels
  resolve under `options`.
- Shell empty-state no longer repeats the boundary copy in the body.

### Banking, approvals, CRM

- Account KPI reads posted+reversed lines; the 7-day work-queue badge
  counts only posted documents.
- Approvals render an empty state instead of a blank surface.
- Lead/prospect first save sends the party revision token; the lead
  owner picker uses the translated unassigned label.

### Payroll, assistant, allocations

- Stub register buckets and the overview setup checklist come from pack
  declarations; FICA carry-in splits into W-2 boxes 4 and 6.
- Assistant runs persist on the server across navigation and stick to
  the bottom with jump-to-latest.
- Period-sweep preview runs inline on the rule Test tab; empty
  dimension options guide the user and bad values speak user language.
- Deleted assistant threads stay deleted across chat switches; local
  blue/green rebuilds can override `NEXT_DIST_DIR`.
- Posted pay-run journal entries are visible on the journal; FX test
  warns when no currencies exist; an already-running agent scan explains
  the 409.
- Schedule editor mutations surface the server error; a blocked account
  save stays on a form-level alert; standalone checks require payee and
  funding bank.
- AR/AP dashboard tiles use the shared open-item reader; remittance
  pickers list org-wide vendors; lease add-charge is satisfiable;
  ownership create refuses a full-method write with a typed error.
- Data-io re-imports exported party kinds; PDF responses keep a strict
  CSP; pack-driven stubs re-resolve the open stub against live rows.
- Approvals center tabs read the same union worklist as the dashboard
  tile; API-key fingerprints stay stable across revoke; users accept
  last_sign_in sort; agent finding hrefs resolve through the nav
  registry; period lists show locked modules and book; journal Origin=All
  includes migration entries; document drawer post fails closed.

### Construction, AR, rates, and consolidation (batches 23–29)

- Rates-blocked banner on aging, registers, GL, journal, and workspaces;
  aging export uses the same as-of rule as the screen; consolidation
  refusals carry typed reason codes.
- AR never renders a sync source handle as the document number; CRM
  lead/prospect first save completes the draft; owner picker resolves
  the nested unassigned label.
- Allocations uncovered kinds answer empty instead of 404; new-rule
  setup is a guided wizard.

### Assets, payroll, i18n, drawers, search, expenses

- Depreciation extends a stale schedule before posting and surfaces run
  problems instead of failing silent; payroll posts one labeled burden
  debit per employer component and lists org-wide vendors.
- Inventory locations, BOM tabs, run funding, and the property workspace
  translate in every locale.
- Document title row wraps so the status pill never clips; AR-pulse
  hero amounts wrap on narrow screens; mobile search sits in the topbar;
  exact numbers bypass the search candidate cap and journal entries are
  indexed.
- Expense reports are editable via recall and correct; the vendor
  drawer Compliance tab assigns the class; funding-bank override
  persists on save.
- Approvals center binds assignee ids as a PostgreSQL array literal so a
  single user-assigned gate no longer 500s the page.

### Invites, close, agents, AI, and a11y (batches 30–35)

- Users can be invited with a set-password link and a pending state;
  the period drawer shows pending reopen requests.
- Agent tiles and status filters no longer depend on the current query;
  the shortcut legend documents a/d; team roles and banner dates
  translate; evidence kinds are labeled in en/fr/es.
- AI Test connection verifies the typed key; load-models errors stay
  structured. Saved list views and bank-feed disconnects confirm first;
  discard-draft on an app always confirms.
- Open-aging built-ins count application-aware open lines; statement
  tables stay readable on a phone; cash cockpit, bank feeds, project
  billing, setup sidebar, and report filter presets translate.
- Drawer banners wrap at 390px instead of squeezing.

### Invites, remittance, banking, and tax (batches 36–39)

- Pending invites expose a one-time set-password link and resend;
  reset-request failures no longer claim the link is on its way; a blank
  company display name pins an inline required error.
- Remittance vendor listbox reads parties+vendor_roles; card-liability
  is offered when no card instruments exist; reconcile never swallows
  an unreadable error; KPI titles wrap and trend ticks stay thin.
- Failed flow runs can be retried; mark-as-filed refusals are typed in
  the filing drawer; delete-payment confirm resolves through the drawer
  scope.

