Changelog

All notable changes to xObject are documented here, using Keep a Changelog. Software releases will use Semantic Versioning.

[Unreleased]

Changes after version 1.0.0 will be recorded here.

[1.0.0] - 2026-11-09

First Community release. Delivered capabilities and verified acceptance are listed below. Explicit later specifications remain planned work. Related development changes are consolidated to describe their final behavior.

Added

• Versioned Community installation packages and native AMD64/ARM64 release-image acceptance before multi-platform publication.

• Native Ubuntu/AMD64 self-hosting acceptance with trusted HTTPS, fresh first-Administrator setup, API/MCP writes and provenance, application/database restart and exact recovery into a second empty installation. Verify credential revocation and off-host backup checksums; document the existing-reverse-proxy variant and retained delivery boundaries.

• Native Safari read/UI acceptance across desktop settings and record tabs, narrow settings/dialog interaction and direct VoiceOver dialog/list traversal with captured cursor/phrase evidence. Record the checked scope, retained automated focus-guard findings and remaining whole-product/device/host boundaries.

• Extend isolated product acceptance to selectable Chromium/Firefox/WebKit engines, automated WCAG checks, every settings section in Light/Dark and all five V1 objects with ordinary-user edits, duplicate/recycle/restore and Primary/Journal/Dossier/Tree readback. Use disposable current installations with normal role onboarding, draft/filter/focus/mobile coverage and bounded failure artifacts. Run Chromium/Firefox in Linux CI with separate failure artifacts; distinguish engine, operating-system and real screenreader acceptance.

• Isolated tree/journal/principal-selection benchmark with fixed targets, cookie/personal-token/OAuth comparisons and observed model/workspace barriers.

• Shared Type/Status/Category list filters through web/API/MCP, with OR/AND semantics, explicit empty values, Category tree matching, URL state and field-aware counts/paging.

• Shared URL-field action opens valid HTTP(S) links in a new tab, including Contact website entries and readable fields without edit rights; empty/invalid values remain non-actionable.

• General Selection tree fields and tree Category mode with same-dictionary parent UUIDs, automatic ancestor selection, descendant deselection and shared API/MCP validation. Preserve safe conversions and update existing selections with atomic per-field journals when a hierarchy changes. Multiple/tree selections use one searchable list/tree dialog with keyboard controls; demo workspaces show all Category modes and independent custom trees.

• Installable online application shell with an original xObject icon family, manifest, Apple/maskable icons, generic private Open Graph previews, contextual/neutral browser titles, effective language/theme color and canonical copy/native-share record links. Application-build updates offer an explicit reload that protects open drafts.

• Authorized live refresh after committed web/API/MCP journal changes through a bounded shared PostgreSQL LISTEN/SSE transport. Add reconnect/focus recovery, connection status, clean-record adoption and three-way draft reconciliation with explicit conflict choices; defer settings source refresh while editing. Public reading remains planned beyond V1.

• Authenticated user ID/name in the shared access context, enabling agents to identify their own assignment principal without privileged user-list access.

• Specify the long-term connected-work vision and later requirements for source-linked context, knowledge quality, versioned agent definitions, bounded delegation, resumable jobs, automation/runner coordination and data portability. These are unassigned future targets, not implemented features or additions to V1.

• Independent Light/Dark workspace primary/secondary colors and primary focus rings, locally served Orbitron headings, selectable workspace icons and a disabled own-logo upload preparation. Version, validate and journal the new appearance properties through the common API/MCP path.

• Transaction-local reuse of equivalent permission explanations and indexed incident-relationship loading meet the specified 10,250-record/20-nested-group performance profile; retain per-record field restrictions and verify all 163 backend regressions.

• Local checksummed source/installer/documentation candidate preparation and an installation-specific portable OpenAI plugin built from canonical skills; define release gates without publishing or changing client configuration.

• Independent Astro/Starlight documentation and canonical product-site Changelog/Roadmap routes with generated pages, user/operator guidance, Pagefind search, changelog/roadmap routes, source-edit links, versioned-base builds and HTML link/anchor validation. Verify responsive navigation/search and address the standard Search button’s visible-label accessibility mismatch through component composition; no documentation deployment.

• Confirm V1 as entirely Community without Premium feature gates, maintained/licensed by Jürgen Schadek personally under ITextreme. Define same-license DCO contributions, copyright notices and private security reporting; future commercial allocation remains separate.

• Local non-root container/Compose installation with atomic current-schema initialization, one-time interactive Administrator setup, dedicated runtime/operator roles and health checks. Add private checksummed backups, transactional restore/integrity verification, maintenance-only current-target upgrade/refusal and isolated Linux-container recovery acceptance. Images remain unpublished.

• Database-backed login limits across application instances, trusted/overwritten client-IP headers, explicit session/cookie policy, HTTPS HSTS, CSP/frame/referrer protection and complete auth-only pool shutdown.

