# Changelog

All notable changes to TimeTracker will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Added

- **DigitalOcean one-click** — `.do/deploy.template.yaml` (Docker Hub image + Dev Database) and Deploy to DigitalOcean button in the README / Distribution guide.
- **Unraid CA profile** — Root `ca_profile.xml` (`CommunityApplications` + `<Profile>`) required for Community Applications submission.

### Fixed

- **Payments** — Stripe checkout now sends JPY and other zero-decimal currencies (and three-decimal ones such as KWD) in the unit Stripe expects; before, every amount was multiplied by 100, so a JPY invoice was charged 100 times its balance, and the webhook amount was divided by 100 the same way.
- **Peppol** — The UBL invoice now reports payments already recorded on the invoice as `PrepaidAmount` and sets `PayableAmount` to the total minus those payments (BR-CO-16), never below zero, as the Factur-X/ZUGFeRD export already does; before, a partly paid invoice sent or exported as UBL asked the buyer for the full total.

### Documentation

- **OrcaRouter** — AI Helper docs and Admin settings include a signup link for an OrcaRouter API key (`https://www.orcarouter.ai/ref/ref_984e584cb4cd86485a8c`).
- **Deploy & discovery** — DigitalOcean and Railway deploy guides; Unraid CA + directory listing submission packages; publishing checklist (`docs/deploy/*`, `docs/marketing/*`).

## [5.19.1] - 2026-11-07
### Added

- **Peppol bridge: getpeppr preset** — `PEPPOL_BRIDGE_PROVIDER=getpeppr` sends the UBL through getpeppr (`GETPEPPR_API_KEY`), with delivery status for the post-send check and an idempotency key so sending the same invoice twice the same day does not deliver a second copy (#840). See [PEPPOL_BRIDGE.md](docs/admin/configuration/PEPPOL_BRIDGE.md).

### Changed

- **CI / develop image** — **CD - Development Build** no longer runs on every merge into `develop`. Publish `:develop` only via **Actions → CD - Development Build → Run workflow**.

### Fixed

- **Admin** — The sidebar links the Quote PDF designer again, next to Invoice PDF; 5.19.0 left only one PDF Templates link, to the invoice designer (#850).
- **Invoices** — Deleting a draft invoice (single or bulk) now gives back the prepaid hours it used; before, fully prepaid time entries stayed non-billable and invoicing the same entries again failed on a unique constraint (#829).
- **Invoices** — A second generate-from-time pass keeps existing invoice lines instead of replacing them (#851).
- **Payments** — Changing a completed payment to refunded, failed or pending through the API now takes it out of the invoice's amount paid; before, the invoice kept the old amount and could stay fully paid (#830).
- **Socket.IO** — Pass the Flask app into the Socket.IO origin check so CORS validation runs with app context (#849).
- **Security / CodeQL** — Make `sanitize_log_value` visible to the log-injection query so findings clear correctly.
- **Release CD** — Stop the no-op `cp` of `docker-compose.nas.yml` when preparing release artifacts.
- **CI** — Migration drift gate ignores constraint/index rename noise and compares against a models-only base checkout more reliably.

### Documentation

- Peppol Bridge / e-invoicing docs and compose examples cover the getpeppr provider preset.
- Release process docs: `:develop` image is manual-only (no per-merge publish).

## [5.19.0] - 2026-11-05
### Added

- **Public demo (`DEMO_MODE`)** — Skip the setup wizard and seed browseable sample data for public demos; README/demo assets aligned with the live demo.
- **App shell UX** — Improved UI look, information architecture, and brand consistency across the app shell.
- **First-run / contributor UX** — Onboarding, empty states, and i18n improvements for new installs and contributors.

### Security

- **SSRF / XSS / mass-assignment / deploy defaults** — Harden outbound URL validation, CORS/Socket.IO, DOM escaping, attachment path jailing, and compose/env credential defaults.
- **Render health checks** — Tolerate transient connection-refused blips during deploys.
- **CodeQL follow-ups** — Clear property-injection, stack-trace, and log-injection findings; run helper images as non-root; Dependabot overrides for `follow-redirects` and `minimatch`.

### Fixed

- **Timer** — Bulk entry can add a slot that starts when another entry ends (adjacent slots).
- **Projects** — Show the new-install empty state when no status filter is set; wrap filter labels/options in gettext.
- **Web** — Restore `#746` reconnect guards; harden entry/invoice paths; restore curated timezones and template script blocks.
- **Migrations** — Make late SQLite upgrades batch-safe.
- **Mobile** — Use named `flutter_local_notifications` APIs after dependency updates.
- **Docker** — Fix local-test compose build context for the root Dockerfile (#818); restore app boot after Dependabot major bumps.
- **CI / develop image** — Broaden CD-Development path filters for image-affecting trees and stop cancelling in-flight publishes so `:develop` reaches GHCR/Docker Hub more reliably.

### Changed

- **CI / releases** — Consolidated PR checks into a single path-aware `ci.yml` with a required `ci-pass` aggregator; Dependabot + nightly dependency audit; automated Prepare/Finalize release workflows (`rc/v*` → tag → publish) and `scripts/bump_version.py` as the version source of truth.
- **Dependencies** — Large pip, GitHub Actions, npm (root + desktop), and Flutter mobile dependency bumps.

### Documentation

- First-five-minutes checklist after Docker quick start; demo credentials beside the live demo link; refreshed dashboard screenshot; community/discovery funnel tweaks.
- Release and version docs aligned with Prepare/Finalize + `bump_version.py` (superseding manual GitHub Releases / `version-manager.sh` as the primary path).

## [5.18.5] - 2026-10-30

### Security

- **Audit logs / 2FA secret (#801)** — Stop writing `two_factor_secret` (and other secret fields such as Settings API keys/client secrets and client portal credentials) into audit log `old_value`/`new_value`. Existing leaked values are scrubbed by migration `200_scrub_sensitive_audit_log_values`. TOTP remains reversible via optional Fernet encryption at rest, not hashing.

### Added

- **Multi-assignee tasks** — Tasks (and recurring task templates) support multiple equal assignees via `task_assignees` / `recurring_task_assignees`. Create/edit/bulk-assign UI, filters, permissions, kanban, API (`assignee_ids`, legacy `assignee_id`), and workflows updated; existing `assigned_to` values are migrated.
### Fixed

- **Exchange rates** — When exchangerate.host returns no rate (it now requires an access key), try a keyless exchangerate.host-compatible ECB endpoint (AllRatesToday) for the same date before the latest-only fallback.
- **Invoices** — Deleting a draft invoice (single or bulk) now makes its project costs and expenses billable again; before, they stayed marked as invoiced and never appeared on a later invoice.
- **Payments** — Recording a completed payment through the API (and the desktop app) no longer counts it twice in the invoice's amount paid; before, a 1.00 payment showed 2.00 paid and an invoice could read as fully paid early.

### Fixed

- **Saved filter params / CodeQL** — Use a `Map` when applying saved filter query parameters so dynamic object writes cannot overwrite built-in properties (remote property injection).

### Documentation

- **Version** — Bumped `setup.py` to **5.18.5**; `VERSION` and desktop/browser-extension/mobile client versions aligned.

## [5.18.4] - 2026-10-28

### Fixed

- **CSP PDF preview (#797)** — Allow `blob:` iframes via `frame-src 'self' blob:` so PDF template previews are not blocked by Content-Security-Policy.
- **Saved filter params** — Prevent prototype pollution when applying saved filter query parameters.

### Changed

- **Dependencies** — Bump black and OpenTelemetry; desktop Electron and related npm packages; Pillow; follow-redirects.

### Documentation

- **Email configuration** — Added a Groundmail SMTP example to the common email providers in `docs/admin/configuration/EMAIL_CONFIGURATION.md`.
- **Version** — Bumped `setup.py` to **5.18.4**; `VERSION` and desktop/browser-extension/mobile client versions aligned.

## [5.18.3] - 2026-10-22

### Fixed

- **Manual entry project picker with one client (#789)** — When the org has exactly one client, the client field stays pre-filled and readonly (#467 / #753), but the project picker no longer stays disabled. The #728 client→project unlock assumed a real `<select>`; a hidden auto-client now counts as already chosen.

### Documentation

- **Version** — Bumped `setup.py` to **5.18.3**; `VERSION` and desktop/browser-extension/mobile client versions aligned.

## [5.18.2] - 2026-10-13

### Security

- **CodeQL / XSS / redirects** — Clear CodeQL findings; harden DOM sinks and PDF templates; block open redirects via referrer/`next`; centralize `safe_redirect`; keep 5xx API errors generic; rebuild OIDC discovery URLs from validated issuer components.
- **Desktop (Dependabot #222)** — Override transitive `sprintf-js` with a vendored build that caps numeric precision (GHSA-hp3w-g68c-fv3c / CVE-2026-97058) until upstream publishes a fixed release.
- **CSP** — Add nonces to remaining inline scripts.

### Fixed

- **Timer review / idle response** — Import `db` in timer review and idle-response handlers.
- **Docker** — Refresh base packages and upgrade pip/setuptools.
- **Models** — Strip UTF-8 BOMs from timesheet/time-off model modules.

### Changed

- **CI** — Add CodeQL workflow to resume code scanning.

### Documentation

- **Version** — Bumped `setup.py` to **5.18.2**; `VERSION` and desktop/browser-extension/mobile client versions aligned.

## [5.18.1] - 2026-10-11

### Fixed

- **Idle detection (#722, #779, #781)** — Server-authoritative "Still working?" prompts with first-answer-wins tokens and idle-credit math. Client heartbeats only count real activity; stop side effects restored for idle responses. Mobile follows the same protocol; Android idle notification is actionable.
- **Server stability** — A single eventlet worker no longer wedges on database waits; Postgres timeouts are tighter under eventlet.
- **Edit Timer (#777)** — Confirm Changes summary renders as HTML in the edit dialog.
- **Gusto (#778)** — Requests now send `X-Gusto-API-Version` (default `2026-06-15`, overridable with `api_version` in the integration config) instead of falling back to the minimum API version set on the Gusto app.

### Changed

- **CI/CD** — Release build runs only for `v*.*.*` tags on main.
- **README** — Adds a Deploy to Railyard button (#774).
- **Dependencies** — Werkzeug 3.1.9; desktop axios 1.20.0, undici 6.29.0, and related transitive bumps.

### Documentation

- **Version** — Bumped `setup.py` to **5.18.1**; `VERSION` and desktop/browser-extension/mobile client versions aligned.

## [5.18.0] - 2026-10-04

### Added

- **Observability** — Echo `X-Request-ID` on responses and in JSON logs; expose scheduler and outbound-HTTP Prometheus metrics; protect scrapes with `METRICS_TOKEN`; capture critical failures via optional Sentry hooks.
- **PDF footer watermark** — Exported PDFs show a small TimeTracker footer; hidden when a supporter license key is activated.
- **CI security gates** — Bandit (high-severity), pip-audit, and migration-drift checks; full-suite coverage floor raised from 35% to 40%.
- **Instance audit report** — `docs/reports/INSTANCE_AUDIT_2026-10-04.md` records the 2026-10-04 running-instance crawl findings and remediations.

### Changed

- **Ops / production defaults** — Prefer `/_ready` for readiness, serialize startup migrations, recycle Gunicorn workers, require Postgres credentials, and default to secure cookies with optional metrics auth.
- **README** — Restructured for conversion (pitch, badges, demo, one-command NAS quick start); in-app star prompts on About and sidebar. Version highlights deferred to this changelog.
- **Dependencies** — `pyjwt` 2.15.0; desktop Electron 41.10.6.

### Fixed

- **Security** — Close open-redirect and webhook/Peppol SSRF holes; roll back failed DB sessions in global error handlers; require timeouts on integration HTTP calls.
- **Data integrity** — Concurrency-safe invoice sequences; single active timer enforced honestly; TimeEntry commits kept in the service layer; background jobs start only on an elected scheduler leader.
- **Instance audit 500s** — Clear broken template endpoints, missing pages, and Jinja/API bugs found in the 2026-10-04 crawl; harden CSRF/login and nginx header overlap; add regression coverage.
- **Android Chromium Flatpickr freeze (#771)** — Disable Flatpickr mobile mode, harden date-input selectors, and batch MutationObserver work so pages stay usable.

### Documentation

- **Version** — Bumped `setup.py` to **5.18.0**; `VERSION` and desktop/browser-extension/mobile client versions aligned.

## [5.17.2] - 2026-09-25

### Fixed

- **Idle dashboard 429 Too Many Requests (#767)** — Global `RATELIMIT_DEFAULT` was too strict (`50 per hour` per IP) for background timer polling. Default is now `5000 per day;1000 per hour`, keyed per logged-in user (IP for anonymous). Polling endpoints (`/timer/status`, `/api/timer/status`, `/api/timer/heartbeat`, `/api/notifications`, `/service-worker.js`, `/offline`) are exempt. JSON `Accept` / API requests get a JSON 429 body; floating timer bar and idle pollers back off on 429 and skip while the tab is hidden.
- **OpenTelemetry export respects telemetry opt-in** — OTLP export to the baked-in shared Grafana Cloud tenant now requires the telemetry opt-in (`ENABLE_TELEMETRY` / admin toggle). Operator-owned backends configured via explicit `OTEL_EXPORTER_OTLP_ENDPOINT` + `OTEL_EXPORTER_OTLP_TOKEN` still export without the opt-in. Metric attributes are normalized (status class, environment) and `http.server.duration` histogram buckets are tightened.

### Documentation

- **Version** — Bumped `setup.py` to **5.17.2**; `VERSION` and desktop/browser-extension/mobile client versions aligned.

## [5.17.1] - 2026-09-23

### Fixed

- **Health probes rate-limited** — `/_health`, `/_ready`, `/api/health`, and `/api/v1/health` are now exempt from the default rate limit. Render probes `/_health` every 5s from a single IP, which exceeded the default limit, returned 429, and caused the instance to be marked unhealthy and restarted (surfacing as 502s).

### Documentation

- **Version** — Bumped `setup.py` to **5.17.1**; `VERSION` and desktop/browser-extension/mobile client versions aligned.

## [5.17.0] - 2026-09-23

### Added

- **Factur-X / ZUGFeRD compliance (Discussion #433)** — Structured company and client addresses (street, postcode, city, country), IBAN/BIC, default and per-invoice VAT category (S/Z/E/AE/K/G/O) with AT/DE Kleinunternehmer and reverse-charge presets (migration **196**). Invoice PDFs embed Liberation TrueType fonts for PDF/A font compliance. Single-pass Factur-X embed + PDF/A-3b (catalog `/AF`, pdfaExtension XMP, OutputIntent). CII XML fixes for EN 16931 (element order, currencyID only on TaxTotalAmount, correct VAT exemptions, Peppol endpoint as URIID, payment means, prepaid amounts). Pre-export validation blocks missing seller/buyer country or AE without buyer VAT ID.
- **Idle unanswered action (#722)** — Admin setting `idle_unanswered_action` (`review` default, or `auto_stop`) controls what happens when the "Still working?" grace window expires unanswered. Auto-stop credits last activity plus the idle timeout across the server sweep, web, browser extension, desktop, and mobile clients.
- **Phase 4 (gap roadmap)** — GDPR user erasure (`UserGdprService`, `POST /api/v1/users/me/erase`, admin `POST /admin/users/<id>/erase`, `POST /api/erase-account`); API v1 list/get for weekly goals, recurring tasks, and project templates; estimates vs actuals report (HTML + JSON); two-step timesheet period approval when multi-level policy is enabled; experimental XRechnung XML helper; Mollie payment provider skeleton; admin module quick presets (Solo focus); custom field definitions `entity_type` for client/project/task/time entry (migration **197**).
- **Phase 5 enterprise foundations** — Design docs under `docs/design/` (OAuth 2.0 API apps, SAML/SCIM, multi-tenant, Zapier/Make webhooks, Teams bot parity). Scaffolding: OAuth application models (migration **198**), optional SCIM `GET /scim/v2/Users` stub (`SCIM_ENABLED`), `POST /api/v1/ai/summarize-entries`, Teams bot command stub.

### Changed

- **Security / hygiene** — Legacy integration webhook CSRF-exempt; default `RATELIMIT_DEFAULT`; rate limits on version check/dismiss; hot-path silent `except`/`pass` replaced with logged handling; Ruff S110 enabled; admin API tokens/backups and API v1 audit-logs extracted from god files.
- **UI consistency** — Bootstrap leftover class cleanup; shared `ttConfirm`/`ttAlert` dialogs; empty states on major list pages; expanded command palette; client versions aligned to **5.17.0**.
- **Dead code** — Removed unregistered `timer_refactored.py`, `invoices_refactored.py`, `projects_refactored_example.py`, `offers.py`.

### Documentation

- **Factur-X / ZUGFeRD** — [PEPPOL_EINVOICING.md](docs/admin/configuration/PEPPOL_EINVOICING.md) updated for structured addresses, VAT categories, embedded fonts, single-pass PDF/A-3, and migration **196**.
- **Gap roadmap** — `docs/GAP_ROADMAP.md` tracks Phases 0–5 remediation status.
- **Version** — Bumped `setup.py` to **5.17.0** (single source of truth for the application version).

## [5.16.0] - 2026-09-18

### Added

- **Client–team messaging** — New `ClientMessage` model, message service, and UI for bidirectional in-portal messaging between the internal team and client contacts; threads visible from both the client view and the client portal (migration **194**).
- **Email thread sync (Gmail & Outlook)** — `GmailConnector` and `OutlookEmailConnector` pull email threads from Gmail API and Microsoft Graph and link them to CRM clients, leads, and deals; `EmailSyncService` handles OAuth token refresh and incremental sync; dedicated setup wizards for both providers.
- **Payroll sync (Gusto & ADP)** — `GustoConnector` and `AdpConnector` aggregate time entries into payroll batches and push them to Gusto's Partner API and ADP Workforce Now; `PayrollSyncService` builds period-scoped batches and `PayrollSyncLog` tracks sync history (migration **194**).
- **DATEV accounting export** — `DatevConnector` generates EXTF Buchungsstapel CSV for direct import into DATEV; `datev_export.py` utility handles the format spec.
- **Sage Business Cloud integration** — `SageConnector` syncs invoices, contacts, and payments with Sage Business Cloud Accounting via OAuth2.
- **Integration setup wizards** — Guided step-by-step wizards for ADP, DATEV, Gmail, Gusto, Outlook Email, and Sage make credential configuration consistent with existing integrations.
- **Visual workflow builder** — Drag-and-drop canvas (`visual_builder.html`) for constructing automation workflows without editing JSON; accessible alongside the existing form editor.
- **Portal custom domain resolution** — `portal_domain.py` utility resolves white-label client portal hosts to the correct `Client` record, enabling custom-domain client portals when `portal_allowed_custom_domains` is enabled.
- **Client Portal REST API** — `api_v1_client_portal.py` blueprint exposes authenticated REST endpoints for portal sessions and client data access.

### Documentation

- **Version** — Bumped `setup.py` to **5.16.0** (single source of truth for the application version).

## [5.15.0] - 2026-09-16

### Added

- **Timer start-time override (#760)** — Start a new timer at a custom time, or adjust the start while already running; the timer page and API both support the override.
- **Pomodoro / Focus sessions** — Pomodoro sessions are now wired into the timer API and UI so focus blocks are tracked and surfaced alongside regular time entries.
- **Expense lifecycle on mobile & desktop** — Full expense CRUD (submit, approve, reject, reimburse) now available in the Flutter mobile and Electron desktop clients.
- **Payroll export templates** — Admins can configure reusable payroll export templates (admin panel + geofence management pages); exports are rendered via the template engine.
- **QuickBooks & Xero sync depth** — Extended accounting sync covers additional entity types, mapping, and error-route handling for both integrations.
- **ActivityWatch rules, inbox & sync errors** — Rules engine and merge filters for ActivityWatch events; a dedicated review inbox and sync-error route surface unmatched entries.
- **Gamification — badges, leaderboards & award hooks** — Badge definitions, leaderboard calculations, and award-hook endpoints exposed via the API for team engagement features.
- **Calendar drag-and-drop** — Events on the calendar view can be moved and resized by dragging, updating the underlying time entry in real time.
- **Recurring project cost engine** — Projects can have recurring costs that are calculated and posted automatically on a configured schedule.
- **Public shareable report links** — Reports can be shared via a public, tokenized URL without requiring the recipient to log in.
- **Geofencing policies** — Attendance module gains location-based clock-in policies; admin UI added for geofence management.
- **Gap-feature models & dashboard surface** — New database models and migrations for the product-gap backlog; key features registered and surfaced on the main dashboard.
- **Mobile API extensions** — Flutter client extended with expense, report, and geofencing API calls.
- **New API endpoints** — Focus sessions, recurring project costs, and shared report endpoints added to the REST API.

### Fixed

- **Inventory PO lines & edit form (#759)** — Correct stock IDs on PO lines and restore the broken edit form.
- **Migrations PostgreSQL boolean defaults** — Migration server defaults now use `true`/`false` literals instead of `1`/`0` for PostgreSQL compatibility.
- **Dashboard Open Timer link** — Use the correct `timer_page` endpoint for the "Open timer" link so it no longer 404s.

### Changed

- **Dependencies** — Bumped `weasyprint` (pip group).

### Documentation

- **Version** — Bumped `setup.py` to **5.15.0** (single source of truth for the application version).

## [5.14.1] - 2026-09-09

### Fixed

- **Docker base images (expired Bullseye security repo)** — Upgrade `node:18-slim` → `node:20-slim` (satisfies sharp’s Node engine) and `python:3.11-slim-bullseye` → `python:3.11-slim-bookworm` so `apt-get update` no longer fails on fresh CI builds after Debian 11’s bullseye-security InRelease expired.

### Documentation

- **Version** — Bumped `setup.py` to **5.14.1** (single source of truth for the application version).

## [5.14.0] - 2026-09-09

### Added

- **OrcaRouter AI provider** — Added `orcarouter` as a named AI provider option (OpenAI-compatible endpoint, standard Bearer-token auth). Admins can select it in System Settings → AI Helper or set `AI_PROVIDER=orcarouter` with `AI_BASE_URL=https://api.orcarouter.ai`.

### Documentation

- **Version** — Bumped `setup.py` to **5.14.0** (single source of truth for the application version).

## [5.13.5] - 2026-09-08

### Fixed

- **Timezone `local_date` crash on plain dates** — Dashboard crashed when `Task.due_date` (a calendar date) was piped through `|local_date`, which assumed a datetime and read `.tzinfo`. Skip timezone conversion for date-only values, matching `format_user_datetime`.
- **Idle auto-stop on paused timers (#752)** — Paused timers stop heartbeating, so the idle sweep treated them as idle: “Still working?” push, needs-review flag, then optional auto-stop. Guard the idle query on `paused_at IS NULL` so intentionally paused timers are skipped.
- **Manual entry single-client lock (#753)** — The manual time-entry form passed `force_selectable=True` to the client select, which bypassed the single-client readonly lock. Dropping the flag restores the pre-filled lock when the org has exactly one client.

### Changed

- **Client versions** — Synced Electron (`desktop/package.json`), Flutter (`mobile/pubspec.yaml`), and Chromium extension (`browser-extension/manifest.json` / `package.json`) to **5.13.5** with the webapp (`setup.py`).

### Documentation

- **Version** — Bumped `setup.py` to **5.13.5** (single source of truth for the application version).

## [5.13.4] - 2026-09-04

### Fixed

- **Alembic multiple heads** — Parallel migrations `183_add_device_token_push_subscription` and `183_add_idle_needs_review` both branched from `182_add_project_last_used_at`, so `flask db upgrade` failed with multiple heads. No-op merge migration `184_merge_183_heads` rejoins them into a single head.

### Changed

- **Client versions** — Synced Electron (`desktop/package.json`), Flutter (`mobile/pubspec.yaml`), and Chromium extension (`browser-extension/manifest.json` / `package.json`) to **5.13.4** with the webapp (`setup.py`).

### Documentation

- **Version** — Bumped `setup.py` to **5.13.4** (single source of truth for the application version).

## [5.13.3] - 2026-09-02

### Added

- **Tracked hours on tasks (#745)** — Task list replaces the redundant Actions column with Tracked hours; task detail surfaces totals; CSV export includes Tracked Hours via a bulk aggregate.
- **Idle needs-review flow** — When a running timer's idle grace expires while no TimeTracker window can answer (tab closed, machine asleep), the time entry is now flagged **needs review** instead of silently lost. A review banner in the web app, a push notification via the service worker, and scheduled-task detection surface these entries so they can be confirmed or corrected; the behavior is configurable in Admin → Settings. The desktop app and browser extension report the same situation, and the v1 API exposes flag/resolve endpoints. Includes migration `183_add_idle_needs_review`.

### Changed

- **Client versions** — Synced Electron (`desktop/package.json`), Flutter (`mobile/pubspec.yaml`), and Chromium extension (`browser-extension/manifest.json` / `package.json`) to **5.13.3** with the webapp (`setup.py`).

### Fixed

- **Idle timeout / Still working? across clients (#722)** — Extension heartbeats no longer defeat the server safety net when `chrome.idle` is unreliable; backgrounded mobile gets FCM wake-up; the idle scheduler is hardened so forgotten timers cannot run for hours.
- **"Service temporarily unavailable" after leaving the dashboard open (#746)** — When the backend went down (or a background tab resumed with stale sockets) while a page stayed open, the service worker answered `/api/*` with a plain-text `Offline` body, so `.json()` parsing threw `SyntaxError`; the chat widget re-polled every 30 seconds forever; and identical error toasts stacked up and evicted the ones carrying Retry/Refresh. Synthetic offline responses are now JSON, remaining background polls (chat, activity feed, kanban) back off after failure and pause in hidden tabs, error toasts dedupe with theme-aware actions, a resume health sweep clears leftover connectivity toasts, and the offline indicator bar is removed as soon as connectivity is restored.
- **Onboarding tour could not be dismissed** — The tour could auto-start twice, stacking a second overlay above its own skip-confirmation dialog, and `!important` z-indexes plus step-transition timers re-raised the tooltip over the "Are you sure you want to skip the tour?" prompt. A double-init guard, non-forced layering, and a pending-skip guard keep the confirmation readable and the tour dismissible.
- **Datetime fields ignore the chosen time format** — Native `datetime-local` inputs (the "Forgot to end your workday?" workday modals, workday history corrections, contact/deal/lead activity forms) render in the browser locale — e.g. 12h AM/PM on en-US — no matter what time format the user or system settings chose. They are now initialized as Flatpickr datetime pickers that display in the user's preferred date + time format (24h by default) while still submitting the same wire format; min/max bounds move to the picker. A regression test enforces that every `datetime-local` input stays prefs-aware. The recurring-tasks "last run" cell and the admin version-update published timestamp also now honor the preference instead of the browser locale.

### Documentation

- **Version** — Bumped `setup.py` to **5.13.3** (single source of truth for the application version).

## [5.13.2] - 2026-08-27

### Added

- **Linear setup wizard** — Guided API-key wizard for Linear so integration setup matches the other providers; the connector registry is re-exported from the integrations package init.

### Changed

- **Mobile start timer flow** — Client, project, and task selection in the start timer sheet now use one consistent searchable picker; picking a client filters the project list to that client and picking a project filters tasks accordingly. Projects can also be picked directly without choosing a client first, which then auto-fills the client. Typing an unknown name offers inline "Create …" for clients, projects, and tasks via the existing v1 endpoints. The projects screen is sorted by most recently used (`last_used_at`) so recent work can be restarted with one tap.
- **Client versions** — Synced Electron (`desktop/package.json`), Flutter (`mobile/pubspec.yaml`), and Chromium extension (`browser-extension/manifest.json` / `package.json`) to **5.13.2** with the webapp (`setup.py`).

### Fixed

- **Web manual entry cascade & inline create (#728)** — Manual time logging and the dashboard start-timer modal now follow the mobile start-timer flow: pick a client first (the project picker unlocks only then), then one of that client's projects, then a task of that project. The client field stays a real searchable dropdown even when only one client exists, so another client can be picked or created inline; a newly created client is selected automatically. Inline project creation attaches automatically to the selected client — the client dropdown is replaced by a read-only display with an editable hourly rate pre-filled from the client default — instead of asking for a client again. Inline task creation creates the task immediately from the combobox "Create …" row (no confirmation modal) for the preselected project.
- **Searchable combobox dark mode & typing (#728)** — Combobox dropdowns build their DOM in JS with utility classes Tailwind purged from the stylesheet, leaving white-on-white rows in dark mode; the dropdown now uses always-emitted component classes (`tt-searchable-*`) with proper dark hover/selected states. Focusing a combobox selects its text so typing replaces the committed label instead of appending to it. Source-controlled assets (`searchable-select.js`, `inline-create.js`, `dist/output.css`) are served with mtime-based version queries via a new `static_url()` helper so edits bust the browser cache without a release bump.
- **Mobile start timer crash** — Two `FloatingActionButton`s with the default Hero tag coexisted in the home screen's `IndexedStack`, turning the screen red whenever a route was pushed on top (e.g. the start timer sheet); the Entries tab FAB now has a unique `heroTag`.
- **Mobile inline creation selection** — The v1 create endpoints wrap the payload (`{"message": …, "<entity>": {…}}`); unwrapping it ensures a newly created client/project/task is selected immediately in the start timer sheet.
- **Mobile stop/pause flicker** — Background timer polling no longer toggles `isLoading`, which disabled the Stop and Pause buttons for the duration of each 5-second sync; the flag is now reserved for user-initiated actions.
- **Android release signing** — CI signs release APKs with a stable keystore so updates install over previous builds.

### Documentation

- **Version** — Bumped `setup.py` to **5.13.2** (single source of truth for the application version).

## [5.13.1] - 2026-08-26

### Changed

- **Projects sorted by last used (#738)** — Timers and manual entries stamp `last_used_at` on projects so pickers and API lists surface recent work ahead of alphabetical order (migration **182**).
- **Client versions** — Synced Electron (`desktop/package.json`), Flutter (`mobile/pubspec.yaml`), and Chromium extension (`browser-extension/manifest.json` / `package.json`) to **5.13.1** with the webapp (`setup.py`).
- **Chrome extension release zip** — GitHub Releases now attach a ready-to-install Chromium extension zip alongside desktop and mobile artifacts.

### Fixed

- **Idle timeout duration & prompts (#722)** — Auto-stop credits `last_active + idle_timeout` instead of recording 0 minutes; web and extension surface “Still working?” notifications, and mobile polls `idle_notified` while backgrounded.
- **Searchable picker blur & Create project (#728)** — Comboboxes reset to the committed selection on blur so typed-but-unselected text cannot look like a form change; Create project stays hidden until a client is chosen; no auto-selected project; Create labels are translated.
- **Extension Create project guard** — Re-applied the client-required guard on the project picker after the last-used sort change so create-without-client stays blocked.

### Documentation

- **Version** — Bumped `setup.py` to **5.13.1** (single source of truth for the application version).

## [5.13.0] - 2026-08-23

### Added

- **Dashboard daily progress widget** — Compact strip showing today's tracked hours vs target with a quick-start timer button directly on the dashboard.
- **Dashboard quick-log & tasks due today** — One-click time log form and a "Tasks due today" widget surface the most time-sensitive work without leaving the home screen.
- **Backend dashboard alerts & productivity breakdown** — Server-side alert rules for overdue timers, approaching daily targets, and idle sessions; new productivity breakdown API for the dashboard.
- **Timer long-run warning** — Active timers exceeding a configurable threshold display an in-page warning and show workday progress against the daily goal.

### Changed

- **Dashboard & list UX polish** — Consolidated dashboard alert banners, list-view sort/filter controls, and empty-state illustrations unified across all entity lists.
- **Navigation declutter** — Sidebar collapsed-mode tooltips and mobile "More" drawer reorganised; key destinations (Reports, CRM, Finance) promoted to top-level slots.
- **Recurring tasks list** — Added status filter chips, column-level toggles (pause/resume/run now), and an inline "Run now" action without leaving the list.
- **Floating timer bar & idle-stop** — Redesigned compact bar with project/task labels, elapsed counter, and a smoother idle-boundary stop flow.
- **Client versions** — Synced Electron (`desktop/package.json`), Flutter (`mobile/pubspec.yaml`), and Chromium extension (`browser-extension/manifest.json` / `package.json`) to **5.13.0** with the webapp (`setup.py`).

### Fixed

- **Productivity heatmap** — Corrected heatmap data aggregation and resolved `empty_state` template render error.
- **Invoice tax rate & currency** — Tax rate and currency now resolve correctly from the linked project and client settings when generating an invoice.
- **Swallowed errors (#736)** — Previously silent exceptions now log at the appropriate level; actionable failures surface feedback toasts to the user.
- **Timer heartbeats (#736)** — Heartbeat pings stay alive through network interruptions and the timer stops cleanly at the idle boundary.
- **Client portal admin template** — Added the missing customisation admin template that caused a 500 on the portal settings page.
- **Recurring tasks CRUD** — Completed create/edit/delete flow and restored sidebar navigation link for recurring tasks.

### Documentation

- **Version** — Bumped `setup.py` to **5.13.0** (single source of truth for the application version).

## [5.12.0] - 2026-08-20

### Added

- **Task dependencies** — Model blockers between tasks so work cannot start out of order; dependency arrows appear on the Gantt chart (migration **179**).
- **Project milestones** — Named due-date checkpoints with task grouping and a timeline on the project page (migration **180**).
- **Billable utilization report** — Report and dashboard widget for billable vs total hours by user or project.
- **Expense approval queue** — Dedicated manager review flow with reject, bulk-approve, and a pending badge in the UI.
- **Quote digital signatures** — Clients can sign and accept quotes in the portal; the captured signature embeds on the quote PDF (migration **181**).
- **Resource scheduling** — Weekly swimlane view of planned tasks and capacity per person to spot over-allocation early.
- **Project health dashboard** — Aggregate budget burn, task completion, milestones, and overdue work into one status view (and API).

### Fixed

- **Dashboard Start Timer modal (#734)** — Restored click handlers after the picker refactor so the dashboard button, FAB, and shortcut callers open the modal again.
- **Approvals PostgreSQL enum case** — Recreate the `approvalstatus` type with lowercase labels so `/approvals` no longer 500s when querying `status='pending'`.

### Changed

- **Client versions** — Synced Electron (`desktop/package.json`), Flutter (`mobile/pubspec.yaml`), and Chromium extension (`browser-extension/manifest.json` / `package.json`) to **5.12.0** with the webapp (`setup.py`).

### Documentation

- **Version** — Bumped `setup.py` to **5.12.0** (single source of truth for the application version).

## [5.11.5] - 2026-08-15

### Added

- **API client-only timer start (#728)** — `POST /api/v1/timer/start` accepts `client_id` without `project_id` (parity with the web timer), rejects `task_id` on client-only starts, and documents the request body in OpenAPI / REST docs.
- **Native client-only timers (#728)** — Extension, mobile, and desktop can start timers against a client without a project; cascading client→project pickers and corrected running-timer labels for client-only sessions.
- **Global time rounding policy (#725)** — Admin Settings can set interval, method, and minimum billable duration for the whole installation, with an **Enforce for all users** toggle that locks personal overrides so everyone tracks time the same way.

### Changed

- **Searchable timer pickers on remaining pages (#728)** — Timer page, bulk entry, and kiosk timer forms use the shared searchable client/project/task combobox stack; scripts load from `base.html` / kiosk base so pages need not re-include them.
- When enforcement is off, unset per-user method and minimum now inherit the admin defaults (interval already did).
- **Client versions** — Synced Electron (`desktop/package.json`), Flutter (`mobile/pubspec.yaml`), and Chromium extension (`browser-extension/manifest.json` / `package.json`) to **5.11.5** with the webapp (`setup.py`).

### Fixed

- **Inline create CSRF header mismatch (#728)** — Client and project inline creates send `X-CSRFToken` (same as task create and the rest of the app).
- **Searchable combobox a11y (#728)** — Combobox inputs expose `aria-autocomplete`, stable option ids, `aria-activedescendant`, and `aria-selected` while navigating the list.
- **Boundary rounding skipped on duration overrides (#725)** — Paths that pass `duration_seconds` (model init, manual-entry service/repo, CSV/Toggl/Harvest imports) now adjust start/end via `round_entry_boundaries` when the method is `boundary`, instead of leaving raw timestamps with a separately stored duration.
- **Email absolute links / APP_BASE_URL admin setting (#730 follow-up)** — Notification emails build links via `safe_external_url_for` and prefer pre-built URL context vars; admins can set the public app base URL in Settings so background email buttons stay absolute.
- **Kiosk stop left duration NULL** — Stopping a timer from the kiosk now goes through `TimeTrackingService.stop_timer`, so `duration_seconds` is computed and rounded like every other stop path (entries no longer vanish from reports and invoices).
- **Quote approval emails raised ImportError** — Implemented `send_quote_approval_request_notification`, `send_quote_approved_notification`, and `send_quote_approval_rejected_notification` so request/approve/reject no longer 500 after a successful commit.
- **Client portal quote accept/reject emails never sent** — Switched the broken `send_email(to=..., template=...)` calls to `send_template_email`, so admins are notified when a client accepts or rejects a quote.
- **Client notification email buttons were relative** — Outbound client portal emails now absolutize `link_url` with `APP_BASE_URL`; overdue invoice checks also create client portal notifications.
- **Dead Jinja blocks (analytics/kanban/tasks)** — Added `extra_head` to `base.html` and renamed `head_extra` overrides so i18n bootstrap and cache-control meta tags actually render; un-nested mis-placed `extra_css` blocks.
- **Desktop React manual entry posted invalid payload** — New time entry dialog now sends `start_time`/`end_time` (API schema) instead of `duration_minutes`/`date`.
- **Extension ignored server idle_notified** — Status poll now enters the same “Still working?” grace window when the server has already marked the timer idle.
- **Android Timer crash under R8 (#731)** — Keep Gson TypeToken signatures for `flutter_local_notifications` in release builds, disable R8 full mode, and make idle notification show/cancel non-fatal so a plugin failure cannot blank the Timer screen.

### Documentation

- **Version** — Bumped `setup.py` to **5.11.5** (single source of truth for the application version).
- **Time rounding** — Documented admin global policy and **Enforce for all users** in `docs/TIME_ROUNDING_PREFERENCES.md`.

## [5.11.4] - 2026-08-13

### Added

- **Boundary rounding & minimum billable duration (#725)** — Users can round start down / end up to interval boundaries, and set a per-user minimum billable duration. When a user has not customized their interval, the admin `Settings.rounding_minutes` fallback applies.
- **Searchable client/project combobox with inline create (#728)** — Timer and edit forms use a filterable combobox with Create rows; shared modals create clients and projects without leaving the page. Client-only entries no longer force-select the first project.
- **Server-side idle heartbeats (#722)** — Timers track `last_heartbeat_at`; a scheduled job auto-stops forgotten timers when clients go offline. “Still working?” prompts are wired across web, extension, mobile, and desktop, including Socket.IO broadcast beyond web push.

### Fixed

- **Per-user rounding gaps (#725)** — Pomodoro, manual-entry service overrides, CSV/Toggl/Harvest imports, and ActivityWatch no longer store raw `duration_seconds` and skip rounding.
- **Attendance Approve button dropped on submit (#709)** — Disabling the clicked Approve/Reject button during loading no longer strips its `name` from the form, so the decision reaches the server.
- **Chrome extension task/project picker races (#700)** — Stale task loads are discarded with a generation counter; tasks and paginated projects are deduped by id.
- **Idle-tab 503 toasts (#703)** — Dashboard and notification polls are quieted and skipped while the document is hidden so resume no longer sticks on unavailable toasts.
- **Client detail API joinedload (#716)** — `GET /api/v1/clients/<id>` no longer eager-loads the dynamic `Client.projects` relationship (regression coverage added).

### Changed

- **Client versions** — Synced Electron (`desktop/package.json`) and Flutter (`mobile/pubspec.yaml`) to **5.11.4** with the webapp (`setup.py`).

### Documentation

- **Version** — Bumped `setup.py` to **5.11.4** (single source of truth for the application version).
- **Time rounding** — Documented boundary method, minimum billable duration, and admin interval fallback in `docs/TIME_ROUNDING_PREFERENCES.md`.

## [5.11.3] - 2026-08-11

### Fixed

- **Manual-entry rounding uses deprecated query API (#725)** — Replaced `User.query.get` with `db.session.get` when resolving the target user for duration rounding on the manual entry form, silencing the SQLAlchemy 2.x deprecation warning and aligning with the recommended session API.

### Changed

- **Client versions** — Synced Electron (`desktop/package.json`) and Flutter (`mobile/pubspec.yaml`) to **5.11.3** with the webapp (`setup.py`).