### Invites, i18n, and cockpit (batches 40–41)

- CSRF treats localhost / 127.0.0.1 / [::1] as one origin so invite
  activation works across loopback addresses.
- Feature-toggle 409s map to localized copy; recent-entry status and
  line counts translate; opportunity status cells and filters use the
  drawer catalog; mobile tabs prefer short AR/AP labels.
- Stat tiles wrap instead of truncating; a retried flow parks the
  subject in pending_approval so the engine-enforced release can land.

### Budgets, reports, drawers, and search (batches 42–44)

- Draft budgets can be submitted, approved, and rejected with
  revision-guarded provenance so Pending approval / Approved are reachable.
- Report-schedule DELETE accepts a bodiless request; add-journal refusals
  stay as a dialog alert; the related-party overlay receives Compliance
  tab inputs.
- Exact journal-entry numbers resolve outside list origin/link scope;
  recurring cadence options translate in fr/es; setup wizard, go-live
  guide, api-keys, and the property buildings table copy backfill.

## [0.1.0-alpha.11] - 2026-09-16

UI and session-gate fixes on top of the self-deploy release. The
per-process database pool size is now configurable.

### UI

- Open receivables read the as-of book; the AR overdue subtitle takes a
  bare percent; recent journal widgets link through the posted-entry route.
- Approvals show loading/pending/empty states; document lines derive amount
  from quantity × unit price; project create activates the placeholder on
  a completing save.
- Customization form edits PATCH the member route, remount per session,
  confirm before deleting the org-default form, and expose visibility
  toggle pressed state.
- Banking fails closed at the root route error boundary; Business Central
  invoice numbers land as `documentNumber`; US state/local income-tax
  statutory slots are labeled.

### Platform

- The session gate fails closed per request with a request id.
- The per-process connection pool size is configurable.

## [0.1.0-alpha.10] - 2026-09-16

Integrity fixes on top of the allocations release, and production now
deploys itself from a version tag.

### Production release

- Pushing a `v*` tag publishes the attested image, then
  `deploy-production.yml` runs on the LAN runner: it executes
  `deploy/swarm-release.sh` over a dedicated forced-options ssh key
  (migrate first, then swap both service pins) and stays red until
  `/api/v1/health` reports the tag. Manual edge publishes never deploy.

### Integrity

- Period allocation runs refuse to post after the rule is deactivated or
  its published version is retired.
- Report-backed allocation drivers resolve features through the canonical
  feature path.
- A bank return supersedes a pending manual payment void and keeps its own
  evidence.
- Sync identity writes qualify the stored row on party-role conflicts, and
  evidence refresh matches lines by the stored `sourceLineRef`.
- Statement-format arithmetic goes through the engine money helpers;
  boolean custom-field list values extract as real booleans; workspace
  package edges that were imported undeclared are now declared.
- Posted journal lines cannot be re-homed onto another entry (0165).
- Optimistic-concurrency tokens advance a `revision_seq` counter on every
  update, independent of the editable `updated_at` display timestamp (0167).
- Retainage draws and releases settle in whole currency minor units and
  refuse a release that would invert draw/reversal posting order.
- Overhead published rates and preview share one exact decimal contract.

### Operator action

- Two additive forward migrations: `0165_jl_guard_original_parent_immutability`
  (replaces `jl_guard()`; no data rewrite) and
  `0167_document_revision_counter` (`revision_seq` column and bump trigger
  on revisioned tables; existing rows backfill 0). No other data changes.

## [0.1.0-alpha.9] - 2026-09-16

Setup polish for the allocations release, from testing alpha.8 in production.

### Allocations setup workspace

- Rules, Drivers, and Runs tabs now use the same composition as every other
  setup list: description plus one primary New/Preview action, the shared
  search toolbar with the show-inactive pill, and a table with a single
  "Nothing here yet." row when empty. The New rule and New driver actions are
  visible on an empty tenant.
- Drawers carry their primary action in the header like the shared setup
  drawer. The driver drawer gets its own Description field, per-source
  configuration (account scope, unit, measure, report), and the manual
  values grid inside the drawer after the driver is saved; loading states
  use the house skeleton.
- Rule drawer dimension filters render a proper none-state when a dimension
  has no values; all copy resolves from the catalog.

