Production Release — August 28, 2026

Release boundary

This packet promotes the complete verified staging delta after production commit cf81eeea39e6b03722f712dbd2b4e2824034695f.

• Verified application baseline: staging commit a39b501d014fc776f0d97cacde91ce17b6fc2d77.
• Baseline CI: GitHub Actions run 33137482095, successful at the exact baseline commit.
• Baseline deployment: GitHub deployment 6134789694, successful in the Bizcom staging environment at the exact baseline commit.
• Repository delta before these release notes: 72 files, 2,863 insertions, and 141 deletions.
• History note: Git reports 437 staging-only commits because earlier production promotions were squash-merged. The current production commit is an ancestor of staging, and the release is governed by the actual tree delta and exact-SHA evidence rather than the raw commit count.

The final promotion PR must identify its own head SHA and prove that its tree contains this baseline, the independently verified download-filename repair from PR #369, the release-blocking client fee-total authorization repair, and the release documentation from PR #367, with no other content delta.

Included improvements

Security and authorization

• Time-tracking ownership and role enforcement.
• Private upload-prefix enforcement with a compatibility path for existing public blog images.
• Server and client blog-content sanitization.
• Content Security Policy cleanup, map-host allow-listing, and fail-closed public anti-bot checks.
• Escaped feedback email content.
• Enforced service-pricing permission across both service detail and client-level fee totals.

Correctness and operational workflows

• Correct AR aging buckets, draft-free receivable totals, centavo-preserving currency output, visible inline status failures, and Manila due-date handling.
• Consistent compliance-pipeline assignment and first-step timestamps across task-creation paths.
• Stuck-task notification deduplication, Sunday recurrence preservation, task input guards, and client invoice visibility restrictions.
• Approved-leave revoke with atomic balance restoration and a staff self-approval guard.
• Serialized email-queue processing and truthful bulk-send failure reporting.
• Client ticket unread approximation based on the latest message author.
• Zod request validation for payment, leave, task, and service routes.

User experience, accessibility, and public pages

• Retryable query failures and generic mutation-failure feedback.
• Confirmation dialogs for four destructive admin actions.
• Audited contrast improvements.
• Route-specific canonical and Open Graph metadata with portal-route cleanup.
• Truthful feedback-to-Paperclip routing state.
• Safe content-disposition fallback filenames without corrupting ordinary ASCII download names.
• Regression coverage for invoice visibility, leave self-approval, task enums, Sunday scheduling, stuck-task deduplication, and SPA metadata navigation.

Documentation only

• Read-only Xero integration architecture and synthetic proof plan. It does not enable or configure a live integration.

Database and dependency impact

Database

No production database migration or data mutation is required.

• main and staging have the same SQL migration inventory through migration 050.
• No migration file is added, removed, or changed by the release delta.
• The shared/schema.ts delta contains request-validation schemas only; no Drizzle table definition changes are present.
• drizzle-kit push remains disabled. It must not be used for this release.

Dependencies

• Adds dompurify and its type package for client-side HTML sanitization.
• Adds jsdom as a development dependency for browser-like regression tests.
• The production dependency audit at the verified staging baseline reported no high-threshold vulnerabilities.

Deferred or partial items

These are not represented as fully resolved by this release:

• Moving legacy blog images into the public-image prefix remains a separately coordinated data migration; the compatibility path remains in place.
• Durable email claim timestamps and failed-email retry counters require a future schema migration. This release supplies process serialization and truthful reporting only.
• Database-level enum/check constraints and historical data backfills for task status, Sunday recurrence, and first-step timestamps remain migration-gated.
• HR permission-preset mapping remains a separate governed data change.
• Client ticket unread state is an author-based approximation, not a persistent per-message read receipt.
• Xero implementation remains approval-gated and disconnected.

Production procedure

1. Merge the release-document carrier into staging after its checks pass.
2. Open one protected staging to main PR with the final exact head SHA, this release packet, and the independent verifier disposition.
3. Require successful CI on the exact promotion head and resolve all review threads.
4. Squash-merge through the protected branch rule.
5. Confirm the resulting main tree is identical to the promoted staging tree.
6. Confirm the production deployment record reports success for the resulting main commit.
7. Run public health checks and authenticated, read-only release-relevant smoke checks.
8. Reconcile production feedback individually: resolve only items proved fixed in production; leave partial or deferred items acknowledged or in progress with an evidence link.

Rollback

Because this release has no database migration, rollback is code-only:

1. Revert the production promotion through a new protected PR to restore the pre-release application tree at cf81eeea39e6b03722f712dbd2b4e2824034695f.
2. Wait for the resulting production deployment and verify its exact SHA.
3. Repeat public health and authenticated smoke checks.
4. Reopen any feedback item whose resolved evidence depended on the reverted release.

Do not force-push main, mutate the production database, or delete release evidence as part of rollback.