### Tests

- Added integration tests for the start-timer 409 conflict payload (#700), transient `calculate_duration` rounding (#725), and explicit manual-entry duration rounding to catch double-apply and override-ignored regressions.

### Documentation

- **Version** — Bumped `setup.py` to **5.11.3** (single source of truth for the application version).

## [5.11.2] - 2026-08-09

### Fixed

- **Attendance correction Approve silently rejected (#709)** — Review forms treated a missing `action` field as Reject, so incomplete POSTs (e.g. pressing Enter in the comment box without a successful submit button) rejected corrections and left history unchanged. Approve/Reject now use distinct button names, a missing decision returns an error instead of rejecting, and applying an approval checks the DB commit and rolls back on failure so history times update reliably.
- **Chrome extension task picker empty for custom Kanban statuses (#700)** — The extension and `status=open` / `status=active` API aliases used a fixed allowlist of statuses, so tasks in custom columns (e.g. `blocked`) never appeared. Open now means “not `done` or `cancelled`” (aligned with `Task.is_active`). The extension requests `status=open`, shows non-todo status next to the task name, reloads tasks when the project filter changes the selection, and still surfaces load errors visibly.
- **Chrome extension task picker missing on-hold tasks (#700)** — Tasks with status `on_hold` are active (`Task.is_active`) and appear in the web UI, but the extension (and the `status=open` / `status=active` API aliases) only included `todo`, `in_progress`, and `review`. On-hold tasks are now included, and the extension surfaces a visible error when the task list fails to load (e.g. missing `read:tasks` scope) instead of showing an empty dropdown.
- **Idle “Still working?” prompt never stopped the timer** — After the idle timeout prompt, dismissing or ignoring it left timers running indefinitely. Web and the browser extension now enforce a 5-minute grace window and auto-stop; the v1 timer API exposes `idle_timeout_minutes` and accepts `stop_time` for accurate stop timestamps.

### Changed

- **Client versions** — Synced Electron (`desktop/package.json`) and Flutter (`mobile/pubspec.yaml`) to **5.11.2** with the webapp (`setup.py`).

### Documentation

- **Version** — Bumped `setup.py` to **5.11.2** (single source of truth for the application version).

## [5.11.1] - 2026-08-06

### Changed

- **Client versions** — Synced Electron (`desktop/package.json`) and Flutter (`mobile/pubspec.yaml`) to **5.11.1** with the webapp (`setup.py`).

### Documentation

- **Version** — Bumped `setup.py` to **5.11.1** (single source of truth for the application version).

## [5.11.0] - 2026-08-06

### Added

- **Auto-deduct break on clock-out** — Admins can opt in to automatically inserting a meal break when a workday exceeds a configurable threshold and insufficient break time was logged, reducing manual corrections for regulated break rules. Enabled via Admin → Settings (new `AUTO_BREAK_DURATION_MINUTES` / `AUTO_BREAK_THRESHOLD_MINUTES` settings; migration `173_add_auto_break_settings`).
- **Smart auto-break fill** — When a partial manual break already exists, only the remaining deficit minutes are inserted on clock-out. Auto-inserted breaks are flagged with `is_auto_break` so they can be distinguished from manual entries.
- **Mobile timer notification (#714)** — Android keeps a foreground-service notification and iOS shows a local notification with project/task name and elapsed time while a timer is running, so users notice forgotten timers.

### Fixed

- **Time correction causes exception (#709)** — Fixed Flask-SocketIO room handlers that called nonexistent `socketio.join_room` / `socketio.leave_room` (use module-level `join_room` / `leave_room` instead). Attendance correction requests now appear on `/workday/history` (requester's own list), on `/approvals` for admins and requesters, and under a new sidebar link **Attendance Corrections**. The "Correct period" form now pre-fills and parses times in the user's timezone.
- **Overnight totals clipped (#706 follow-up)** — Sessions crossing midnight no longer inflate "At work today". Totals are clipped to the requested day, and auto-closed shifts show a dashboard prompt so users can confirm or correct their leave time before starting a new day.
- **Chrome extension task picker empty (#700)** — The popup requested tasks with `status=active`, which is not a valid task status, so existing tasks never appeared in the dropdown. The extension now loads open tasks (`todo`, `in_progress`, `review`) without that filter, and `GET /api/v1/tasks` accepts `status=active` / `open` aliases plus comma-separated status values for older extension builds.
- **Client projects joinedload error (#716)** — `GET /api/v1/clients/<id>` raised `InvalidRequestError` because `joinedload` cannot be applied to a `lazy='dynamic'` relationship.
- **OpenAPI spec missing Tasks and Clients endpoints** — The `/api/openapi.json` document was missing all paths for the Tasks and Clients groups despite the endpoints being fully functional. Added 5 Tasks paths (`/tasks`, `/tasks/{task_id}`) and 14 Clients paths (`/clients`, `/clients/{client_id}`, `/clients/{client_id}/contacts`, `/contacts/{contact_id}`, `/clients/{client_id}/notes`, `/client-notes/{note_id}`, `/clients/{client_id}/invoice-unbilled`). Fixed `Task.priority` schema type from `integer` to `string` enum; expanded `Client` schema from 4 to 16 properties; added `Contact` and `ClientNote` schemas.

### Documentation

- **Version** — Bumped `setup.py` to **5.11.0** (single source of truth for the application version).

## [5.10.1] - 2026-07-25

### Added

- **Forgot overnight clock-out (#706)** — If a workday stays open past midnight, the dashboard and Timer page prompt for the actual leave time so yesterday can be corrected before starting a new day. Smart notifications also warn when an overnight session is still open. `POST /workday/end` and `POST /api/v1/workday/end` accept optional `end_time`.

### Fixed

- **Chrome extension connect did nothing (#700)** — `browser-extension/lib/api.js` was never shipped because root `.gitignore` ignored `lib/`. Connect/Options/background module imports failed silently. The client is now tracked, and Options connect handlers surface unexpected errors.
- **Time entry typing and edit date format (#704 follow-ups)** — Typing `1234` into a time field now becomes `12:34` (not `12:04`). Edit/bulk/calendar date inputs use the user's preferred date format (e.g. DD.MM.YYYY), and edit-page timestamps use `|user_datetime`.
- **Dashboard “At work today” double-count** — Live workday updater no longer adds full session elapsed on top of server hours that already include the active period.

### Changed

- **Client versions** — Synced Electron (`desktop/package.json`) and Flutter (`mobile/pubspec.yaml`) to **5.10.1** with the webapp (`setup.py`).

### Documentation

- **Version** — Documented release **5.10.1** to match `setup.py` (single source of truth for the application version).

## [5.10.0] - 2026-07-23

### Added

- **Admin book time for others (#701)** — Admins can create manual and bulk time entries (and API v1 creates) on behalf of another active user.
- **Chromium timer extension (#700)** — New `browser-extension/` Manifest V3 package connects to `/api/v1` (same tokens as desktop/mobile), starts/stops timers from the toolbar, shows elapsed time on a red badge/icon, and supports quick-create project/task. Load unpacked from the folder; see `browser-extension/README.md`.
- **Self-hosted frontend assets** — All 17 third-party browser libraries (Font Awesome, Chart.js, flatpickr, Socket.IO, Toast UI Editor, Pickr, Konva, SortableJS, FullCalendar, frappe-gantt, anime.js, cmdk, and the Inter webfont) are now vendored into `app/static/vendor/` from npm instead of being fetched from cdnjs, jsDelivr, uicdn.toast.com and fonts.bunny.net at runtime. The app renders fully with no outbound network access, which makes air-gapped installs work and stops leaking every user's IP address to three CDNs.
- **JavaScript build pipeline** — New esbuild-based build (`scripts/build-js.mjs`) minifies and bundles the previously unbundled scripts into content-hashed files resolved through a new `asset_url()` Jinja helper (`app/utils/assets.py`). The dashboard drops from **32 JS requests / ~550 KB to 12 requests / ~284 KB**.
- **First-run module presets** — The setup wizard asks what you will use TimeTracker for and switches off modules you are unlikely to need. Previously every one of the 41 modules was enabled by default, presenting 80+ navigation destinations on a fresh install. The "Just me" preset enables 12 modules; "A team or agency" 28; "Compliance" 35; "Show me everything" keeps the old behaviour. Existing installs are unaffected, and Admin → Modules still controls everything afterwards.
- **Strict CSP (report-only)** — A nonce-based Content-Security-Policy is now emitted as `Content-Security-Policy-Report-Only` alongside the enforced policy, so violations are observable before `'unsafe-inline'` is dropped. All 196 inline `<script>` blocks carry a per-request nonce.
- **End-to-end, CSP and accessibility CI** — New Playwright suite (`tests/e2e/`) runs against the real Docker image, asserting zero CSP violations, that the app renders with every external host blocked, an axe-core accessibility baseline, and a JavaScript page-weight budget. CI previously had eight jobs and none of them opened a browser.
- **Regression guards** — `tests/test_no_external_assets.py` fails the build if a CDN reference, remote font `@import`, duplicate Font Awesome load, or un-nonced inline script reappears. `scripts/check_translation_coverage.py` and `scripts/check_silent_excepts.py` add ratchets that may improve but never regress.

### Fixed

- **Desktop and browser lost connection after idle (#702, #703)** — Closing the desktop app with X (tray hide) or leaving a browser tab idle could leave a sticky "connection lost" / "Service temporarily unavailable" state. Session and health probes now recover on success, re-check when the UI becomes visible again, and health checks no longer toast via the service worker's synthetic 503.
- **24h time format preference ignored (#704)** — Native time inputs followed the browser locale (AM/PM). Flatpickr now respects the user's time format preference, and client-side displays use `formatUserTime` / `formatUserDateTime`.
- **Sidebar expand clipped when collapsed (#699)** — Hide the Commands shortcut in the collapsed rail so the expand control stays visible; clarified the onboarding tip (including Ctrl/Cmd+B).
- **Sidebar expand, theme icons, and Ctrl+K** — Collapse control stays reachable when the rail is narrow; theme switcher shows the current mode icon; command palette loads after its markup so Ctrl+K registers.
- **Socket.IO / Flask session crash** — Bumped Flask-SocketIO for Flask 3.1 compatibility; supporter-key verify logging no longer leaks codes; budget alert jobs push a real app context.
- **Multi-key keyboard shortcuts never worked** — `g d`, `g p`, `g t`, `g r` and `g i` were registered but could never fire: the live handler only ever matched a single key combo, and the sequence-buffering logic existed solely in two script files that no template loaded. Added sequence handling to `keyboard-shortcuts-advanced.js`.
- **Font Awesome loaded twice** — Both the CSS build (6.4.0) and the conflicting SVG-with-JS build (6.4.2) were loaded on every page, roughly doubling the icon payload. Four templates loaded *only* the JS build via a `<script>` tag pointing at a stylesheet, which is a no-op.
- **Command palette broke without internet** — `command-palette.js` imported its scoring helper from jsDelivr at runtime, so Ctrl+K silently failed in offline and air-gapped deployments.
- **Contacts navigation was a dead end** — The CRM menu showed "Contacts (via Clients)" as unclickable grey text. It now links to Clients, with a tooltip explaining that contacts are scoped per client.
- **Silenced dashboard errors** — Donation-metric failures on the dashboard were swallowed entirely, so a genuine database fault appeared only as a slow page. Now logged.
- **Inter webfont fetched from a third party** — `input.css` `@import`-ed the font from `fonts.bunny.net` on every page load. Now self-hosted, shipping only the four latin weights actually declared (8 files instead of the package's 126).
- **Tailwind's `hidden` had no effect on icons** — Font Awesome's `.fa-solid { display: inline-block }` and Tailwind's `.hidden { display: none }` have identical specificity, and Font Awesome was loaded last, so it won. Every element combining `hidden` with an `fa-*` class stayed permanently visible — 27 of them, including the theme switcher, which rendered its light, dark *and* system icons at once. Font Awesome now loads before the compiled Tailwind CSS in all eight templates that load both, and a regression test enforces the order.
- **Rich-text editor failed to load** — Toast UI Editor threw `Cannot read properties of undefined (reading 'PluginKey')` on all ten screens that use it. The npm package's UMD build declares the eight `prosemirror-*` packages as webpack *externals* and `require()`s them at runtime, so they were undefined in the browser; the CDN file it replaced was the "all" build with those dependencies bundled in, which npm does not publish. A genuinely self-contained bundle is now produced from the package's ESM entry by `scripts/build-js.mjs`.
- **CSP Report-Only was inert and drowned the console** — It had no `report-uri`, so browsers had nowhere to send violations ("will not block and cannot report violations"), and because `script-src-attr` was undeclared it fell back to `script-src`, making all ~547 inline event handlers violate on every page load. The policy now declares `script-src-attr 'unsafe-inline'` so it reports only what nonces actually fix, and posts violations to a new rate-limited `/csp-report` endpoint.

### Changed

- **nginx** — `Connection` on the `/socket.io/` proxy is now set conditionally via a `map` instead of being hardcoded to `upgrade`, which is the documented pattern for mixing WebSocket and HTTP long-polling. (This was investigated as the cause of `/socket.io/` handshakes returning HTTP 400; an A/B test returned 200 with both the old and new header, so that report remains open.) Added `gzip` for text assets, which matters now that vendored libraries are served exactly as their packages ship them (the Toast UI bundle compresses 580 KB → 209 KB).
- **`base.html` split into partials** — Reduced from 2,614 to ~1,267 lines by extracting `partials/_head.html`, `_sidebar.html` and `_topbar.html`, and relocating 309 lines of inline CSS into `app/static/src/input.css`.
- **Removed ~4,800 lines of dead frontend code** — Ten static assets and one duplicate macro library that no template referenced: `commands.js`, `global-fab.js`, `keyboard-shortcuts.js`, `keyboard-shortcuts-enhanced.js`, `quick-actions.js`, `reports-enhanced.js`, `kiosk-mode.css`, `ui-enhancements.css`, `css/brand-colors.css`, `css/rtl-support.css`, `templates/_components.html`, plus eight unused `pdf_editor/*.mjs` re-export stubs.
- **CSP no longer allowlists any third party** — Removed six CDN origins plus stale `code.jquery.com` and `cdn.datatables.net` entries, and added `object-src 'none'`, `base-uri 'self'` and `form-action 'self'`.
- **Client versions** — Synced Electron (`desktop/package.json`) and Flutter (`mobile/pubspec.yaml`) to **5.10.0** with the webapp (`setup.py`).