### Features page

- Sub-features nest under their parent (indented, secondary type, no icon)
  and stay hidden until the parent is on, with a quiet "N options once
  enabled" hint; category counts cover visible rows only. Applies to
  Projects, Flows, and Allocations children.

### Operator action

- No migrations. No data changes.

## [0.1.0-alpha.8] - 2026-09-16

Allocations release. One allocation kernel replaces three requests that used
to be separate products elsewhere (allocation schedules, distribution keys at
transaction entry, and a posting-time GL plug-in): a versioned, effective-dated
rule model bound at three moments, a driver registry, one exact apportionment
engine, and a lineage table that traces every allocated cent to its source
line, rule version, and driver value.

### Allocation kernel

- Rules are versioned and effective-dated; a published version is frozen and
  hashed, and every run and lineage row carries that hash. Applicability is
  per GL account (or account group) and per department, location, class,
  project, subsidiary, party, item, or custom segment, including untagged
  pools. Bases are fixed percentages, stepped tiers, or a driver; targets are
  explicit or dynamic (every active dimension value with weight). Impacts are
  reclass, net-zero pair (never changes an account total), or report-only.
- Drivers resolve from statistical journals (`journal_lines.quantity`), GL
  activity or balance, seven native measures (headcount, labor hours, billed
  hours, labor cost, revenue, direct cost, rentable area), effective-dated
  manual tables, or any saved report definition, run under the actor's own
  permissions; unavailable measures fail loudly instead of returning zeros.
- Entry mode: a bill, expense, or journal line that matches an automatic
  rule explodes on save into a stamped group of real lines (amounts exact,
  quantities proportional, tax recomputed per child); suggest rules offer a
  chip; a split dialog, group headers, un-split, and lock live in the line
  grid; imports and the records API accept `distributionKey`.
- Post mode: contributions land on the transaction's own journal entry,
  stamped with their contributor (`journal_lines.contributor_kind/ref`),
  balanced per contributor and per subsidiary, mirrored on void, written to
  secondary posting books as their own entries, and grouped in the GL impact
  drawer. A `custom_gl_lines` user-script trigger contributes lines the same
  way, with the kernel lines frozen.
- Period mode: preview, post, reverse, and re-run per rule, period, and book
  with one posted run per occurrence, an explain payload (sources, driver
  vector, shares, residual), re-run idempotency by fingerprint, scheduled
  occurrences through the durable outbox, a close automation action
  (`run_allocation`), and approval flows that hold a run pending until the
  flow approves.
- The overhead net-zero-pair writer is now a system-owned kernel rule derived
  from the overhead settings and rate card, proven byte-identical to the
  previous journal lines, with per-time-entry lineage.
- Setup → Allocations workspace (Rules, Drivers, Runs tabs with a
  four-tab rule drawer, driver values grid, run detail with lineage drill),
  Allocation summary and Allocation lineage reports, an in-app help article,
  six locale catalogs, seven read-only assistant/MCP tools, and an
  internal-controls evidence set (seven cases) published beside the trust
  corpus.

### Assistant, agents, and setup

- Chat threads appear in the sidebar instantly, page long histories, get short
  generated titles, and forward finding handoffs; page headers wrap actions
  under the title on phones.
- Agents overview, library, policy pages, activity, inbox, proposals, and
  briefings are rebuilt on the shared setup and table components.
- Analytics sentences are localizable; source-evidenced bank sign-offs count
  as reconciled for close readiness; JPY/KWD are pinned end to end.

### Operator action

- Five additive migrations (0160–0164) run automatically before the new code
  serves. No posted history is reinterpreted; the dormant planning-era
  allocation tables are replaced only if empty (they are, on every install).
- Re-run `engine/src/seed-roles.ts` after upgrading: built-in roles gain the
  `allocations.read/manage/run/approve` grants (roles are snapshots).
- The `allocations` feature defaults off. Enable it, and the entry and
  posting sub-features, under Company Settings → Features.
- Posting a document under a rule whose driver is a saved report requires the
  posting actor to hold `reports.read` (fail-closed by design).

