@7365admin1/layer-common 4.97.1-staging.502 → 4.98.0

package/CHANGELOG.md

@@ -1,5 +1,886 @@
 # @iservice365/layer-common
 
+## 4.98.0
+
+### Minor Changes
+
+- 7c54796: Let an `AppSelect` be searched, and search the intercom contact name picker.
+
+  The Add Contact name picker lists every SIP account on the site. That list is
+  short on a new site and grows with every resident who opens Web Call, and the
+  only way through it was to scroll — on an estate with a few hundred homes, past
+  several people called Harris.
+
+  `AppSelect` takes a `searchable` prop that puts a filter box at the top of its
+  popover, with `search-placeholder` for its wording. It is opt-in, so the 44
+  consumers that do not ask for it render exactly the DOM they render today: a
+  list short enough to read does not want a search field in front of it. The
+  filter is a case-insensitive substring over the option's TITLE, not its value —
+  the title is the only part anyone can see to type — so on the contact picker it
+  finds a person by name or by where they live, the unit being part of every
+  option's text.
+
+  `close-on-content-click` had to come off for the single-value popover while
+  searching, and that is the whole reason this needed a prop rather than a
+  component. It fires on the click that puts the caret in the box, so the popover
+  shut the moment it was typed into; with it off, picking an option closes the
+  popover by hand instead. The multi-value popover already ran with it off and is
+  unchanged in that respect.
+
+  Enter picks the first match, Escape closes, the term is dropped on every open so
+  a stale filter cannot hide the list, and the caret lands in the box — opening a
+  searchable select is almost always a prelude to typing. A filtered-to-nothing
+  list says "No matches" rather than showing an empty popover.
+
+- 2374f0e: Offer the module permissions no role editor could grant yet (owner answers Q5,
+  Q9 and Q10). Catalogue-only: role editors offer more, no gate changes, and
+  nobody is granted anything.
+
+  - `useMechanicalElectricalPermission`, `usePestControlPermission` and
+    `usePoolMaintenancePermission` now offer `emergency-contact` with the seven
+    actions Cleaning and Landscape already offer (`see-all`, `see-details`,
+    `add-/update-/delete-emergency-contact`,
+    `add-/delete-emergency-contact-category`).
+  - `useSecurityPermission` now offers `emergency-contact` (the same seven),
+    `facility-booking-mgmt` (Property's five actions),
+    `passes-and-keys-mgmt:see-all-passes-and-keys`,
+    `resident-transactions:see-all-resident-transactions`,
+    `nfc-patrol:see-all-nfc-patrol`, `incident-reports:review-incident-report`,
+    and two new strings: `nfc-patrol:start-nfc-patrol` and `cctv-mgmt:see-all-cctv`.
+  - `usePropertyPermission` now offers `cctv-mgmt:see-all-cctv`.
+  - `constants/permissions.ts` records the two new strings as canonical.
+  - Bulletin was already offered by all five fleet catalogues as `bulletin-board`;
+    unchanged.
+  - Module counts: Security 30, Property 33, Pest 17, Pool 17, M&E 16.
+
+- 544c9ea: CCTV camera wall: Recorded footage — pick a start time and length and play what the camera recorded (server link, plain refusal messages); `cctv-mgmt:view-recordings` added to the Property Management and Security catalogues.
+- e85696e: Client invitations: an accepted invitation whose site never reached the company's Sites list now says so in plain words and offers "Add <site> to your Sites" (`linkInvitationSite`, `PUT /service-provider-invitations/:id/link-site`). Needs core 3.100.0.
+- a1fb6bf: Client invitations: a dedicated module for a service-provider company to answer invitations from its clients (Pending / Accepted / Declined / Expired, plain-language status on every card, Accept / Decline only while waiting). Accepting adds the site to the company on screen. The bell's invitation row opens it. The inviting site's list now also shows accepted invitations. Removes the combined prompt from the member-invitations page.
+- dd146ec: Invite Client: for a new client, Seven365 now sets the owner's role permissions per application next to the modules (all permissions of the ticked modules ticked by default, only those offered) and sends them as `permissions`. Role editors (`RolePermissionMain`) offer only what that owner role allows for its application; new `ownerGrant` / `catalogueForOwnerGrant` in `utils/org-modules`. The form's site value is now actually sent.
+- ac2e7c8: Members: the "role from another site" banner gets "Fix roles from other sites" — a preview of each member, their site, the current role and the role proposed at their own site (warnings for fewer permissions or several/no matches, never pre-ticked), Apply, an automatic undo file download and an Undo button. Uses `GET/POST /api/members/cross-site-roles/fix` and `POST /api/members/cross-site-roles/undo` (core). The list and the banner count refresh after it.
+- 3c787e6: HERO building map and lift queue show the HERO Fleet Core building at sites with fleet robots: walls, doors (open doors highlighted) and lift shafts from the fleet, refreshed every 5 s, read-only (no Edit map); the lift queue shows each fleet lift's car floor and the robot holding it. The map editor's duplicate "Full screen" button is removed - the page header's one full-screens the viewer or the editor.
+- 47829e0: HERO robots phase e: site Alerts (`RobotSiteAlerts`) and Activity log (`RobotActivityLog`, site or network) as RobotSiteScreen views `alerts` / `log`; the header bell shows the site's open faults on every view; the Add / edit robot dialog rebuilt to the handoff (520px, type-filtered brands with capability, replace-only credentials) and the Remove dialog's wording; the building map reads the site's map whichever robot type saved it; mini-map name tags stay inside the plan.
+- 414cc4f: HERO phase (d): 3D building map (`RobotBuildingMap` - CSS 3D stacked floors, ISO/TOP/SIDE/UNDER, drag/pan/zoom, floor filter, auto-orbit, full screen, robots with pins, patrol routes, lift shafts, "Floors · top down" legend + Floor unknown tray), map editor (`RobotMapEditor` - Wall/Zone/Door/Lift shaft/Move/Delete, Undo + Ctrl/Cmd+Z, plain-language save checks, keyboard), lift queue (`RobotLiftQueue` - animated shaft, riding/requested/released/timed-out rows), `RobotSiteScreen` `view` prop, `utils/robot-building.ts`, `useRobotBuilding`. Floors read "L1"/"B1"; a security robot's "Not reported" line lists spot clean; route tags and checkpoint labels stay inside the plan; plan grids repeat again.
+- b91fb57: Robots: shared pieces for the HERO network view - Needs attention, Clients drill-down, Faults & alerts table, fault bell, live indicator, a feed-agnostic live-state store (`useRobotLive` with a 4 s polling feed, paused while the tab is hidden, swappable for a push feed), summary cells that show "—" for unmeasured values, and display helpers (split lines, since/ago text, Reconnecting instead of stale facts). Not used by any app until the org network page adopts them.
+
+  A robot with no interface now shows an UNKNOWN status chip (error tone); "No interface" appears only on the capability badge.
+
+- a7935b0: Robots: add the HERO robot theme (scoped `hero-light` / `hero-dark`, robot pages only) and the shared robot components (status chip, battery, capability badge, command bar, summary strip, table, card, lift row, map toolbar, toast, notices). The capability badge reads the brand's COMMAND level; overlays opened from a robot page take the HERO look, all others are unchanged. Not used by any app yet.
+- f929838: HERO robot fleet phase c: `RobotSiteScreen` (shared shell header + site fleet overview + robot detail) for Property Management, Hygiene, Security and the console drill-down, built from new `RobotSiteHeader`, `RobotSiteFleet`, `RobotMiniMap`, `RobotDetail`, `RobotLivePlan`, `RobotFloorPlan`, `RobotPatrolRoutes`, `RobotMark`. `siteStatesFeed` (estate-scoped 4 s poll); `useRobots` gains `getSiteFleet`, `getSiteSummary`, `getRobot`, `getPatrolRoutes` and the pause / resume / cancel / navigate / relocalize command kinds. Pure rules in `utils/robot-display.ts` (list paging - fixes the old fleet never paging past page 1 -, site summary, mini-map placement, patrol drawing and schedule rows, facts grid, optimistic command status, trail, spot points). `RobotTable` gains `paged-foot`; `notReportedLine` uses the handoff's words (battery, floor, spot clean, live position).
+- 5beb877: Show doors opened from the resident app on the HID Access Log dashboard.
+
+  A resident on an intercom call opens the door by sending the reader's door
+  code as a DTMF tone on the SIP call, and the door station acts on it. The
+  reader never reports that as an access event — its own access log only knows
+  cards, PINs, faces and QR codes — so those door opens never appeared on the
+  dashboard.
+
+  The resident app now records each one through the API as an
+  `intercom_door_open` event, and the dashboard fetches those by type alongside
+  the reader's live logs and renders them with the code it already has: the
+  resident's name and unit from their HID identity, "Authorized", the reader's
+  location, and a new "Intercom" access method, which is also a filter option.
+
+  Fetched by type on purpose. The dashboard's general page of persisted events
+  is shared with every other event a reader emits and is discarded whenever the
+  reader has live logs — which it always has — so an intercom event on that page
+  would never have been shown.
+
+- bf29ed6: Add an Access Permissions screen to the HID reader row, and send the
+  organisation with an enrolment so the access it now grants is stored against
+  the right one.
+
+  Enrolling somebody makes the reader RECOGNISE them; it is a separate chain of
+  rules on the device, starting at a `user_groups` row, that decides whether the
+  door opens. Until now nothing in any app wrote that second half: the backend
+  and the `useHidAmico` wrappers were both finished and had no callers, so an
+  enrolled resident was recognised at the door and refused — access log event 6,
+  which reads as a broken face reader rather than a missing assignment.
+
+  The new dialog opens from the HID Readers row menu and lists the residents
+  enrolled on that reader, each with a Has access / No access switch. Switching
+  somebody off removes their assignment and the reconcile deletes their
+  `user_groups` row; their identity, face, card and PIN are untouched, so they
+  stay recognisable at the door and are simply refused. The reader must have a
+  location set — the server will not manage permissions without one — and the
+  dialog says so rather than letting the first request fail.
+
+  Residents are narrowed by the query rather than after it, because the pager's
+  count comes back from the same request and filtering on this side would print a
+  total that never matched the rows beneath it. Rows the screen cannot act on are
+  drawn with the reason in place of the switch instead of being dropped, for the
+  same reason.
+
+  `HidUserEnrollment` gains an `org` prop and sends `orgId` when creating an
+  identity. A site reached through `customer.sites` is owned by one organisation
+  and managed by another, and without this the grant lands in the owning org's
+  permission document, which the screen does not read.