### Documentation

- **Version** — Documented release **5.10.0** to match `setup.py` (single source of truth for the application version).

## [5.9.4] - 2026-07-23

### Added

- **Desktop app catch-up** — Timer pause/resume (incl. tray), Reports summary view, workday/attendance controls matching mobile, Kanban board, CRM (leads/deals/contacts/notes), and finance depth (payments, mileage, quotes, recurring invoices, credit notes). See [DESKTOP_WEBAPP_GAP.md](docs/mobile-desktop-apps/DESKTOP_WEBAPP_GAP.md).
- **Mobile app catch-up** — Calendar, Kanban, CRM hub, clients, issues, mileage, per diem, Belgium report, and deeper project/task flows aligned with the webapp.
- **Issues API (v1)** — Exposed issues endpoints on the REST API for mobile and desktop clients.

### Changed

- **Desktop docs** — Auth docs now describe username/password login and the React+Vite renderer.
- **Client versions** — Synced Electron (`desktop/package.json`) and Flutter (`mobile/pubspec.yaml`) to **5.9.4** with the webapp (`setup.py`).

### Documentation

- **Version** — Documented release **5.9.4** to match `setup.py` (single source of truth for the application version).

## [5.9.3] - 2026-07-16

### Added

- **Kanban WIP limits** — Per-column work-in-progress limits on Kanban boards.
- **Task checklists** — Per-task checklists and subtasks on the Kanban board.
- **Kanban board templates** — Save and reuse board layouts as templates.
- **Comment @mentions** — Teammates are notified when mentioned in task comments.
- **Docker Hub automation** — Release workflow (`cd-release.yml`) now auto-publishes the repository description from `docker/hub-README.md` (with current version injected). Development builds (`cd-development.yml`) also push the `develop` tag to Docker Hub when credentials are configured.

### Changed

- **Docker Hub publish resilience** — Release and development workflows only push to Docker Hub when `DOCKERHUB_USERNAME` and token/password secrets are set; GHCR-only builds no longer fail on missing Docker Hub credentials.

### Fixed

- **Client portal sessions** — Native client portal users stay in the portal UI after login instead of being redirected to the main app ([#677](https://github.com/DRYTRIX/TimeTracker/issues/677)).
- **Calendar holiday overlays** — Holiday overlays now appear correctly in day and week views.
- **Workday history dates** — Fixed date formatting on the workday history page.

### Documentation

- **Version** — Documented release **5.9.3** to match `setup.py` (single source of truth for the application version).

## [5.9.2] - 2026-07-13

### Added

- **Distribution hub** — [DISTRIBUTION.md](docs/admin/deployment/DISTRIBUTION.md) consolidates install paths for Docker, NAS, PaaS (Render, Railway, Fly.io, Coolify), Unraid, and Portainer.
- **Portainer app templates** — One-click stack in Portainer via `templates/portainer/templates.json`.
- **Unraid Community Applications** — App templates for the TimeTracker app and PostgreSQL database.
- **PaaS deploy configs** — `fly.toml` and `railway.toml` for Fly.io and Railway one-click deploys.
- **Docker Hub README** — `docker/hub-README.md` for the Docker Hub repository page.

### Changed

- **Docker Hub namespace** — Images now publish to `drytrix/timetracker` (replacing `driesp/timetracker`). CI release workflow, deploy scripts, and docs updated accordingly.

### Documentation

- **Version** — Documented release **5.9.2** to match `setup.py` (single source of truth for the application version).

## [5.9.1] - 2026-07-13

### Fixed

- **Calendar holiday and time-off overlays** — Restored holiday overlays on `/calendar` via a dedicated `/api/calendar/data` feed (avoids route collision with `/api/calendar/events`). Fixed local date keying, merged overlay handling, and FullCalendar overlay end dates.
- **Dashboard working-time limit banner** — Banner now appears only when justifications are pending.
- **Attendance compliance** — Stopped eager loading of dynamic attendance relationships that caused regressions in `list_days`.
- **Template globals** — Fixed `Settings` shadowing in Jinja template globals.

### Documentation

- **NAS deployment** — Added `docker-compose.nas.yml` and [NAS_DEPLOYMENT.md](docs/admin/deployment/NAS_DEPLOYMENT.md) for QNAP, Synology, and Portainer installs without cloning the repo.
- **Calendar API** — Documented `/api/calendar/data` endpoint in calendar feature docs.
- **Version** — Documented release **5.9.1** to match `setup.py` (single source of truth for the application version).

## [5.9.0] - 2026-07-06

### Added

- **Belgium 2027 attendance compliance** — Optional attendance compliance module with Belgium preset (daily/weekly hours, break and rest rules, 10-year retention). Employees clock in/out and track breaks via workday flows; corrections require admin approval; workforce CSV export and mobile API support inspector-ready records. See [BELGIUM_2027.md](docs/compliance/BELGIUM_2027.md).
- **Missed workday reminders** — Smart notification and optional email when an employee has not pressed **Start Workday** on an expected work day (Mon–Fri, excluding holidays and approved time off). User settings under **Settings → Notifications**; migration `165_add_missed_clock_in_notifications`. See [SMART_NOTIFICATIONS.md](docs/features/SMART_NOTIFICATIONS.md) and [WORKDAY_SESSIONS.md](docs/features/WORKDAY_SESSIONS.md).
- **Attendance correction for missing workdays** — Employees can request admin-approved retroactive work periods from `/workday/history` when they forgot to clock in on a past day.
- **Time-off request PDF** — Printable leave/vacation form with employee details, approval metadata, and signature lines. Download from the Workforce dashboard (`/workforce/time-off/<id>/pdf`) or `GET /api/v1/time-off/requests/<id>/pdf`.
- **Calendar holidays and time-off overlay** — Company holidays and the user's time-off (approved and pending) appear on the main calendar and timer calendar views with filter toggles.
- **Mobile workday controls** — Shared **Workday** card on Home and Timer screens with error feedback via SnackBar.
- **Slack attendance commands** — Workspace-level `/in`, `/brb`, `/back`, `/out` slash commands for clock-in/out and breaks in a dedicated Slack channel, with in-channel confirmations and email/Slack-ID user linking. Admin setup under **Integrations → Workspace integrations**; migration `166_add_slack_user_id`. See [SLACK_ATTENDANCE.md](docs/integrations/SLACK_ATTENDANCE.md).

### Fixed

- **Client portal login and logout (#677)** — External clients with portal credentials can sign in at `/login` as well as `/client-portal/login`; wrong passwords no longer fall through to self-registration. Portal logout (native and user-based sessions) redirects to `/client-portal/login`. Portal usernames are matched case-insensitively. See [CLIENT_PORTAL.md](docs/CLIENT_PORTAL.md).

### Documentation

- **Version** — Documented release **5.9.0** to match `setup.py` (single source of truth for the application version).

## [5.8.6] - 2026-06-28

### Added

- **Portal-only users** — Internal user accounts can be restricted to the client portal via a new **Portal only** option (`users.portal_only`). Such users are redirected away from the main app UI to `/client-portal` after login. The admin user form clarifies that enabling Client Portal alone does not restrict main app access. See [CLIENT_PORTAL.md](docs/CLIENT_PORTAL.md).
- **Deleted username blocklist** — Deleting a user now reserves the username in a new `deleted_usernames` table, preventing the account from being recreated through self-registration, OIDC, or LDAP provisioning. Admin-created accounts are exempt. See [USER_DELETION.md](docs/features/USER_DELETION.md).

### Fixed

- **Peppol (Peppyrus)** — Authenticate API requests with the `X-Api-Key` header instead of `Authorization: Bearer`, matching the Peppyrus API. See [PEPPOL_BRIDGE.md](docs/admin/configuration/PEPPOL_BRIDGE.md).
- **Client portal access** — Portal access is now denied when the user or the assigned client is inactive, and native client login clears stale main-app session keys to avoid session/preference conflicts.
- **Client portal payments** — The payment-success page now confirms based on the gateway capture or invoice payment status, showing a "processing" message when payment is not yet fully settled.
- **Client portal documents** — Attachment downloads require an explicit `type=client|project` parameter to avoid ID collisions between the client and project attachment tables.
- **Client portal actions** — Approvals, rejections, and project comments fall back to an auto-created portal contact when a client has none, and the notification mark-as-read flow now redirects with a flash message.
- **Client portal currency** — Dashboard and report summaries display the invoice currency instead of assuming a fixed code.
- **Admin user roles** — Editing a user now replaces the full role set with the selected role, preventing stale roles from lingering.

### Documentation

- **Version** — Documented release **5.8.6** to match `setup.py` (single source of truth for the application version).

## [5.8.5] - 2026-06-25

### Fixed

- **Invoice time entries and expenses (#662)** — Clearer UX separates logged hours (Invoice Items) from expense-module records (Expenses section). Generate-from-time shows diagnostic hints when no entries are available, excludes entries already on the invoice, and aligns billed-entry detection across client invoices. Optional **one line per time entry** preserves individual descriptions; admin setting controls default grouping.

- **Manual time entry task dropdown** — Fixed a JavaScript initialization error on `/timer/manual` that prevented the task list from loading when a project was selected ([#675](https://github.com/DRYTRIX/TimeTracker/issues/675)).

### Documentation

- **Version** — Documented release **5.8.5** to match `setup.py` (single source of truth for the application version).

## [5.8.4] - 2026-06-19

### Fixed

- **Workflow template migration** — Migration 161 no longer queries `users.is_admin` (a model property, not a database column), fixing PostgreSQL deploy failures when seeding starter workflow templates.

### Documentation

- **Version** — Documented release **5.8.4** to match `setup.py` (single source of truth for the application version).

## [5.8.3] - 2026-06-19

### Added

- **Peppol bridge** — Self-hosted Peppol adapter with setup wizard and provider presets; see [PEPPOL_BRIDGE.md](docs/admin/configuration/PEPPOL_BRIDGE.md).
- **Accounting integrations** — Sync configuration and integration metadata for accounting exports.
- **Payments** — Provider registry and unified checkout flow.
- **Workflows** — Template library and event bridge for automation.
- **Invoices** — Service helpers for API detail, line items, and PDF generation.
- **Analytics** — Profitability dashboard and utilization forecast.
- **Reports** — Invoice data source for scheduled reports.
- **CalDAV** — All-day event handling and sync-loop prevention.
- **Desktop app** — Minimize-to-tray, keyboard shortcuts, and richer views.
- **Mobile app** — Invoice detail screen and expanded finance APIs.

### Documentation

- **Version** — Documented release **5.8.3** to match `setup.py` (single source of truth for the application version).

## [5.8.2] - 2026-06-15

### Fixed

- **Invoice expenses** — Expense records from the Expenses module now link to the invoice Expenses section instead of being misrouted into invoice items or lost on save. Generate-from-time no longer wipes existing line items when only expenses are selected; the Add Expense flow focuses the expenses picker; edit-time expense sync is hardened (#662).

### Documentation

- **Version** — Documented release **5.8.2** to match `setup.py` (single source of truth for the application version).

## [5.8.1] - 2026-06-10

### Fixed

- **Quote email** — Sending a quote by email no longer shows a false error after delivery; the send route now matches the util’s `(success, message)` return tuple instead of unpacking three values (#652).

### Documentation

- **Version** — Documented release **5.8.1** to match `setup.py` (single source of truth for the application version).

## [5.8.0] - 2026-06-07

### Added

- **Configurable quote numbering** — Admin settings now mirror invoice numbering: prefix, number pattern, and start number. Quotes use the shared document numbering engine instead of a hardcoded `QUO-YYYYMMDD-NNN` format (migration **159**).

### Fixed

- **Quote email** — Sending a quote by email no longer fails with “recipient required” when submitted from the web form; empty recipient falls back to the client email, and validation errors redirect with a flash instead of raw JSON (#652).
- **Invoice from time entries** — Creating an invoice from time entries no longer fails with a missing `invoice_id` on line items, and totals are recomputed from persisted line items instead of staying at zero.
- **Payment delete** — Deleting a payment now correctly updates invoice payment status (flush delete before recomputing totals; unpaid invoices no longer read as fully paid).
- **Audit listeners** — SQLAlchemy flush listeners register once per process, preventing duplicate audit callbacks and CPU hangs when many Flask apps are created in one process (e.g. parallel pytest).

### Changed

- **Invoice send email** — Form POST handling aligned with quote send-email (consistent form/JSON read path).

### Documentation

- **Client reply template** — Refreshed `docs/CLIENT_EMAIL_WORKDAY_FEATURES.md` for workday sessions and working time limits rollout.
- **Version** — Documented release **5.8.0** to match `setup.py` (single source of truth for the application version).