## [0.1.0-alpha.7] - 2026-09-16

Assistant and agents release. A live benchmark of the in-app assistant on a
real ledger (three models, graded against tool output) showed nearly every
lost point was a tool-surface gap; this release closed those gaps, made
the model's context proportional to the question, generalised the
background-agent runtime, and gave agent work a home in the product.
Everything the assistant and MCP clients can do reuses the same services,
permission gates, subsidiary scoping, and feature switches as the screens.

### Assistant and MCP

- One capability catalog for chat and `/mcp`: read tools across ledger,
  reporting, banking, payroll, tax, projects (portfolio ranking), inventory,
  orders, fixed assets, equipment, subcontracts and WIP, CRM, subscriptions,
  property, time, expenses, close and periods, FX, budgets, files, data-io,
  sync, environments, PDF templates, reporting deliveries, and admin reads
  (secrets never leave the server). Governed commands with a review card and
  idempotency key: settings, feature switches, setup records, journal post,
  bank reconciliation actions, FX revaluation, budget cells, file upload.
- Tools of disabled modules are hidden from the model, MCP, and the close
  agents; the system prompt states the org's module switchboard; every tool
  declares its feature key, and parity tests pin feature, permission,
  subsidiary scoping, and chat/MCP visibility.
- Context proportional to the question: a 24-tool core is always on,
  `find_tools` activates a module's tools mid-turn, a pre-router pre-activates
  modules from the message, tool results are compacted for the model (full
  results still stream and persist), older turns become summaries, a rolling
  conversation summary with resolved entities persists per conversation
  (migration 0152), pronouns resolve from pinned entities, and step budgets
  adapt. A typical turn now sends roughly 6k–13k tokens of tool definitions
  instead of 45k.
- Turns can no longer end silently: the last permitted step must answer, and
  a turn that produced no prose gets a visible fallback. Engine domain errors
  reach the model as actionable messages instead of `tool_failed`.
- Strict provider compatibility: every tool schema is linted for RE2-safe
  patterns, described properties, and bounded sizes (an unescaped bracket
  had made one provider reject the whole catalog); a contract harness runs
  every read tool against a scratch org under a size budget.
- App packages declare their own assistant/MCP tools (`tools[]` in the
  manifest with validated JSON-schema inputs and install-time contract
  checks); they run through the app runtime with governance evidence and use
  the same confirmation path as built-in mutations.
- `describe_capabilities` answers "what can you do" from the live catalog.

### Agents

- The continuous-close runtime is a registry of agent packs: accounting,
  finance, collections, payables, reconciliation, data hygiene, forensics,
  tax readiness, payroll compliance, project margin, and cash alerts
  (migrations 0151 and 0155 widen the agent-key constraints). Packs read and
  propose; nothing runs a write without a confirmed review card.
- Agents are a first-party Setup category: overview with enable switches and
  run-now, a library, per-pack policy pages with detector controls and
  notification routing (migration 0154), and an activity log. `/admin/ai`
  is provider configuration only.
- Agent Workbench at `/agents`: a ranked inbox with keyboard and bulk triage,
  a proposals lane rendering the same review cards as chat, a cached morning
  briefing with email send, ask-about-this handoff into chat, assignment with
  due dates and notes (migration 0153), and a dashboard tile.

### Connectors, banking, assets, currencies

- Connectors mirror cleared markers and party merges/holds and carry source
  reconciliation evidence on every mirror run; a source-evidenced sign-off
  engine can close reconciliations from that evidence (migration 0158).
- Fixed assets and lessee schedules continue from opening balances
  (migration 0156); the fixed-asset register import carries openings in.
- The currency registry is the full active ISO 4217 list, backfilled for
  existing tenants (migration 0157), with localized picker labels.
- Analytics sentences, sentinel forensics, ratio definitions, and health
  findings are localizable; sentinel duplicate groups and per-currency stats
  corrected; close readiness ignores non-posting order kinds.

### Operator action

- Eight additive migrations (0151–0158) run automatically before the new
  code serves. No data is reinterpreted.
- Agent packs beyond accounting and finance are off until enabled under
  Setup → Agents; the `continuousClose` feature still gates the runtime.
- The MCP endpoint requires the `apiAccess` and `mcpAccess` features and an
  API key; provider model lists are cached for ten minutes.