• Standard MCP OAuth authorization with maintained Better Auth 1.7.18 plugins: public HTTPS client metadata, PKCE, signed consent, resource-bound opaque tokens, rotating refresh and interactive application revocation. Recheck current user/session/scope/revocation in application transactions and journal token state without secrets. Provide bilingual consent and account-management UI; the selected Codex login/consent/renewal path has passed live acceptance.

• Official MCP SDK 2.4.0 with 2026-07-28 discovery/envelopes, SDK-managed stateless 2025 support, shared REST output schemas, validated structured results and conservative action annotations. The quality report records the separately executed live Codex exercise.

• Four canonical agent skills through the official MCP Skills extension: foundation, Contacts, Projects and model design. Current module/object/role rights filter discovery and direct file reads; private zero-lifetime resources carry verified digests. Codex exercised resource loading and installed plugin instructions separately; native extension activation remains client-dependent.

• User-bound API/MCP credentials with one-time secrets, channel/read-only restrictions, mandatory expiry, current-rights enforcement, last-use metadata and individual/all-token revocation. Account security manages personal credentials; Administrators inspect/revoke other users’ credentials. Password changes and account deactivation revoke access, and journals record the trusted access channel, credential ID and actor.

• Versioned API v1 with generated OpenAPI request/response schemas, an authenticated contract endpoint and MCP resource, a typed bearer client and consistent structured errors. Integration tests validate successful responses against the generated contract.

• Confirmed Full-level permanent deletion from the recycle bin: remove live contents and operational links atomically, retain complete immutable history for installation Administrators and project only content-free deletion notices to other previously/currently authorized readers, including linked-record history. Current rights, frozen visibility and dependency guards remain enforced; the Administrator recycle-bin history opens retained journals.

• Configurable Primary association requiredness and required Contact/Project/Case context per object type/workspace, with existing/recycled-record and descendant preflight, shared API/MCP enforcement, optimistic definition versions and per-property journals. Object settings and record forms expose the rules; required Primary form elements remain visible.

• Record the later ITSM design idea of shared Cases with Type “Ticket” and conditional form sections; replacing the proposed Incidents object remains subject to evaluation. No catalog or runtime change.

• Specify planned Type/Status-driven field display conditions, retained hidden values and conditional requiredness, independently of semantic applicability and permissions. Implementation and release assignment remain open.

• Consistent object icons before record keywords in tables, relationship lists and selections, the tree and search results; Contacts distinguish Organization, Contact person and Individual contact without exposing unreadable Contact kinds. Supplied objects share their semantic icons with navigation; custom objects retain the generic object icon.

• Configurable module-based sidebar with ordered sections, repeated shared-object entries and Contact-kind sublists. Persist workspace defaults and personal arrangements through versioned API/MCP operations with atomic journals, keyboard/pointer sorting, visibility controls and optional Resources. Compose Sidebar 02 search, Sidebar 07 navigation and Sidebar 08 secondary links; apply Contact-kind filters before authorized counts and paging.

• Supply lean Projects, Cases and Tasks templates with bilingual protected fields, editable starter forms, a User/Group Responsible reference and assignment through Access principals, configurable Task status meanings and atomic completion validation. Add the shared date/instant/zoned temporal codec with regional editing, named-zone/DST rules and typed history; refresh fictional fixtures.

• Specification for four later guided Contact-kind conversion workflows: organization formation with a new/existing Organization, continuation as an Individual contact and separation of all Contact persons. The PRD defines preview, identity/data preservation, atomic journals and remaining design details; this is planned scope, not implemented conversion support.

• Relationship-owned fields using the shared typed field editor, configurable input aids, both-endpoint field rights and per-field journals through UI/API/MCP. Contact persons and Individual contacts expose direct Job title, Department and multiple Function fields in a separate Professional details section beneath Photo; Organization changes retain their values. Edge/source/definition versions, reassignment history and recycle/restore preserve identity and atomicity.

• Versioned object/field module contributions, one common object form across modules and additive template updates. Deactivation retains definitions, contents and customized forms; shared objects remain active while another contributor is enabled. Structural conflicts and stale updates fail atomically.

• Searchable country selection in postal addresses with localized German/English labels, bilingual name/code search, keyboard navigation and explicit clearing. Existing country text is retained until explicitly changed; new selections store English country names through the existing shared address contract.

• Postal-address previews and journal values include PO box, additional address, every street line and Region. Shared component limits drive exact input feedback and save gating; editing the main street preserves additional lines. Preview formatting leaves stored components and the optional formatted label unchanged.

• Additional Contact details: Nickname, ordered communication languages and messenger URIs with the shared telephone-style Usage/Type/URI editor and configurable grouped input aids, independent named contact time zone, and Wedding anniversary/Date of death with an optional year. Shared typed validation, whole-field rights and per-field history apply through UI/API/MCP; fixed kind-specific forms and bilingual fictional examples include the fields. Contact sections place Name & organization beside Photo/Logo, then Further details beside Language & time zone, and the existing contact/address sections. Photo/Logo has disabled presentation preparation only.