+
+  The editing model lives in `utils/hid-permission-assignments.ts` with tests:
+  the save replaces the reader's whole assignment set while the list arrives one
+  page at a time, so the draft is held for the entire reader and the payload is
+  always built from all of it. Building it from what is on screen would silently
+  revoke everybody who is not.
+
+- ff460b0: Bring back Read at Reader in the physical HID card dialog.
+
+  Assigning a card by hand needs its facility code and card number, and neither is
+  printed on the card. An operator holding a blank fob has no way to look them up,
+  which left the dialog with one route in that could not be walked. Presenting the
+  card to the reader is the route that works: the reader listens for 30 seconds
+  and reports what it read.
+
+  Assign Manually stays, for the cards whose values are already known.
+
+  Nothing behind the screen changed. `POST
+/readers/:readerId/users/:hidUserId/cards/enroll` and its `enrollment/cancel`
+  counterpart were never removed, and the `useHidAmico` wrappers for both were
+  still exported with no callers — this restores the only thing that was taken
+  away, which was the buttons.
+
+  Cancelling tells the DEVICE to stop rather than only abandoning the request, so
+  the reader does not sit out its remaining seconds and enrol whatever is
+  presented in the meantime.
+
+  It also hands the dialog straight back. The server cannot tell a cancelled read
+  from a failed one — the reader simply reports no card — so the enrol still in
+  flight ends as a 400 seconds later. Waiting for that was the whole problem:
+  Cancel appeared to do nothing until the rejection arrived. The dialog is now
+  released as soon as the reader confirms it has stopped, and the doomed enrol
+  lands silently. The button reads "Cancelling…" for the second or two that
+  confirmation takes, and the reading state is only cleared once it arrives —
+  re-enabling Read at Reader any earlier invites a second attempt the reader
+  refuses with "already running", because the enrollment lock is released by the
+  cancel call itself.
+
+- 2f58eb4: Tell the operator when the selected resident is already enrolled on the HID
+  reader, instead of letting the enrolment run and fail.
+
+  Picking a resident in the enrolment dialog now asks the identities endpoint
+  whether that person already holds a HID user on the selected reader. If they
+  do, the field carries an inline message naming the existing user and the submit
+  button is disabled; the check runs again on submit, before anything is written
+  to the device, because the dialog can sit open while somebody else enrols the
+  same person.
+
+  The check is reader-scoped — being enrolled at another gate is normal and says
+  nothing here — and it fails open: if the lookup itself errors the operator is
+  not blocked, because the server refuses the duplicate regardless.
+
+- fc8122b: Let HID enrolment enrol property-management staff, not only residents.
+
+  The enrolment form could only ever pick a resident. The person came from a
+  Block → Level → Unit → Resident cascade running on People Management's occupancy
+  endpoints with `type = "resident,tenant"`, so a guard, admin or technician could
+  never appear in it, and the field was labelled `Resident` in the markup. Staff
+  could be granted a group assignment from Access Permissions, but that does not
+  enrol credentials — a face, PIN or password — on the reader.
+
+  An "Enrolling" dropdown now sits at the top of the dialog. Choosing Member
+  replaces the whole cascade with one searchable picker, because staff hold no unit
+  to narrow by. Their role is shown beside the name in the
+  picker and mirrored into a read-only Role field, on the same rule the form
+  already applies to Name: restated from the record, never typed.
+
+  Nothing new was needed on the server. The write path has always carried three
+  subject categories — it maps them onto `person`, `member` or `serviceProvider` —
+  and `createIdentity` already validates a member against the site's active
+  members, resolves their account, refuses a duplicate with "This staff member is
+  enrolled on this reader", and grants access under the `property_management`
+  category. Only the picker was missing. Candidates come from `GET /api/members` — the same
+  endpoint, with the same filters AND the same page size that the Members menu
+  reads — so the picker and that menu always agree, and no new endpoint was needed
+  either.
+
+  The page size is load-bearing. `member.repo.ts` caches each page under a key
+  that includes `limit`, so asking for a different one gets a different cache
+  entry with its own 15-minute life. An earlier version asked for 50 and landed in
+  a rarely-touched slot that went stale, showing six members where the Members menu
+  showed nine — the same query, the same moment, two answers. Ten is the menu's
+  own page size, so the two now read the same entry.
+
+  The rest of the staff arrive as the dropdown is scrolled. `AppSelect` grew two
+  opt-in props, `has-more` and `loading-more`, and a `load-more` emit: it asks for
+  the next page when the list is scrolled near its end, and again when a page
+  settles without filling the menu — a page of ten whose rows are mostly filtered
+  out can draw four options in a box built for eight, and a reader with nothing to
+  scroll would otherwise be stranded. Every other AppSelect in the product is
+  untouched: leave the props alone and there is no footer, no listener and no
+  emit.
+
+  Requests carry a sequence number, so a page still in flight when the dialog
+  reopens cannot append onto a list that has since been replaced — the same guard
+  `EntryPassInformation.vue` uses for its own card pager.
+
+  Reading staff from the Members endpoint rather than the HID permission-candidate
+  endpoint is deliberate. The candidate endpoint applies no `type` filter, so it
+  returns every active members row at the site: service providers and residents
+  included. A picker offering a resident as a "Member" is worse than no picker.
+  Which type to ask for comes from the running app, the same way
+  `HidQrCodeConfiguration` reads it, so the property app lists its own staff and
+  the security app lists its own. Service providers will get their own option
+  rather than being folded in here.
+
+  Three details worth knowing:
+
+  The duplicate pre-check used to give up on anything that was not a resident, so
+  it now runs for any subject. It only moves the server's refusal in front of the
+  operator before the reader is touched.
+
+  The type is offered while enrolling and merely stated while editing. An
+  identity's subject cannot change category after the fact, and the picker is
+  hidden on edit so an existing record cannot be re-pointed at somebody else.
+
+  A member with no app account is not listed, because reader access is bound by
+  user id and there is nothing to bind. A note under the picker says how many were
+  left out and why, so an absent colleague does not read as a broken screen. The
+  count is worked out here, from the `user` field the members endpoint already
+  returns, so it needs nothing new from the server.
+
+  The name shown is the one on the member's ACCOUNT, falling back to the
+  membership's. A membership carries whatever was typed when the invitation was
+  sent, and the person may have set their own name since. `userName` comes from
+  `@7365admin1/core`; until a release carrying it is installed the picker falls
+  back to the membership name on its own, so this is safe to deploy ahead of it.
+
+- 0945265: Add "Re-apply settings" to the HID reader's Identification Methods dialog.
+
+  A reader's configuration can change without iService365 knowing — a firmware
+  update, somebody using the reader's own touchscreen or web UI, a restore, a
+  factory reset. The screen then says a credential is off while the door happily
+  accepts it, and the screen is what people trust.
+
+  Saving the dialog only writes what is on screen. This reads the device first,
+  puts back anything that had drifted, and names the credentials it corrected.
+
+  Two outcomes are reported rather than hidden. A reader whose identification
+  methods have never been set has nothing to re-apply and says so. A reader that
+  shares a device with another registered record is refused outright: the device
+  holds one configuration, so two records would each read the other's values as
+  drift and revert them, and a person has to remove one record first.
+
+  Requires the reconcile endpoint from `@7365admin1/core`; see the merge order in
+  the PR.
+
+- 7c54796: Name an intercom contact after the unit it rings, not just the person.
+
+  Add Contact picks the name from the site's SIP accounts, so a contact always
+  names someone who holds an extension. It offered the bare name, which is not
+  enough on either side of the glass: staff picking between two residents called
+  Harris had nothing to tell them apart, and the contact list a visitor scrolls on
+  the door panel named a person without saying whose home it called.
+
+  The picker now offers, and stores, `Harris - Blk 1/Level 1/Unit 1`. This is the
+  name the reader keeps, so the door panel, the Intercom Contacts table and its
+  search all show the unit — the address the API now returns as `unitLabel` on
+  each SIP account. Somebody who does not live here carries their membership type
+  in the same place, `Dexter Tan - Security Agency`, so the list reads the same
+  way for staff.
+
+  `unitLabel` is optional. An API still on the `@7365admin1/core` release that
+  predates it answers without the field, and an owner the site knows neither an
+  address nor a membership for gets `""`; both fall back to the bare name rather
+  than trailing a dangling separator, so the picker degrades to exactly its old
+  behaviour instead of offering `Harris - `.
+
+  A contact created before the unit was part of the name resolves to its SIP
+  account on edit all the same: the bare name is matched as well as the composed
+  one, so its extension and the Address hint stay right instead of the name
+  looking unrecognised. Its stored name is left alone until it is re-picked —
+  `applySipAccountToContact` returns early on no match and never blanks an address
+  the reader already holds.
+
+- 3b75773: Move the identification-method settings onto the reader, and hide visitor QR
+  issuance.
+
+  Which credentials a door accepts — facial, card, QR, and PIN versus
+  ID-and-password — is now set per reader, from HID Readers > Identification
+  Methods. The device's own `identifier` module is what holds them, so a
+  site-wide copy could only ever describe one reader.
+
+  The old controls sat on the site settings screen and were not what they
+  appeared to be. Facial and QR Code were written to site metadata and never
+  reached any device; only Card and PIN were sent, and always to a single reader
+  borrowed from the Visitor QR gate list. On a site where those gates had never
+  been saved the reader id was empty and all five toggles were disabled with no
+  explanation, which is what made this worth fixing rather than restyling.
+
+  The new dialog talks to `PUT /readers/:readerId/identification-methods`, which
+  validates each method against the reader's own `capabilities` and confirms the
+  write by reading the device back. So the screen disables a control the hardware
+  cannot do and says why, shows when the READER last confirmed the settings
+  rather than when somebody saved them, and on refusal reports the credential the
+  device would not take and reloads instead of keeping the rejected choice on
+  screen. Switching a credential off decides what stops opening a door, so it
+  takes a confirmation naming the reader and what is being turned off.
+
+  PIN and ID-and-password are one setting with two modes, not two switches — the
+  reader has a single `pin_identification_enabled` flag. There is no Bluetooth
+  control: the HID API has no Bluetooth identification field, and the old toggle
+  of that name referred to the phone-as-a-card feature in the mobile app.
+
+  Saving the site settings screen no longer touches any of this. `enabled` and
+  the stored `identificationMethods` are passed through from what was loaded
+  rather than recomputed from toggles that are no longer there, so saving printer
+  or template settings cannot erase or flip them. The deprecated site-level
+  fields stay in the schema; the backend still validates them.
