Rolls up 4.6.1–4.6.28. No new migration since Version000406020Date20260810000000; a rebuild is required (npm run build) — both for the version bump, which invalidates the integrity manifest, and for the one source change below.

What the 4.6 line delivered, one line each

• 4.6.6–4.6.11 — bulk team import: its own tab, multiple admins per team, resolved account names, underscores and Collectives named properly, and team: in a member list accepting a name.
• 4.6.12 — a bulk-imported team admin is activated outright instead of being left on a pending invite (level 8 with no circles_membership row meant no access at all).
• 4.6.13–4.6.16 — the team-expiration workflow: request, decide, warn (no CHANGELOG entry of their own — see Known gaps).
• 4.6.17 — a copied ?team= link works for the person you sent it to (join / request-to-join / invite-only), and two join-gate holes close: invite-only teams were joinable by crafted POST, and approval-required teams auto-approved.
• 4.6.20 — every TeamHub-created team calendar was published to the internet; the public share is removed and revoked by migration, replaced by an in-app FullCalendar grid. Team names move to a harm-based blocklist capped at 120 characters, and duplicates are refused.
• 4.6.21 — dates belong to the reader: TimezoneService and src/lib/localDate.js fix meetings created at the UTC offset and "today" meaning the UTC day in 17 browser places and several server paths.
• 4.6.22 — the expiration workflow gets an ending: approved / denied / superseded requests appear as Completed instead of vanishing from both sides.
• 4.6.23–4.6.24 — Deck boards and Talk conversations follow team ownership, and the corrections from the first real transfer: access comes from team membership afterwards, not from a personal grant left behind.
• 4.6.27 — the Maintenance expiration panel goes from eleven blocks to four, and {n} day left stops rendering its English plural in every locale.
• 4.6.28 — bulk team export becomes a licensed feature; bulk import deliberately stays open.

Security

• A decision's sourceRef was stored with no scheme check and rendered into an href and an iframe src. DecisionService's own contract note has said "controllers must validate" since the field was added; no controller did, and propose() checked length only. TeamDecisionsView hands a ref whose sourceType is url to openSourceUrl(), which puts it in <a :href> and <iframe :src> — a javascript: ref there is stored XSS in the Nextcloud origin, executable by anyone who opens the decision.

It was not reachable through propose(), because ALLOWED_SOURCE_TYPES does not contain url — the value the render branch keys on. That is an accident of an unrelated allowlist rather than a defence of this field, and the render path stays live for any legacy row already carrying that type. Fixed at both ends: assertSourceRefSchemeSafe() refuses a scriptable scheme (javascript, data, vbscript, file, blob) or any non-http(s) scheme:// form on write, and openSourceUrl() re-checks at the sink with new URL() — the half that protects rows stored before the server check existed. The sink stores parsed.href, so the value that was validated is the value that reaches the attribute.

The two checks are deliberately not the same check. The server is looser than DecisionExternalLinkService::validateUrl()'s strict http(s) allowlist, because sourceRef legitimately holds a bare message id, a .proposals/…md path or prose; the strict allowlist is applied at the sink, where the value is about to become a URL and nothing else. Copying either rule to the other end breaks something: the strict one rejects valid data, the loose one lets a protocol-relative //evil.example/x through. Reasoning in DESIGN.md §2.100.

Control characters are stripped before matching, since a browser dispatches java\tscript: as javascript:. Spaces are not — stripping them too would join see http://x.com into seehttp://x.com and refuse a legitimate free-text ref. Behaviour pinned against 24 inputs covering scriptable schemes, mixed case, embedded control characters, protocol-relative URLs, ids, paths and prose.

Added

• One string — the refusal shown when a source link is not http(s) — keyed in all seven locale files.

Removed

• The unconditional console.log in ProjectSwimlaneView.vue's buildDependencyEdges(), added as a diagnostic in 4.3.18 and shipped ever since. It fired on every canvasLayout compute — spreading an object, materialising [...cardAnchor.keys()] and mapping a five-event sample on each render, whether or not anything was wrong. The five skip counters and two id arrays that existed only to feed it are gone with it; the supported parameter stays in the signature, as it already did.

Known gaps

• Nineteen versions in the 4.6 line have no CHANGELOG entry: 4.6.1–4.6.5, 4.6.13–4.6.16, 4.6.18, 4.6.19, 4.6.25 and 4.6.26. Several are provably real — 4.6.13 created the expiry indexes this file still cites, 4.6.14 shipped the export routes 4.6.28 documented, 4.6.16 introduced the Email-owner gating — so this is step 5 being skipped at session end, not versions that never existed. The pattern is recorded in HANDOFF.md §3 with two earlier instances.

Notes

• The full Nextcloud security-guideline checklist was walked at close, against the app as it stands rather than against a diff — this working copy has no git. Results by guideline: 1 no raw SQL beyond four bound ? statements, no interpolation into any QueryBuilder string method, every orderBy() a column literal and every createFunction() a literal fragment. 2 six v-html bindings, all fed from marked → DOMPurify.sanitize(); both PHP templates escape through htmlspecialchars(); the one unvalidated URL sink is fixed above. 4, 6 no eval, exec, shell_exec, system, proc_open, passthru, popen, call_user_func or unserialize anywhere in lib/. 7 no #[PublicPage] and no #[CORS] in the app at all; getTeamPreview(), the one deliberately un-gated endpoint, still requires a session, shape-guards its id, binds both parameters and gates on source = 16. 9 all 310 routes cross-checked against the 121 CSRF-exempt methods: only two non-GET routes are exempt (integration#registerIntegration, integration#deregisterIntegration), both admin-gated with the reason documented in place, and no GET route mutates. 3 no X-Frame-Options or CSP manipulation anywhere, so the framework defaults stand. 5 the one filesystem read driven by a name (AnnouncementService::loadMarkdownBody) resolves only against a server-side registry and re-rejects /, \ and .. before touching disk; the CSV and image uploads basename() the client-supplied name. 8 no password, API key or credential reaches a log; what appears in log context is Talk room tokens, which are conversation identifiers already in every member's URL — not the bearer secret 4.6.20 removed. 10 no RedirectResponse in the app at all, so there is no redirect surface. 11 the link-preview and image-proxy paths validate every redirect hop, reject encoded-IP forms, resolve DNS and check every A/AAAA record, and fail closed.
• Guideline 7 cannot be verified mechanically in this codebase, and that is worth knowing. A script flagged 40 of 184 team-scoped routes as ungated; every one sampled turned out to be gated, just under a different name each time — requireAdminLevel, getMemberLevelFromDb plus an inline level comparison, requireLinkLevel, requireLaneWithEdit, requireActionLevel, or a service throwing AccessDeniedException. There is no single gate idiom to grep for, so the check is manual by construction. Recorded in HANDOFF.md.
• Not covered: no PHP was executed — php is not on the development machine's PATH, so not even php -l ran against the changed service.
• oc_migrations carries a stale teamhub / 000407000Date20260810000000 row from the 4.7.0 that was rolled back on 2026-08-10. Nothing looks it up and this release adds no migration, so it stays harmless — but that class name is now burnt: a migration created under it would be treated as already applied and never run.

Rebuild required. No new migration.

Fixed

• team:Marketing was dropped as "Unknown team". The members column resolved group: tokens by name but matched team: tokens only against a raw Circles unique_id — a 31-character hash nobody hand-writes into a spreadsheet — so naming a sub-team the way the column reference implied could never work. team: now resolves by display name, case-insensitively, and still accepts an ID (tried first, since it is unambiguous).
• Two teams sharing a display name is refused rather than guessed, with a message pointing at the ID. Circles does not enforce unique display names, so silently picking one would attach the wrong team to somebody's import.
• The row's matched-names note now reports the team's own spelling ("marketing" → Marketing) instead of its id, which was accurate and told the admin nothing.

Changed

• team: resolution and the duplicate-name check now read one memoised lookup instead of two queries with two copies of the display-name derivation. That duplication is why a name could count as "already exists" for the collision check while being unresolvable as a sub-team. teamExists() is gone, replaced by resolveTeamId().

Rolls up 4.5.48–4.5.51. No new migration since Version000405042; a rebuild is required.

Known issue

• A Nextcloud Office document opened from the Files tab still arrives without its conversation. Diagnosed but not fixed: the Files sidebar never opens for it (sidebarFound: true, sidebarOpen: false), so the chat tab is never reached. 4.5.50 removed a genuine timing flaw one step further along, which is why it does not resolve this. Every other file type is unaffected.

Fixed

• Every App Store release after v4.30 — that is v4.4.2 and 4.5.0 — shipped v4.30's frontend. The publish workflow ran npm install && npm run build on the release repository, compiling whatever src/ was committed there. src/ is not mirrored by scripts/publish-to-release.js — by design, since the release repo is supposed to carry pre-built output only — so it had been frozen since 2026-07-20 and CI silently overwrote the correct mirrored bundle with a v4.3.0-era rebuild. Installing 4.5.0 gave you current PHP against a v4.3.0 js/, which is why no frontend change since v4.3.0 was visible. Reinstall or update to 4.5.1 to get the real bundle.
• The integrity manifest was hiding it. npm run build regenerates appinfo/integrity.json, so the CI rebuild also re-hashed its own stale output and stamped it app_version: 4.3.0 (read from the release repo's equally stale package.json). Every hash matched, so the Compliance tab reported Compliant while blessing a three-week-old frontend.

Changed

• CI packages, it no longer compiles. .github/workflows/publish.yml assembles the tarball from the committed release payload — the same allow-list as PUBLISHABLE in scripts/publish-to-release.js — so the published artifact is byte-for-byte the bundle that was built and tested locally. src/, scripts/, screenshots/, .tx, package*.json, vite.config.mjs and the developer docs no longer ship inside the app tarball.
• New CI gate: .github/verify-package.js. Runs on the assembled folder before upload and aborts the release if integrity.json's app_version disagrees with appinfo/info.xml, if any manifested file is missing or altered, or if a file inside a covered directory is absent from the manifest. Verified against the published 4.5.0 artifact — it fails with the exact mismatch.
• scripts/publish-to-release.js pre-flight. Refuses to mirror, copying nothing, when info.xml and package.json disagree, when integrity.json was generated for a different version, or when src/ is newer than js/ (a stale build). Override with TEAMHUB_SKIP_PREFLIGHT=1.
• scripts/generate-integrity.js reads the app version from appinfo/info.xml instead of package.json. info.xml is what Nextcloud reads, and it is mirrored to the release repo whereas package.json is not.

Added

• In-app announcements from TeamHub HQ to unlicensed instances. Envelope icon in the sidebar footer next to the help ?; clicking it opens a popover with one "Click here to see it" link per unread message. Clicking the link renders the full markdown body in the main content area. Messages are .md files in announcements/ registered via announcements/registry.json, each with a role (admin | everyone) and an exact version gate. The server filters by license state + version + role; per-user dismissal state lives in a new teamhub_announce_read table. Rendering is client-side via marked piped through dompurify with a strict tag/attribute allow-list (no <script>, <iframe>, <style>, and only http(s) / mailto URIs).
• New endpoints under /api/v1/announcements — see APIendpoints.md. Filename travels as a query/body parameter, not a URL segment, so trailing .md on filenames does not confuse NC's Symfony routing.
• Placeholder announcements/welcome-4.5.0.md (role: admin) so the affordance is visible on first install; replace with real release commentary or delete the registry entry to hide it.

Changed

• Create-team wizard, step 4: Create new / Connect existing buttons cropped. NcButton size="small" drops the pair from ~44 px to NC's --clickable-area-small (~34 px), so they no longer dominate the app-row pills. Padding, font-size and icon scale follow from the size token — no CSS changes.

Added translations

• 9 plain + 2 plural keys across all 7 locales (.js + .json); npm run check:l10n clean at 2422 (en) / 2448 (nl,de,fr,da) / 2420 (es,it).

Deps

• Added marked ^14.1.3 for announcement markdown rendering. npm install required before npm run build.

Database

• New migration Version000404017Date20260728000000 creates teamhub_announce_read (user_id, filename, dismissed_at) with composite PK. Table name is 21 chars — auto-generated PK name (teamhub_announce_read_pkey = 26 chars) is well under NC's 30-char cap. MariaDB and Postgres compatible.

Security

• Removed #[NoCSRFRequired] from 22 state-changing controller methods across MeetingController and TeamController. Every write endpoint (POST/PUT/DELETE) now goes through NC's built-in CSRF token check. The frontend already sends the token on every request via the @nextcloud/axios interceptor, so this is transparent for legitimate callers and a hard-block on any forged same-origin request (defence in depth on top of the browser's default SameSite=Lax cookie policy).
• Methods now protected: MeetingController::createTeamMeeting, saveMeetingSettings; TeamController::updateTeamApps, deleteTeamResource, createIntravoxPage, deleteIntravoxPage, invalidateIntravoxCache, invalidateCollectivesCache, leaveTeam, markTeamSeen, requestJoinTeam, updateTeamDescription, removeMember, updateMemberLevel, approveRequest, rejectRequest, inviteMembers, createTeamResources, updateTeamConfig, deleteTeam, transferOwner, saveAdminSettings.
• Kept #[NoCSRFRequired] on IntegrationController::registerIntegration and deregisterIntegration — these are legitimately CSRF-exempt because external NC apps call them PHP-to-PHP from their own install / uninstall hooks (no browser session, no token). Documented reason preserved in the code.
• GET endpoints across all controllers keep #[NoCSRFRequired] — that's the correct pattern for reads.

Verification checklist (after npm run build and redeploy)

Any UI action that returns a 401 from the app after the rebuild means a caller isn't going through @nextcloud/axios or the axios interceptor isn't loaded. Smoke test the main write actions:

• Create a team, edit its description, transfer ownership, delete a team
• Invite a member, change a member role, remove a member
• Approve / reject a pending join request; leave a team
• Save Admin Settings (any tab); save a team's Config (any tab: budget/time/timeline/messages/collectives/dashboard/type)
• Create / save meeting settings
• Create / delete an IntraVox page; invalidate its cache
• Update team apps; delete a team resource

If any of those returns 401, the specific #[NoCSRFRequired] annotation can be added back and this changelog updated.

Session-end major bump wrapping up the "What’s new" personal aggregated feed feature. Two big themes across 4.2.11 → 4.3.0:

1. Public-message plumbing + admin toggle (v4.2.11) — messages can be marked public (opt-in per team, admin-gated); new GET /api/v1/messages/public endpoint; is_public column on teamhub_messages.
2. "What’s new" feed (v4.2.12 onwards) — new sidebar entry, cross-team chronological feed combining team messages + public messages + Talk polls + Talk thread starters, with a right-side Feed control widget (Team / Public / Talk toggles + 20/50/100 per-page radios, localStorage-persisted), Prev/Next pagination.

Added in v4.3.0

• License gate on "What’s new". Sidebar entry hidden when unlicensed; view branch shows a License required empty-state on stale deep-link; backend endpoint returns 403 { licenseGate: true, enforcementLevel } when the instance's license is unlicensed or soft-lock. Frontend recognises the shape and surfaces a license-specific error instead of the generic one.
• Preview line restored on Talk thread cards — cards now render subject + preview (both from talk_threads.name, matching other feed cards for visual consistency).
• 3 new license-copy strings translated across nl/de/fr/da/es/it.

Removed in v4.3.0

• All temporary ->debug('[TeamHub][TalkService]') and ->debug('[TeamHub][MessageService] getPersonalFeed:') lines added between v4.2.15 and v4.2.20 during the Talk-feed debug chase. Warning-level logs for genuine failures (SQL errors etc.) kept.

Session-end totals

• Version: 4.3.0 (was 4.2.10 at session start)
• New endpoints: GET /api/v1/messages/public, GET /api/v1/messages/feed
• New DB migration: Version000402011Date20260720000000 (adds is_public SMALLINT column to teamhub_messages)
• New components: WhatsHappeningView.vue
• Files touched: lib/Controller/MessageController.php, lib/Service/MessageService.php, lib/Service/TalkService.php, lib/Db/MessageMapper.php, lib/Migration/Version000402011Date20260720000000.php, appinfo/routes.php, src/App.vue, src/components/WhatsHappeningView.vue, src/components/PostMessageForm.vue, src/components/ManageTeamView.vue, src/store/index.js, l10n/*.{js,json} (× 7), appinfo/info.xml, package.json, HANDOFF.md, CHANGELOG.md, APIendpoints.md, DESIGN.md.
• Translations: 40+ new strings across 7 locales.
• No debug logging in shipped code.

First proper 4.x session on top of the 4.0.0 marketing cut. Wide session — new subsystems, several long-running bug reports closed, documentation and API reference brought current.

Added

• Messages internal integration. New per-team messages_enabled flag (default true) toggleable under Manage Team → Integrations → Messages. Endpoints GET/PUT /api/v1/teams/{teamId}/messages/config. Layout bundle now carries messagesConfig so the desktop message-stream widget, tablet stream column, mobile Home tab, and post form can gate on it without a second fetch.
• Team template label. New table teamhub_team_type (migration Version000400002Date20260716000000) — one row per team, team_id PK, type (STRING 32). Written by CreateTeamView after team creation via new GET/PUT /api/v1/teams/{teamId}/type. Rendered as the leading badge in the Team info widget (teamLabels) and as a pill on Browse Teams cards. Deliberately a separate table rather than extending teamhub_project.type (would flip isProject across 14+ services).
• New TeamTypeMapper (single + batch lookups) and TeamTypeService (admin-gated setter with enum validation against ['collaboration','project','department']).
• BrowseTeamsView search now also matches the localized template label.
• Messages checkbox in the CreateTeamView modules list; unchecked path fires PUT /messages/config with messages_enabled: 0 after team creation.
• Post-message action moved from the first row of the Message stream widget into the widget header as a .teamhub-widget-header-btn. MessageStream accepts :hide-header="true" on desktop and exposes openPostForm() for the ref-based header trigger.
• Auto-fit widget heights on new team open. DEFAULT_LAYOUT items carry autoFit: true; on first mount TeamWidgetGrid.runAutoFitPass measures rendered content vs allocated grid rows and grows h to fit (capped at 8). New layout-autofit event that TeamView saves unconditionally, bypassing the edit-mode gate. Also triggers when the set of visible widgets changes (watcher on a sorted-joined visibleWidgetIds computed) — so phase-gated widgets like Project Health, which appear mid-session, get the fit pass instead of keeping their initial scrollbar.
• Auto-save on the Project tab. Project dates, Budget project settings, per-workstream row, Time project settings, and per-member time row all switched to @change → per-section autoSaveXxx() debounced wrapper (400 ms). Add/Remove editor on lane rows also triggers auto-save. Save buttons removed; success toasts stripped.
• Auto-save on Admin Settings → Archive. Deep watcher with 400 ms debounce persists on every change; Save button removed.
• New Permissions section on the Settings tab grouping Meeting min-role + Custom links min-role, both auto-save (compact manage-section__row layout).
• New "Internal integrations" documentation section in docs/team-management/widgets-and-tabs.md listing every built-in toggleable feature.
• Documented paths corrected in docs/user/messages.md (Pin/Post moved to Integration settings), docs/team-management/team-links.md (Custom-links under Settings → Permissions), docs/team-management/decisions.md (stale Manage-Team → Decisions paths rewritten to Integration settings).
• New "Database identifier length" rule in SKILLS.md.

Changed

• MessageService::getTeamMemberUids dedup switched from array-key (which coerces numeric UIDs to int per PHP spec) to value-based array_values(array_unique(map(strval, …))). Fixes a real 400-error report where a team member with UID 1724022 broke every post's notification dispatch.
• Callsites in sendNotificationsWithName / sendMentionNotifications / sendPriorityEmailsWithName all cast to string before setUser, wrap each per-recipient call in catch(\Throwable), and outer catches widened from Exception to Throwable. createMessage now wraps the whole notification-dispatch block so notification errors can never fail a POST whose message row was already committed.
• TeamService::deleteTeam rewritten. Old logic iterated teamhub_team_apps (app enabled flags) so teams whose admin never touched an app toggle had their Talk rooms / Deck boards / calendars / team folders survive. New logic iterates teamhub_team_app_resources (source of truth for connected resources) and calls ResourceService::deleteSpecificResource per row. Intravox — no per-resource row — still handled via the legacy per-app path.
• ResourceService::destroyOrDetachOnTeamDelete gains hasOtherCircleOwners — a per-app defensive check against native NC storage (dav_shares, deck_board_acl, talk_attendees, share, group_folders_circles). If any OTHER circle principal has access, resource is preserved and only this team's ACL is stripped. Individual user shares don't preserve — team-only rule per spec.
• MessageCard renders message.author_display_name with UID fallback. getTeamMessages and createMessage enrich payloads with the display name in one IUserManager pass.
• Description tab in Manage Team renamed to General.
• Meeting permissions + Custom links now share a single "Permissions" section on the Settings tab (compact manage-section__row layout).
• Decision categories merged into the Decisions section on Integration Settings (one block per integration, <h4> sub-heading).
• .manage-section-desc off-scale 13 px → var(--th-font-meta) (12 px) to match the row-desc pattern.
• CreateTeamView modules list has a messages entry (default checked).
• LayoutController's DEFAULT_LAYOUT items carry autoFit: true; save-layout preserves it when explicitly sent.

Fixed

• [Client bug] Migration Version000393000 (teamhub_budget_lane_editor, 26 chars) failed on install/upgrade with Primary index name on "oc_teamhub_budget_lane_editor" is too long. — Doctrine's auto-generated PK name (<table>_pkey = 31 chars) exceeded NC DBAL's 30-char identifier cap. Added explicit 'th_ble_pk' to setPrimaryKey.
• [Client bug] TalkService::deleteRoomById returned SQLSTATE[42000] (unbound :dcValue1) on team-delete because three separate $db->getQueryBuilder() calls per statement produced a placeholder registered on one QB and referenced from another. Consolidated to one QB per statement (per-attendees delete, per-rooms delete).
• [Client bug] Calendar shared with a second team via native NC sharing got destroyed on team-delete because the safety check only consulted teamhub_team_app_resources. Now cross-checks dav_shares (and equivalents for Deck / Talk / Files).
• [Client bug] Post message from a numeric-UID user returned 400 "Failed to post" toast even though the message was posted. See getTeamMemberUids dedup fix above.
• Mobile bottom bar's Files icon rendered blank — Folder was used in availableWidgets but never imported into MobileWidgetView.
• Route ordering: PUT /messages/config used to be caught by PUT /messages/{messageId} (updateMessage) with messageId='config'. Config routes moved before the catchall.

Removed

• Manage Team → Permissions tab (key messages). Pin/Post role → Integration settings → Messages. Custom-links role → Settings → Permissions. Image cache → Integration settings → Messages.
• Per-workstream and per-time-member Save buttons on the Project tab (auto-save now).
• Save-project-settings buttons on the Budget and Time blocks (auto-save now).
• Save-dates button on the Project dates block (auto-save now).
• Save-archive-settings button on Admin Settings (auto-save now).
• Success toasts on the five auto-saved paths — per-keystroke toasts would be noise; errors still surface.

Security

• All new endpoints (messages/config, type) gate reads via MemberService::requireMemberLevel and writes via requireAdminLevel. Body params on saveTeamType validated against a fixed enum server-side. saveMessagesConfig coerces boolean input to strict "0"/"1". No new sensitive data exposed.

Fixed

• Timeline iframe crashed on NC 34 with Call to undefined method OC\Server::getContentSecurityPolicyNonceManager(). NC 34 removed the shortcut method on \OC\Server; the same nonce manager is still available under its FQCN via the DI container. templates/timeline.php now resolves the manager through \OC::$server->get(...) with a has(...) guard and a legacy fallback so NC 32 / 33 / 34 all render the standalone timeline page correctly.
• IntegrationController::getEnabledIntegrations failed with SQLSTATE[42P01] "relation oc_teamhub_team_integrations does not exist" on fresh NC 34 installs where the v2.9.0 create-table migration didn't materialise the tables. Added safety-net migration Version000387100Date20260709000000 that idempotently creates teamhub_integ_registry and teamhub_team_integrations with the final schema (v2.9.0 base + php_class column + composite unique index). Existing installs where the tables already exist skip the migration entirely.
• IntegrationService::getEnabledIntegrations now degrades to an empty result instead of throwing when the integration tables are missing, so the tab bar / sidebar loads cleanly even if the safety-net migration hasn't run yet.

Frontend build required

None — all changes are PHP-side.

Second session boundary of the 2026-06-30/07-01 window. Rolls up two post-3.86.0 patches (3.86.1 and 3.86.2). Nothing new landed here beyond the version bump and the docs sweep — see the entries below for per-change detail.

Rolled up

• 3.86.1 — Timeline Deck-assignee fetch: skip DbIntrospectionService entirely, try (table, participantColumn) variants directly with try/catch. Introspection was silently returning [] on installs where the table exists but is empty (Strategy 2 SELECT * LIMIT 1 fails on empty tables + Strategy 3 INFORMATION_SCHEMA can be access-restricted).
• 3.86.2 — Shared-files tab in Filecenter widget always empty. Backend was still gating on the shared_files toggle that the frontend removed when the widget was folded in. Removed the gate and swept the remaining plumbing from ResourceService, TeamController ($allowed, $toggleOnlyAppIds), TelemetryService::getBuiltinIntegrationUsage, and dead comments in ManageTeamView.vue.

Changed

• Deck-assignee logging in TimelineService demoted from info to debug. The info level was appropriate during the diagnostic phase but fires on every timeline fetch — would bloat production logs. Admins can set loglevel=0 for the diagnostic capability when needed.

Frontend build required

ManageTeamView.vue was touched at comment level only during 3.86.2. If deploying from the previous session's 3.86.0 baseline you already needed npm run build for AdminSettings.vue / BrowseTeamsView.vue / TeamTabBar.vue; this rollup adds nothing to that.

Session boundary per SKILLS.md §session-end §3. Rolls up 3.84.1 → 3.84.8.

Headline changes

• Audit-tab "Find teams for a user" (3.84.1) — new admin panel finds every team a user belongs to (direct + group + sub-team inherited) with role, owner, source classification, and bulk remove. Two new MaintenanceController endpoints; new service methods; per-row audit events.
• SSO empty-state hint (3.84.2) in InviteMemberModal — explains why lazy-provisioned Microsoft Entra / SAML / OIDC users only appear after first login.
• Browse Teams "Open" button + TeamSearchProvider (3.84.3) — direct-jump to a team you're already a member of; new unified-search provider surfaces TeamHub teams with deep links.
• Hourly Talk-membership reconciler (3.84.4) — new TalkMembershipReconcileJob + TalkService::reconcileEffectiveTalkRoomMembers close long-standing drift gaps for group/sub-team membership changes.
• Invite-action role guards (3.84.5) — three Invite-user buttons gated by isTeamModerator. Audit pass mapped every TeamWidgetGrid action emit to its backend role requirement.
• Audit-tab user search wiring fix (3.84.6) — autocomplete now fires per keystroke; Enter flushes the debounce.
• Two small fixes (3.84.7 / 3.84.8) — column alias whitespace bug; grid CSS selector targeting the actual grid container.

Added

• 26 new user-facing strings, all translated to nl / de / fr / da / es / it.
• New PHP files: lib/Search/TeamSearchProvider.php, lib/BackgroundJob/TalkMembershipReconcileJob.php.
• New service methods: MaintenanceService::listTeamsForUser, MaintenanceService::adminRemoveUserFromTeam, MaintenanceService::resolveUserSingleId (private), TalkService::reconcileEffectiveTalkRoomMembers.
• New MaintenanceController endpoints: GET /api/v1/admin/maintenance/users/{userId}/teams and POST /api/v1/admin/maintenance/users/{userId}/remove-from-teams.
• New audit event type: member.removed_by_admin.

Frontend build required

All Vue components touched (AdminSettings, InviteMemberModal, BrowseTeamsView, App, TeamWidgetGrid, MobileWidgetView). One npm run build covers everything.

Security

• Both new admin endpoints gate at #[AuthorizedAdminSetting] attribute + service requireNcAdmin() defence in depth.
• TeamSearchProvider membership-filters every result via circles_membership + direct rows; non-member teams are unreachable.
• adminRemoveUserFromTeam refuses to remove owners (level≥9) and refuses non-direct memberships before any DB write; emits per-removal audit events with actor UID.

Session rollup of 3.81.2 through 3.81.10. See those entries for the per-change detail; this row marks the session boundary per SKILLS.md.

Headline changes

• Upcoming Events widget actions: 3 → 2 (Add event + Add Meeting). The Meeting Wizard and Team Meeting modal merged into a 2-step wizard.
• Add Meeting wizard writes meeting notes plus calendar event in one go; optional ## Tasks (overdue + unscheduled Deck cards) and ## Proposals (open/finalized decisions) sections rendered into the notes file. Category multi-select to scope which proposals get included. Group-folder-backed teams supported. Manual date/start/end fallback when the Presence module is off. Talk agenda-request message localised to the meeting organiser's UI language.
• AppEmbed toolbar — every button now shows a short label (Today/Add/Remove/Suggest/Reload/Open in new tab) under the icon. Fixed the "all icons look alike" complaint.
• Team-list unread badge — fixed the literal "NaN" output from NcCounterBubble (prop-driven, not slot-driven in @nextcloud/vue 8.x).

Security & privacy

• Redacted four logger->debug lines in MeetingService.php that were logging Talk-room tokens and share tokens (pre-existing; in-scope this session). Now log tokenLen only.
• MeetingController adds bound-checks on all new free-text fields (title ≤200, location ≤200, description ≤4000, categories ≤500, attendees ≤500, proposalCategories ≤200) to limit payload abuse.
• All new queries (deck cards, decisions for proposals) use OCP\DB\QueryBuilder only.
• User-supplied text rendered into the notes Markdown goes through a new mdEscape() helper that escapes [, ], (, ), backslash and friends.
• Group-folder team-folder resolution delegates to ResourceService::getTeamResources() which performs its own membership check — adds defence-in-depth on top of MeetingService::enforceMinLevel.

Design

• SKILLS.md — new rule: state-coloured backgrounds use full saturation paired with the matching -text token. Soft variants (-light, -hover, color-mix(... transparent)) reserved for non-state surfaces.
• DESIGN.md §2.22 — two calendar widget actions, one shared wizard component, MeetingService delegates calendar writes to ActivityService, agenda lives in the notes file rather than the iCal record.
• DESIGN.md §2.23 — AppEmbed toolbar buttons are stacked icon + label (custom <button> instead of NcButton, bar wraps rather than scrolls).

Added

• Tab bar responsive overflow — when tabs exceed available bar width, excess tabs are collected into a "More…" dropdown. Uses ResizeObserver + cached tab widths for flicker-free recalculation. Supports hover and click, handles all tab types (built-in, ext-, link- NC-relative, link-* external). Active-tab highlighting in overflow dropdown.
• Decision unified search — decisions are now searchable via Nextcloud's unified search bar. New DecisionSearchProvider searches across question and selected_answer text, membership-filtered. Results show decision question as title, status/impact/team name as subline, with deep link to the team view.

Changed

• Proposal filenames (GitHub Issue #37) — proposal documents in .proposals/{id}/ now use a sanitized slug of the decision question (e.g. Should-we-migrate-to-PostgreSQL.md) instead of {id}.md. Slugs are truncated to 80 chars, with ID fallback for empty questions. Old .md files are cleaned up on regen. Legacy flat layout ({id}.md at .proposals/ root) unchanged.

Fixed

• PostgreSQL migration error — fresh installs on PostgreSQL failed with SQLSTATE[42703]: Undefined column: 7 ERROR: column "level" when creating a decision. Root cause: ALTER migrations added columns (level, decisions_level_enabled, decisions_action_min_level, team_id, icon, description) but the base createTable migrations weren't updated to include them. Fixed by updating Version000364000Date20260602000000.php and Version000367000Date20260603000000.php per SKILLS.md §2.17 migration discipline.

Security & privacy

No new authorisation gaps. DecisionSearchProvider enforces team membership via MemberService::getMemberLevelFromDb() per result — same enforcement pattern as MessageSearchProvider. Search uses prepared statements via QueryBuilder. proposalFilename() sanitizes input with regex before filesystem use.

Added

• Timeline Milestones — team admins can define named, optionally-dated markers from Manage Team → Integration settings → Timeline. Dated milestones render on the Timeline as a full-height red line with their label, always plotted (not a filterable source — admins who set a milestone want it visible unconditionally). Undated milestones are listed in the management UI but not plotted (no x-position to plot them at).
• New table teamhub_milestones (id, team_id, label, milestone_date nullable, created_by, created_at).
• Full CRUD: lib/Db/Milestone.php, lib/Db/MilestoneMapper.php, lib/Service/MilestoneService.php — all operations admin-gated via MemberService::requireAdminLevel.
• Display ordering (dated-ascending, undated last) computed in PHP, not SQL — cross-database NULL-ordering consistency (MySQL and PostgreSQL default NULL ordering differs).
• Manage Team "Decisions" tab renamed to "Integration settings" — now always shown (previously hidden entirely when the Decisions module was off instance-wide). Contains a Decisions block (existing settings/categories, conditional on the module being enabled) followed by a Timeline block with full Milestone management.
• Timeline crowding count-badges (3M/6M views) — when a single section has 4+ chips on the same calendar day, they collapse into one count-badge per section instead of stacking that many lanes deep. Click jumps to the 1-Week view, snapped to the week containing that day, via a postMessage bridge from the iframe to TeamView.vue (the iframe has no navigation state of its own). Threshold purely density-driven, not tied to zoom level.
• Timeline 1-Week view: full per-item Gantt mode for every section — every distinct item (Deck card, decision, calendar event, message) gets its own row; connected lifecycle chips (created+due, proposed+decided) share a row with a connecting bar. Crowding badges are skipped entirely at this zoom level — the point of zooming in is to see everything.
• Three Timeline connector overlays, opt-in toggles in the filter menu, all on by default:
• Decision ↔ task links (v3.78.5) — arrow from a decision's outcome chip (decided/withdrawn) to each Deck card linked via "Link tasks." Anchors on the outcome, not the proposal, so the arrow reads causally: decision → resulting task.
• Deck card dependencies (v3.78.8) — NC 34 / Deck 1.18+ only. Detects the new deck_dependent_cards table via DbIntrospectionService; the toggle is entirely absent from the filter menu on older installs rather than shown disabled. Arrow runs prerequisite card → blocked card, inferred from Deck's own CardMapper::addDependency() semantics and the "Assign dependent cards" UI (not officially documented by Nextcloud — flagged in code as reversible if it turns out backwards in practice).
• Message ↔ decision links (v3.78.9) — arrow from a messageType='decision' stream post to the decision's "proposed" chip it announced. Uses the decision row's existing message_id — no new schema or query needed.
• Share button on decision detail panel — icon button next to the status pill copies a ?team=…&decision=… deep-link to the clipboard (TeamDecisionsView.vue), matching the existing meeting-invite link pattern.

Changed

• Timeline section order: Deck → Decisions → Messages → Calendar (top-to-bottom), was Deck → Calendar → Decisions → Messages. Filter menu item order updated to match.
• All Timeline sources, sub-filters, and connector overlays now default to enabled — maximizes visible relationships out of the box. Previously Deck/Decisions "created"/"proposed" sub-filters and all three connector overlays defaulted off.
• DecisionTaskService::extractDeckCardId changed from private to public static so TimelineService can resolve task_path → Deck card ID using the exact same logic as the decision-task link feature, rather than re-deriving the regex separately.

Fixed

• Activity widget showing literal " instead of a quote mark (ActivityWidget.vue, ActivityFeedView.vue) — @nextcloud/l10n's t() HTML-escapes named placeholder values by default (safe for v-html insertion), but formatSubject()'s output is always rendered via plain {{ }} text interpolation, which Vue already escapes safely on its own. Double-escaping left raw entities visible. Fixed by wrapping every dynamic placeholder value (user, card, board, file, detail) with { value, escape: false } in both files — the same workaround pattern already used elsewhere in this codebase for meeting-invite links.

Security & privacy

No new authorisation gaps. Every new endpoint (getMilestones/createMilestone/updateMilestone/deleteMilestone) is gated through MilestoneService's requireAdminLevel checks at the service layer, consistent with the controller-thin/service-fat pattern. The card-dependency and decision-task bulk lookups are scoped to card/decision IDs already derived from the requesting team's own resources — not user-suppliable IDs — so neither introduces a cross-team data exposure path. No raw SQL introduced; all new queries go through OCP\DB\QueryBuilder with parameterized binds.

Translations

20 new strings (Milestones UI, Timeline filter-menu connector labels, decision share button) translated into all 5 locales (en/nl/de/fr/da); .js locale files regenerated to match. See HANDOFF.md for a separately-discovered, pre-existing 60-key discrepancy between en.json and the other four locales (unrelated to this session's strings) flagged for a future dedicated translation-sync session.

Added

• Link Decision (Session C) — bidirectional decision ↔ decision linking with full UI in the detail panel.
• New table teamhub_dec_links (17 chars ✓): one row per link with canonical ordering (decision_id_a < decision_id_b), unique index on the pair, indexes on team + both sides.
• DecisionLink entity, DecisionLinkMapper (with findByDecisionId OR-query covering both sides), DecisionLinkService enforcing membership for read and decisions_action_min_level for create/delete.
• 3 new endpoints: GET/POST/DELETE /api/v1/teams/{teamId}/decisions/{decisionId}/links[/{linkId}].
• Detail-panel UI: linked-decisions section with peer title + level pill + status pill, click-to-jump navigation, gated "Link decision" button, search-as-you-type decision picker modal (reuses /decisions?q= endpoint with 250ms debounce, excludes self + already-linked peers).
• Migration Version000373010Date20260609080000.
• Audit events for task + decision link/unlink — 4 new transitions in DecisionAuditService::TRANSITIONS: task_linked, task_unlinked, decision_linked, decision_unlinked. Decision link/unlink events written to both decisions' audit trails.
• Shared widget design tokens (src/styles/widget-tokens.css) — single source of truth loaded once from main.js. Defines hard-contrast brand palette (--th-color-{success,warning,error,neutral} + soft variants), typography scale (title 14/600, row primary 14/500, row meta 12/400, pill 10/700), spacing tokens (row padding 10px 14px, gap 12px), and shared utility classes: .th-widget__panel, .th-widget__title, .th-widget__rows, .th-widget__row (+ --clickable), .th-widget__row-icon, .th-widget__row-title, .th-widget__row-meta, .th-widget__state (+ --empty, --error), .th-widget__spinner, .th-widget__pill (+ --primary/--success/--warning/--error/--neutral, plus --outline variant).
• peer_level field in decision-link list/create responses.

Changed

• All 13 widgets refactored to consume the shared tokens — DecisionsWidget, DecisionsList, ActivityWidget, CalendarWidget, DeckWidget, FilesWidget, FilesFavoritesWidget, FilesRecentWidget, FilesSharedWidget, IntegrationWidget, IntravoxWidget, MembersWidget, MemberRow, MemberPresenceRow, ExternalWidgetItem. Loading/empty/error states unified to compact .th-widget__state rows with shared spinner. Hardcoded font-sizes replaced with tokens (kept only for genuinely widget-specific elements: calendar date badge, tab counter, action button). Soft NC colour vars (--color-success, --color-warning, --color-error and their text variants) replaced with hard-contrast --th-color-* tokens app-wide.
• DecisionsList row simplified — impact and level pills removed from the meta line, category now rendered as plain text with small uppercase CATEGORY label prefix. Primary line uses size-driven hierarchy (14px medium) instead of bold.
• Activity subject uses regular weight (400) — sentences read better unbolded; the rest of the app keeps medium weight on primary lines.
• Detail-panel "Linked tasks", "Linked decisions", and "Source files" unified under one .th-dv__link-* row pattern — same border, hover, focus ring, spacing across all three. Solid-filled pills (no transparency / soft tints).
• --th-color-warning darkened to #a05a00 for WCAG-AA 4.5:1 contrast against white pill text (was #c97a00, 3.34:1).
• Removed dead deny-modal CSS (~70 lines) from DecisionsWidget — replaced by DecisionApprovalModal in Session B.
• Link task button now uses LinkVariantIcon (matching Link decision) instead of PlusIcon.

Fixed

• Focus indicators on .th-dv__link-row, .th-dv__link-remove, .th-dv__dec-picker-item-btn, and .th-widget__row--clickable — removed redundant outline: none that was followed by a re-set rule, then ensured each :focus-visible has a 2px primary-coloured outline visible (WCAG SC 2.4.7).
• aria-live="polite" added to the linked-decisions list and decision-picker results so screen reader users hear async updates.

Security

• New decision-link endpoints follow the membership + min-level pattern. listDecisionLinks requires team membership; createDecisionLink and deleteDecisionLink require decisions_action_min_level. Peer decisions must belong to the same team — cross-team linking rejected at the service boundary. All queries use OCP\DB\QueryBuilder with explicit PARAM_INT/PARAM_STR typing.

Added

• Message image cache. When a user inserts an image from their personal files, the new POST /api/v1/teams/{teamId}/messages/cache-image endpoint copies the file into .teamhub-cache/ inside the team folder. The cached copy is accessible to all team members via /core/preview (team folder is circle-shared). Survives if the posting user leaves the team.
• Clear image cache. New DELETE /api/v1/teams/{teamId}/messages/image-cache endpoint (admin level). Exposed as a button in Manage Team → Messages tab with a count of files removed.
• Attendees in AddEventModal. Team members can now be selected as attendees directly from the add-event modal. Server sends iTIP invitations identically to the meeting wizard. Self is excluded from the picker.
• RoomVox room picker in AddEventModal. When RoomVox is installed and configured, the location field becomes a room picker; free-text fallback when no rooms are available.
• Category field in AddEventModal. Comma-separated category tags, passed through to the calendar event.
• Talk meeting toggle in AddEventModal.

Changed

• AddEventModal consolidates ScheduleMeetingModal. Both modals used the same backend endpoint with minor field differences. Single modal now covers all simple event creation. ScheduleMeetingModal.vue is unused and can be removed.
• @schedule-meeting event in TeamView now routes to showAddEvent (same consolidated modal).
• Schedule Meeting action removed from the upcoming events calendar widget (desktop and tablet layouts).

Fixed

• Images inserted from personal files were invisible to other team members. /core/preview?fileId=... enforces per-user ACL — other members got 404. Fixed by caching the file in the circle-shared team folder and using that copy's fileId.
• Uploaded/attached images were invisible to other team members. Circle share was created correctly but the URL still used /core/preview. Fixed by using /apps/files_sharing/publicpreview?token=... (share-token-based, no per-user ACL check).
• Pluralisation of "files removed" in cache clear confirmation now uses n() instead of a conditional string.

Fixed

• Admin settings: clicked tab no longer shows white-on-white. The active tab matched both the active-state override and the inactive-focus rule at equal CSS specificity; being later in source order, the inactive rule's white background won while the active rule's !important white text stayed — rendering an empty white box until focus moved elsewhere. The inactive-focus rule now excludes the active tab via :not(.teamhub-admin-tab--active).
• Admin settings → Maintenance: team "Created" date no longer shows "Invalid Date". Two methods named formatDate existed in AdminSettings.vue; the second (expecting a Unix timestamp) silently overrode the first (for datetime strings), so the teams table's datetime-string creation value was multiplied as a number → NaN → "Invalid Date". Split into formatDate (datetime string, hardened to also accept ISO and numeric input) and formatUnixDate (Unix timestamp, used by the archive table).

Fixed

• Presence module admin tab still visible when module is disabled — tabs() computed in AdminSettings.vue now conditionally includes the Presence module tab only when form.presenceModuleEnabled is true. When the toggle is turned off, the tab is removed immediately and the active tab switches to Integrations if needed.
• Team Info warning strip height and chevron — replaced "Open settings →" text with a ChevronRightIcon icon (consistent with DeckWidget unassigned-card nudge). Updated CSS to use line-height: 1.3 and icon-only button layout so the strip height matches the DeckWidget row exactly.

Added

• docs/USER_GUIDE.md — comprehensive user guide covering: team navigation, tab bar, presence tab (team view), My Presence personal settings (weekly template + date overrides + calendar integration), team admin actions (members, settings, presence toggles, links, danger tab), and FAQ.

Changed

• README.md — updated to include Presence module, Members widget presence dots, and updated admin settings section.
• INSTALL.md — rewritten as a full NC Admin guide: installation, all admin settings tabs (including Presence module on/off, status types, locations, holidays), optional integrations table, background jobs table.
• src/components/AdminSettings.vue — tabs() gates presence tab on presenceModuleEnabled; toggle redirects away from presence tab when disabled.
• src/components/TeamWidgetGrid.vue — warning button uses ChevronRightIcon; CSS tightened to match DeckWidget strip height.

Added

• Unassigned card nudge in Upcoming Tasks widget. Each connected Deck board now shows an amber row at the top of the widget listing the count of cards that have no assignee and are not yet overdue (no due date counts as not overdue). Clicking the row opens that board in the embedded Deck iframe — same behaviour as clicking the Deck tab. With multiple boards each board gets its own row, sorted by count descending.
• Team-as-member support. One team can now be added as a sub-member of another team. A per-team toggle ("Prevent this team from being a member of another team") appears in Manage Team → Settings, using the same CFG_ROOT (8192) bit that Nextcloud Contacts uses — the two UIs are now in sync. Admins must enable the "Teams" invite type in Admin Settings → Invite Types before the invite picker shows teams. Teams with the prevention toggle checked are excluded from invite search results. The admin integrity check flags only the contradictory state (team is nested but also has prevention active).
• Deck board activity in team activity widget. Deck board and card events now appear in the team activity feed. Includes board name and card title extracted from Nextcloud's own subjectparams JSON, producing descriptions like "Justin created card 'Fix login bug' — Sprint board".

Fixed

• Critical: Deck activity was completely missing. ActivityService was checking $resources['deck']['board_id'] but deck became an array of board objects in 3.28.0, so this check silently failed for all installs. No Deck activity appeared in the widget regardless of how many boards were connected.
• Critical: updateTeamConfig() used wrong bit mask. TeamService::updateTeamConfig() still had $MANAGED_BITS = 1|2|4|16|512 (pre-3.39.1 wrong values) as a local variable, overriding the canonical constant. Every toggle other than "Anyone can join" (CFG_OPEN=16 was in both old and new masks by coincidence) was silently discarded on save. Now uses CirclesConfig::MANAGED_BITS.
• Critical: ManageTeamView config constants were the old pre-3.39.1 wrong values. Identical to the 3.39.1 bit-encoding bug: ManageTeamView.vue had its own local const CFG_OPEN = 1 block instead of importing from circlesConfig.js. Enabling "Anyone can join" was writing CFG_SINGLE (1) again, hiding the team from Contacts. Fixed by replacing the local constants with a proper import.
• searchUsers() circle search used iLike() which does not exist on NC's QueryBuilder. The exception was caught silently, returning zero results for the circle type every time.
• Deck board picker always opened the first board. Moving selectedDeckBoard to Vuex introduced a Vue 2 data/computed shadowing bug — the local data() property with value null won the name collision against the mapState computed getter, so deckUrl always fell back to resources.deck[0]. Fixed by removing the dead data declaration.
• Integrity check falsely flagged all team-as-member relationships. The check now only flags nesting as an issue when the sub-team has CFG_ROOT set (prevention active) but is nested anyway — a genuinely contradictory state. Valid nesting (CFG_ROOT not set) is silently skipped.
• PHP parse error in MemberService (3.40.1–3.40.3). The str_replace tool double-escaped backslashes when embedding PHP namespace separators, producing \\OCP\\DB\\... instead of \OCP\DB\.... Caused 500 on every MemberService-dependent endpoint.

Changed

• "Prevent teams from being a member of another team" toggle now uses CFG_ROOT (8192) — the same bit Nextcloud Contacts uses — instead of CFG_CIRCLE_INVITE (16384). The two UIs now write the same bit with the same meaning and stay in sync.
• fetchDeckTasks card-ID lookup changed from one OR clause per card to a single IN (board_ids) query + one IN (card_ids) clause in the main activity query. Scales better with many boards and large boards.
• Activity formatSubject for Deck events now includes board name and card title when available (e.g. "Justin created card 'Fix login bug' — Sprint board").

Fixed

Circles config bit encoding (was 3.39.1)

• Critical: Circles config bit encoding. Every TeamHub release prior to 3.39.1 wrote the wrong Circles config bits when users toggled checkboxes in the Manage Team settings panel. Each TeamHub label was mapped to a bit that meant something completely different in Circles' real encoding. Consequences observed in production:
• "Anyone can join" wrote bit 1 (real CFG_SINGLE) → Circles tagged the team as a personal identity circle → Contacts hid it.
• "Visible to everyone" wrote bit 512 (real CFG_NO_OWNER) → Contacts refused config edits.
• "Enforce password protection" wrote bit 16 (real CFG_OPEN) → team became open-join.
• The always-on "Prevent sub-team membership" hint wrote bit 1024 (real CFG_HIDDEN) → team disappeared from listings.
• Settings made via Contacts and TeamHub no longer round-tripped — each side read a different field of meaning from the same column.

This release corrects the bit encoding in both PHP and Vue, introduces canonical constants in lib/Constants/CirclesConfig.php (mirrored in src/constants/circlesConfig.js) so the drift cannot recur, and ships a one-shot migration (Version000339001) that decodes admin intent from the old (wrong) encoding and re-encodes with correct Circles bit values. Admin sees the same checkbox states before and after — only the underlying storage changes.

• resolveUserSingleId() DB-join fallback was checking config & 2048 (which is CFG_BACKEND) thinking it was CFG_SINGLE. Now correctly uses config & 1.
• browseAllTeams() CFG_VISIBLE filter was filtering on bit 512 (CFG_NO_OWNER) instead of bit 8 (real CFG_VISIBLE).
• isOpen checks in browseAllTeams() and MemberService::requestJoinTeam() read bit 1 (CFG_SINGLE) instead of bit 16 (real CFG_OPEN).
• Manage team → Settings tab now always reloads from the database when activated. Previously the checkboxes showed cached state and external changes (e.g. via Contacts) were not reflected until page refresh.

Unread message counter (was 3.39.2)

• Unread message counter restored in sidebar. The NcCounterBubble badge next to team names was effectively dead: no polling caused team.unread to go stale immediately after page load, the counter was hardcoded to display "1" regardless of count, and team.unread was a boolean not a count. Fixed: backend returns a real per-team count, the badge displays the actual number, a 60-second background poll keeps badges current, and posting a message triggers an immediate refresh. Excludes own messages from the count.

Group invitations (was 3.39.6 → 3.39.14)

• Inviting a group to a team now works correctly. Circles' addMember() was creating an Invited row with level=0 for non-user types (groups, circles), and Circles has no working notification path for group invitations — so groups stayed in permanent limbo and TeamHub's filters silently hid them. Fixed by auto-confirming group/circle membership immediately after addMember() succeeds (UPDATE to status='Member', level=1) and triggering a Circles membership cache rebuild so users in the group get immediate access to team resources.
• @mention now works for indirect members (users added via a group). Multiple cascading bugs fixed:
• getAllEffectiveMembers now correctly reads from circles_membership (Circles' denormalized cache) which contains every reachable user including those via groups, instead of attempting unreliable IGroupManager lookups by GID labels.
• Frontend store correctly unwraps the {members: [...]} response shape (was treating it as a bare array and discarding the data).
• Mention autocomplete supplements OCS results with team members that NC's user-enumeration privacy settings would normally hide.
• Manage team → invite flow refreshes allEffectiveMembers in the store after adding a group so mentions work immediately.

Added

• lib/Constants/CirclesConfig.php — single source of truth for Circles bit values, plus MANAGED_BITS, SYSTEM_BITS_FORBIDDEN_ON_USER_TEAMS, and the migrateLegacyConfig() decoder.
• src/constants/circlesConfig.js — JS mirror of the same constants, imported by ManageTeamView.vue, CreateTeamView.vue, and TeamWidgetGrid.vue.
• Reset config action (icon button) in admin settings → maintenance → per-team row. Clears all user-managed and forbidden-system bits to clean defaults. Confirmation dialog before applying.
• Config bitmask integrity check in admin settings → maintenance. Scans every user-created team for forbidden system bits (CFG_SINGLE, CFG_SYSTEM, CFG_NO_OWNER, CFG_HIDDEN, CFG_BACKEND, CFG_APP). Per-team Repair button calls resetTeamConfig().
• Three new API endpoints:
• POST /api/v1/admin/maintenance/reset-team-config/{teamId} — clears user-managed and forbidden-system bits, returns { oldConfig, newConfig }. Logs to teamhub_audit_log.
• GET /api/v1/admin/maintenance/config-check — returns array of teams with corrupted bits.
• New Vuex state allEffectiveMembers + fetchAllEffectiveMembers action + UPDATE_UNREAD_COUNTS mutation + refreshUnreadCounts action.

Changed

• repairMembershipCache() now strips every bit in SYSTEM_BITS_FORBIDDEN_ON_USER_TEAMS before rebuilding the cache.
• updateTeamConfig() MANAGED_BITS mask updated to the correct Circles bit values (8 | 16 | 32 | 64 | 256 = 376).
• TeamWidgetGrid.vue::teamLabels — labels now read from real Circles bits. The misleading "No nested teams" label removed.
• CreateTeamView.vue — the "Prevent sub-team membership" checkbox removed entirely. It controlled nothing real and wrote CFG_HIDDEN.
• Audit log event types: new team.config_reset, team.config_migrated_3_39_1, team.config_migrated_3_40_0.

Migration

• Version000339001Date20260518000000 — one-shot data migration. For every source=16 team where any legacy-damage bit (1, 4, 512, 1024) is set, decodes admin intent from the old encoding and re-encodes with real Circles bits. Skips teams that have no legacy-damage bits. Logs every change to nextcloud.log and writes an audit log entry per team. Bursts Circles' APCu cache when done.

Added

• Integrity check: nested team detection. Flags any circles_member row where a user-created team (source=16) is a member of another. Repair removes the offending row.
• Integrity check: CFG_SINGLE corruption detection. Flags source=16 circles with bit 1024 set (causes Circles to hide the team from its own API). Excludes legitimate personal/system circles. Repair: clears the bit.
• Integrity check: duplicate member detection. Flags circles where the same user_id appears more than once as a direct member. Repair: keeps highest-level row, deletes rest.
• Integrity check: no-owner detection. Flags source=16 teams with no level=9 member row. Repair: promotes highest-level existing member, or inserts calling NC admin if team is empty.
• Integrity check: wrong display_name detection. Flags circles where display_name ≠ sanitized_name — this causes Circles to misclassify user-created teams as personal circles. Repair: sets display_name = sanitized_name.
• Link permissions. New linkMinLevel setting per team (member/moderator/admin, default admin). The + button in the tab bar is hidden for users below the required level. Configurable in Manage team → Permissions.
• getTeamMemberUids() in MessageService. Direct DB member lookup for notifications — replaces Circles API getCircle() call in the message write path. Eliminates "Circle not found" 500 errors when posting to teams with config issues.

Changed

• Manage team tab renamed: Messages → Permissions. Pin level, post level, and new link level settings consolidated here.
• updateTeamConfig() no longer calls getCircle() for cache flush. The Circles API was triggering internal sync that re-applied CFG_SINGLE (1024) after every config write. Only APCu cache is flushed now.
• CFG_SINGLE (1024) removed from MANAGED_BITS. This bit marks personal circles and must not be written to user-created teams. Frontend no longer sends it; backend no longer includes it in the write mask.
• repairMembershipCache() auto-clears CFG_SINGLE before rebuilding the membership cache.
• searchUsers() no longer returns teams/circles in invite search results. Inviting a team into another team corrupts Circles' visibility queries.
• Orphaned teams query no longer requires app:circles: name prefix — compatible with NC33 which stores plain team names.
• getAllTeams() deduplicates by unique_id — prevents duplicate rows when a circle has multiple level=9 member rows.
• Ghost cleanup moved from its own tab into the Maintenance tab.

Fixed

• PostgreSQL: backtick quoting in resolveUserSingleId() (c.\config`→c.config`) caused syntax errors on PostgreSQL, breaking indirect member detection.
• SQL HAVING clause for duplicate member detection used aliased COUNT() which MySQL rejects. Replaced with createFunction('COUNT(cm.id)').
• InviteMemberModal no longer shows teams in search results (AccountMultiple icon removed, circle type branch removed).
• ArchiveTeamModal displays resolved folder name instead of raw /f/{id} link.
• Announcement banner (mohamedsakhri/nextcloud-announcementbanner) suppressed in iframes via .announcementbanner-stack CSS selector.
• share_folder config.php respected when creating team folders (AIO and similar installations).

Added

• Ghost member cleanup. New "Ghost cleanup" tab in Admin settings. Scans all team memberships for users whose NC account has been deleted, grouped by uid. Admin can remove a ghost from a single team or from all teams at once. Includes a live-account safety guard. Endpoint: GET /api/v1/admin/maintenance/ghost-members, DELETE /api/v1/admin/maintenance/ghost-members/{userId}.
• share_folder config.php support. When an NC instance sets 'share_folder' => '/Shared' (or any path) in config.php (common in AIO installations), TeamHub creates the shared team folder inside that path. Falls back to the user root when the path is absent, missing, or not a folder.
• Invite button in Manage team → Members tab. Team admins and owners now have an "Invite members" button directly on the Members tab, opening the existing InviteMemberModal. Member list refreshes after invite completes.
• Archive location name resolution. The archive/delete confirmation modal now shows the human-readable folder name (e.g. "TeamHub Archives") instead of the raw /f/150770 file ID link. Resolved server-side in ArchiveService::getAdminSettings().
• Announcement banner suppression in iframe. The CSS injected into embedded iframes now hides banners rendered by the announcementbanner app (mohamedsakhri/nextcloud-announcementbanner). The banner remains visible on the parent TeamHub page.

Added

• Message @mentions. PostMessageForm and MessageCard edit mode use NcRichContenteditable with the NC core OCS autocomplete API (/ocs/v2.php/core/autocomplete/get), scoped to team members. Mentions render as styled highlight pills in the message body. Backend sends a message_mention NC notification to each mentioned team member (on create and edit).
• Message pagination. 5 messages per page with prev/next controls in the message stream. Page resets to 1 on team switch and after posting. MessageMapper::countByTeamId() added. listMessages now returns total, page, and limit alongside messages.
• Per-team message settings. New Messages tab in Manage team for team admins. Configures minimum role to pin messages and minimum role to post messages, stored as per-team IConfig keys. Post Message button hidden (not just disabled) when the user lacks the post role.
• Calendar view dropdown. Embed bar now has a native select for Month / Week / Day / List variants; selecting reloads the iframe with the chosen view in the URL.
• Calendar embed auto-reload. After adding or deleting events, the calendar iframe reloads automatically so changes appear immediately.
• NC-relative team links. Custom team links now accept apps/... or /apps/... paths (e.g. apps/collectives/s5) and open in an iframe tab, just like built-in app tabs. External https:// links continue to open in a new browser tab.
• VitePress documentation site in docs/. Covers Nextcloud admins, Team management, Developers, and Users — 20 pages total.
• New migration Version000336200 — remediates auto-generated primary key name on oc_teamhub_team_app_resources for existing PostgreSQL installs.
• message_mention notifier subject in Notifier.php.
• getMessageSettings / saveMessageSettings endpoints (GET/POST /api/v1/teams/{teamId}/messages/settings).
• getCalendarEventsForWeek endpoint (GET /api/v1/teams/{teamId}/calendar/events/week).
• deleteCalendarEvents endpoint (DELETE /api/v1/teams/{teamId}/calendar/events).

Changed

• Calendar iframe URL now uses the public share token path /apps/calendar/p/{token}/{view}/now (team-calendar-only, no personal calendars). Falls back to full app when no token available.
• Calendar connect error handling in ManageTeamView no longer logs the full HTML 500 response body to the console.
• getPinMinLevel reads per-team IConfig key first, falls back to global key. Admin settings Messages tab removed (settings are now entirely per-team).
• activeFilesIsGf / activeFilesIsShared in ManageTeamView use .some() across all active files rows so the GF connect buttons correctly hide when a GF is active even if a shared folder row appears first.
• dav_shares access filter in getRealCalendarIds broadened from IN (1,2) to IN (1,2,3) for compatibility with NC Calendar 5.x circle shares.
• resumeCalendarAccess corrected from access=1 (read-only) to access=2 (read-write).
• Select dropdowns in AppEmbed bar and Manage team Messages tab have no background color (theme-transparent).

Fixed

• MariaDB migration failure on NC 32.0.9: Version000328200 now uses explicit 'th_tar_pk' for setPrimaryKey() — auto-generated name was 31 chars, one over the 30-char DBAL limit.
• Calendar connectExistingCalendar TypeError — ResourceService was passing $resourceId as string to a method expecting int; cast to (int) at the call site.
• GF connect buttons visible when GF already active — activeFilesIsGf now uses .some() instead of .find() so ordering of rows doesn't affect the result.

Added

• Strict 1:1 enforcement for files resources. ResourceDiscoveryService::reconcileApp now snapshots the team's active files state and routes newly discovered rows accordingly: active shared + incoming GF → pending (with isDualFolderPending flag); active GF + anything → ignored (GF precedence); active shared + another shared → ignored. acceptResource and unignoreResource apply the same guard. All refusals write resource.suppressed_duplicate audit entries with reason codes.
• Group folder takes precedence in getTeamResources. When both shared and GF rows are active (dual state during manual migration), the loop explicitly picks the gf: row so widgets and the team home always read from the group folder.
• Dual-folder informational notice in Manage Team → Settings → Team Apps. When a GF is discovered alongside an active shared folder, a blue panel explains the situation and directs the admin to connect the group folder via the existing buttons and migrate files manually.
• Resource-type badge ("Group folder" / "Shared folder") on each active files row in the settings panel.
• Picker filtering by active files type. GET /api/v1/pickers/files now accepts activeFilesType=shared|gf|none. Shared folders are suppressed when one is already active; both types hidden when a GF is active.
• isDualFolderPending flag on panel data rows.
• normalPendingResources, dualFolderPendingRow, dualFolderSharedRow, activeFilesRow, activeFilesIsShared, activeFilesIsGf computed properties in ManageTeamView.vue.
• Create New button for Talk — shown in empty state alongside Connect existing.
• Create New group folder button for Files — shown only when Group Folders is installed; switches label to "+ Create new group folder" when a shared folder is active (signals the workflow).
• Both 1:1 buttons hidden once a resource is connected, except when a shared folder is active and Group Folders is available — then the GF buttons remain so admin can attach a GF for manual migration.

Changed

• ResourceService::upsertResourceRow() — now promotes pending/ignored rows to active on explicit connect instead of skipping. Fixes silent failure when the discovery reconciler had already inserted the resource as pending.
• ResourceService::getTeamResources() — files block prefers gf: row when multiple active rows exist.
• ResourceDiscoveryService::getSettingsPanelData() — adds dual-folder detection and tagging.
• ResourceDiscoveryService::resolveFileName() — falls back to basename(path) when filecache.name is empty (some storage backends).
• FilesService::listConnectableFileFolders() — accepts activeFilesType parameter, filters output accordingly. Also falls back to basename(path) for shared folder names.
• ResourceStateController::getPanelData() — now triggers reconcileTeam before returning panel data, so externally added GF resources appear immediately.
• ManageTeamView::connectExisting() — empty catch block replaced with showError().

Fixed

• Critical pre-existing bug in ArchiveService.php: stray extra } (line ~2770) caused ParseError: unexpected token "try" on every admin archive request. Removed. Archive settings save works again.
• AdminSettings.vue archive form: archiveBeforeDelete was missing from the data() default and from loadArchiveSettings — the toggle had no reactive backing. Both fixed.

Removed

• The auto-migration system (FolderMigrationService, FolderMigrationController, FolderMigrationModal.vue, two endpoints) was scoped, built, and removed per user direction. NcDialog wiring proved unreliable; manual file migration is the supported path. The dual-folder notice remains as an informational signal only.

Security

• All new endpoints check team admin level (≥8) before any action.
• No raw SQL anywhere; no \OC::$server; constructor DI throughout.

Added

• Connect existing app resources to a team. Team owners can now choose, per app, to connect a Calendar / Files folder / Deck board / Talk room they already own instead of creating a new one. Available in the Create-team wizard step 4 and in Manage Team → Settings → Apps.
• Resource pickers (GET /api/v1/pickers/{calendar|deck|talk}) listing the current user's owned resources, scoped to the caller's UID.
• Connect endpoint POST /api/v1/teams/{teamId}/resources/{app}/connect (team-admin required) that inserts the share/ACL row granting the team's circle access to the selected resource.
• ResourcePicker.vue — unified picker component used by both the wizard and the manage-team dialog. Files mode opens NC's standard getFilePickerBuilder dialog; the other three apps render a populated <select> populated from the picker endpoint.
• Connected-resource warning under "Delete team" in Manage Team → Maintenance, explaining that connected resources are deleted with the team and how to preserve them.
• Archive-before-delete admin toggle. New checkbox in Archive Policy controls whether team deletion produces an archive ZIP first or skips archiving entirely. Default OFF for new and existing installs. Same three deletion modes (hard / soft30 / soft60) apply to both archive-on and archive-off paths.
• POST /api/v1/teams/{teamId}/soft-delete endpoint for soft-delete without archive — creates a pending-deletion row and suspends connected app resources but skips archive production.
• Owner-side delete dialog when archive-before-delete is OFF, with description and confirmation text adapted to the chosen deletion mode (immediate hard delete vs 30/60 day grace period without archive).

Changed

• The Delete-team button in Manage Team → Maintenance now branches based on admin policy: archive ON opens the existing archive modal; archive OFF opens a plain NcDialog confirmation.
• Description text for the Delete-team row dynamically reflects the active archive policy and deletion mode.

Fixed

• PostgreSQL SQLSTATE[22P02]: invalid input syntax for type smallint: "f" on team creation. The enabled (in teamhub_team_apps) and is_builtin (in teamhub_integ_registry) columns are SMALLINT (per the v3.9.0 cross-database fix), but their bind parameters were still using IQueryBuilder::PARAM_BOOL. PostgreSQL refuses the boolean-to-smallint coercion at the wire-protocol level; MySQL accepted it silently. Fixed by casting to int and binding as PARAM_INT in TeamAppMapper::upsert() and IntegrationRegistryMapper::register().

Security

• Every connect endpoint re-verifies that the user owns the specified resource (WHERE owner = currentUid or IRootFolder::getById() for Files), preventing forged-resourceId attacks across the four supported apps.
• Each app refuses to connect a second resource if one is already linked to the team (one-resource-per-team invariant).
• Picker endpoints scope listing to the caller's UID — never accept a UID from request parameters.

Added

• Mobile single-canvas layout for viewports ≤ 768px and tablet portrait (≤ 1024px portrait). New MobileWidgetView.vue: scrollable canvas, collapsible icon bar at bottom with one icon per accessible widget, FAB action button.
• FAB widget actions — in-canvas action button rows removed; actions surfaced via FAB: single action fires directly, multiple actions open a slide-up sheet.
• Tablet landscape layout for viewports ≤ 1200px landscape: 60/40 split with message stream left and collapsible widget column right. Widget cards have spacing and rounded borders.
• NC sidebar auto-close on mobile/tablet-portrait — uses NcAppNavigation :open.sync prop to close reactively after selecting a team or action, instead of fragile DOM manipulation.

Changed

• Embedded app iframe content height set to 100% (previously 90%).
• Edit layout button hidden on both mobile and tablet layouts (editing not available in these modes).
• Seven modals (ManageLinksModal, AddEventModal, AddTaskModal, AddPersonalTaskModal, InviteMemberModal, ScheduleMeetingModal, TeamMeetingModal) now set min-width: 0 on viewports ≤ 768px to prevent horizontal overflow on phones.
• MessageStream accepts hide-header prop and exposes openPostForm() method for FAB integration.

Added

• DELETE /api/v1/comments/{commentId} — hard-delete a comment. Author may always delete their own; team admins (Circles level ≥ 8) may delete any comment. Audit event comment.deleted written with metadata { message_id, author_id, deleted_by_admin, cleared_solved }.
• Solved-question revert on answer deletion. If the deleted comment is the marked answer to a question, the parent message is automatically reverted to unsolved (question_solved=0, solved_comment_id=NULL). The confirmation dialog warns the user before proceeding.
• Delete button on comments. Visible to the comment author and team admins. Confirmation dialog; disabled/spinner during async delete. Error messages are HTTP-status-aware (403, 404, generic).
• currentUserIsTeamAdmin Vuex getter (level ≥ 8) — derived from current_user_level now returned by GET /api/v1/teams/{teamId}/members.
• Markdown formatting toolbar in PostMessageForm.vue (new messages) and CommentsSection.vue (comments): Bold, Italic, Inline code, Code block, Heading (H2), Bullet list, Link. @mousedown.prevent preserves contenteditable selection; execCommand('insertText') fires at cursor.
• Markdown toolbar on edit message. Same seven buttons in MessageCard.vue edit mode. Uses native selectionStart/End + setSelectionRange (plain textarea — no execCommand needed).

Fixed

• XSS via v-html in message and comment bodies. Both renderMarkdown functions now pass output through DOMPurify.sanitize() with an explicit ALLOWED_TAGS/ALLOWED_ATTR allowlist before binding to v-html.
• Headings (## text) and bullet lists (- item) rendered as literal text. renderMarkdown was a flat .replace() chain ending with \n → <br>, so heading and list regexes (which need multiline anchors) never matched. Rewrote using a null-byte placeholder pattern: code blocks and inline code are stashed before block-level rules run; restored after <br> conversion. Applied to MessageCard.vue and CommentsSection.vue.
• Deck boards created with permission_edit = 0. Deck's AclMapper does not mark entity fields dirty when set via __call magic, so setPermissionEdit(true) was a no-op. Added enforceAclEditPermissions(): one independent QB UPDATE per column (permission_edit, permission_share, permission_manage), each try/caught so a missing column throws silently without blocking the others. Schema confirmed from live DB.
• All Deck boards and Calendars provisioned in the same blue colour. createTeamResources() now picks one random colour per team ($teamColour = self::randomTeamColour()) and passes the same value to both createCalendar() and createDeckBoard().
• Provisioned resources (Talk, Files, Calendar, Deck) not deleted when a team is deleted. deleteTeam() now fetches the team's app list from teamhub_team_apps before destroying the circle, then calls deleteTeamResource() for each app. Resources are deleted before circleService->destroy() so CalDAV/Talk can still resolve the circle principal. All apps are cleaned regardless of their enabled flag.

Changed

• GET /api/v1/teams/{teamId}/members response now includes current_user_level (integer) alongside is_direct_member.
• DELETE /teams/{teamId} now deletes all provisioned Nextcloud app resources before destroying the circle.
• ResourceService::TEAM_COLOUR_PALETTE — 12-colour curated palette for NC-friendly team colours.

Fixed

• Indirect members (added via NC group/sub-team) could not see built-in app tabs (Talk, Files, Calendar, Deck). ResourceService::getTeamResources() checked only for a direct circles_member row; indirect members have none, so the method threw and the controller returned all-null resources. Added isEffectiveTeamMember() helper in ResourceService that mirrors the two-step indirect-membership check (circles_member → circles_membership) used elsewhere, without introducing a circular dependency on MemberService.
• Member count in members widget was inflated when groups or sub-teams were present. getEffectiveMemberCount() used COUNT(*) FROM circles_membership, which includes group-proxy and sub-team-proxy circles as rows alongside individual users. Replaced with a query that inner-joins circles_member on user_type=1, level=9 to isolate personal user circles, and uses COUNT(DISTINCT user_id) to deduplicate users who appear via multiple membership paths.
• Pages widget hidden after team creation even when Intravox page was successfully created. create-resources did not write to teamhub_team_apps, so getTeamResources found no intravox row and returned resources.intravox = false.
• Manage team → Settings → Team apps showed all apps enabled after creation, regardless of wizard selections. Same missing write: ManageTeamView fell back to defaultEnabled = true for every app when no rows existed. The wizard now sends a complete appStates payload (all apps, enabled and disabled) with create-resources; the backend validates and persists these via updateTeamApps().

Added

• WCAG 2.2 accessibility audit and remediation (Sessions 1–3). Full codebase reviewed against all A and AA criteria. The following fixes were applied:

1.1.1 Non-text content

• AppEmbed.vue: <iframe> now carries :title="label" so screen readers identify embedded apps (Chat, Files, Calendar, Deck).
• MessageCard.vue: poll options now carry role="button", aria-pressed, aria-label, tabindex, and @keydown.enter/space handlers — keyboard and AT users can vote in polls.

1.3.1 Info and relationships

• TeamWidgetGrid.vue: all 11 widget title <span> elements replaced with <h2> (margin/padding reset added to prevent browser defaults from breaking layout). Screen reader users can now navigate widgets by heading.
• MessageCard.vue edit mode: bare <input> and <textarea> now have associated <label> elements linked by unique per-message id.

1.4.1 Use of color

• MessageCard.vue: voted poll option now shows a CheckCircleOutline icon alongside the background highlight — vote state is no longer conveyed by colour alone.

1.4.3 Contrast — hardcoded colours

• DeckWidget.vue: #0e7490 teal replaced with var(--color-info-text, var(--color-main-text)).
• FilesFavoritesWidget.vue: #f6c342 gold replaced with var(--color-warning, #f6c342).
• TeamWidgetGrid.vue: #1a1a1a on success/warning badges replaced with var(--color-success-text, #1a1a1a) and var(--color-warning-text, #1a1a1a).

2.1.1 / 2.4.7 Keyboard access and focus visible

• All 10 components with outline: none on :focus migrated to :focus-visible with 2px solid var(--color-primary-element) ring. Mouse/touch users are unaffected; keyboard users now see focus indicators.
• App.vue: duplicate :focus-visible blocks consolidated; outline: none removed.
• TeamTabBar.vue: role="tablist", role="tab", and aria-selected added to all tab buttons. Tab/Shift+Tab moves focus; Left/Right arrow reorders the focused tab and restores focus after re-render via $nextTick.
• TeamWidgetGrid.vue (edit mode): all 11 drag handles gain tabindex="0" and @keydown handlers for ↑ ↓ ← → to move widgets on the grid. moveWidget() swaps positions with the neighbour in sorted order (fixes vue-grid-layout vertical compaction cancelling y ± 1 nudges).

2.4.6 Headings and labels

• Same as 1.3.1 widget <h2> and edit input <label> changes above.

2.5.7 Dragging movements

• Tab bar: Left/Right arrow keys on focused tab provide a keyboard alternative to drag-to-reorder (WCAG requires a pointer/keyboard alternative).
• Widget grid: ↑ ↓ ← → on focused drag handle provide a keyboard alternative to grid drag-and-drop.

4.1.2 Name, role, value

• TeamTabBar.vue: role="tablist" + aria-label="Team navigation" on wrapper; role="tab" + aria-selected on each button tab; web link tabs correctly excluded from tab role.
• TeamWidgetGrid.vue: all 11 collapse/expand buttons now include the widget name in their aria-label (e.g. "Collapse Team Messages" instead of "Collapse").
• AppEmbed.vue: <iframe title> fix (see 1.1.1).

4.1.3 Status messages

• PostMessageForm.vue: attachment list wrapped in aria-live="polite" aria-atomic="false" — upload status changes (Uploading…, ✓, error) are now announced to screen readers. Checkmark symbol ✓ given :aria-label="Upload complete".

Security

• renderMarkdown (pre-existing): v-html binding in MessageCard.vue and CommentsSection.vue renders user content without HTML sanitization. Logged as open issue for a dedicated security session — fix requires DOMPurify.sanitize() before return.

Removed

• Debug console.log calls in TeamWidgetGrid.vue (moveWidget) and TeamTabBar.vue (moveTabLeft, moveTabRight).

Fixed

• Double margin-top gap below NC top bar. NC page frame and NcContent both applied margin-top: var(--header-height) to the same element. Added #content-vue.app-teamhub { margin-top: 0 } to zero the page-frame copy only.
• TypeError: e.n is not a function on team pages. translatePlural imported at module scope is invisible to Vue 2 templates — added n to methods: { t, n } in all five affected components; AdminSettings gets an inline n() method matching its existing t() pattern.

Changed

• All error messages use {error} named placeholder instead of string concatenation. Allows translators to reposition the error detail within the sentence (22 call sites across 10 components).
• All count-bearing strings converted to n() plural forms (14 strings across 5 components). Translators can now supply correct plural rules per language.

Added

• Transifex plumbing. .tx/config and .l10nignore added. Stale l10n/en.js / l10n/en.json removed. Ready for NC community bot once @nextcloud-bot is invited to the repo.
• TRANSLATORS: hints on ambiguous strings: Comment, Leave, