Add Help contact form and PHP mail endpoint for support@katerion.ru, with validated Reply-To, explicit diagnostics consent, CSRF/origin checks, hashed rate limits and duplicate protection. Preserve drafts on error and avoid serializing customer data or SDK internals. Full PR QA passed in 35559317001; isolated PHP and 30 browser cases passed in 35559179372. Standard production gates unchanged. Publication checks do not send real mail; inbox receipt remains unverified. No training photo assets or unfinished training lifecycle changes.
Load the missing promo module, add a prominent creation button and place Promos beside Overview. Use existing AAL2-guarded server RPCs with selected plan, subscription duration and code validity; preserve form input, honest clipboard feedback and scope async responses. Full PR QA succeeded in run 35547013076. No live data, SQL, MFA or unfinished training branch changes. Preserve normal main QA and exact-asset/browser publication verification.
Recover only unverified Caterium Developer TOTP factors from the full factor list. Preserve verified MFA, reuse the in-memory QR after closing the dialog, serialize enrollment and retain correct-code/AAL2 checks. Complete pull-request QA passed in run 35518429693. Standard main QA and publication gates remain unchanged.
Keep notification-read state personal to user/company, preserve server read-only sections during staff synchronization, and respect separate order-create/edit/delete rights. Add visible mobile header session actions and a sticky logout that survives profile RPC failure; scope asynchronous profile/branding to user and workspace. Targeted browser suites and isolated SQL recovery tests passed in run 35506145405, iPhone screenshots reviewed. Full main QA remains required before production promotion. Workspace branding RPC migration is included but has NOT been applied to production Supabase; older servers retain safe owner-only fallback. No live membership/business-data repair is claimed without identifying the reported employee.
Add a single-page A4 preview and PDF for all selected banquet dishes or a ready-menu selection, with company branding and optional costs. Preserve draft/order state and saved line prices, enforce access and tenant scope, and fail clearly rather than clipping oversized menus. Nineteen targeted browser scenarios passed twice and the generated iPhone PDF was visually checked. Full main QA must pass before the existing automatic production promotion; production verification includes the new renderer and real-asset client menu export.
Add Settings > Учебный каталог, off by default and available on ordinary writable profiles. Load ready example boxes, photos, TTKs and linked sample inventory additively; preserve own data, saved orders and edited examples when hiding or re-enabling. Respect company/profile scope, read-only permissions, failed downloads and tenant changes. Preserve the opened recipe guide across real catalog refreshes on iPhone. Integrated feature checks and full pull-request QA passed. Standard main QA and exact-asset production UI verification remain in place.
The Поддержка tab opens an assistant that answers how-to questions from
the handbook. The chat is a sandboxed iframe on the assistant's own
origin and is only loaded after an explicit click, so Help and its search
stay local and no third-party script runs inside the app.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Add compact accessible client summaries and menu discounts in percent or rubles with explicit durations. Preserve ordinary catalog prices and order line snapshots; derive current prices and expire promotions automatically without background writes. Keep fractional prices, legacy sale compatibility, and regression coverage. Full pull-request QA passed. Publication remains gated by full main QA and byte-for-byte production asset and UI verification.
production had diverged from main with 20 unreviewed direct-push
commits never merged back (account center feature, owner-only employee
roles, and a login-screen redesign - the exact "cream login" work that
replaced the old dark table-photo screen). Neither QA nor the
audit fixes on main had ever seen this code.
Conflict resolution:
- service-worker.js: kept production's newer cache-refresh mechanism
(CRITICAL_FRESH, forceFresh, withAccountCenter, v81 cache name) and
combined both sides' CORE asset lists (account-center-v1780.js +
login-signature-v1776.js from production, auth-security-v1774.js +
order-enhancements-v1775.js from main).
- deploy-timeweb.yml: kept main's version, which already independently
verifies service-worker.js's sha256 alongside the login/logo files -
strictly more thorough than production's version of the same check.
Also fixes fallout from production's commits never having been
QA-tested before landing: package.json was bumped to 17.8.0 with
nothing else in the codebase updated to match (reverted to 17.7.3,
matching package-lock.json/release-manifest.json/app-runtime.js, since
no other release artifact actually changed), and three tests
(static-security.mjs, edge-security-v1774.mjs, release-check.mjs) had
hardcoded strings (old PWA cache name, old employee role list) that no
longer matched the code they were checking.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
release-manifest.json still pointed "dataLayer" at the removed
data-layer-v1771.js instead of the actually-loaded v1773.
service-worker.js's offline cache list never included
auth-security-v1774.js, order-enhancements-v1775.js or
login-signature-v1776.js despite performance.js loading all three at
runtime - PWA/offline mode could serve a stale or missing module.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
