Platform release notes

Current authority: Assignment, appointment scheduling and technician work start share one server check of the current owner, requester, payer, contract and member links. Changed, revoked or unbound saved approvals hold work and require review. Cosmetic name changes do not invalidate unchanged authority.

Visible review and retained evidence: Arabic and English service cards display a red authority flag. An authorised Accountant can record a reason and request fresh approvals from eligible current parties. Previous approvals remain in history; the control does not change payer, invoices, payments or access grants. Invalid party or payer links require a separate authorised correction.

Pending registration visibility: Filter pending registrations before pagination and count them independently from the visible people page. Remove the former100-claim display cap. All returns the complete permitted matching set; completed history remains stored and available through the scoped history query.

Shared list controls: Each section has top/bottom size choices, full ranges and page counts, numbered navigation and mirrored Arabic/English Previous/Next. Search and scope filters reset both page positions while retaining separate sizes. Exact profile filters and language links retain their context; private search text stays out of URLs.

Selection and current review: Selections survive paging within the25-record batch boundary. Changed visible records or stale review readiness clear their selections. Detached controls cannot operate a newer list. Invitation preparation, identity review and final access approval remain explicit actions with server version and authority checks.

Pending identity reviews: Changed applicant identity links or target records, revoked or reassigned reviewers, incomplete evidence and missing legacy bindings require an explicit current Accountant match. The server repeats these checks for every selected claim before granting any account link. Routine session activity does not invalidate an otherwise current review.

Visible review reasons: Company registration cards and their review dialogs show red bilingual reasons and the required correction. Stale claims cannot be selected for access approval. Current claims retain selection and the explicit CEO decision. Internal identity fingerprints remain server-only.

Review history: An explicit re-review or claimant resubmission retains superseded evidence in private history. Read-only projections do not rewrite requests, approved accounts or source records.

Shared list navigation: Choose20,50,100 or All permitted matching requests. Top and bottom controls show the full result and page counts, numbered navigation and Previous/Next in the selected language direction. Empty and last-page ranges use the same arithmetic as other registers.

Request and list context: Opening a request and returning preserves search, page size and position. An exact request link returns to its matching list page. The address follows the displayed request and clears its request selector when returning to the list. Typed searches reset paging without changing the selected page size.

Permitted search fields: Assigned Operations retains its limited search fields. Paging, filtering and retired controls cannot grant record access or submit a business action. Existing review and activation checks remain separate.

Current review evidence: Changes to the saved applicant, canonical owner or matched existing building invalidate affected pending reviews. Revoked, relinked or reassigned reviewers cannot leave their old review valid. Earlier evidence and review history are retained; repeating one affected review does not invalidate an independent current review.

Actionable review flags: The authorised Accountant or CEO sees a red warning identifying the changed binding or review. The activation control stays disabled until both current reviews pass. Internal binding hashes are not exposed in browser projections; applicants and assigned Operations retain their existing limited view.

Agreement validity dates: Review display and server activation use the same Saudi start-of-day and inclusive end-of-day boundary. An agreement outside its recorded validity dates produces an explicit review warning.

Session failure classification: Member-provider server, gateway, throttling and unknown network failures return a sanitized503 instead of a200 signed-out result or a401 private API rejection. Explicit authentication, denial and missing-member outcomes still deny access. Every retry reads current identity and saved authority; no stale-authority fallback is introduced.

Recoverable Arabic and English feedback: The shared client offers a selected-language retry message. Temporary failures do not trigger sign-in navigation, clear the last known account or resend writes. Protected views remain concealed until a successful fresh check; real sign-out, revocation and changed-account behavior remain enforced.

Stalled session diagnostics: Reports a bounded start and, after five seconds, the pending read phase. Completed response timings remain available. Diagnostics contain only a random check ID, build, phase names, durations and HTTP status; reporting failures cannot repeat, cancel or decide authentication reads.