## [0.1.0-alpha.6] - 2026-09-15

Defect-remediation release: ~300 atomic fixes from a third audit
(persona attacks, real-data replay, mutation survivors, standards
conformance, boundary sweeps), each with a red-then-green regression test
and an independent review. Highlights below; every commit carries its own
defect / root cause / fix / verification record.

### Integrations

- Chargebee settlement imports now receipt what was actually collected.
  `amount_paid` is the booked receipt, `amount_adjusted` posts as its own
  adjustment line against the customer (carrying the provider's reason when
  the export surfaces one) instead of being silently dropped, and the import
  refuses to post when the provider total does not foot to amount paid plus
  adjustments plus applied credits — naming the invoice rather than booking
  an unreconciled receipt. Adjustments are tracked apart from refunds in
  batch totals and post as their own clearing line. Schema gains
  `psp_settlement_batches.adjustment_amount` and the `adjustment` settlement
  line kind (migration 0144, additive).

### Scheduler topology

- Scheduled work now runs in the worker process only (`npm run worker`, the
  `worker` Compose service / worker Deployment). The web process no longer
  starts the scheduler unless `OPENBOOKS_RUN_SCHEDULER=1` is set explicitly
  (single-process installs), and never under `next dev`
  (`OPENBOOKS_RUN_SCHEDULER=force` is the only development override). Each
  process logs one `[scheduler]` line at boot stating which mode it is in.
  Concurrent worker replicas still run each tick once via the existing
  Postgres claim lock. No job semantics changed.

### Analytics

- Analytics: True Cost dashboard restored as a hub dashboard; the report
  remains at /reports/true-cost.

### Operator action

- Scheduler topology: multi-process deployments take no action — keep the
  worker service running (it already runs in `compose.yaml` and the HA
  reference). Single-process installs that run web without a worker: set
  `OPENBOOKS_RUN_SCHEDULER=1` on web.

### Ledger and close

- Posted journal entries can no longer be flipped back to draft through the
  kernel guard (migration 0146, `je_guard` v3: posted exits only to
  reversed). Tax amounts without calculation evidence fail closed instead of
  silently dropping at posting. Account-parent cycles no longer hang every
  statement. Direct inventory postings stamp the GL location dimension.
- Close readiness scopes the posting-period check to the run period, goes red
  on unrecognized deferred revenue, and re-publishing after a reopen versions
  the binder (original retained, restatement note required). Consolidation,
  elimination, lease, asset and FX-revaluation writes into closed periods
  refuse with named errors instead of raw storage failures. Depreciation
  catches up skipped months and allocates 4-4-5 calendars; secondary books
  revalue; asset disposal refuses while a begun stub period is unposted.
- New admin remediation paths: bulk assign-posting-period from the readiness
  blocker, and duplicate-project detection with an audited merge.

### Cash, receivables and payables

- Open items net unapplied credit memos (cash forecast, cash position,
  vitals and assistant tools now tie to aging to the cent); as-of agings and
  forecasts reconstruct settlement timing instead of reading live balances;
  day-90 items age into the 90+ bucket; quiet parties keep their balance on
  statements. Consolidated open items, bank balances, cockpit tiles and the
  analytics hubs translate every functional currency to the presentation
  currency at the correct spot and fail closed on missing rates.
- Ad-hoc vendor payments honour subcontractor compliance blocks. Early-payment
  discounts round to the bill currency's minor units. Refund-first PSP
  webhooks park as pending clawbacks and settle exactly once (migration
  0149). Void versus application races no longer deadlock.

### Tax, payroll and standards

- GST34 packs installed by the pre-split seed are healed to the collected /
  paid / taxable bases (migration 0147; a real tenant filed net tax at double
  the true amount). Codeless source tax is refused upstream with the source
  reference. The payroll remittance summary survives a run with an unknown
  filing account and statutory payable remappings return a typed warning.
- Conformance matrix republished at 75 passing cases and 15 declared gaps
  (partial disposal, intercompany asset transfer, lease early termination,
  4-4-5 depreciation, partial disassembly, loss of control, …).