• Insert timestamp in multiline fields using the current user and effective regional time zone/format, preserving the cursor position and continuing on the next line; length-safe insertion and Markdown preview line breaks.

• Structured contact fields: ordered name components, multiple emails/phones/postal addresses/websites and birthdays with optional year and a compact regional text/calendar input; finite schema inventory through shared API/MCP, typed shadcn controls, whole-field permissions, safe conversions and atomic per-field journals with entry/path/order details.

• Base Contacts & Relations activation provisions protected Contacts and Distribution lists, fixed Contact-kind identities, permission-aware derived names, one Organization per Contact person, direct Identities and explicit distribution membership. Contacts reuse existing supplied Projects bindings. Bilingual fictional fixtures use the current profiles; Contacts/Distribution lists have passed local functional acceptance; later Projects templates and overall release acceptance remain open.

• Translated field descriptions/input hints, typed creation-only defaults and scalar uniqueness through the common field/classification editors and API/MCP rules. Defaults respect omission, conditions and creation rights; uniqueness includes recycled values and concurrent writes, with clear duplicate feedback. Record forms/previews use the same localized metadata and typed controls.

• Transactional record-number configuration per object: prefix/suffix, exact start/increment, padding and never/yearly/monthly periods in the workspace zone. Protected immutable numbers, append-only issuance, retained counters and atomic creation/journal rollback; number display/search in record and workspace lists. Current installation and bilingual fictional fixtures include both features.

• Workspace record recycle bin with shared searchable/filterable tables, read-only contents/Journal inspection, confirmed Delete-level recycling and Full-level restoration through UI/API/MCP. Normal reads/search/counts/selectors exclude recycled identities; fields, policies, edges and history remain retained. Lifecycle writes are versioned and atomic, retained links reserve cardinalities, and unavailable Primary associations do not expose parent contents. Permanent deletion and its history projection are described separately above.

• Access principals can be placed, reordered and sized half/full in the Form designer using their existing protected field identity; sensitive demo forms start with the field in General.

• Access principals in record forms now use a searchable quick-selection field with tabbed rights details. Apply edits the form draft; record Save atomically persists contents, links and security with one version/change ID. Existing grades, public confirmation, reset/dirty guards and Full access checks remain enforced.

• One current unreleased installation definition and initial module catalog, schema/catalog fingerprint checks, empty initialization and guarded local reset. Authentication uses the pinned Better Auth schema API. Runtime/operator roles remain separate.

• Record-header “Link with…” and “New linked record” object dropdowns (only the supplied Organization/Contact-person assignment is omitted; General, Identities and other associations remain available): General-only direct actions, submenus using existing relationship side labels, an object-filtered existing-record picker and atomic linked creation through API/MCP. New records retain source context, inverse-side selection and guarded source return; versions, rights, conditions and cardinalities are enforced without replacing existing source links.

• Graded Access-principal ownership and separate Create rights, nested/graded groups, default/per-object foreign access in both directions, transitive bounded paths, optional own-record delegation and immediate inheritance/revocation controls. Record security includes workspace-public access with confirmation, Personal/Confidential privacy, foreign maxima, field exceptions and effective-right explanations; duplication respects visibility and creation validation. Shared API/MCP authorization protects searches/counts, Dashboard, relationships and history. Versioned editors and atomic journals use the current shared policy store; calendar-only operations and notification delivery remain future work.

• Object/field administrative ceilings for users and groups, additive active-group grants, explicit user overrides and installation-wide Administrator access. Sensitive types retain protected Access principals with creator defaults; membership and relationship links confer no content rights.

• Database-backed Modules settings with Contacts & Relations, Projects & Tasks and Documents & Communication. Projects activation supplies protected base Contacts/Projects/Cases/Tasks and fixed Contact → Project → Case UUID roles; planned modules remain visible. Reserved module object technical names apply even while modules are disabled/planned, and collisions never silently adopt custom definitions. Complete domain templates/shared-module ownership remain open.

• Form designer for actual workspace objects, with translated editable groups, scalar/relationship placement and ordering, half/full widths, optional relationship visibility and initial table state. New objects start with General; added elements remain Unassigned, including after group deletion. Versions, required-element guards, retained inactive entries preserve authored layouts and stored values. Module-specific metadata is retained without speculative UI views.

• Shared record and workspace tables with standard-only initial columns, account/view-scoped column visibility, current-page selection, supported server sorting/filtering, row actions and complete pagination. Dashboard combines the normal mixed-object table with exploratory real statistics/activity, shadcn dashboard-01 cards/gradients and a zone-aware 7/30/90-day chart. Growing management tables reuse the footer and muted headers.

• Read-only Projects-owned Primary hierarchy tree with inherited ancestor context, lazy paginated descendants, keyboard navigation, defensive cycle termination and explicit depth/context limits. General/custom connections remain in the Dossier.

• Relationship types with one object pair per custom definition, directed/undirected semantics, translated side labels, one conventional cardinality and separate required-link settings. Shared API/MCP validates composite workspace identities, protected system meanings, used pair/direction locks, activation preflight and atomic per-property journals. General stays core; Projects gates Primary association.