## [5.7.0] - 2026-05-25

### Added

- **Workday sessions** — Employees can **Start Workday** / **End Workday** on the dashboard and timer page without a project or client. Hours at work are tracked separately from project time entries so totals are never double-counted (`WorkdaySession`, `WorkdaySessionService`, migration `158`).
- **Working time limits** — Configurable daily and weekly hour caps (admin settings and per-user overrides). Soft enforcement: email notification when exceeded, in-app justification workflow, and admin review at `/admin/working-time` (`WorkingTimeViolation`, APScheduler job every 15 minutes).
- **REST API and kiosk** — `GET/POST /api/v1/workday/*` and kiosk `start-workday` / `end-workday` endpoints.

### Documentation

- **[Workday sessions and working time limits](docs/features/WORKDAY_SESSIONS.md)** — User and admin guide.
- **[REST API](docs/api/REST_API.md)** — Workday session endpoints.
- **Client reply template** — `docs/CLIENT_EMAIL_WORKDAY_FEATURES.md`.
- **Version** — Documented release **5.7.0** to match `setup.py` (single source of truth for the application version).

## [5.6.3] - 2026-05-24

### Fixed

- **Comment API update/delete** — v1 `PATCH`/`DELETE /comments/<id>` no longer return 500: handlers eager-load `Comment.author` (not the non-existent `user` relationship). Comment edits now persist reliably — `edit_content()` no longer calls `now_in_app_timezone()` before commit, which could roll back the session when no `Settings` row exists and discard content changes while `updated_at` still advanced (`app/models/comment.py`, `app/routes/api_v1.py`).

### Added

- **German translations** — Updated `translations/de/LC_MESSAGES/messages.po` with community translation improvements.

### Documentation

- **Version** — Documented release **5.6.3** to match `setup.py` (single source of truth for the application version).

## [5.6.2] - 2026-05-20

### Fixed

- **Invoice PDF designer Items Table alignment (#622, follow-up)** — Fixed the regression where exported tables were still misaligned after the color fix: text and images use page-absolute coordinates on the PDF canvas, but tables were laid out in the margin-adjusted flow area (`left_offset = x − margin`), so a table at `x=40` appeared at the content edge (~57pt) while the preview showed 40pt. Items/expenses tables are now drawn on the canvas at template `(x, y)` via `wrap`/`drawOn`, with width capped to the remaining page width. The template editor serializes table groups with `getClientRect()` so moved/scaled tables match saved JSON. **Generate Preview** for invoice and quote PDFs now returns the same ReportLab PDF bytes as export (HTML preview remains fallback). Header/row colors and column alignment continue to use per-cell `ParagraphStyle`; `hAlign = LEFT` is retained (`app/utils/pdf_generator_reportlab.py`, `app/routes/admin.py`, `app/templates/admin/pdf_layout.html`, `app/templates/admin/quote_pdf_layout.html`).

### Tests

- **Invoice PDF template Items Table** — `tests/test_invoice_pdf_template_table.py` covers colors, alignment, `rowBackground`, canvas story collection, page-bound width capping, and PDF generation when table `x` is below the left margin.

### Documentation

- **Version** — Documented release **5.6.2** to match `setup.py` (single source of truth for the application version).

## [5.6.1] - 2026-05-20

### Fixed

- **Docker / PDF build** — Bumped `pydyf` to 0.12.1 for compatibility with WeasyPrint 68 in container builds.
- **Security** — Upgraded `PyJWT` to 2.12.1 (RFC 7515 `crit` validation, CVE-2026-32597) and `markdown` to 3.8.1 (DoS fixes).

### Changed

- **Docker build context** — Added `.dockerignore` to exclude local `.venv` and shrink image build context.

### Documentation

- **Version** — Documented release **5.6.1** to match `setup.py` (single source of truth for the application version).

## [5.6.0] - 2026-05-15

### Added

- **Personal integration connectors — GitHub, Google Calendar, Slack** — Three new per-user, opt-in connectors that subclass `app/integrations/base.py` and persist their config inside the existing `Integration.config` JSONB (no new tables, all secrets encrypted at rest). The new `app/routes/integrations_webhooks.py` blueprint exposes signature-verified webhook receivers (`POST /api/integrations/github/webhook` with `X-Hub-Signature-256`, `POST /api/integrations/slack/events` with `X-Slack-Signature`), the Google OAuth flow (`/integrations/google/{connect,callback,disconnect}`), and a uniform `config`/`status`/`test`/`sync` API surface for each provider. GitHub auto-creates tasks on `issues.opened`, marks them done on `issues.closed`, and (optionally) starts a timer on `issues.assigned` for the linked TimeTracker user (`users.github_username`). Google Calendar supports `import` / `export` / `both` directions with token refresh inside a 5-minute window and a 30-minute scheduled sync (`google_calendar_sync` APScheduler job). Slack posts a stopwatch/checkmark message on every timer start/stop (fire-and-forget hook in `app/routes/timer.py` and `app/routes/api.py`), implements the `/tt` slash command (`start [project]` / `stop` / `status` / `today`), and posts a configurable daily summary (`slack_daily_summary` APScheduler job, every 30 minutes). Three new cards in **Settings → Integrations → Personal connectors** drive the UI (`app/templates/integrations/_connector_cards.html`, vanilla JS + Tailwind). New migration `155_add_integration_columns` adds `users.github_username` and an indexed `tasks.external_ref` for de-duplicating webhook events. Every connector degrades gracefully — when the `Integration` row is missing or `is_active=False` all methods return `{"ok": false, "error": "Integration not configured"}` without raising. See [docs/integrations/GITHUB_CONNECTOR.md](docs/integrations/GITHUB_CONNECTOR.md), [docs/integrations/GOOGLE_CALENDAR.md](docs/integrations/GOOGLE_CALENDAR.md), and [docs/integrations/SLACK.md](docs/integrations/SLACK.md).
- **Custom themes** — Per-user theme picker under **Settings → Custom theme**. Eight built-in themes (`default`, `ocean`, `forest`, `sunset`, `lavender`, `rose`, `slate`, `high-contrast`) plus four independent overrides: accent colour (10 presets or any `#RRGGBB`), sidebar style (default/compact/minimal hover-expand), text size (sm/base/lg) and corner radius (sharp/rounded/pill). Live preview swaps a `<style id="tt-theme-vars">` block via `GET` / `POST /api/user/theme`; preferences persist on the `users` table via migration `156_add_user_theme_columns`. Default theme injects no CSS at all so existing users see zero visual change until they opt in. Backed by `ThemeService` (`app/services/theme_service.py`) and the self-contained `components/theme_picker.html` component (vanilla JS, no framework). See [docs/features/CUSTOM_THEMES.md](docs/features/CUSTOM_THEMES.md).
- **Personal productivity dashboard** — New **My productivity** page at `/dashboard/productivity` (sidebar link) with today/week summary, streaks, 14-day hours chart, project doughnut, focus stats, 12-week activity heatmap, and insight cards. Backed by `ProductivityService` (user-timezone-aware) and `GET /api/productivity/stats` (`period` 1–90 days, 5-minute cache when no active timer). See [docs/features/PRODUCTIVITY_DASHBOARD.md](docs/features/PRODUCTIVITY_DASHBOARD.md).
- **AI time entry suggestions** — `GET /api/ai/suggest` returns deterministic (and optional LLM-rich) project/task/notes suggestions. Wired into the Start Timer modal (`components/ai_suggestions.html`) and manual entry **Autofill** (`js/ai_autocomplete.js`) when the AI helper is enabled.
- **Project forecast panel** — `ForecastService` and `GET /api/projects/<id>/forecast` (deterministic metrics plus optional `?ai=true` narrative; 10-minute in-process cache). Self-contained card on active projects with estimated hours or budget. Documented in [docs/BUDGET_ALERTS_AND_FORECASTING.md](docs/BUDGET_ALERTS_AND_FORECASTING.md) and [docs/features/PROJECT_DASHBOARD.md](docs/features/PROJECT_DASHBOARD.md).
- **Smart reminders: break, end-of-day, and idle toasts** — Extends smart in-app notifications with optional **break reminder** (Pomodoro-style nudge every N minutes while a timer runs, 15–240 min) and **end-of-day wrap-up** (hours logged today in a configurable hour window). New kinds `break_reminder` and `end_of_day_reminder` in `NotificationService`; user prefs under **Settings → Notifications**; migration `154_add_smart_notify_break_and_eod`. [`app/static/idle.js`](app/static/idle.js) shows blue/purple/green toasts for no-tracking, break, and end-of-day (alongside existing idle stop-timer prompt). APScheduler job `smart_reminder_push` (every 15 min) sends browser push for eligible users when VAPID and push subscriptions are available. Env default `SMART_NOTIFY_END_OF_DAY_AT` (`17:00`). See [docs/features/SMART_NOTIFICATIONS.md](docs/features/SMART_NOTIFICATIONS.md).

### Documentation

- **Version** — Documented release **5.6.0** to match `setup.py` (single source of truth for the application version).

## [5.5.7] - 2026-05-14

### Fixed

- **Invoice PDF designer layout** — Restored the missing canvas-area wrapper in the invoice PDF designer so the properties panel sits in the third grid column beside the canvas instead of stacking below it (`app/templates/admin/pdf_layout.html`).
- **Invoice PDF preview vs export (#622)** — The JSON-to-HTML preview path now uses the same table style keys as export (header and row text, row background, border width) so the preview matches generated PDFs.

### Changed

- **Designer template JSON and ReportLab export** — Saving template JSON from the designer reads items-table and expenses-table width, colors, and separator line settings from the Konva group children; column widths scale to the chosen table width and a style block is emitted for ReportLab (`app/routes/admin.py`, `pdf_layout.html`).
- **ReportLab invoice tables** — Column widths scale to `element.width`; tables are wrapped in a two-column outer table so horizontal offset from the left margin is honored; `borderColor` and `borderWidth` from template style are applied (`app/utils/pdf_generator_reportlab.py`).

### Documentation

- **Version** — Documented release **5.5.7** to match `setup.py` (single source of truth for the application version).

## [5.5.6] - 2026-05-14

### Documentation

- **Uninstall / AI** — Expanded [UNINSTALL.md](UNINSTALL.md) with a dedicated **Disabling or removing the AI helper** section (admin UI, `.env`, Docker `ai` profile, `ollama_data` volume vs full `down -v`, API token scopes `read:ai` / `write:ai`, hosted provider keys).
- **Version** — Documented release **5.5.6** to match `setup.py` (single source of truth for the application version).

## [5.5.5] - 2026-05-12

### Fixed

- **Main column layout and footer alignment** — Removed an extra closing `</div>` in `{% block content %}` on admin backups, admin API tokens, and quote detail templates. Invalid HTML caused the browser to recover by closing ancestor nodes early (including `#mainContent`), leaving modals and page chrome mis-nested so the authenticated “Built by an independent developer” line no longer lined up with the content column.

### Changed

- **App shell uses full main-column width** — `base.html` no longer caps `<main id="mainContentAnchor">` or the attribution line with `max-w-7xl`; the main area and support banner inner row span the width beside the sidebar (padding unchanged). `<main>` and the footer line sit in a shared `flex-1 flex flex-col min-w-0 w-full` wrapper so the column grows vertically with the layout.

## [5.5.4] - 2026-05-11

### Fixed

- **Full database restore** — Admin restore cleanup no longer uses `current_app` from a background thread outside Flask application context. While `restore_backup` runs (archive extract through Alembic upgrade), the app sets `_database_restore_in_progress`; the client portal global context processor skips non-essential database reads during that window and rolls back the session on `SQLAlchemyError` so login and error pages can render when PostgreSQL schema is briefly torn during `pg_restore --clean`.

### Documentation

- **Backup and restore** — Added [docs/admin/BACKUP_AND_RESTORE.md](docs/admin/BACKUP_AND_RESTORE.md) and cross-links from the admin index, [DATABASE_RECOVERY.md](DATABASE_RECOVERY.md), and import/export guides for operational behaviour during restore.

## [5.5.3] - 2026-05-06

### Fixed
- **Approvals status values stored correctly** — `ClientApprovalStatus` values are now bound to the Postgres enum values (not the Python enum member names), preventing mismatches between API payloads/UI state and the persisted status.
- **Clients view delete-note confirmation** — Removed a nested `<script>` tag that could orphan `confirmDeleteNote`, causing delete confirmation to break in the clients view.

## [5.5.2] - 2026-04-30

### Fixed
- **Quote edit redirect for delegated editors** — Users with `edit_quotes` permission could save changes on draft quotes they did not create but were redirected to an empty/“not found” flow because quote detail/list visibility was still filtered by `created_by`. Quote list/detail scope now matches edit capability for users with `edit_quotes` across web and API quote reads. Added a regression test for edit-then-redirect view loading and updated quote comment edit context links.

## [5.5.0] - 2026-04-27

### Added
- **LDAP authentication** — Optional directory login via `AUTH_METHOD=ldap` or combined `AUTH_METHOD=all` (with local + OIDC). New `LDAP_*` settings in `app/config.py`, `LDAPService` (`app/services/ldap_service.py`), login and password-reset behaviour keyed off `users.auth_provider` (`local` | `oidc` | `ldap`), admin **System Settings** LDAP panel and `POST /admin/ldap/test`, production env validation for required LDAP variables, Alembic `153_add_user_auth_provider`, and tests in `tests/test_ldap_auth.py`. Dependency: `ldap3`. Documentation: [docs/admin/configuration/LDAP_SETUP.md](docs/admin/configuration/LDAP_SETUP.md); OIDC and getting-started guides updated for `ldap` / `all`.