### Integrity, contracts and concurrency

- Reference ownership is fenced on every write path (records API, documents
  and lines, journals, expenses, items, parties, assets, timesheets, rate
  cards, property, custom records, scripts, Flows actions and imports):
  foreign-org ids are refused with tenant-opaque 404s instead of storage
  errors. Dozens of routes refuse magnitudes wider than their numeric columns
  and dates that are not real calendar days with typed 4xx responses.
- Revision tokens on prebill lines, AP-capture reviews, custom records and
  opportunities; compare-and-swap on percent-complete overrides; sorted
  advisory locks for inventory reversals; repeatable-read sandbox clones with
  per-sandbox refresh serialization; sandboxes holding posted documents can
  be created, refreshed and deleted (migration 0148). Audit rows now carry
  actor and before/after for the v1 writer, imports, Flows mutations,
  pay-run commits and mirror-posted documents.
- The approvals worklist and the pending-approvals count unify Flows gates,
  document-status approvals and pay runs. KPI definitions are single-sourced
  (DSO across all six surfaces). Paginated lists carry a unique tiebreaker and
  malformed filters fail closed to empty. Budget vs actual and the dashboard
  cash tile bind to the resolved period.

### Imports and integrations

- Every registered data resource round-trips export → import into a fresh
  org and re-imports idempotently (matrix test committed). Settlement links
  state their currency on all six connectors and the reconciler converts or
  refuses. Source subsidiary functional-currency changes are held for review.
  The QuickBooks Desktop Web Connector SOAP route is reachable through the
  edge and password guessing is bounded.

### Dashboard

- Saving Quick Actions on a never-customized dashboard no longer wipes the
  widget grid; malformed or empty stored layouts fall back to the default and
  self-heal on the next view. The greeting follows the viewer's clock.
- Performance: the indirect cash flow's outer scans are bounded by the window
  (138 s → ~10 s on a multi-million-line tenant); capped detail exports
  disclose the cap in every format.

### Operator action

- Migrations 0146–0149 apply automatically on deploy (forward-only,
  idempotent). 0147 rewrites installed CA_GST34 pack rows for lines 101 /
  103 / 106 on every org that installed the pre-split seed; re-run affected
  returns after upgrading.

## [0.1.0-alpha.5] - 2026-09-15

A hardening release. A multi-agent audit read the engine, API, and application
layers end to end and shipped about 350 atomic defect fixes, each with a
regression test that failed before the fix and passes after it. No feature
work is included. Operator action: none beyond the normal migration step; the
three payroll migrations below are additive.

### Financial integrity

- Posting: source corrections can no longer over-apply live settlements;
  negative-total credit memos and vendor credits are refused at the posting
  boundary; FX spot lookups break direct/inverse ties deterministically; line
  accounts and parties are checked against the tenant and subsidiary before
  any write; the vendor-payment "total is the cash amount" contract is pinned.
- Payments and receipts: allocation totals use exact money everywhere the UI
  or engine summed them; provider over-collection stays on account instead of
  being dropped; early-payment discounts are vendor-only; settlement evidence
  is scoped to the run's bank account; CPA-005, NACHA and SEPA writers refuse
  blank, oversized or checksum-invalid account and creditor identifiers.
- Banking: Plaid pending authorizations are no longer imported as statement
  truth; GoCardless and CAMT.053 lines are keyed by provider-unique ids;
  inactive reconciliation rules cannot be applied; SFTP statements are parsed
  from exact bytes.
- Payroll: signed stub lines net the deduction-protection base; WCB and
  employer QPIP caps consume committed stubs only; staleness watches pay
  schedules, statutory rates and union fringes; US state withholding engines
  receive YTD supplemental wages and current federal tax; RL-1 slips carry
  opening YTD; Quebec-only remittances use the Revenu Quebec calendar; SINs
  are Luhn-checked on T4/RL-1 transmission; bank-file generation re-verifies
  approval inside its transaction; opening balances now carry second-order YTD
  history and capped employer levies (migrations 0141 and 0143); retro
  readiness compares against a persisted quantification snapshot (0142).
- Tax: taxable-base return boxes convert at the posted FX rate; MACRS pool
  runs refuse short-year factors; nexus rates compare at ledger scale;
  provision reconciliation percents round half away from zero; filing boxes
  keep exact decimals; 1099 thresholds and box rules follow the IRS
  instructions (fishing boat proceeds, OBBBA 2026 threshold, corporate boxes).
- Consolidation and FX: proportionate interests are eliminated; source-to-
  elimination rate pairs are derived; test FX syncs no longer move the
  production schedule cursor.
- Reports and analytics: quarter breakouts follow the organization's fiscal
  start month; cash-basis drill-downs tie to settlement-share recognition;
  utilization and true-cost bases count approved time only; project margins
  scale identically in tables and exports; CSV exports keep exact decimals;
  cockpit tiles are scoped to the primary book and visible subsidiaries and
  translate mixed-currency totals.