• Record-edge storage and identity registry with atomic scalar/relationship replacement, optimistic endpoint/definition versions, final-state cardinalities, Primary uniqueness/cycles and one central edge journal event projected to both endpoints.

• Generic field and relationship-endpoint applicability using stable unconditional single-choice controller/option UUIDs. Final-state validation, conditional requiredness and dependency protection retain incompatible data until explicitly cleared. The fictional Contact configuration supports one Organization per Contact person and direct symmetric Identities lists without another object type or name-based behavior.

• Full-width dedicated record creation/edit pages with one grouped form, sticky Save/Create/Reset actions, missing-field feedback, retained drafts across tabs and formatted previews/inactive-value disclosures. Created/changed metadata appears above Journal; technical details retain identities/version. Custom single-target connections use labeled InputGroups; multi-target sides use individual collapsible tables. General and subordinate Primary links are not duplicated in Details.

• Dossier data table with relationship type, object type, Keyword, Type, Status and Category; object filtering, localized search/sort, columns, page selection/actions and pagination. Record/definition/instance Journals share tables and structured detail dialogs, preserving immutable snapshots, current-name context, historical type formatting and the appropriate server/client pagination contract.

• Deferred business-row/registry integrity, definition versions, restricted runtime versus operator credentials, schema/workspace lock barriers, targeted graph checks and pagination/history indexes. Fresh-database guidance separates current initialization, Administrator provisioning and optional seeding.

• Explicit fictional ITextreme development seed with one account per role, English contents/default language, German/English metadata, all 15 custom field types, nine active objects with 74 records, an inactive lifecycle sample and 54 actual relationships. Forms, ownership, foreign access and field restrictions use normal operations; seeding refuses existing workspaces and keeps generated credentials private, separate from installation defaults.

• Administrator user management with start-password provisioning, mandatory first password change, optimistic edits, reversible activation and session revocation. Secret-free user/security journals are atomic; Workspace General shows creator and evidenced creation time. Instance Journal exposes recorded events with scope/property/entity-kind filtering.

• Workspace-scoped User/Designer roles and direct user groups with versioned membership/activation journals. Administrators manage roles/memberships and content grants; Designers configure permitted workspace definitions and input aids. Removing workspace access revokes direct memberships/grants without deleting accounts or history.

• Workspace language catalog/policy for shipped German/English packs, independent definition languages, retained unavailable preferences/translations, versioned API/MCP configuration and transactional journals. A shared translation input switches languages without losing draft labels.

• Named workspace time zones, optional personal overrides and regional display preferences independent of UI language. Exact numeric/money strings, date-only values, currency placement, first weekday, DST-gap rejection and explicit overlap selection are shared across record inputs, tables and journals.

• Shared workspace shadcn appearance: base/accent/chart palettes, primary/secondary overrides, radii, interface/heading fonts from the pinned 26-font catalog, menu surfaces/accents and interactive light/dark previews. Fonts/licenses are served locally; saved tokens cover portals and switching workspaces. Browser light/dark/system preference remains personal.

• Personal Profile, Account & security, Appearance and Language & region settings: own display-name changes, read-only sign-in email, verified password changes, own-session inspection/revocation, bounded failed-password guard and secret-free atomic journals. Avatar initials/disabled upload preparation does not enable image storage or email changes.

• Definition deactivation/reactivation and confirmed deletion only when unused, with dependency/current/history checks, protected supplied definitions, tombstones and atomic journals. Type/Status lifecycle is coupled; inactive content remains inspectable. Record recycling/restoration is implemented under ADR 0029; permanent deletion retains history under ADR 0029.

• Optional Keyword, Type/Status and Category installation through their shared editors and API/MCP, including required flags, stable localized choices/defaults, Without Type statuses, manual option ordering and single/multiple Category selection. Staged configuration and storage creation commit together; absent fields remain absent until explicitly installed and missing Keyword uses the UUID.

• Unified custom-field editor for Text, Multiline/Markdown, Integer, Decimal, Money, Boolean, Date, Date/time, choices, Email, international Telephone, URL and User/Group references. Requiredness, precise validation and lossless conversion preflight apply through all channels; conversion journals preserve original history.

• React/Vite frontend, shared TypeScript contracts and direct workspace/list/record/settings routes, URL search/sort/page state, guarded navigation, centralized keyboard shortcuts/help and scrollable Command/Ctrl+K navigation with authorized record search. Sidebar resources link to planned documentation/changelog/roadmap destinations above the user menu.

• Fastify/Kysely/PostgreSQL/Better Auth local backend with UUIDv7 identities, readable workspace-prefixed tables, localized definition labels, explicit initialization/provisioning commands, per-field journals, isolated PostgreSQL/web tests and GitHub application checks.