Private request correlation: Current-session browser checks attach a validated random UUID header. Concurrent consumers still share one request; the URL, no-store behavior, deadline and current permission checks remain unchanged. Unsupported UUID generation falls back safely. Other routes and write methods do not receive the diagnostic header.

Session read dependencies: A valid session does not wait for unrelated deferred finance, customer-registry or migration blocks. Current member identity, browser verification, revocation, page controls and reviewed payment readiness remain checked. Missing required payment evidence still prevents a successful response.

Session diagnostics: Server-Timing reports member, authority, verification, required-setting and total durations. Metrics contain no account IDs, cookies, credentials or source evidence. Other routes do not add these session metrics.

Confirmed save versus refresh: A failed refresh no longer turns a confirmed save into an uncertain account preparation or reenables a confirmed invitation submission. The page reports the saved outcome and the separate refresh problem. Invitation acceptance remains distinct from delivery.

Current account and invitation handoff: Account forms recheck their current context before saving and suppress late follow-up after sign-out or changed authority. An explicit invitation review opened after a successful account save stays usable when the old register is replaced; it cannot send after leaving that page or changing account.

Unsaved review navigation: Replaced the blocking browser confirmation with an Arabic/English in-page dialog. Keep reviewing is focused by default; Escape and cancel preserve the draft. Page-size controls restore immediately while awaiting a choice. Explicit discard navigates once and clears only the old page selection.

Current review context: Repeated navigation cannot stack confirmations. New renders, sign-out, scope changes or pending save outcomes cannot execute an old deferred navigation. No save, approval or source edit is performed by the dialog. The browser unload guard remains for closing a tab with unsaved work.

Complete register controls: Removed the 40-record candidate cutoff. Accounts and unlinked candidates share 20/50/100/All paging, page counts, typed search, category/status filters, list/cards and visible-only selection/copying. Search and filters apply before result counts.

Correct role and record destinations: Owner-team members open the matching saved membership instead of an ordinary editor that cannot represent their role. Their displayed building scope follows current ownership. Imported candidates open their exact existing people profile. Company, client/team and service/legal account groups are counted separately.

Independent loading and current context: The account register renders without waiting for access-request or saved-preparation queues. Delayed reads cannot overwrite a newer view or signed-out context. Paging shares one arithmetic model with existing server registers. Saved preparations gain scoped search, while legacy creation markers remain explicitly unknown.

Exact identity and current authority: Requested email and member subject must match an eligible provider response before portal access is saved. Current administrator permissions and record bindings are checked again after provider calls and during every commit retry.

Saved preparation recovery: User administration includes saved attempts with20/50/100/All paging and an explicit review of the original requested role and scope. The authorised creator can reconcile the attempt;the CEO can inspect or withdraw it. Withdrawal does not delete a Wix identity or suspend an existing account.

Uncertain outcomes and duplicate protection: A durable attempt marker precedes the provider creation call. A lost response is reconciled by exact member lookup;another command cannot bypass a pending attempt for the same email. Late results cannot grant withdrawn access. The original form preserves its exact command and reviewed details after an uncertain save. Invitations remain a separate explicit action.

Access request review: Requests now have version-checked resolve, decline and close actions with an attributed reason. Confirming availability requires the requested page to be enabled for the current saved account. This action changes neither role nor record scope.

Personal follow-up and CEO queue: Pending reviews appear in the CEO work queue and notifications. Requesters can open their own history from the request dialog or notification, including the recorded decision reason. Lists share20/50/100/All paging and exact request links. Reading a notification does not decide a request.

Safe decision retries: A lost response can be retried with the exact saved command and payload without duplicating the outcome. Stale requests, changed account versions, revoked CEO authority and mismatched identities are rejected. Historical requests and permission rules remain intact.

Tab and cached-page restoration: Restoration conceals private content immediately, even if a background check is pending. A check begun before the latest hide cannot reopen the page or restore background focus. One current read follows when needed, while duplicate restoration notifications share the pending current check.