### Isolation, authorization, and audit

- Subsidiary scope is enforced on budgets, journals, timesheets, approvals,
  flows, custom records, file-cabinet folders, parties, assistant and MCP
  tools, payroll run populations, and every module cockpit that read past it.
- Feature gates for field tickets, WIP billing, work breakdown and project
  scheduling are enforced in services, not only in navigation.
- Configuration saves (close policy, automation, calendars, reporting
  packages, sandbox schedules), timesheet decisions, and approval gate
  decisions write actor-attributed before/after audit evidence.
- Sealed tax identifiers are omitted from directory payloads; sandbox clones
  scrub masked custom data and users and rebuild derived aggregates.

### API contracts

- Malformed ids answer 404 on every verb instead of surfacing database errors;
  PATCH and DELETE validate what POST validates (dates, booleans, enums,
  referenced ids, custom fields on partial updates); document edits and voids
  carry the exact revision token so stale writes are refused.

### Sync

- Open-item verification compares expense reports alongside invoices, bills
  and credits, so a clean ledger no longer fails the financial gate;
  QuickBooks report dates are normalized
  at the adapter boundary; realized-FX groups get their own entry numbers;
  master-data upserts type their JSON parameters; tax-rate mirrors touch only
  the open current window.

### Test infrastructure

- Test fixtures refuse databases that do not carry the ephemeral marker, so a
  stray test run cannot write to a real database.

### Payroll

- Remittance bills for Revenu Québec destinations are now due on Revenu
  Québec's own timetable. The Canada pack declares the RQ schedule
  (quarterly, monthly, or twice-monthly by average monthly remittance, per
  Guide TP-1015.G and form TPZ-1015.R): Québec income tax, QPP, and QPIP bills
  carry RQ due dates and rules instead of inheriting the filing account's CRA
  remitter type, which previously stamped CRA accelerated-threshold dates on
  RQ bills. Set the frequency from your Revenu Québec notice under Setup →
  Payroll (new employers remit monthly, the default); Setup readiness warns
  while it is unconfirmed and when last year's average points at another band.

## [0.1.0-alpha.4] - 2026-08-20

### Time and timesheets

- Timesheet weeks have a lifecycle. Approved time stays read-only, but a week
  can be reopened while nothing downstream has consumed its hours; the reasons
  it cannot be (invoiced, paid, costed) are named rather than implied. Weeks
  carry their own record, with rejection reasons and amendment links.
- Whether hours require approval before they can be billed or paid is now
  organization policy rather than an assumption, and approval routing runs
  through flows, so approver, order, and quorum are configuration.

### Payments

- Fixed: the NACHA and SEPA direct-debit writers accepted a half-configured
  originator. They checked only that each required field was non-empty, while
  the credit rails additionally reject unfinished `FILL-ME` placeholders and an
  ODFI routing number that is not exactly nine digits. Because the writer
  slices that number to eight characters, an over-long value produced a
  well-formed file addressed to the wrong originating institution. Both debit
  rails now parse their originator to the same standard as the credit rails.

### Integrations

- NetSuite accounts can map their own job billing types instead of inheriting a
  single tenant-wide convention.

### Internal

- Raw SQL now carries its row type as a type argument (`db.execute<Row>(…)`)
  instead of asserting the shape back afterwards. 2,381 laundering casts across
  504 files were removed, along with a dozen ad-hoc "anything with `.execute`"
  parameter types that discarded the row type at the boundary; they share one
  `SqlExecutor` seam. Type-level only — no runtime behaviour changed.