+
+  Visitor QR passes are hidden at the manager's request (2026-09-23). This is one
+  flag, `HID_VISITOR_QR_ENABLED`, in `VisitorForm.vue` — issuing, the preview
+  dialog, printing and the regenerate handler are all intact, so the feature
+  comes back by flipping it. The resident mobile app has its own visitor QR
+  screen and is deliberately untouched.
+
+- b29c28b: Add a HID QR Code screen where a signed-in member generates their own pass.
+
+  Every other HID screen acts on somebody else, a resident being enrolled or a
+  visitor being issued a pass. This one has no subject picker, because the server
+  takes the caller from the session and there is no user id to send.
+
+  Pick a reader, generate, and the code is drawn in the browser from the value the
+  server returns. It can be downloaded as a PNG straight off that rendered image,
+  so the credential never travels again just to be saved. Regenerating replaces
+  the previous code and the old one stops working immediately. Removing withdraws
+  it from the device without touching the member's identity or their facial
+  enrollment.
+
+  Issuing a code does not grant access. A member's door permission comes from the
+  HID permissions screen, so the screen reports whether that screen actually
+  admits them to the reader and warns when a code would be refused at the door,
+  rather than handing out something that silently fails. It also refuses to offer
+  one on a reader with no QR capability.
+
+  The menu entry sits between HID Reader Users and HID Cards. The menu test now
+  pins the entries by title rather than by count, so the next change to it says
+  which entry moved.
+
+- cab34a3: Carry the chosen HID reader between the HID screens instead of resetting it on
+  every one.
+
+  HID Reader Users, HID Cards, Access Logs and HID QR Code each held their own
+  reader and each defaulted it to the first one the site returned. Because they
+  are separate pages, the component unmounted on every navigation and that default
+  ran again — so picking HID 2 on HID Reader Users and clicking through to HID
+  Cards put you back on HID 1, with no way to make the choice stick. On a site
+  with several doors it had to be re-picked on every screen.
+
+  The choice now lives in one place, `useHidReaderSelection`, and every screen
+  seeds from it and writes back to it. The dropdowns are untouched: the web
+  already used `AppSelect` everywhere, so this is the state and not the control.
+
+  A remembered reader is only used when it belongs to the current site and is
+  still in the list. That one condition covers a site switch, a reader being
+  deleted, and the first load; each falls back to the first reader instead of
+  querying an id the site does not own, which returns nothing and reads on screen
+  as a reader with no users, no cards and no logs.
+
+  Kept in memory rather than stored. Moving between these pages is a route change
+  rather than a page load — the menu's items carry a `route` and
+  `NavigationItem.vue` renders them through `:to` — so a module-scoped ref
+  survives exactly the navigation that was losing the choice. Surviving a hard
+  refresh as well is a separate and much smaller benefit.
+
+  Intercom keeps its own reader. Its question is which panel you are calling, not
+  which door you are administering, and joining them would mean switching reader
+  on Access Logs changed who you would dial.
+
+- 91c29e1: Inventory: packing on items (form, stock list, item detail, movement report), "Fault reported by" on Record Usage and in the usage report, and each technician's stock shows left and used this month (My Stock, Technicians). Items used up this month stay listed at 0 left without the Record usage button.
+- cc838c5: Inventory roles: one permission per job (view stock, request items, record usage, approve requests, issue and receive stock, view reports, inventory admin) with plain names in the role editor, and one-click presets ("Staff: request & use", "Supervisor", "Storekeeper", "Inventory admin"). The Inventory screen shows only the tabs and buttons the role allows.
+- 3aa7779: Inventory: "Main store · <company>" with who manages it, a request-first view for other companies, pending-approval banner for the owner; Used by on items (form, chips, column, filter, bulk edit, report filter); Give to colleague (My Stock) with confirm/decline; Hand-overs report; name · company · service on requests, holdings, history, reports; Issue Stock "Give to" grouped by company with a Used-by warning.
+- 83b11aa: Inventory: Purchases report (by month and supplier, up to 12 months), supervisor "Mark checked" on usage records with a not-checked-yet filter, "Copy from old Equipment list", and the dashboard supply tile shown to inventory roles and named "Low Stock" when it lists items at or below their alert level.
+- 7c892e6: Inventory: a store that supplies several properties names them all ("Supplies Winsland House I and Winsland House II") for every viewer, including service providers; requests show which property they are for; the Stock Movement report can be filtered to one property.
+- 4f08426: Add Inventory: `InventoryMain` and its tabs (Stock, My Stock, Requests, Technicians, Reports, Settings) with receive, request, approve/issue, record usage, return, stock count, Excel import and Excel report export, backed by `/api/inventory`. Adds `useInventory`, `useInventoryPermission` and the `inventory` permissions to every app's role catalogue.
+- 0fccd91: Inventory: supplier list. Receive Stock and opening stock pick the supplier from a searchable list (or add a new one, with a near-duplicate warning); new Suppliers tab with add/edit (only the name required), inactive, and Excel import.
+- 221ea52: Inventory is easier to use: a new store shows only **Add Items** until it has items; the item form explains Unit, Packing, the low-stock alert and unit price; the item picker is labelled; requests read "Waiting for approval" / "Approved" with "N handed over (asked M)" and who decided and when; cancelling a request asks first; item history shows who did each step; Record Usage says "Tenant unit"; the Usage report shows the before/after photos the supervisor checks; "Count diff." reads "Stock count +/-"; a technician's activity says "Taken from store".
+- 69501a3: Inventory: usage drafts (save the before photo first, add the after photo and submit later; edit or discard with a confirm; My drafts cards with an old-draft warning; "in drafts / free" on holdings); History per item and "My usage" with date, item and place filters; Usage report as the store owner's usage tracking (status incl. in-progress drafts, person, item, place, work order, flags, search; totals by item / person / company; photo thumbnails with times; draft and submit times; how the stock reached the person; Excel with the same filters and photo links; click a person or an item for its full history); a provider's supervisor gets "Company usage" for its own people at the main store.
+- c256b3b: Inventory Record Usage: a before photo and an after photo are required (owner decision 2026-09-27). Save is refused with "Add a before photo and an after photo to record usage." until both are added; the API enforces the same rule.
+- 2af39e9: Invite Client: for a new client the form asks for the modules of each chosen service (all ticked by default, always-included modules locked) instead of a role, and sends them with the invitation. The client's owner gets the client's own owner role, bounded by those modules. Inviting into an existing organisation is unchanged.
+- 1173d74: Invite Client: a Property Management client also gets the Service365 resident app modules, all ticked to start
+- 66e6fd3: Invite member: from inside a site the Site field is fixed to that site (read-only), and the Role list shows only the organisation's own active roles for the invited app and that site, each labelled "Site role" or "Organisation role". Org-less template roles are no longer offered on an invitation into an organisation.
+- e7ccdd5: Members list and Members → Service Providers: a "Last active" column (last sign-in: "Today, 9:05 AM", "Yesterday, …", or the date; "—" until the person next signs in).
+- ef816aa: Excel templates made live from the property: every import (inventory items, receive stock, building units, areas, units, vehicles, cameras) downloads a template with dropdowns, an example row and an Instructions sheet, and the server-checked imports show every row before saving and save nothing while a row needs fixing. Add Item records opening stock like a delivery (date, supplier, PO no., received by).
+- 99cfad0: Camera wall: show the live view from the server's signed address when it sends one
+
+  The CCTV relay's live routes have no authentication today — anyone who knows a
+  channel number can watch a live camera. The relay is being closed behind a
+  signature the server mints per request and carries on the address as query
+  parameters.
+
+  The signature cannot be written onto `host`: that is the stored record, copied
+  into patrol-route documents and re-read by the server's own relay-URL check,
+  which rejects an address carrying a query. So the server hands the signed
+  address over beside it as `liveUrl`, and the wall now prefers it.
+
+  Additive and backward compatible. A camera whose relay is not configured gets no
+  `liveUrl` and still plays from `host`, exactly as before. The address is used
+  verbatim — never rebuilt from a host and a channel — so the signature survives
+  to the player.
+
+- b40a5f2: Building map editor: drag to move, resize handles, drag wall/door ends and zone corners, add/remove zone corners, turn doors and lift shafts, flip a door's swing, multi-select (Shift+click, box select), snap to grid, keyboard nudge/delete/escape and redo. A whole drag is one undo step.
+- bd40309: Members: a banner "N members here have a role from another site. Assign each one a role for this site." with a one-click filter to list them (server `roleState=other-site`); disappears at 0. `useMember().getAll` accepts `roleState`.
+- 3f44414: Members list: a member holding a role that belongs to another site shows a warning chip ("<role> — belongs to <site>. Assign a role for this site.", server roleState "other-site"), and the Assign Role action in the row menu is highlighted whenever the role chip is a warning.
+- f536ef0: Members list: the role chip shows the member's real role name, and a clear warning ("No role assigned - assign one", "<name> (deleted) - assign a new role", "Invalid role - assign a new role") when the server's roleState says the role is missing, deleted or another organisation's. Rows from an older server render as before.
+- e17c43c: Members → Site access (organisation-level Members screen, owner request 2026-09-28):
+  the organisation's owner/admin chooses which of the organisation's sites a member
+  can open and the role at each (only roles created for that site), with "Same role
+  for all selected sites", and can remove the member's organisation-wide access so
+  they see only the chosen sites. New `MemberSiteAccess.vue`, `utils/site-access.ts`,
+  `useMember().getSiteAccess/saveSiteAccess`.
+
+  Fix: Assign Role pre-fills the member's current role again when the server marks it
+  usable (`roleState: "ok"`); 4.65.3 treated "ok" as unusable.
+
+- f8c2009: Members > Service Providers: new `MemberServiceProviders` component listing every person from the site's service providers who can open its information - company chips with head counts, service and company filters, search, role at the site, date added, status, "Invited by" for subcontractors, Export to Excel and an "Email company" action. `MemberMain` takes `extraTabs` so an app can add the tab beside Active / Inactive.
+- 075676d: Members table: one compact "Role & access" cell (each role once; one site by name, several as "N sites" opening the full site list), name with email underneath, one-line dates, clean role labels.
+- 43b1741: Phones: below 600px every data table (`VDataTable`, `VDataTableServer`, `VDataTableVirtual`) shows each row as a stacked card (label: value) instead of a wide grid scrolled sideways, and the 720px `.app-table-scroll` floor no longer applies on phones. Tablets and desktop are unchanged.
+- baac4ab: Add a derived module-to-application map (`utils/module-applications.ts`).