• Independent public Astro project introduction with Tailwind, ITextreme semantic tokens, selected Base UI shadcn primitives, self-hosted fonts, unchanged official brand assets, light/dark/system menus, validated MDX, metadata/sitemap and responsive/CSP browser checks. Full Starlight docs and product installation remain planned.

• Product PRD with stable requirement IDs and acceptance scenarios, ADRs, public roadmap, shared agent instructions and the full AGPL-3.0-only declaration/license including Premium code.

Changed

• Clarify technical-name keys for record values versus field/choice/reference IDs across shared schemas, MCP descriptions, actionable errors and Foundation guidance. Record live OpenAI Codex acceptance for workflows, permissions, OAuth, lifecycle and skill loading with explicit client/protocol limits.
• Align Contact technical fields as academic_title and wedding_anniversary with explicit vCard mappings, and use scenario-specific review/context/amount field names in the IT and family demos.
• Use Number / Nummer consistently in the UI and record number / Datensatznummer in documentation; align the technical field/API projection as record_number and reserve the localized standard-field names.
• Replace the public development work diary with current setup, reproducible verification and public CI evidence; reconcile demo guidance and references to removed chronological sections.
• Show Contacts, Projects, Cases, Tasks and Distribution lists as the default Dashboard filters in that order; add custom object filters through Add filter.
• Supply three distinct demo stories: an explicit feature laboratory, a managed IT company and a small family/household. Eight installation accounts have scenario-specific memberships, graded group/foreign rights, field restrictions and genuine assignment. Use workspace-prefixed record numbers (ITx-…-1001, JS-…-1), contextual custom objects, Markdown briefs, timestamped Notes, relationship-attribute history and reversible recycle-bin examples. The three editable standard/brand/personal designs remain available.
• Expand custom-object demo Primary associations across Contacts, Projects and Cases, including inherited customer chains, internal contexts and an intentionally unassigned tool.
• Present the Primary tree as compact Explorer rows with permission-filtered status captions, compact ancestor context, keyboard help and cancellable sequential Expand all / Collapse all controls, including remaining pages. Align tree loading placeholders.
• Use one standard Base UI Toaster for short save/copy/revocation results; retain inline validation, security guidance and unsaved-change state without layout-shifting success callouts.
• Open duplication as an editable unsaved creation draft, rechecking source rights/version on Save without allocating rows/numbers/history beforehand. Add permission-aware Duplicate/Recycle actions to record-list, Dashboard and Dossier menus and Copy ID to record-header actions.
• Make external-access tables usable on narrow screens, with named token confirmations and readable, regionally formatted token history. Keep command search available when the mobile Sidebar is closed. Mount Settings sections on first visit while retaining drafts; align Contact creation, token-table and retained-journal loading states with their finished layouts. Administrator deleted-record history adds frozen display captions, authorized search, object filters, sorting and shared table controls.
• Defer personal table-column order and widths to V2 and an additional explanatory module-dependency UI beyond V1 until a concrete use case exists; V1 retains column visibility and existing required-field validation. Align the PRD remaining-work summary with implemented Primary-context requirements and the locally accepted Projects slice.
• Give every Primary-association level Choose/Change, Open and Clear controls. Changes clear following selections; clearing falls back to the nearest earlier level without modifying parent records. Project/Case pickers filter by the selected ancestor through the shared permission-aware API/MCP search before counts/paging.
• Compact date/time inputs into responsive labeled rows with calendar controls, a shared options popover for time representation/zone/format help, discreet zone context and inline errors. Task progress aligns with the completion row and shows its percent unit; loading placeholders follow the same structure.
• Task assignees are the users/groups in Access principals, sharing ownership and the existing atomic security journal; the redundant assignment field is removed. Tasks now pair Number, Responsible and Access principals in Task details beside Schedule & progress, using the same editable layout as Projects/Cases. The demo assigns Tasks through ownership and retains distinct content and rights examples.
• Demo descriptions and Notes have distinct content: descriptions demonstrate supported rich Markdown; Notes show chronological work entries with timestamps and no headings. All available modules are enabled and navigation inherits catalog defaults. Supplied forms retain standard layouts; custom Mobile workshops, Workshop tools and Support packages demonstrate configurable groups, widths, field types, relationships and rights independently of planned module objects.
• Projects and Cases group Record number, Responsible and Access principals in that order in their Details area beside Schedule. Cases also supply optional Start date and Target date with the same inclusive date-order validation as Projects. Form groups support editable half/full widths, stack on narrow screens and retain their width in definition journals.
• Projects, Cases and Tasks are activities and always user-sensitive. Module provisioning supplies Access principals; UI/API/MCP prevent disabling activity sensitivity while retaining configurable ownership and foreign access.
• Reduce V1 to Contacts, Distribution lists, Projects, Cases and Tasks. Defer Appointments, Vacations, Resource plans, Risks, Time entries and Goals while retaining the shared temporal foundation.
• Close the local V1 Contacts/Distribution-list functional acceptance and separate later contact conversion, duplicate merge, media/exchange extensions and later Projects extensions in the PRD/roadmap. Add a rights-filtered Distribution membership acceptance scenario, including protected hidden members and atomic rejection of duplicate/unauthorized changes.
• Refine Contact forms with mobile record actions, direct desktop actions, compact multi-select Function, contextual date/time-zone help, quieter media placeholders, wider phone types and Contact-kind-aware loading.
• Use one common form per object type across all modules; remove the form-view selector and module-specific form configuration from records, the designer and API/MCP.
• Address details and preview actions now align side by side, with full-width disclosure contents and consistent spacing.
• Specified additional contact-profile scope; Nickname, communication languages/messaging, contact time zone and Wedding anniversary/Date of death are now implemented locally. Professional position/function/department are direct Contact fields; Photo/Logo has presentation-only preparation and exchange remains pending.
• Distribution lists use General with Keyword and a short plain-text description, separate final Markdown Notes and no default record numbering; the demo description has three lines.
• Markdown preview and read-only text share explicit heading/list/quote/link/code typography, preserving line breaks and omitting raw HTML and images.
• Custom-object starter forms and demo layouts share editable General, separate Primary association before Classification, list-only Relationships and final Notes groups when the corresponding elements exist; later additions remain explicitly Unassigned. Maximum-one links start in General. Existing authored layouts retain their grouping and order.