Recovery and current authority: An older failure cannot replace a newer restoration with obsolete retry state. Current failures keep forms and private dialogs intact until a fresh successful check. Actual member or permission changes still clear and reload; missing or inactive identities cannot reopen private content. Identical permission lists compare independently of their order.

Existing sign-in rules retained: A fresh page continues to reuse the session verified for that exact document without another initial check. Current server authorization, verification requirements, OTP duration, inactivity rules, browser limits and periodic checks remain unchanged.

Open request preview: The attention card now selects up to four open journeys from the complete permitted history before applying the 200-record history preview. It shows the displayed and total counts and opens the full open-request list. Older incomplete snapshots no longer produce an unsupported empty-state claim.

Current dashboard context: The account dashboard and portal share the same account-context check. Delayed account, property, rental and rehearsal responses cannot repaint after access, page or refresh changes. Inactive or pending-verification contexts do not start another dashboard read. Existing session verification remains in force.

Exact rental follow-up: The portal follow-up card now opens the exact rental application it displays. The isolated rehearsal keeps its separate route. Arabic and English links preserve their displayed language.

Linked account journeys: The account dashboard andticket history now share the same current journey projection. A reciprocal permitted service/rental handoff retains the original reference andpublic history inone row;old request links still find that journey. Unavailable handoffs keep the original follow-up. Shared support replies appear without internal notes orinternal update times.

Complete scoped history: A dedicated read-only ticket view filters before pagination,counts all permitted rows beyond200,anduses shared20/50/100/All controls withpage counts andnumbered navigation inArabic andEnglish. Exact records andold source aliases remain reachable outside the firstpage. Dashboard open counts use the full permitted set.

Current access andloading: Ticket entry omits unrelated financial,message,archive andengineering history. Failed filtered reads offer a read-only retry. Late responses cannot replace newer filters orrepaint after account/member/page authority changes;unsubmitted search edits cannot relabel an earlier result.

Unified request centre: Owner and tenant enquiries now appear through their existing minimal account projection. A handoff replaces its source only when both records link to each other and the destination is actually represented under current access. Missing, private, preparation, hidden or unrelated destinations no longer hide the source.

Exact account follow-up: Account requests open the exact permitted service order as well as rental applications. An unavailable handoff retains the original request follow-up action in Arabic and English. Internal CRM notes, tracking secrets and staff assignments remain outside customer enquiry projections.

Saved actions and files: Current-actor outcome lookup returns metadata only. Ticket upload references survive the version change caused by attachment history, preventing duplicate files and history on exact retry. Private bytes and upload bindings are rechecked.

Recovery experience: Share the exact-action controller with source review. Recover unknown creates and replies, resume partial file batches, keep only an opaque actor-bound reference after reload, and refresh confirmed saves without resubmission. Existing access, approval and publication rules remain.

Protected control states: Preserve controls that were already disabled before a save attempt, including the fixed CEO-exception flag, while restoring editable controls after recovery. Server exception and publication rules remain unchanged.

Scoped ticket browsing: Reuse the shared register paginator and server page model after current record scope and filters. Preserve page/filter/language URLs,clamp empty or shrinking results,and honor read-only technician creation limits.

Private callback lifecycle: Complement the shared session guard with module-level identity/scope/lifetime checks. Discard obsolete results before assigning list state,rendering details,downloading a blob or starting an upload after file reading. Access denial removes obsolete private content;unchanged sessions retain unsaved fields.

Decision recovery: Retain one command and captured reason per request;retry only unconfirmed decisions without repeating confirmed saves. Close/reopen resumes the same review. A confirmed save followed by a read failure offers refresh only.

Current authority and review: Stop later requests on lost authority,discard late responses,validate returned decision receipts,focus missing reason/confirmation,and require current-version review after a conflict. Existing operational approval rules and limits remain.