+
+  The Seven365 console listed the whole 47-entry catalogue as one flat list, so a
+  security client was offered Cleaning schedule management. R1 is written in terms
+  of applications, so the console needs to know which application each module
+  belongs to.
+
+  The map is DERIVED from each application's own `use*Permission` composable — the
+  same object that app passes to its role editor — so the console cannot disagree
+  with the apps. It is many-to-many on purpose: M&E reuses the cleaning schedule
+  module, and members/roles/attendance are shared by nearly all of them.
+
+  The seven app composables now import `useCommonPermissions` explicitly instead of
+  relying on Nuxt auto-import. Identical inside the app, and it is what makes the
+  catalogue readable outside Nuxt so the map can be derived at all.
+
+- 0e6002e: Offer Emergency Contacts in the Cleaning and Landscape role editors, and stop the
+  client module list from hiding what a client or a role already has.
+
+  - `useCleaningPermission` and `useLandscapingPermission` now offer
+    `emergency-contact` with the seven actions `constants/permissions.ts` defines
+    (`see-all`, `see-details`, `add-/update-/delete-emergency-contact`,
+    `add-/delete-emergency-contact-category`). The long `see-all-emergency-contacts`
+    spelling is not added.
+  - `orgAllowsModule` treats every spelling of one module as the same module
+    (`MODULE_SPELLING_GROUPS`, derived from `LEGACY_PERMISSION_ALIASES`) and always
+    offers `ALWAYS_ALLOWED_MODULES` (sites, subscriptions, customers,
+    payment-methods, members, invitations, roles, roles-and-permissions,
+    site-settings). Widening only: everything offered before is still offered, and
+    the whole-catalogue fallback is decided exactly as before.
+  - The role dialog lists grants a role holds outside the client's offer as
+    "Granted — not offered to this client", read-only. Saving keeps them.
+
+- f0f8f0c: Module gate on the web (RP-5): read the client's module deny list from `/api/members/user/:id/app/:type/modules`, refetch it when the org|site in the route changes, and hide the menu entries, dashboard widgets and pages of denied modules. Fails open: no list, a 404 or any error denies nothing, so it changes nothing until a client has a saved list and the API route is live. The member and role lookup is unchanged. The Assign Role picker always offers the member's current role.
+- 15a7d59: NFC patrol report: the route picker also lists deleted routes, labelled "(deleted)" and after the routes still in use, so past patrols on a deleted route can still be reported on. `useNFCPatrolRoute().getAll` takes `includeDeleted`. Needs `@7365admin1/core` with NFC route soft delete in API-core; against an older API, which refuses the parameter, the picker asks again without it and lists what it did before.
+- b7bd8e6: NFC routes: drag a checkpoint onto another in the Add/Edit Route form to swap their positions; the new order is saved with the route. Travel time is removed from NFC routes: the form no longer has a Travel time column or Total Travel Time / Tolerance Balance, the routes list and Route Details no longer show travel time, and the patrol report drops its Travel time (Actual/Expected) column, renames "Total travel time" to "Total time" and shows the route's own tolerance. Needs the matching @7365admin1/core release, which stops requiring travelTime on checkpoints.
+
+  NFC patrol report times are shown on the site's clock: scan times no longer read as UTC (a 10:50 scan showed as 02:50), and on patrol logs from the updated core every time follows the log's timezone. The Actual row now runs from the guard pressing Start Patrolling to the last scan or skip, so a patrol started early in the Early Start Allowance shows as early.
+
+  NFC route form: Tolerance takes digits only (letters and symbols cannot be typed or pasted) and is at most 60 minutes; opening a route saved with more shows the message instead of a silently disabled Submit.
+
+- 0584632: Notification bell: robot alarms open the site's Robot alerts page, inventory alerts open their store on the right tab (Requests / Stock / My Stock), older "work-order" and "other" inventory rows route, and a click with nowhere to go now says why instead of doing nothing.
+- b8ce3a0: Notification bell: every notification now opens its page. Rows route on `params.kind` (else their `module`) to the matching page — work order, feedback, incident, visitors, cameras, patrol logs, documents, emergency contacts, events, facility bookings, online forms, bulletin board, inventory, service providers, marketplace orders, and the Seven365 staff robot/client pages — in this app when it has the page, otherwise in the app that does (by its `APP_*` URL), with the organisation and site in the link. Rows with nowhere to go are no longer drawn as links. New `chooseNavigation`, `notificationKind`, `WEB_TARGET_KINDS`.
+- 03ea14d: Notification Settings: Email per module, with an "Email address for notifications" card (send code, verify, resend, change). New `/notifications/open` page turns a notification email link into the right page, using the bell's own target table.
+- 800eee1: `getVerifications` takes `origin`; the console Client List's Pending tab lists only invitations Seven365 sent.
+- 11a3ac2: Organization app Members: lists every person of the organisation, including people limited to specific sites (one row each, labelled "Limited to: Site A, Site B"; organisation-wide people read "All sites"); a Site access button on every row; the actions column stays pinned on the right; shorter dates; at organisation level the "role from another site" banner is gone and such a role reads "Security (The Loft)". Needs core with `GET /members?people=1` (older servers refuse the flag).
+- 7e671c3: Site access lists "Organisation roles" and "<Site> roles" in every site's Role list and in "Same role for all selected sites" (organisation roles offered before any site is ticked), with a "Create an organisation role" link. RolePermissionMain takes `scope` ("organisation" = roles with no site); getRoles sends it only when set.
+- 21cfefc: Add / Edit robot: Ounitech credential fields read "AppID" / "Secret" (demo: "any value"); a Robot picker lists the robots the company credential covers (Find robots) so the serial is picked, and adding with no pair typed reuses the client's saved Ounitech credentials.
+- 8e082b8: Robot detail: while a robot reports a fault, "How to clear this fault" lists its maker's manual steps (from the robot profile; Ounitech today), and the fault bar shows the code once, then the English words and fix.
+- 7387b63: Robot detail: virtual walls, safe and slow zones and the taught route drawn on the robot map (with a line naming them); records card adds status history, map details (walls, zones, versions, floor map history, obstacle picture), changes made in the maker's app and read-only robot settings; the 0-jobs state says the maker reports no finished cleaning jobs. Mobile robot-rules copy now carries the records rows.
+- 79733b1: PadBot security robots on the HERO robot screens: Add robot labels the fields "AccessKey ID" / "AccessKey Secret" and picks the robot from the account; robot detail offers Start patrol / Resume patrol (brands with `patrolControl`), Live video (minted per click), Mark resolved on an alarm, an ALARM badge for security alerts, and a Patrol history panel. Pause / Resume now need the brand's `pauseResume`, Cancel its `pauseProcess` (no change for existing brands).
+- ecec8a6: Robots (PadBot S2 and all brands): a robot no longer vanishes from the map on one missed or failed reading - the last position is kept for up to 15 s, drawn faded with "last seen N s ago", then "Reconnecting"; the floor becomes unknown only when the robot says so; an online robot without a position reads "Position not reported right now". Patrol routes whose stops cannot be placed on the plan are listed ("Stops: Gate → Lobby"), never drawn at a guessed spot; when the brand keeps schedules to itself (`scheduleShared: false`) the panel says so and shows recent patrol runs plus a clearly labelled guess ("Looks like ... runs daily around 20:00"). Live view opens in the page (HD / Smooth, re-minted before expiry, never stored; iframe / native video / "Open in new tab" / RTMP explanation), also from the fleet row menu. Alert photos ("Photo", "Thermal photo") on the fault bar and Alerts rows. Go to point / Set position pick from the robot's saved points when its maps list them (`go-to-point`; Set position only on the robot's floor, with a confirmation line). Manual control (only when the server reports `manualDrive` and the user can update robots): hold-to-move with a big STOP, head controls, heartbeat-guarded session that ends on release, tab hide, close or connection loss.
+- beca2f4: Dashboard: the Property Management and Security dashboards show a **Low Stock** tile (inventory items at or below their alert level) wherever their own inventory store serves the property; it can be hidden in Customize. Sites without a store are unchanged. Five tiles share one row.
+- 390c5ad: Add Resident Checklists and Security Checklists toggles to facility booking
+  setup, bound to the facility's `isResidentChecklistEnabled` and
+  `isSecurityChecklistEnabled`. The two are mutually exclusive: enabling one
+  disables the other.
+- 84434c3: Inventory: show "Equipment is now in Inventory." when a retired Equipment page forwards here (?moved=equipment).
+- 330cb76: HERO map editor - Fleet Core (Open-RMF) parity: Waypoint, Lane, Fiducial and Measure tools; lanes on route graphs 0-8 (graph picker, names, robot brands), two-way / one-way, speed limit, facing, shared-space group; waypoint settings (charger, parking, holding, pass-through, cleaning zone, dock name, spawn, pick-up / drop-off, merge radius); waypoints drag their lanes, deleting one deletes its lanes; the four door types with hinge / swing / degrees / leaf ratio; lift shafts at any angle with cabin doors per floor (which door opens where) and size fields; fiducial level alignment and scale by measurement (plan and drawing); plain-language checks (duplicate names, lanes through walls, charger without a dock, lanes that lost a waypoint, lift floors with no door); zoom and pan; the drawing area is the building's real size (plans larger than 40 x 26 m are no longer cut off; turned plans); import a building file or a route map into a graph. The editor now saves the map's `rmf` part. The 3D view draws door types, cabin doors, turned lifts, the building's real shape and a Routes toggle; the mini-map shows robot lanes.
+- 321257a: The building in 3D, generated from the robot's own floor plan
+
+  Adds `RobotMap3D` and `utils/building-map.ts`. The robot's map image is a SLAM
+  occupancy grid — walls are already dark pixels — so it is fetched into a canvas,
+  thresholded, traced into wall segments and extruded. Nobody draws walls.
+
+  Reachable from the fleet list's "View layout" action, so every application that
+  shows robots gets it without a change of its own.
+
+  No 3D engine: the scene is extruded boxes on flat floors, which a parallel
+  projection and a back-to-front draw order render correctly — and this layer is
+  consumed by eleven web apps.
+
+  The robot is drawn only when its position AND its floor are both known. The
+  vendor's tracking stream carries no floor, so drawing it on whichever level
+  happens to be selected would put it on a storey nobody confirmed.
+
+- b510338: Robot detail: a cleaning robot whose brand reports them (Ounitech) now shows Clean water and Dirty water (Low / Medium / High with the %), a "Tanks and covers" line ("Tanks and covers OK", or which cover is open / tank not fitted) and, while it cleans, "This job" (% done and m² cleaned of planned). Warning tags for clean water low, dirty water full and any open cover or missing tank. Nothing is shown for brands that do not report them. The rule (`cleaningReadings`) is part of the robot rules synced to the mobile apps; "What this robot can do" lists "water levels and tanks".
+- 26f2091: Robot screens: brand picker, live positions, and cleaning by area
+
+  The Add Robot form now asks which brand a robot is, offering each with what its
+  protocol actually allows in plain words. There is no safe default — sending a
+  robot a command in another brand's protocol is the one mistake the adapter layer
+  exists to prevent — so a brand is preselected only when there is no choice.
+
+  The fleet screen follows each robot's position while it is open, via the
+  `/track` stream, and stops every stream on unmount: the server holds one
+  connection to the robot cloud for each open one.
+
+  Losing a stream marks a robot `UNAVAILABLE` rather than leaving its last known
+  mode, which would advertise it as ready for work forever.
+
+  Adds "Clean area", so zones can be chosen from the robot's own maps rather than
+  cleaning everything. Battery is shown only when the brand reports one — a brand
+  that cannot measure it must not render as 0%, which reads as flat.
+
+- 6e8bf3d: Robot detail laid out for the operator: header (name, status, site, model · serial, Edit/Remove), one-row status strip, camera and live map side by side above the fold with the commands under the map (map full width for robots without a camera; stacks camera, map, commands, patrol when narrow), then Patrol schedule next to Recent patrols (5 rows, See all), this robot's Alerts, and "What this robot can do" folded at the bottom. New `detectPatrolSchedule` / `patrolSlotText`: for brands without a schedule API (PadBot) the patrol schedule is detected from the last 30 days of runs ("Patrolling Lvl3 · daily 20:00 · last ran 18 h ago · next expected 20:00 today"), clearly labelled.
+- 91b60e3: Robot fleet screens, shared by every application that shows robots
+
+  Adds `useRobots` (the `/api/robots` calls), `utils/robot-display.ts` (one set of
+  words and colours for a robot's state), and two components: `RobotFleet` — the
+  list with live status, floor and the Clean / Return actions — and `RobotForm`
+  for registering a robot.
+
+  One component rather than a copy per app, so Property Management, Hygiene, the
+  Seven365 console and the two mobile apps cannot drift into describing the same
+  robot four different ways. Each app passes only which robot `type` it presents
+  and which actions its user holds a permission for; the API narrows the result
+  again on its own side.
+
+  An unrecognised mode renders as "Unknown" and is never offered a Clean button,
+  and an unknown floor is shown as unknown rather than guessed. Return-to-dock
+  stays available while a robot is busy, because that is how an operator recovers
+  one.
+
+- 406f423: Robot building map editor: floor plans per floor (upload / replace / remove, stored privately in the map; Set scale by measuring a known length; Fit), HERO Fleet Core import into the saved map, and downloads of the building file and route maps. The 3D building map draws saved floor plans. Edit map is also offered at HERO Fleet Core sites (it edits the site's saved copy). The Add robot note says "stored encrypted" only when the server reports it.
+- 7b9f224: Robots: the live view shows the PadBot (EZVIZ) camera's H.265 picture. HLS now plays through hls.js wherever the browser has Media Source Extensions (native HLS only as the Safari fallback), the player owns `video.src` so a re-render can no longer reset the stream (the cause of the fatal bufferAppendError / black picture), and it recovers by itself: media-error recovery, then a fresh URL with backoff on network errors, expired URLs and stalls. When no picture can be shown it says so in plain words with a Retry button. The robot detail gains an inline Live view panel that plays automatically, with an "Always show live view" switch remembered per browser; it releases the stream while the tab is hidden, the panel is far off-screen or the robot is offline, and Full screen reuses the same stream.
+- c130550: Robots: building layout editor in the 3D view (place, move and remove doors and lift shafts, floor heights, save/remove the layout), doors and lift shafts drawn in 3D with shafts spanning stacked floors, and a live lift queue panel (simulated lift) with request/release for demo robots. New useRobots calls for building maps and lift sessions.
+- ccf0b17: Robot detail: an Ounitech robot shows its real floor map with its area layer, area names and live pin ("position approximate" until Ounitech confirms the map corner); Clean area picks the areas to clean; new records card: recent cleaning jobs, alert history, every robot and base-station reading, parts wear, timed switch on/off and lifts. The site mini-map shows cleaning robots on their own map.
+- 567f2d7: Robot maps: a robot with more than one map (PadBot) now has a map selector on robot detail and the site mini-map, opening on the map the robot is on ("Robot is here"). Each map shows its own image at its real shape, its saved points and its routes. Go to point offers another map's points only when PadBot can take the robot there (same map group), otherwise says "The robot must be on this map first."; Set position lists only the robot's current map. The building map draws a robot's map on its floor when the floor number is known and the floor has no saved plan.
+- ff47855: Robots: draw walls and zones on the building layout. The layout editor can now draw, move, reshape and remove wall segments and named zone polygons per floor, with undo of the last change and keyboard shortcuts; walls and zones are saved with the building map and drawn in the 3D view.
+- a63f6b4: Robot detail: "What this robot can do" card built from the robot's brand + model manifest; information grouped Status / Location / Patrol|Cleaning / Camera; unsupported facts hidden (never greyed); commands confirm what will happen and report the result; "Return to charger" everywhere; maker-app schedule text from the manifest. Site fleet Brand column names the model; the capability badge's tooltip lists what that robot does.
+- cd32225: Robots: when a robot is online but its position isn't arriving, robot detail, the site mini-map and the building map say so in a calm banner ("<Robot> is online, but we're not receiving its position right now.") and detail keeps the last position seen faded, tagged "last known · HH:MM". The live-view segment fix now also catches a stray H.264 delimiter split across two TS packets. New `scripts/sync-robot-live.mjs` copies the web live-view player into the mobile apps.
+- 5c0af24: Robots: edit and remove, schedule, spot clean on the floor plan, faults, stacked levels
+
+  - `RobotFleet` gains a row menu: Schedule (read-only view of the robot's plans),
+    Spot clean (only for brands whose state reports `capabilities.spotClean`),
+    Edit (name, serial) and Remove, behind new `canEdit` / `canDelete` props.
+  - A robot's reported fault is shown under its status chip.
+  - `RobotMap3D` offers "All levels (stacked)" when a robot maps more than one
+    floor; the view fits the whole stack.
+  - `useRobots` gains `updateRobot` and `deleteRobot`.
+
+- 1b71827: Add a search to both role dialogs, and stop Unselect All clearing what is hidden (R5).
+
+  A client builds a role out of up to 47 modules and about 127 actions inside a
+  modal. The search matches the names a person reads as well as the raw keys, so
+  "statements" and "soa" both find `SOA-mgmt`.
+
+  It filters the DISPLAY only — a permission ticked and then filtered out of view
+  is still ticked and still saved. Select All and Unselect All now act on the
+  visible set: with no search that is the whole catalogue, unchanged; with a search
+  active, Unselect All no longer discards every permission outside the filter,
+  which on the edit dialog would have been a role somebody is already using.
+
+- d455aeb: Roles and permissions (owner approval 2026-09-25): Robots offered in the Property Management and Cleaning role editors; the PM editor's camera-wall row reads "CCTV" (label only, `virtual-patrol:*` strings unchanged); PM's CCTV page follows the client's module list (`org-site-cctv` -> `virtual-patrol`, fails open); `NavigationDrawer` takes `sectionLabels` so an app can rename a sidebar heading.
+- 43c0574: Add `useSiteActions(org)` and `utils/site-actions.ts`: whether the signed-in person may add or delete sites (and add organisations) in an organisation, as core answers it. Site-confined members are never offered these buttons.
+- e13160f: Settings → Site Information is read-only on a site the organisation serves but does not own: a note says "This site belongs to <Client>. Only they can change its details.", cover photo, description and documents are inert and Save is hidden. Blocks and guard posts stay editable. Driven by `detailsEditable`/`ownerOrgName` on the site read (core); absent on an older API = unchanged.
+- 475a46a: Service Providers: "Change or end provider" on provider rows and a "Provider changes" dialog (preview in plain words, plan for a date, undo within 14 days, cancel a plan, change site owner).
+- 52930d4: Service Providers > Invitations: the status line says who must act while an invitation waits ("Waiting for a Seven365 Super Admin to approve - the email is sent after approval") and, once approved, whether the email went out ("Email sent 30 Sept, 14:14" or "Email failed: <reason> - use Resend", in red). Reads `emailStatus` from core 3.134+; older rows keep "Sent - waiting for their answer".
+- 62ffde8: Service-provider invitations can be answered in the app: the notification bell opens "<Company> has invited you to <site>" on the organisation app's Invitations page (other apps send the click there by URL), the new `ServiceProviderInvitationsReceived` section lists invitations from other organisations with Accept / Decline, `useServiceProviderInvitation` gains `acceptInvitation` and `getReceivedInvitations`, and the invitation card shows a failed accept or decline instead of swallowing it.
+- 5c6f3a1: Service Providers screen (inviter's side): accepted providers appear under Service Providers for the site; the Invitations tab shows only this site's invitations with the company that accepted, who invited and when, when it was answered or expired, and a View provider panel; "Members" is now "Staff on site" and is not shown for invitations.
+- 497960c: Members > Service Providers: the row of company chips above the table is replaced by a Company filter in the toolbar (each company with its service, head count and "via" inviter; narrowed by the Service filter) and a one-line summary ("7 companies · 37 people · 1 company has not added anyone yet").
+- 9d50ba2: Service Providers screen: a subcontractor another provider brought onto the site reads "Invited by <provider>" (list and details), the invite form says Seven365 approves every invitation and calls the field "Service", and the bell opens SP Approvals for a waiting invitation and the hygiene Service Providers page for an answered one.
+- 9a370cb: "Open as Seven365 staff": persistent staff-view banner with Exit in every app's top bar, and staff in an open view work at that client with full setup rights without a membership.
+- ca1ba92: Suspended access: when the API answers ACCESS_SUSPENDED (every membership of the person is suspended), the app signs out and the sign-in page shows the server's message. Role names are unique per site, so role pickers and the roles table show "Admin · St. Regis Residences" (`roleLabel`), and the Members role chip uses the same "Role · Site" form.
+- 378a99b: Unit Info > Management tab: the Service Providers panel now lists and assigns the site's provider PEOPLE (the same list as Members > Service Providers) instead of provider companies. `useServiceProvider().getSiteMembers(siteId, unit)` takes a `unit` filter and `updateSiteMemberUnit(id, unit)` attaches/detaches one person. Needs `@7365admin1/core` with `updateSiteMemberUnit` and API-core's `PATCH /api/service-providers/site-members/:id/unit`.