### Fixed
- **Admin “Allow only one active timer per user” ignored at runtime** — Timer start and related flows always blocked a second running entry and never read `Settings.single_active_timer` from the database. Enforcement now uses `Settings.get_settings()` via `TimeTrackingService.can_start_timer` (web timer routes, REST v1, kiosk start, legacy session `POST /api/timer/resume`). `POST /api/v1/timer/start` returns **409** with `error_code: timer_already_running` when the setting is on and a timer is already running. `SINGLE_ACTIVE_TIMER` still seeds new installs only. Tests: `tests/test_single_active_timer_setting.py`.
- **API integration test for project tasks** — `tests/test_api_comprehensive.py` now matches `GET /api/projects/<id>/tasks`, which returns **all** tasks (including done and cancelled) for the time-entry UI.
- **Quote create returned HTTP 500 after save (#583)** — The quote was saved, but the redirect to the quote detail page crashed when **Valid until** was set: the template compared `valid_until` to `now()`, and `now` was never defined in the Jinja context. The expired badge now uses `Quote.is_expired` (same rule, app timezone). Regression coverage in `tests/test_routes/test_quotes_web.py` posts `valid_until` so the view path is exercised.
- **Desktop app navigation guard** — `will-navigate` no longer mis-classifies `file:` loads (opaque `"null"` origin) as external navigation. Allowed in-app protocols include `file:`, `about:`, and `devtools:`; `http:` / `https:` are still blocked from the embedded window.
- **Desktop offline UI (bundle)** — Shared helpers load before dependent modules; timesheet period and time-off request lists expose **Delete** where allowed (with `currentUserProfile.id` for ownership); approve/reject controls read approval state from `state.currentUserProfile`; API client includes `deleteTimesheetPeriod` and `deleteTimeOffRequest`.

### Added
- **Mobile bottom navigation (web)** — On viewports below the `md` breakpoint (768px), signed-in users get a fixed bottom bar with tabs for Dashboard, Timer, Time entries, Projects, and **More**. **More** opens a slide-up drawer (backdrop, close control, Escape) linking to Invoices, Clients, Reports, and **My Settings** (`user.settings`), respecting module enablement where applicable. Implementation: [`app/templates/partials/_bottom_nav.html`](app/templates/partials/_bottom_nav.html) included from [`app/templates/base.html`](app/templates/base.html); [`app/static/mobile.js`](app/static/mobile.js) drives the drawer. **Safe area:** `pb-safe` utility in [`app/static/src/input.css`](app/static/src/input.css) and safelist in [`tailwind.config.js`](tailwind.config.js). Main content uses `pb-16` on small screens so it is not covered by the bar. Layout breakpoint for sidebar visibility, main margin, mobile menu, and RTL `#mainContent` margin is aligned to `md` (768px).
- **Smart in-app notifications** — Opt-in under **Settings → Notifications → In-app reminders**: nudge when no time is logged today (configurable hour window, user timezone), alert when an active timer exceeds a configurable duration, and end-of-day summary of hours logged. Server-driven via `GET /api/notifications` and `POST /api/notifications/dismiss`; per-day dismissals stored in `user_smart_notification_dismissals`. Environment defaults: `SMART_NOTIFY_MAX_PER_DAY`, `SMART_NOTIFY_NO_TRACKING_AFTER`, `SMART_NOTIFY_SUMMARY_AT`, `SMART_NOTIFY_LONG_TIMER_HOURS`, `SMART_NOTIFY_SCHEDULER_SLOT_MINUTES` (see `app/config.py` and [docs/features/SMART_NOTIFICATIONS.md](docs/features/SMART_NOTIFICATIONS.md)). Migration `150_add_smart_notifications`. The dashboard client polls the API and shows toasts (optional browser notifications when enabled and permission granted). `toastManager.show` supports an optional `onDismiss` callback.
- **Value dashboard widget** — Dashboard productivity block backed by `StatsService` and `GET /api/stats/value-dashboard` (short-TTL Redis cache when available). Wired from `dashboard-enhancements.js` with the existing real-time dashboard refresh.
- **Quote line item reorder (Issue #584)** — Non-null `quote_items.position` (migration `146_add_quote_item_position`); `Quote.items` is ordered by `position`, then `id`. Create, edit, duplicate, bulk duplicate, API item payloads, and quote-template apply assign positions from the submitted row order. **Create quote** and **edit quote** forms include per-row **Move up** / **Move down** controls on **Quote line items**, **Costs**, and **Extra goods** so rows can be reordered without deleting and re-entering data; PDFs and detail views follow the saved order. New translatable UI strings: **Order**, **Move up**, **Move down** (run `pybabel extract` / `update` per [docs/CONTRIBUTING_TRANSLATIONS.md](docs/CONTRIBUTING_TRANSLATIONS.md)).
- **Offline queue replay** — Queued requests now store method, headers, and body in a replay-safe form (serializable for localStorage). POST/PUT requests replayed when back online send the same body and method. Legacy queue items (with `options` only) are still replayed via fallback.
- **Inventory API scopes** — New scopes `read:inventory` and `write:inventory` for inventory-only API access. Existing `read:projects` and `write:projects` still grant the same inventory access for backward compatibility.
- **Client portal reports: date range and CSV export** — Reports support optional `days` query param (1–365, default 30). Add `?format=csv` to download a CSV of the same report (summary, hours by project, time by date). Export uses the same access control as the reports page.
- **Jira webhook verification** — When a webhook secret is configured in the Jira integration (Connection Settings → Webhook Secret), incoming webhooks are verified using HMAC-SHA256 of the request body. Supported headers: `X-Hub-Signature-256`, `X-Atlassian-Webhook-Signature`, `X-Hub-Signature`. Requests with missing or invalid signature are rejected. If no secret is set, behavior is unchanged (all webhooks accepted).
- **Crowdin integration (maintainers)** — Root [`crowdin.yml`](crowdin.yml) maps `translations/en/LC_MESSAGES/messages.po` to per-locale `messages.po` paths (with `nb` → `no` for Norwegian). Manual [`.github/workflows/crowdin-sync.yml`](.github/workflows/crowdin-sync.yml) uploads sources and downloads translations when `CROWDIN_PROJECT_ID` and `CROWDIN_PERSONAL_TOKEN` are set. [docs/CONTRIBUTING_TRANSLATIONS.md](docs/CONTRIBUTING_TRANSLATIONS.md) includes a Crowdin setup section; [docs/TRANSLATION_SYSTEM.md](docs/TRANSLATION_SYSTEM.md) and contributor docs cross-link it.

### Changed
- **Documentation (API)** — Documented session-auth `GET /api/stats/value-dashboard` (response fields, Redis TTL, rate resolution) in [`docs/api/REST_API.md`](docs/api/REST_API.md) and linked dashboard session JSON from [`docs/API.md`](docs/API.md).
- **API v1 search scoping** — Project, task, and client branches of token search use shared `apply_project_scope` and `apply_client_scope` query helpers in [`app/utils/scope_filter.py`](app/utils/scope_filter.py) for consistent subcontractor restrictions.
- **Documentation (translations)** — Added [docs/CONTRIBUTING_TRANSLATIONS.md](docs/CONTRIBUTING_TRANSLATIONS.md) for contributors without Git (issue template, optional spreadsheet or hosted platform, maintainer workflow). Root [CONTRIBUTING.md](CONTRIBUTING.md) links to it; [docs/TRANSLATION_SYSTEM.md](docs/TRANSLATION_SYSTEM.md) defers the enabled locale list to `app/config.py` (`LANGUAGES`) and points translators at the new guide.
- **Factur-X / PDF/A-3 invoice PDFs (export and email)** — Download and email attachments use the same embed-and-normalize path. Embedded CII uses Associated File relationship **Data** and MIME **text/xml**. PDF/A-3 normalization embeds sRGB via `app/resources/icc/` (override with `INVOICE_SRGB_ICC_PATH`). Added `app/utils/invoice_pdf_postprocess.py` and tests; [PEPPOL e-Invoicing](docs/admin/configuration/PEPPOL_EINVOICING.md) updated (veraPDF note, pytest command).
- **Documentation sync** — CODEBASE_AUDIT.md: marked gaps 2.3–2.7 and 2.9 as fixed; added “Implemented 2026-03-16” summary. CLIENT_FEATURES_IMPLEMENTATION_STATUS: report date range and CSV export noted as implemented. INCOMPLETE_IMPLEMENTATIONS_ANALYSIS: added “Verified 2026-03-16” for webhook verification, issues permissions, search API, offline queue.
- **Activity feed API date params** — `/api/activity` now returns 400 with a clear message when `start_date` or `end_date` are invalid (e.g. not ISO 8601). Invalid dates on the web route `/activity` are logged and the filter is skipped (no 500).
- **Invoice PEPPOL compliance check** — Exceptions in the PEPPOL compliance block are no longer silently ignored: specific and generic exceptions are caught, logged, and a generic warning (“Could not verify PEPPOL compliance; check configuration.”) is shown to the user so the view still renders.
- **Documentation and i18n audit** — Updated docs and translations to match current implementation: removed stale "coming soon" claims; marked INCOMPLETE_IMPLEMENTATIONS_ANALYSIS as historical and added still-relevant summary; rewrote INVENTORY_MISSING_FEATURES as "Remaining Gaps" (transfers, adjustments, reports, PO management, API are implemented); updated GETTING_STARTED (PDF export, project permissions, REST API); REST_API (webhooks supported); KEYBOARD_SHORTCUTS_SUMMARY (customization implemented); BULK_TASK_OPERATIONS (bulk due date/priority implemented); INVENTORY_IMPLEMENTATION_STATUS (report templates done); activity_feed (invoices/clients/comments status clarified). Removed orphaned translation strings "Bulk due date update feature coming soon!" and "Bulk priority update feature coming soon!" from 10 locale `.po` files.

### Added
- **Mileage and Per Diem export and filter (Issue #564)** — Mileage and Per Diem now support CSV and PDF export using the same filter set as the list view, matching Time Entries behavior. **Mileage**: Export CSV and Export PDF buttons in the filter card; exports use current filters (search, status, project, client, date range). Routes: `GET /mileage/export/csv`, `GET /mileage/export/pdf`. PDF report via [app/utils/mileage_pdf.py](app/utils/mileage_pdf.py) (ReportLab, landscape A4, totals row). **Per diem**: Client filter added to the list form (with client-lock/single-client handling); Export CSV and Export PDF buttons; routes `GET /per-diem/export/csv`, `GET /per-diem/export/pdf`. PDF via [app/utils/per_diem_pdf.py](app/utils/per_diem_pdf.py). Export links are built from the current filter form (JS), so applied filters apply to both the list and the downloaded file.
- **Break time for timers and manual time entries (Issue #561)** — Pause/resume running timers so time while paused counts as break; on stop, stored duration = (end − start) − break (with rounding). Manual time entries and edit form have an optional **Break** field (HH:MM); effective duration is (end − start) − break. Optional default break rules in Settings (e.g. >6 h → 30 min, >9 h → 45 min) power a **Suggest** button on the manual entry form; users can override. New columns: `time_entries.break_seconds`, `time_entries.paused_at`; Settings: `break_after_hours_1`, `break_minutes_1`, `break_after_hours_2`, `break_minutes_2`. API: `POST /api/v1/timer/pause`, `POST /api/v1/timer/resume`; timer status and time entry create/update accept and return `break_seconds`. See [docs/BREAK_TIME_FEATURE.md](docs/BREAK_TIME_FEATURE.md).
- **Architecture refactor** — API v1 split into per-resource sub-blueprints (projects, tasks, clients, invoices, expenses, payments, mileage, deals, leads, contacts) under `app/routes/api_v1_*.py`; bootstrap slimmed by moving `setup_logging` to `app/utils/setup_logging.py` and legacy migrations to `app/utils/legacy_migrations.py`. Dashboard aggregations (top projects, time-by-project chart) moved into `AnalyticsService` (`get_dashboard_top_projects`, `get_time_by_project_chart`); dashboard route simplified to call services only. ARCHITECTURE.md updated with module table, API structure, and data flow; DEVELOPMENT.md with development workflow and build steps.

### Fixed
- **Xero integration for apps created after March 2026 (Issue #567)** — OAuth no longer fails with "Invalid scope for client" for Xero Developer apps created on or after March 2, 2026. Replaced deprecated `accounting.transactions` scope with granular `accounting.invoices` and `accounting.payments`. Expense sync now uses the correct `/api.xro/2.0/ExpenseClaims` endpoint (replacing the non-existent `/api.xro/2.0/Expenses`) and reads `ExpenseClaimID` from the response. `_api_request` now accepts an optional request body so invoice and expense payloads are sent to the Xero API. See [docs/integrations/XERO.md](docs/integrations/XERO.md).
- **Time Entries date filter and export (Issue #555)** — Start/End date filters were hard to discover and exports ignored them. The Time Entries overview now has a visible **Apply filters** button in the filter header (next to Clear Filters and Export) so users can apply date and other filters without scrolling. CSV and PDF export links always use the current filter parameters: export href is set from the page URL on load and updated whenever filter form values change, so left-click export, right-click "Open in new tab", and "Save link as" all produce filtered exports. The in-form Apply filters button and the header button both trigger the same filter logic; clicking the header button expands the filter panel if it is collapsed.
- **Log Time / Edit Time Entry on mobile (Issue #557)** — Opening the manual time entry ("Log Time") or edit time entry page on mobile could freeze or crash the browser. The Toast UI Editor (WYSIWYG markdown editor) for the notes field is heavy and causes freezes on mobile Safari/Chrome. On viewports ≤767px we now skip loading the editor and show a plain textarea for notes instead; desktop behavior is unchanged. Manual entry and edit timer templates load Toast UI only when not in mobile view.
- **Stop & Save error (Issue #563)** — Fixed error after clicking "Stop & Save" on the dashboard. The post-timer toast was building the "View time entries" URL with the wrong route name (`timer.time_entries`); the correct endpoint is `timer.time_entries_overview`. Time entries were already saved; the error occurred when rendering the dashboard redirect.
- **Dashboard cache (Issue #549)** — Removed dashboard caching that caused "Instance not bound to a Session" and "Database Error" on second visit. Cached template data contained ORM objects (active_timer, recent_entries, top_projects, templates, etc.) that become detached when served in a different request.
- **Task description field (Issue #535)** — When creating or editing a task, the description field could appear missing or broken if the Toast UI Editor (loaded from CDN) failed to load (e.g. reverse proxy, CSP, Firefox, or offline). A fallback now shows a plain textarea so users can always enter a description; Markdown is still supported when the rich editor loads.
- **ZUGFeRD / PDF/A-3 and PEPPOL (Discussion #433)** — ZUGFeRD embedding no longer silently succeeds without XML when the embed step fails; export is aborted with an actionable error. XMP metadata is created when missing so validators recognize the document. Optional PDF/A-3 normalization (XMP identification and output intent) and optional veraPDF validation gate added. Native PEPPOL transport (SML/SMP + AS4) and strict sender/recipient identifier validation added.