• Contacts select Organization, Contact person or Individual contact before creation and retain that kind through UI/API/MCP updates. Fixed contact cores put names/Organization first, omit derived-name/controller inputs and use compact contact rows and always-visible name details and expandable address details. Salutation and Academic title are independent configurable selects; personal-name fields follow the agreed order in Name & organization without an additional-name disclosure. Further details sits alongside it on large screens and contains Record number, birthday, optional configurable Gender (separate from Salutation) and applicable register information; Contact details and Addresses share a second row with consistent section headings, including Notes. Contact details lists telephone numbers before email addresses and websites. Telephone rows and field input aids separate configurable Usage and Phone type, each with an optional single selection and stable option-group metadata; usage, type and number align in one row in wide containers and wrap on smaller screens. Collection headings have compact Add actions; rows expose configurable labels and direct reorder buttons. Order determines preference consistently through UI/API/MCP; independent preference controls are removed. Invalid draft entries no longer mark correct siblings invalid. Contact rows use consistent visible labels and give the telephone number more width; preference help is compact and expandable. Unframed address entries use separators between addresses and group their label/actions above the postal fields; Region/state appears before Country in the main address fields; formatted-address text is omitted from manual input. Record number appears only in Further details; loading uses the same responsive composition. First/last names use one plain text input each, without component-list controls; untouched structured names retain their values and identities. The Form designer shows the protected core and configures additional fields/custom relationships; field input aids remain editable.
• Specified the staged structured-domain architecture in ADR 0032: typed JSONB codecs, shared object/relationship field metadata, purpose bindings, retained-reference integrity, whole-field and both-endpoint rights, field-level history, domain-zone values and sparse versioned recurrence overrides. Defined API/MCP/UI integration and staged acceptance; the contact-field/base-provisioning slice is implemented, while role attributes, temporal codecs, recurrence and synchronization remain pending.
• Elaborated draft start profiles for all 22 target-catalog objects, with bilingual field recipes, initial forms/input aids, 16 explicit relationship proposals and per-profile acceptance. Separated standards-aligned structured values from lean scalar templates, identified storage/edge-attribute/exchange prerequisites and retained current implementation and later synchronization boundaries.
• Defined lean starting templates for V1 objects outside the five standards-aligned groupware profiles: essential fields/relationships, configurable input aids and editable forms, with authorized extensions instead of speculative specialist workflows. Existing domain decisions, module protection and configuration-role boundaries remain unchanged.
• Specified vendor-neutral groupware model alignment for Contacts, Distribution lists, Appointments, Vacations and Tasks: vCard/iCalendar profiles, complementary JSContact/JSCalendar references, explicit mappings and future CardDAV/CalDAV boundaries. Includes repeated contacts, partial birthdays, date/time/recurrence semantics and loss-aware interoperability; no synchronization or calendar delivery claim.
• Reconciled documentation against source and accepted product decisions: corrected obsolete storage tables/column order, recycle-bin and inherited-rights status, record-number search/columns and module scope; linked ADR refinements and consolidated guidance/release entries. Local implementation, target behavior and publication remain distinct.
• Specified Contacts & Relations and Projects & Tasks as the two V1 modules with a release-scoped 22-object target catalog, preserved existing requirement IDs, defined the outstanding domain-profile specification process and clarified shared-module activation/evolution acceptance. Documents & Communication and the other target modules remain later scope; catalog decisions do not claim implemented templates or specialized accounting/messaging functions.
• Unified field labels/descriptions/hints and direct control associations, clear field-editor sections with collapsible help, stacked mobile translations and compact expandable numbering settings. Record numbers use consistent standard columns and permitted global-search labels. Validation identifies/focuses the affected field or uniqueness rule. Group editors include graded memberships with atomic name/member Save and shared Reset; user administration explicitly labels instance roles.
• Consolidated graded ownership in one policy store; Access principals are virtual. Supplied-object bindings also provide the fixed Primary roles. Current API/MCP operations replace parallel journal, ungraded-membership, requiredness and language-only interfaces.
• Development initialization rebuilds the current model without preserving obsolete development schemas or fixtures. Application builds clear generated output; current integration tests replace upgrade-only scenarios.
• Permission administration explains effective user/group sources, separates principal lists from grants, exposes direct selection actions and keeps Save/Reset in the fixed footer. Object labels and sensitivity save atomically with both expected versions; member removal explains grant/membership effects before confirmation.
• Settings and nested editors use the Sidebar 13 background hierarchy and consistent rounded functional sections, spacing, responsive tables and fixed action placement. Record groups/loading states reuse these sections and full main-content width. Personal/workspace/instance navigation shares one ordered definition; email belongs to Account & security.
• Object/field administration separates properties, alphabetical fields, lifecycle/history and framed technical details. Consistent Yes/No requiredness, shared translation controls, staged optional standards and side-by-side Type/Status input aids retain Save/Reset and dependency protection.
• Relationship editors start with object pair/direction, then identity and applicable side controls. Symmetric sides share controls; independent drafts survive mode changes. Fixed values use read-only presentation, and technical-name controls share format/fixed-name help. New definitions clearly start as drafts.
• Record/table menus use consistent icons, spacing and copy-ID grouping; Dashboard “Add filter” adds object-filter tabs. User-menu/resource spacing, toolbar alignment, responsive period selection and gradient chart presentation follow the selected shadcn examples while retaining actual authorized data.
• Common dialog actions use Cancel/Create for creation, Close/Reset/Save for editing and explicit destructive confirmations. Reset supports invalid drafts; normal dialogs have localized close buttons and all close paths preserve pending/dirty guards.
• Standard-field names/technical names are reserved even when absent; unused Type/Status options can be deleted only without current/history references or retained child mappings. Deleted identities are never reused. Administrator status uses the protected sys_users.is_admin flag.
• Public website header/footer use the shared ITextreme structure, neutral theme/mobile icon menus, semantic surfaces, compact navigation, nine social icons and actual stack/developer credit, retaining CSP and asset notices.