+- fc851aa: Building Management > Unit Info: new Management tab (`BuildingUnitManagement.vue`) with Management and Service Providers panels. Add lists only active members / providers not yet on a unit; remove detaches. Suspended, inactive or deleted ones drop off on their own (the server detaches them). `useMember().updateMemberUnit`, `useServiceProvider().updateUnit`, and a `unit` filter on both `getAll`s. Needs `@7365admin1/core` with the unit-management-assignment change and the API-core routes.
+- c1797de: Vehicle QR stickers: the QR code itself can now take a shape - circle, heart, star badge, hexagon, octagon, shield, speech bubble, rounded square, blob, droplet or car - with the dots filling the whole shape (the real code in the middle with a 2-module white ring, the plate number on a dark tag at the bottom). New "Frame" choice (none = the shape is the sticker, or a card round it) and "Sticker size" choice (Small / Standard / Large, only sizes that keep the QR at least 25 mm). The print preview and the foot of every sheet now show the QR size, shape size, sticker size after cutting, stickers per A4 and gap, "print at 100%", and a 10 mm size-check bar. All codes stay error correction Q (H was tested and read worse); round "circle" QR corners were removed because tilted stickers did not scan reliably. Every shape x size x style x colour decodes under seven camera conditions.
+- 4abf631: Notification bell on by default in the shared top bar, for every signed-in web app: unread count, the latest notifications, mark one or all as read, an in-page pop-up for new ones (checked every 30 s and when the tab regains focus), optional desktop notifications, and a link to Notification settings. The list shows everything addressed to the person (it was site-scoped, which disagreed with the badge).
+- eaafd63: Resolve a member's role per SITE, not once per signed-in session.
+
+  `secure-member.client.ts` keyed the role by the user alone, so someone holding a
+  different role at two sites kept the first site's role for the whole session.
+  The lookup is now keyed by user and the route's site, and `getByUserType` can
+  send `?site=`, which the server already answers (core's `pickSiteMembership`).
+
+  Sending the site is held behind `SEND_SITE` (default `false`), matching the
+  mobile apps' switch, because a site role can be narrower than the
+  organisation-wide one. While it is held the request is unchanged, so no role
+  changes; a re-resolve that fails now keeps the last-known role instead of
+  blanking it.
+
+- 489d8d2: Security headers on every app (HSTS, nosniff, frame-ancestors/X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, minimal enforced CSP + full Report-Only CSP), drop `x-powered-by`, explicit `SameSite=Lax` on the session cookies, `sanitizeHtml` for rich text rendered with `v-html`, html2pdf.js 0.14 (jsPDF 4.2.1).
+- 5446089: Worker nouns follow the account type: one term map (`utils/worker-terms.ts`, `useWorkerTerm()`), keyed by the app's `appSlug`. Cleaning says Cleaners, security Security officers, pest control Pest technicians, M&E Technicians, landscape Gardeners, pool Pool attendants, property management Staff / Service staff, anything else Staff. Applied to Inventory (tab, report, usage column, export file name and sheet headers via `appSlug` on the export), Attendance, the schedule checklists, the security dashboard and NFC patrol report. Display only - field names and API keys are unchanged. `scripts/sync-worker-terms.mjs` copies the map into the mobile apps and API-core.
+
+### Patch Changes
+
+- d7302ad: Make the access card screens use the site's own Entrypass URL. Add Access
+  Card, the card preview dialog and Assign to Unit all called
+  `/api/encrypt-acm-url` with no `url`, so their door/lift levels, access
+  groups and card assignments went to the route's hardcoded default host
+  whatever the site had configured under Entry Pass settings. Only the
+  contractor pass in `VisitorForm` honoured the setting. A new
+  `useSiteEntryPassSettings().getEncryptedAcmUrl(siteId)` resolves the site's
+  URL first and falls back to the default when none is set or the settings
+  cannot be read; the three screens now call it.
+- 947d818: Let an access card be assigned to Management and Service Providers, not only
+  the unit's residents. The Assign Card dialog now asks which group first and
+  then who, listing the site members and the service providers attached to that
+  unit (core #2515's `unit` filter). Management assigns end to end; service
+  providers are listed but not yet assignable, because that endpoint returns
+  provider COMPANIES and a card is written onto a person's user account - the
+  picker enables itself as soon as a row carries one.
+- 512a053: Sign-in card and every page: the member, role and organisation lookups the router guard awaits before each navigation are now bounded (5 s, same as the module deny list). A lookup that never answered used to hold the first page - every app's sign-in card included - blank for ever; past the bound it now counts as a transient failure (role unresolved, retried on the next navigation) and the page renders. Successful and 404 answers are unchanged.
+- 13857a6: Edit Camera: the device password is write-only. On edit the Password field is optional, starts blank with the placeholder "Saved · leave blank to keep", and is sent only when a new one is typed, so an admin can switch a camera's Status without re-typing its login. A status-only change now enables Submit. Password stays required when adding a camera.
+- 10b9603: CCTV wall: the grid now uses only the columns it has tiles for. One camera on a four- or nine-tile wall filled half (or a third) of the width and left the rest black; the layout button means "up to this many tiles", so the wall no longer keeps empty columns.
+- 82073b9: CCTV wall: full screen now gives the wall the whole screen (the capabilities panel is not drawn while it is on, so the picture is no longer squeezed into 68% of the height), and a player that reports its first frame and then goes quiet is shown as "Not confirmed" instead of "The picture stopped arriving" — the relay reports only the first decoded frame, so the old rule called every working camera dead after 12 seconds.
+- a33011f: Connect the feedback and work-order Chat panel to the real comment thread. It
+  shipped as a mockup - five hardcoded messages from "Tan Wei" dated 06/28/2024, a
+  textarea with no model and a Send button wired to nothing - while a complete
+  `useComment` composable sat in the layer with no callers. The panel now loads,
+  groups by day, aligns by sender, sends, and attaches photos. The bubble matches
+  the mobile apps field for field, its avatar renders an actual profile picture,
+  and a load failure is reported rather than shown as an empty thread.
+- 28feb30: Checklist: the tick that finishes a set now always opens the photo dialog.
+  A set holding a rejected unit counts as finished once every unit is approved
+  or rejected (the server's rule), and roles without add-remarks get the dialog
+  too, without the remarks field, instead of an auto-approve the server refuses.
+  A server photo refusal on a single tick opens the dialog instead of an error.
+- c6efd2a: Dashboard Customize: the widget toggles use the platform switch (`app-switch`), so ON and OFF are clearly different in light and dark mode, and Submit uses the theme's primary colour. The Customize choice is now remembered per signed-in user and per app (one `dashboard-widgets` cookie storing hidden widgets), so another user on the same browser, or another service app, no longer inherits it, and new widgets appear by default. Widget visibility follows the estate permission rule (`grantsPermission`): a saved role with an empty permission list sees every widget, and every shipped spelling of a grant counts. Hiding a KPI tile no longer leaves a gap in the row.
+- 955c89c: Let the entry pass card picker be searched and paged. The "Select Cards"
+  field was a `v-select` over the first 100 available cards, which only let
+  the operator scroll. It is now a `v-autocomplete`: typing narrows the list
+  at once and, after a 500ms debounce, sends the term to the available-cards
+  endpoint as `search`; reaching the end of the list fetches the next page and
+  appends it. Responses that arrive after a newer request are dropped, so a slow
+  search cannot overwrite a fast one and a late page cannot be appended onto a
+  list that was replaced. API-core does not read `search` yet; until it does,
+  Vuetify's client-side match on `cardNo` is what narrows the list.
+- 7c54796: One date format in the Access Logs date column.
+
+  Reader rows read `15:18:43 23/9/2026` and the intercom door-open row directly
+  below read `9/23/2026, 2:15:29 PM`. `formatDate` branched on the value's type
+  and only the number branch was formatted: a reader reports its clock as an
+  epoch, while an intercom door open never touches the reader, so the API writes
+  it as an ISO string — and that branch fell through to `toLocaleString`.
+
+  Both branches now build the same `HH:mm:ss D/M/YYYY`. Local parts for the
+  string, UTC parts for the epoch, deliberately: the reader encodes its own wall
+  clock as if it were UTC, an ISO string is a real instant, and reading each the
+  way it was written is what makes both rows show the time that was on the clock
+  at the door.
+
+  Nothing else changes — sorting and the export date range already worked off
+  `parseDate`, not the display string.
+
+- b29c28b: Remove the Read at Reader action from the physical HID card dialog.
+
+  Cards are now assigned by entering the value. The button's progress alert and
+  its Cancel Reading button went with it, since both existed only to narrate the
+  30-second wait while the reader listened for a card, and neither could be
+  reached once the trigger was gone. The same is true of the two handlers behind
+  them and the state they set.
+
+  The `enroll` and `enrollment/cancel` endpoints are untouched and still served by
+  the API, so this is a change to the screen, not to what the backend offers.
+
+- fd92ac8: Deleting a HID user now actually deletes the stored identity, so the person stays deleted.
+
+  The HID Users list is read from the **reader**, and `listReaderUsers` builds each row out of the device's own columns — it carries no identity `_id`, so `toHidUser` left `_id` undefined for every row on screen. `deleteUser` then called `deleteIdentity` only `if (selectedUser.value._id)`, so for every row in that list it never called it at all. The device user was destroyed and the identity row stayed `active`, with no error, because the guard was an `if` and not a failure.
+
+  An orphaned identity is not inert:
+
+  - `findIdentityBySubject` excludes only `status: "deleted"`, so the duplicate guard still answers _"this person is already enrolled on this reader"_ and refuses to enrol somebody the operator can no longer see.
+  - `findProfileIdentity` finds it too, so the next reconcile reuses its stored `hidUserId` and rebuilds the device user from the access grant — the deleted user returns, same UID, in the reader's group.
+
+  The identity is now resolved by the reader's own keys before the device user is destroyed, the same way `saveUser` already resolves it through `findExistingIdentityOnReader`. The lookup reads our own records, so doing it first means a failure there costs nothing; if it cannot resolve a row the device delete still proceeds and the next delete can clear it.
+
+  Pairs with the core change that makes `deleteIdentity` remove the access grant reliably. Either half helps on its own; both are needed for a delete that revokes.
+
+- 2f58eb4: Ask the identities endpoint for the whole human, not one link field, when
+  checking whether the selected resident is already enrolled.
+
+  The enrolment dialog filtered on `person`, which misses a resident enrolled
+  through the permissions screen, because that screen files them under their user
+  account instead. The check now uses the `subject` filter, which follows the
+  record to its account and matches every link field, so the inline warning agrees
+  with what the server will do on submit.
+
+- 2f58eb4: Show the reader's facial reference when editing a HID user that has one.
+
+  The face photo is never shown or kept once registration completes, so the
+  dialog reported only that somebody is enrolled. It now prints the reader's own
+  reference for that enrollment under a Facial Data heading, directly below the
+  Face Enrolled button. That value is the only handle on the enrollment there is:
+  the reader holds the image and the biometric template, we hold neither.
+
+  It reuses the roster's Facial Data column so the dialog and the table cannot
+  disagree, and it is drawn only when there is a value, so enrolling a new user
+  shows nothing until the reader has accepted a photo.
+
+- 2f58eb4: Take block, level and unit out of the HID edit form, and let a credentials-only
+  edit save.
+
+  Editing a HID user does not move anybody. The record already carries its block,
+  level and unit; the dialog loads them on open and writes them back untouched on
+  save, so the location and the Unit column survive an edit without the operator
+  being asked for them. The cascade is now drawn while enrolling and nowhere else.
+
+  A resident is required to enrol, because an identity has to be linked to
+  somebody, and is no longer required to edit. The reader owns its own user table
+  and holds users we never enrolled, and changing a photo, PIN or password on one
+  of those is a reader-side operation that says nothing about who they are.
+  Demanding a resident there refused the save for a field the dialog does not
+  draw. Such an edit now applies to the device and writes no identity.
+
+  The resident field itself is drawn only where it can offer something: while
+  enrolling, or while editing a record whose stored unit gives it a list. Opening
+  an existing user loads the people in that unit, so the field shows a name rather
+  than the raw id it printed before.
+
+  The link is sent only when the form holds one. An empty string reads to the
+  server as a link being removed, not as "leave it alone", so the keys are omitted
+  instead and the stored subject is kept.
+
+  Registration number joins ID as read-only in both modes. It was read-only while
+  enrolling and editable while editing, which is backwards: both values are
+  allocated by the reader and neither was meant to be typed.
+
+- b29c28b: Make the HID user search fire when you type.
+
+  Both reader-user screens reloaded on `@keyup.enter` and on nothing else. Typing
+  sent no request at all, so a search box that looks like every other one did
+  nothing unless you happened to guess that Enter was required.
+
+  Typing now searches, debounced by 400ms because each reload is a
+  login/load/logout round trip to a reader over a VPN rather than a database
+  query. Enter still works and skips the wait.
+
+  Debounced typing means several loads can be in flight at once, so both screens
+  gained the monotonic sequence guard `HidAccessLogDashboard` already uses: a
+  reply that arrives after a newer load started is discarded instead of
+  repopulating the table with stale rows, and only the newest load clears the
+  spinner.
+
+  The enrollment screen's placeholder now says what is searchable - name, UID or
+  registration number - matching the roster's.
+
+- 07ffe7f: Inventory: show "Copy from old Equipment list" only when the store's sites have old Equipment records not yet copied.
+- 9f85e34: Show the completion photos on the area checklist history screen. The API has
+  always returned the file ids of the photos a technician took when completing a
+  unit; nothing drew them, so the office had no way to see the proof of work.
+  Each unit now shows its photos as thumbnails that open full size.
+- a209e3f: useSite().getSites lists an organisation's sites from GET /api/sites?org= (the old /api/sites/organization/:org route does not exist and returned 404), so Inventory's "Properties this store supplies" and the set-up form offer every property of the organisation again.
+- ab8140d: Inventory store switcher: when a person can see several stores of the same kind, each is named with its organisation ("Property store · Margaret Ville"); more than three stores are chosen from a list instead of a row of identical buttons.
+- ecb24c1: Invitations list: a site app now lists only the current site's invitations.
+  `InvitationMain` sends the page's `siteId` to `GET /api/verifications` (it was
+  commented out, so every site showed the whole organisation's invitations - owner
+  report 2026-09-28, Wing Tai / The LakeGarden Residences). The org console sends
+  no site and is unchanged. The empty table now reads "No pending invitations for
+  <site>. Use Invite member to add someone." / "No expired invitations."
+
+  Members → Assign Role: a member's role from ANOTHER site (roleState other-site,
+  other-org, deleted, missing) is no longer pre-filled or offered ("Role already
+  assigned"); only this site's roles are listed. A site with no role says "No roles
+  created for <site> yet. Create one in Roles & Permissions." with a link that
+  returns to Members after the role is created (`?returnTo=`).
+
+- 1916cfe: Invite Client form: the Site field can appear again when an organisation is known (it compared the app list to a single string, so it never did), no site list is requested without an organisation, Role and Site are marked required as their rules already were, a disabled app now says "Already uses this app in another client" (what is actually checked), and an existing account is no longer announced in red as if it were an error.
+- b086810: Invite Client -> Role: list organisation roles only, not the platform staff roles
+
+  The picker sent `type: props.app` and its only caller passes no `app`, so it
+  asked for no role type at all and the endpoint returned every org-less role --
+  including the two `type: "admin"` platform staff roles that the console's own
+  `/super-admin/role-permissions` screen edits. It now asks for
+  `type: "organization"`, which is what a client administrator's role is.
+
+- 211c3a3: Invite Client takes one application per invitation, its dialog scrolls so every module, the owner role and Submit are reachable, and Feedback is offered once (both spellings sent together). Screen modals shown outside a v-dialog now scroll their body.
+- 1f3f3b7: Invite Client offers Real Estate Developer, which gets the Property Management modules and the Service365 resident app modules like a Property Management client.
+- bebef55: Invite member: when the Role list cannot be loaded (for example no access to the organisation's roles), it says so instead of "No roles have been created for this site yet".
+- ced091b: Invite member: "Create more" keeps the same app and site, so the Role list after an invitation is the same as before it (it used to switch to the organisation-type roles). When no role exists for the site, the list says so and links to Roles & Permissions.
+- d831861: Members > Service Providers: a provider entry with no company name and nobody at the site no longer shows as an empty chip.
+- d1ec0e6: Module gate: a page of a denied module now redirects to the site dashboard by path (`/:org/:site/dashboard`) instead of by route name, and only in apps that have that dashboard; elsewhere the page is left open (fail open). Fixes web-app-main's route-names check, which rejected the route name, and stops the layer's visitor-management preview page from redirecting to a page that does not exist in the main, org, account and admin apps.
+- 5a07f04: Inventory Stock Movement: the Received column labels opening stock received in the month ("incl. N opening stock").
+- 597b1dd: Organization Members: keep the "Fix roles from other sites" banner at organisation level, worded for the organisation ("N members hold a role created for one particular site…"), without the per-site "Show them" filter. 4.75.0 had hidden the whole banner there.
+- 6a8f745: Signed-in QA sweep fixes (plain words and readable controls):
+  - Inventory Settings names every property it supplies (was "Current property" when the organisation's site list did not include it).
+  - Inventory item lines label the packing ("Code 001 · Bulb · Packing: 25") instead of a bare number.
+  - Dashboard Low Stock tile shows 0 and "Every item is above its alert level" instead of "No data to display".
+  - Dashboard activity chart y-axis shows distinct whole numbers (was "0 0 0 1 1 1"); the Customize entry is called "Activity chart" and describes what it draws.
+  - A plain on/off switch now has a visible off track in light mode.
+  - Bell panel title "Notifications"; notification settings say "iService365"; the robot mini-map no longer shows "(placeholder)".
+- c0c033c: A Real Estate Developer client links to the Property Management app (app switcher, cross-app redirects, client details service link).
+- 22dce74: Require a photo before a checklist task can be completed.
+
+  The Submit button in the completion dialog stays disabled until at least one
+  photo is attached, and the uploader is marked required. It gates on the uploaded
+  ids rather than previews, so a half-finished upload cannot slip through to a
+  server that then refuses it.
+
+  The reject dialog is deliberately not gated — a reject is somebody reporting a
+  problem, and demanding a photograph first would stop them reporting it. The
+  server scopes the rule the same way.
+
+- 7f8599b: Robot detail: after a command the line follows the robot ("Leaving the charger…", "On the way to P4…", "Arrived at P4", "Docking…", "Back on charger") instead of a false "didn't start"; says up front that undocking takes about 10 s, with a spinner while it follows; reads the robot every 1 s for a minute after a command (then every 4 s) so the status and map pin keep up; a note under the live view says the video is about 8 s behind and the map is real time.
+- 0b155fb: Robot detail: a robot's own map image follows the layout's height cap (280 px beside the camera, 360 px full width) instead of a fixed 440 px, and opening a robot scrolls its header to the top so the camera, map and commands are on screen.
+- c709924: Robot (HERO) screens: the robot header no longer slides under the app's top bar - `.hero-page` and `.hero-screen` drop their `margin: -24px` (the apps pad 8-16px, so the page was pulled above its content box). The HERO fault-count bell is removed from the shared robot header (`RobotSiteHeader`), and `RobotBell` is deleted, so the app's own top-bar bell is the only bell. `RobotSiteHeader` loses its `faults` prop and `bell` emit, and `RobotSiteScreen` its `bell` emit and 30 s fault poll; a page still passing them keeps working (they fall through unused). Open faults stay on the Faults summary, Needs attention and Alerts.
+- f9e6778: Robot live view: turn on hls.js low-latency mode so the 1.2x catch-up actually runs after a hiccup (without it hls.js never changes the playback rate).
+- 63edcab: Robot live view: sit 6 s behind the newest picture instead of hls.js's default 12 s, catch up at up to 1.2x after a hiccup, jump forward past 14 s.
+- dd238f3: Robot live view (PadBot S2): the camera's stray H.264 delimiters are now rewritten into real H.265 access-unit delimiters (after a 4-byte start code). The S2 sends VPS/SPS/PPS each in its own PES; without an H.265 delimiter hls.js 1.7.3 dropped the PPS from the init segment and Chrome decoded 0 frames (black picture, clock running).
+- 24956ec: Robot live view: no more silent reload every ~6 s. PadBot's video URL expiry comes without a time zone ("2026-09-26 16:26:02"); read as local time it was already past, so the panel fetched a new URL every 5 s forever. An expiry that has no zone, or is under a minute away, no longer schedules a re-fetch (the stream's own failure still reconnects, with capped backoff, then Retry). The no-picture and stall watchdogs no longer count while the page is hidden.
+- dd42b0d: Robot live view: the PadBot S2's EZVIZ camera puts an H.264 access-unit delimiter in front of every H.265 frame, which made Chrome refuse every frame (decode error, black picture). The player now neutralises those units in each segment before playback, so the picture shows. The "couldn't be decoded" message no longer blames EZVIZ encryption (disproved).
+- 9673bed: Robots: live view says honestly when the camera video cannot be decoded (MEDIA_ERR_DECODE, e.g. EZVIZ video encryption switched on) instead of retrying: at most two hls.js recoveries, then a plain message with Retry. The message no longer blames the browser when the decoder reports support.
+- 232eb16: Robots: a robot's name tag stays inside the plan. Near the right edge it sits to the robot's left, and near the top it goes below: on robot detail (name + status) and on the building map, as the mini-map already did. Before, the S2 docked at the top-right showed only "HERO-OT".
+- d7575d9: Robot detail: each command's outcome line names its command ("Return to charger: …"), and a fault that was already showing when the command was sent is reported as an earlier fault to clear first, not as the new command's result.
+- e13cc29: Fix the robot pages crashing in the browser on 4.50.0/4.51.0 ("process is not defined" / "Couldn't resolve component default"). A parameter named `measure` in `utils/rmf-editor.ts` was picked up by Nuxt auto-imports as the `measure` export of `utils/theme-aa-ledger.ts`, whose top-level command-line check read `process.argv`. The parameter is renamed and the ledger's check is guarded; a new test evaluates every util in a browser-like scope with the auto-imports injected.
+- 05dadfc: Robots: Start patrol (security) picks the route from the routes on the robot's current map and the confirm names the route, its stops and the map; after "accepted" the detail watches the robot for 30 s and says "<robot> started <route>." or "<robot> didn't start - <reason>" (kept on screen); Resume patrol shows only when a patrol is paused or unfinished; Cancel only while a job is running; Start patrol hidden while patrolling.
+- 0fc34f8: HERO robot rules for the mobile apps: `scripts/sync-robot-rules.mjs` writes a generated, hash-stamped copy of `utils/robot-display.ts` (+ lift-queue rows, HERO_PALETTE) and shared test vectors into iClean365, iMA365 and iSecure365. Repo tooling only; nothing a consuming app loads changes.
+- ec366e8: Robot maps: a robot that reports its floor but no position on the plan (Ounitech, now that its API reports the floor) is listed under the map ("can't be placed on the map, so it is listed but not drawn") instead of silently missing.
+- 46c51a6: Robot detail: when the robot cannot be read, show the API's plain reason (e.g. "Ounitech rejected the robot list (sign-in) ...") under the title instead of only "Reconnecting". `mergeLiveStates` carries the optional `reason` from `/robots/states`.
+- 8899156: Role editor: a service provider editing its roles on a client's site is no longer narrowed by the client's site module list. The site tier applies only when the site belongs to the organisation whose roles are being edited; otherwise the organisation's own list applies, as before.
+- a9491ca: Create Role / Edit Role: a refused or failed save now shows "Couldn't save: <reason>" above the buttons (it was printed below the whole module list, out of sight). Catalogue snapshot test ties the dialog catalogues to core's full-catalogue create test.
+- d19240e: The client's module list now governs the permission gates this package spreads into the staff apps. `useAreaPermission`, `useUnitPermission`, `useAttendancePermission`, `useBulletinBoardPermission`, `useScheduleTaskPermission`, `useServiceProviderPermission`, `useEquipmentItemPermission` and `useEquipmentManagementPermission` — 43 gates — now ask the deny list immediately before their `*` short-circuit, the order `DashboardMain` already uses. The apps closed the same hole in their own gates, but these are re-exported from here and an app PR could not reach them (40 of hygiene's 47 spread-in gates, 43 of landscape's 43, 38 of M&E's 45).
+
+  Inert and fails open: no client has an enforced list, so an absent, empty or unreadable list denies nothing. `useSettingsPermission` is deliberately untouched (`site-settings` is always allowed and can never be denied), as are the schedule gates that match any `*-schedule-mgmt` string.
+
+- bf5c6ec: Print the entry pass with one large QR code instead of five. The pass carried
+  four small copies at the corners around a centre one so a strip could be cut
+  apart; the small copies were downscaled from the centre render and scanned
+  poorly on thermal paper. `createReceiptLayout` now draws a single 350px QR,
+  generated at the size it is printed, in the same band above the company name.
+  The `QrTemplatePreview` dialog shows the same single 260px QR so the preview
+  matches what comes out of the printer.
+- a015eee: Robots: fix the site fleet capability tooltip line break (a literal line break inside a string broke every consuming app build on 4.56.0/4.57.0). The SFC compile test now compiles each component's script as well as its template, so this kind of break fails CI here instead of in the apps.
+- 5628ad6: Service Providers screen: extracted the service-type code-to-label lookup (the one behind "security_agency" showing as "Security") into a tested pure function, with unit tests covering every known service type code.
+- 9571194: Service Providers screen: the TYPE column still showed the raw code (e.g. "security_agency" instead of "Security") for every row, because the API's `nature` field is not free text - it mirrors the same raw code as `type` - and the label lookup treated any truthy `nature` as an override. Only treat `nature` as free text when it is not itself a known service type code.
+- febb72a: Inventory supplier picker: show "Add ... as a new supplier" also when the supplier list is empty.
+- c80ea00: Inventory supplier picker: one "Add ... as a new supplier" row (it showed twice when nothing matched).
+- 04e8637: Fix the context switcher showing a tick against two sites at once.
+
+  Not a comparison bug: `selected === item.value` was true for both rows because
+  both rows were the same site. The seven service apps build this list from
+  `customer-sites` with `value: i.site`, and a customer-sites row is an ENGAGEMENT,
+  not a site — one site can carry more than one. Production has two active rows for
+  the same site, identical except for a stale `name` snapshot.
+
+  The switcher now offers each destination once. First occurrence wins, so the
+  surviving label is the current one rather than the stale snapshot. Items with no
+  `value` are kept — they cannot collide, and dropping them would hide a malformed
+  row.
+
+- de70cb1: Table card search (SOA Mgmt, Online Billing, Facility Mgmt, Incident Reports and the other `TableMain` screens with search): the box beside the title-row button no longer shrinks to "Se". It is the design's search field, 260px wide, the same 40px height and radius as the button, with the magnifier in front and a clear button once something is typed.
+- f6d2f6d: Building Management → Units import dialog: the instructions no longer ask for a block number (the import takes it from the chosen building).
+- b541a00: `useMember()` now returns `getDeniedModules`. It was declared but never returned, so the module deny list never reached the web apps (the router guard failed open) and the Client details role dialog threw and never stopped loading.
+- b6d2cae: List a contractor's members in the Visitor Management preview dialog.
+
+  The list row has counted them beside the name (`( +2 members)`) for as long as the field has existed, with nowhere to go for the names themselves. The preview now draws each member as an inset card - `Card/MemberInfoSummary`'s `--hover` on `--border` at `--r-inner`, so a member looks the same here as in the form that created it - showing the name plus whichever of NRIC, contact and vehicle number they carry.
+
+  - Both NRICs in the preview - the visitor's and each member's - are revealed by pressing the masked number, which carries an eye as its affordance. It replaces a hover tooltip, which gave no sign there was anything to reach and could not be reached at all on a touch screen. The eye alone was not enough on its own: a 14-16px glyph is well under the 24px target floor, and the layer's 32px `AppButton variant="icon"` would have made the NRIC line half again the height of the Contact line beneath it. Pressing the digits gives a target the width of the value at no cost to the rhythm, takes a tab stop, and reads the right way round. Each member reveals separately, and all of them clear when the dialog closes.
+  - Read off the raw list row rather than `selectedVisitorObject`, which filters itself to `typeFieldMap` plus five fixed keys; widening that computed would change what four other dialogs on the screen see.
+  - Not gated on the Guests tab, because the row's own member count is not either.
+  - Blank entries are dropped. The payload carries `""` for every detail nobody filled in, so a member with neither a name nor any detail would otherwise render as an empty box.
+  - `plateNumber` is read defensively: the API returns it on `members[]`, but neither `TMemberInfo` here nor `TContractorMembers` in API-core's visitor model (name and nric only) declares it. The types have drifted from the document and from each other; reconciling them is separate work.
+
+- 88030ea: Visitor Management search box: waits 350 ms after typing and searches from 2 characters (trimmed), so a burst of typing, a paste or a scanner no longer leaves the table showing the first letter's results; a late reply for an older search is never shown; a new search goes back to page 1; clearing the box resets at once; the address-bar sync no longer puts back an older value over letters typed since; the empty table says "No visitors match '<search>'"; Download Report uses the same search as the table.
+- 1832d39: Visitor Mgmt: the Unregistered tab now appears on first load and after switching site, without a hard refresh. `useANPRSettings` takes a ref or getter for the site and keeps one entry per site; the Visitor Mgmt page reads its own site's ANPR switches instead of relying on the layout's plate toast, which kept the first site's switches after a site switch. A plate-toast link to the Unregistered tab is no longer bounced to Registered while the switches are still loading.
+- 25dae49: Worker nouns: fall back to the deployment's `APP` code when the app sets no `appSlug` (hygiene, M&E, pest, pool, landscape), so hygiene shows Cleaners instead of the neutral Staff.
+
 ## 4.97.0
 
 ### Minor Changes
@@ -2082,11 +2963,11 @@
   `utils/console-tier.ts` + `composables/useConsoleTier.ts` mirror the server's
   own rule from two endpoints the console already calls, unprojected:
 
-                                                                                                                                      GET /api/members/user/:user/app/admin    the Seven365 staff membership
-                                                                                                                                      GET /api/roles/id/:role                  that membership's role document
+                                                                                                                                                                                                                                                                                                                                                                                          GET /api/members/user/:user/app/admin    the Seven365 staff membership
+                                                                                                                                                                                                                                                                                                                                                                                          GET /api/roles/id/:role                  that membership's role document
 
-                                                                                                                                      owner  = member.type === "admin" && role.type === "admin" && role.default === true
-                                                                                                                                      staff  = member.type === "admin" && role.type === "admin"
+                                                                                                                                                                                                                                                                                                                                                                                          owner  = member.type === "admin" && role.type === "admin" && role.default === true
+                                                                                                                                                                                                                                                                                                                                                                                          staff  = member.type === "admin" && role.type === "admin"
 
   `role.default` is the marker because it is the only property of a platform
   staff role no API caller can set - `role.controller.ts` validates create and