### Added
- **Dashboard time-by-project chart** — "Time by project (last 7 days)" horizontal bar chart on the dashboard (Chart.js); link to Summary report.
- **Summary report charts** — Time-by-project (last 30 days) bar chart and daily trend (last 14 days) line chart on the Summary report page.
- **Summary report PDF export** — New route `/reports/summary/export/pdf`; one-page PDF with today/week/month hours and top projects table ([app/utils/summary_report_pdf.py](app/utils/summary_report_pdf.py)).
- **Post-timer toast** — After stopping the timer, a success toast shows "Logged Xh on [Project]" with an action link "View time entries"; toast manager supports optional `actionLink` and `actionLabel`.
- **Remind to log** — User setting "Remind me to log time at end of day" with time picker (Settings); scheduled task runs hourly and sends one email per day to users who have the reminder enabled and have logged &lt; 0.5h that day (in their timezone). Migration `135_add_remind_to_log_settings` adds `notification_remind_to_log` and `reminder_to_log_time` to users.
- **Migration merge 133** — Merge heads 132 (timesheet governance) and 129 (task tags) so `flask db upgrade` runs without conflicts.
- **PEPPOL native transport** — Transport mode can be set to **Native** (SML/SMP participant discovery + AS4 send) in addition to **Generic** (HTTP JSON access point). Sender and recipient identifiers are validated before send. New settings: `peppol_transport_mode`, `peppol_sml_url`, `peppol_native_cert_path`, `peppol_native_key_path` (Admin → Peppol e-Invoicing).
- **PDF/A-3 and validation** — Option **Normalize ZUGFeRD PDFs to PDF/A-3** and optional **Run veraPDF after export** with configurable path. Migration `130_add_peppol_transport_mode_and_native` adds the new columns.
- **Dashboard timer widget** — Pause and Stop buttons while a timer is running (Pause saves the segment so you can resume later). When no timer is active, a prominent "Resume (project name)" button restarts tracking with the same project/task/notes as your last entry. Quick time adjustment buttons (−15 / −5 / +5 / +15 minutes) let you correct the current session without leaving the dashboard. New route `POST /timer/adjust` for start-time adjustment.

### Changed
- **UI/UX redesign** — Consolidated component system: single `page_header`, `empty_state` / `empty_state_compact`, and `loading_overlay` in `components/ui.html`; migrated overdue tasks page from Bootstrap to Tailwind; added form error and disabled states in design tokens. Base layout: main content max-width (1280px) and centered; first-class **Timer** and **Time entries** in sidebar; reduced nav label weight. Timer flow: single adjust-time form with one submit; dashboard hero is the Timer card (start/stop, quick start, repeat last); post-stop toast with “View time entries” unchanged. Dashboard: Timer as hero block first, then Today/Week/Month stats, then Recent entries (last 5, columns Project/Duration/Date/Actions) with “View all” link to Time entries overview. Empty and loading states use shared macros; toasts used for errors and success. New [UI Guidelines](docs/UI_GUIDELINES.md); README and ARCHITECTURE updated with UI overview and UI layer section.
- **Dashboard** — Weekly goal widget already showed progress bar; added time-by-project (7d) chart and chart data from main route.
- **Summary report** — Added Chart.js time-by-project and daily-trend charts; added Export PDF button; backend passes chart and trend data from AnalyticsService.
- **Toast notifications** — Optional `actionLink` and `actionLabel` in toast manager for action links in toasts.
- **Documentation** — README updated with new features (dashboard chart, summary charts/PDF, post-timer toast, remind to log); daily workflow note in Screenshots section.
- **Log Time Manually page** — Redesigned for a more professional layout: form grouped into sections (Project & task, Date & time, Details) with clear headings and icons; main card uses rounded-xl and shadow-lg; unified label and helper text styling; primary "Log Time" and secondary "Clear" buttons aligned with dashboard button styles; duplicate-entry banner uses rounded-xl.

## [4.20.6] - 2025-02-20

### Changed
- **Version Update** — Updated to version 4.20.6.

## [4.20.5] - 2025-02-17

### Changed
- **Version Update** — Updated to version 4.20.5.

## [4.20.0] - 2025-02-16

### Fixed
- **PDF layout: decorative image persistence and PDF preview (Issue #432)** — Decorative images now survive save/load: image URLs are synced onto groups before generating the template, injected into the saved design JSON using position-based matching, and restored from the saved JSON onto the canvas on load. Empty decorative image elements are no longer added to the ReportLab template, and the PDF generator skips empty or invalid image sources and validates base64 data URIs, preventing a mostly-black or broken PDF preview.
- **Header Start Timer button** — Fixed manual entry URL (`/timer/manual_entry` → `/timer/manual`); timer now correctly opens manual entry when starting from the header button.

### Added
- **Header quick access buttons** — Chat, Timer, and Help are grouped in the header as round icon buttons, vertically aligned and evenly spaced. One-click timer start/stop from any page; Help links to documentation; Chat opens team chat when enabled.
- **ZugFerd / Factur-X support for invoice PDFs** — When enabled in Admin → Settings → Peppol e-Invoicing, exported invoice PDFs embed EN 16931 UBL XML as `ZUGFeRD-invoice.xml`, producing hybrid human- and machine-readable invoices. Uses the same UBL as Peppol; these PDFs can be sent via Peppol or email. New setting `invoices_zugferd_pdf`, migration `128_add_invoices_zugferd_pdf`, dependency `pikepdf`, and [docs/admin/configuration/PEPPOL_EINVOICING.md](docs/admin/configuration/PEPPOL_EINVOICING.md) updated for both Peppol and ZugFerd.
- **Subcontractor role and assigned clients** — Users with the Subcontractor role can be restricted to specific clients and their projects. Admins assign clients in Admin → Users → Edit user (section "Assigned Clients (Subcontractor)"). Scope is applied to clients, projects, time entries, reports, invoices, timer, and API v1; direct access to other clients/projects returns 403. New table `user_clients`, migration `127_add_user_clients_table`, and docs in [docs/SUBCONTRACTOR_ROLE.md](docs/SUBCONTRACTOR_ROLE.md).

### Changed
- **Version Update** — Updated to version 4.20.0.

## [4.19.0] - 2025-02-13

### Added
- **REST API v1** - CRM and time approvals: `/api/v1/deals`, `/api/v1/leads`, `/api/v1/clients/<id>/contacts`, `/api/v1/contacts/<id>`, `/api/v1/time-entry-approvals` (list, get, approve, reject, cancel, request-approval, bulk-approve). New API token scopes: `read:deals`, `write:deals`, `read:leads`, `write:leads`, `read:contacts`, `write:contacts`, `read:time_approvals`, `write:time_approvals`.
- **Documentation** - Service layer and BaseCRUD pattern ([docs/development/SERVICE_LAYER_AND_BASE_CRUD.md](docs/development/SERVICE_LAYER_AND_BASE_CRUD.md)); RBAC permission model ([docs/development/RBAC_PERMISSION_MODEL.md](docs/development/RBAC_PERMISSION_MODEL.md)).

### Changed
- **API responses** - Projects and new CRM/approvals API v1 routes use standardized `error_response` / `forbidden_response` / `not_found_response` from `app.utils.api_responses`.
- **Templates** - All templates consolidated under `app/templates/`; root `templates/` removed and extra Jinja loader removed.
- **Version** - README, FEATURES_COMPLETE.md, and docs reference `setup.py` as single source of truth for version (4.19.0).
- **Refactored examples** - `projects_refactored_example.py`, `timer_refactored.py`, `invoices_refactored.py` marked as reference-only in module docstrings.

## [4.14.0] - 2025-01-27

### Changed
- **Version Update** - Updated to version 4.14.0
- **Documentation** - Comprehensive README and documentation updates for clarity and completeness
- **Technology Stack** - Added complete technology stack overview to README
- **Quick Start** - Enhanced with prerequisites, clearer instructions, and troubleshooting links
- **System Requirements** - Added detailed system requirements section
- **Documentation Organization** - Improved organization by use case and user type

### Fixed
- **Version Consistency** - Fixed version inconsistencies across all documentation files
- **Documentation Links** - Fixed broken links and improved navigation
- **Feature Documentation** - Added comprehensive links to feature guides throughout README

## [4.13.2] - 2025-01-27

### Changed
- **Version Update** - Updated to version 4.13.2
- **Documentation** - Comprehensive README and documentation updates for clarity and completeness

### Fixed
- **Version Consistency** - Fixed version inconsistencies across all documentation files

## [4.8.8] - 2025-01-27

### Changed
- **Version Update** - Updated to version 4.8.8
- **Documentation** - Comprehensive project analysis and documentation updates

### Fixed
- **Version Consistency** - Fixed version inconsistencies across documentation files

## [4.6.0] - 2025-12-14

### Added
- **Comprehensive Issue/Bug Tracking System** - Complete issue and bug tracking functionality with full lifecycle management

## [4.5.1] - 2025-12-13

### Changed
- **Performance Optimization** - Optimized task listing queries and improved version management
- **Version Management** - Enhanced version management system

## [4.5.0] - 2025-12-12

### Added
- **Advanced Report Builder** - Iterative report generation with email distribution capabilities
- **Quick Task Creation** - Create tasks directly from the Start Timer modal for faster workflow
- **Kanban Board Enhancements** - Added user filter and flexible column layout options
- **PWA Install UI** - Improved Progressive Web App installation user interface

### Fixed
- **Permission and Role Management** - Fixed bugs in permission and role management system

### Changed
- **Error Handling** - Improved error handling throughout the application
- **Performance Logging** - Enhanced performance logging and monitoring

## [4.4.1] - 2025-12-08

### Added
- **Custom Reports Enhancement** - Enhanced custom reports and scheduled reports functionality

### Fixed
- **Dashboard Cache Invalidation** - Fixed dashboard cache invalidation when editing timer entries (#342)
- **Custom Field Definitions** - Fixed graceful handling of missing custom_field_definitions table (#344)

## [4.4.0] - 2025-12-03

### Added
- **Project Custom Fields** - Add custom fields to projects for enhanced project tracking
- **File Attachments** - File attachment support for projects and clients
- **Salesman-Based Report Splitting** - Report splitting and email distribution based on salesperson assignments

### Changed
- **Performance Optimization** - Optimized task queries and fixed N+1 performance issues
- **Version Update** - Updated setup.py version to 4.4.0

## [4.3.2] - 2025-12-02

### Added
- **Custom Field Filtering** - Custom field filtering and display for clients, projects, and time entries
- **Client Count Tracking** - Client count tracking and cleanup for custom field definitions
- **Unpaid Hours Report** - New unpaid hours report with Ajax filtering and Excel export
- **Time Entries Overview** - New time entries overview page with AJAX filters and bulk mark as paid
- **Configurable Duplicate Detection** - Configurable duplicate detection fields for CSV client import
- **Enhanced Audit Logging** - Improved error handling and diagnostic tools for audit logging

### Changed
- **Offline Sync** - Enhanced offline sync functionality and performance improvements
- **Error Handling** - Improved error handling throughout the application
- **Docker Healthchecks** - Enhanced Docker healthcheck functionality

## [4.3.1] - 2025-12-01

### Changed
- **Offline Sync** - Enhanced offline sync functionality and performance improvements

## [4.3.0] - 2025-12-01

### Added
- **Custom Field Filtering** - Custom field filtering and display for clients, projects, and time entries
- **Client Count Tracking** - Client count tracking and cleanup for custom field definitions
- **Unpaid Hours Report** - New unpaid hours report with Ajax filtering and Excel export
- **Time Entries Overview** - New time entries overview page with AJAX filters and bulk mark as paid
- **Configurable Duplicate Detection** - Configurable duplicate detection fields for CSV client import
- **Enhanced Audit Logging** - Improved error handling and diagnostic tools for audit logging

### Changed
- **Error Handling** - Improved error handling throughout the application
- **Docker Healthchecks** - Enhanced Docker healthcheck functionality
- **Offline Sync** - Enhanced offline sync functionality

## [4.2.1] - 2025-12-01

### Fixed
- **AUTH_METHOD=none** - Fixed authentication method when set to none
- **Schema Verification** - Added comprehensive schema verification

## [4.2.0] - 2025-11-30

### Added
- **CSV Import/Export** - CSV import/export for clients with custom fields and contacts
- **Global Custom Field Definitions** - Global custom field definitions with link template support
- **Paid Status Tracking** - Paid status tracking for time entries with invoice reference
- **OAuth Credentials Dropdown** - Converted OAuth credentials section to dropdown in System Settings

---

## Release notes format

This changelog follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Section headings used:

- **Added** — New features
- **Changed** — Changes in existing functionality
- **Deprecated** — Soon-to-be removed features
- **Removed** — Removed features
- **Fixed** — Bug fixes
- **Security** — Security-related changes

For release artifacts and tags, see [GitHub Releases](https://github.com/drytrix/TimeTracker/releases).