### Operator action

- None. The schema gains `timesheet_weeks` plus two nullable columns on time
  entries; existing weeks derive their state on first use.

## [0.1.0-alpha.3] - 2026-08-04

The first public community preview of OpenBooks.

### Accounting and operations

- PostgreSQL-enforced double-entry ledger, exact decimal money arithmetic,
  periods and close controls, audit evidence, receivables, payables, payments,
  banking, reconciliation, budgets, tax workpapers, and income-tax provisions
- Multi-currency, multi-book, multi-subsidiary, intercompany, consolidation,
  eliminations, non-controlling interest, and goodwill configuration
- Inventory costing and reconciliation, fixed assets and tax pools, project
  accounting, time and job costing, construction progress billing, retainage,
  change orders, and project revenue recognition
- Configurable transaction approvals and workflows, reports and analytics,
  saved searches, exports, custom fields and records, scripts, apps, API keys,
  backups, sandboxes, and optional AI assistance

### First-run experience

- Adaptive company setup that uses industry, size, entity structure, currency,
  operational complexity, and control requirements to shape the workspace
- Three progressive operating profiles—Essentials, Growing, and Advanced—with
  authoritative feature gates that remain fully adjustable in Company Settings
- Go-live readiness guidance from company identity and fiscal calendar through
  opening balances, controls, and first month-end close
- RLS-isolated industry sample-company imports for evaluation and training
- Maintained country tax packs for Canada, the United States, Australia, New
  Zealand, the United Kingdom, Germany, France, Spain, Italy, the Netherlands,
  Ireland, Singapore, India, South Africa, the UAE, and Japan

### Data, integrations, and platform

- Generic migration and mirror framework with adapter-scoped source identities
  for NetSuite, QuickBooks, Xero, ERPNext, Odoo, and Microsoft Dynamics
- Governed tenant-scoped query console with schema browsing, contextual table
  actions, and access only through reviewed reporting views
- Platform controls for apps, scripts, API documentation and keys, MCP, query
  tools, workflows, sandboxes, and AI features
- English, French, Spanish, German, Brazilian Portuguese, Chinese, and Japanese
  locale catalogs

### Deployment, security, and integrity

- One-command Docker Compose installation using separate database-owner and
  constrained runtime roles, generated secrets, health checks, MinIO, Redis,
  web, worker, and migration-first startup
- Multi-platform GHCR image built once, scanned at the exact digest, retagged
  without rebuilding, and published with provenance attestation
- One audited canonical PostgreSQL baseline for clean installations, plus
  release tests for row-level security, source identity, setup provisioning,
  accounting invariants, and documented claims
- Production startup rejection of database roles that can bypass tenant RLS;
  tenant context is enforced across APIs, integrations, scripts, query tools,
  and background jobs
- Product-neutrality, history-hygiene, secret, dependency, container, and
  workflow checks in the release and security pipelines

### Known limitations

- This is alpha software and has not completed an independent accounting audit,
  security audit, or broad production validation. Start with test or parallel
  books and reconcile all opening balances, tax treatment, permissions,
  reports, backups, and jurisdiction-specific requirements.
- Country packs provide maintained configuration, workpapers, and exports; they
  are not universal electronic-filing certification or professional tax advice.
- The included Compose deployment is a single-host installation. A separate HA
  application-tier reference is provided, but operators remain responsible for
  production-grade database, cache, object-storage, ingress, monitoring,
  backup, and recovery infrastructure.

### Operator action

- Fresh installations bootstrap directly from the canonical baseline.
- Keep the generated `.env.compose` file secure and back it up; it contains the
  first administrator login and deployment secrets.
- Before using OpenBooks as a system of record, complete a restore rehearsal and
  the validation steps in the upgrade and backup runbooks.

[0.1.0-alpha.4]: https://github.com/braedonsaunders/openbooks/releases/tag/v0.1.0-alpha.4
[0.1.0-alpha.3]: https://github.com/braedonsaunders/openbooks/releases/tag/v0.1.0-alpha.3