Removed

• Development-version migration chains, label/administrator/design/form adoption routines, duplicate owner columns, implicit policy reconstruction, obsolete API aliases and retention of previous development bundles.
• Obsolete public website /licenses/NOTICE.txt index; individual upstream license files remain distributed with their assets.

Fixed

• Give the complete isolated browser suite a bounded six-minute deadline so the slower Firefox run can finish every unchanged functional and accessibility check on hosted runners.

• Preserve readable InputGroup values when only an addon action is disabled. Apply group disabled styling to the input/textarea control itself; cover pending Primary-context loading with a deterministic browser regression.

• Translate new-record browser titles with the existing shared label and include visible selections in the accessible name of shared multiple-value controls.

• Reserve the Primary-association section before Classification in fresh supplied module templates without rebuilding authored forms when Projects activates; correct the documented Task Priority placement.

• Correct accessible shell labels, native-search ARIA and record-tree naming; use readable semantic text for muted keyboard hints/avatar initials, destructive feedback and larger sidebar action targets. Preserve HTTP throttling status for non-JSON failures and show a localized retry-later message.

• Bound Primary-tree reads to the requested branch and reuse the administrative ceiling for Access-principals eligibility; preserve visibility, locale sorting, paging and lifecycle semantics while meeting all three scoped path targets.

• Revalidate interactive sessions inside business transactions after lock acquisition, using wall-clock expiry and shared session-row locks; queued revoked/expired requests cannot commit changes.

• Keep pre-restore configurations in private recovery storage and exclude generated environment files from Git, Docker contexts and commit-bound source archives; verify artifact contents using synthetic-secret regressions.

• Align the collapsed-sidebar Search button with the other navigation icons by removing duplicate header/group padding and using the shared sidebar menu structure.

• Keep normal navigation stable while live-update subscriptions renew: show connecting notices only after a sustained attempt, retain immediate offline feedback and cancel pending notices on reconnect/workspace changes.

• Preserve cached record editors and their drafts through transient background session/data failures; show a retry notice while continuing to close views after confirmed access loss or deletion.

• Apply draft interface fonts and color schemes to portalled preview menus. Expand the design preview with real sidebar/card/table primitives, local active/selection states, mode-correct labels and advisory custom-primary contrast checks for links and focus borders. Align English/German explanations.

• Complete the Gray base palette’s sidebar roles using its own semantic colors, preventing a cool near-black content surface from inheriting Neutral sidebar colors or retaining another workspace’s tokens.

• Apply complete CSS color expressions for HSL-based workspace palettes, preventing invalid surface, border and text colors when switching themes.

• Resume the unchanged application container after backup with Compose v2-compatible up --wait --no-recreate; report bounded operator diagnostics without private payloads.

• Reserve Caddy’s fixed backend address outside Docker’s dynamic pool so database-first installation cannot consume the proxy address. Exercise loopback HTTPS without public DNS or ACME.

• Resume OAuth authorization through signed sign-in context, serve the early theme initializer as a CSP-compatible external script, and improve settings scroll focus/profile-initial contrast.

• Include Customize navigation in command search, keep one record-draft notice in the footer across tabs and match Dashboard/Recycle bin sidebar spacing to the other navigation groups.

• Place Task Priority in Schedule & progress directly before Progress, rather than in Classification.

• Use the same permission-aware record icon projection for creation, updates, duplication, recycling/restoration and single/list reads.

• Align record-loading groups with the shared form grid and temporal control structure. Simplify domain time inputs with expandable representation/zone options; associate validation errors with inputs and focus the first failing field on submission. Settings tables fit narrow screens, with stacked membership/field-right controls.

• Complete unknown browser routes with the application error page while retaining JSON API/MCP and missing-asset errors. Record loading and loaded forms share header, tab slots and bottom actions; Contact errors appear after leaving the field or a submit attempt. Journals retain time/actor context on small screens, generated fields show read-only effective permissions, relationship editors stay in the settings frame, and custom multi-choice/reference fields share compact selection with optional format help.

• UI review corrections: timestamp insertion errors clear on draft reset; long text inputs scroll within a bounded height; reloads reuse the last resolved interface language; shared record and Journal tables explain page selection and offer copying selected IDs and clearing the selection.

• Contact forms share UUID-bound conditional name requirements with the server; invalid structured defaults block saving. Derived fields expose only editable attributes, while protected contact collections retain configurable contexts. Empty optional collections use compact Add controls.

• Record and instance journals format structured historical values with their historical field definitions. Module relationship provenance is explicit; fixed structure and editable labels are distinguished consistently. Settings tables retain readable columns with keyboard-accessible horizontal scrolling, contained fieldsets and responsive controls; duplicate section headings are removed.

• Journal newly added relationships only after final-state validation, so derived Contact names cannot turn a cardinality conflict into a database error or snapshot an invalid intermediate graph.

• Virtual Access principals remain displayable without unsupported sorting; invalid list-sort URLs recover automatically. Protected system-field inspection avoids false reserved-name/role warnings, and creation restrictions no longer mislabel active object types as inactive. Security journals use translated properties/rights and current principal names while retaining original snapshots. Recycle-bin previews share form groups, widths and dialog actions, separate inactive fields and respect applicability/field visibility; Command-K includes the workspace recycle bin.

• Native controls and scrollbars follow the selected light/dark appearance through the browser color scheme.

• Permission administration retains inactive policy entries, rejects new inactive memberships/foreign rules, preserves deleted-object overrides without blocking edits, journals removed Create grants and reports per-record field ceilings. Rights editors retain draft versions, distinguish default rules from object overrides, show effective Create/current access, and share clear translated sections, pagination, save shortcuts and guarded read-only/pending states.

• Typed SQL-count results in linked-record tests so the full server/root type check includes those assertions without unknown-row errors; the complete application tests and builds pass.

• Exact regional numeric/date/time editing preserves semantic values across load/blur and preference changes. Invalid drafts keep their prior interpretation and block Save; grouping variants, currency placement, calendar keyboard input, milliseconds and explicit DST occurrences are covered by regression checks.

• Destination-specific loading frames retain actual table columns/control slots/page size, form groups and dialog boundaries. Unknown counts/empty states wait for responses; background refresh retains contents. Lazy Settings loading no longer shifts Dashboard layout.

• Form-designer group creation retains Unassigned drafts/settings; hidden incompatible connections can be revealed for explicit removal. Layout changes do not remove stored fields or links.

• Narrow/scrollable settings, Type/Status editors, user forms, command dialogs and relationship pickers preserve controls, rounded corners and space for actions; long labels wrap without widening their containers.

• User editing opens from rows or accessible name buttons, retains dirty baseline versions across refetches and resolves conflicts through Reset. Successful group save closes and returns focus. Dashboard search supports the common keyboard shortcut.

• Record return navigation retains list filters/focus or a validated linked source, rejecting unrelated destinations. Clickable rows respect embedded controls/text selection, keep the standard cursor and do not underline Keywords on hover. Not-found views use appropriate navigation icons and distinguish connection errors.

• Record/definition journals distinguish historical identities from reused technical names; empty/classification-only records retain creation history and historical usage still blocks unsafe definition deletion. Contact acceptance uses separate Contact-person records connected by Identities, never multiple Organizations for one Contact person.

• Chunk-load failures report accurately; current builds clear generated output under ADR 0028, and open development clients require refresh after rebuilds. PostgreSQL readiness uses TCP checks to avoid premature initialization success.

• Standard Base UI component composition, keyboard-help framing, theme-menu dismissal, creation icons, field focus/error states and unsaved-edit protection are consistent across the application.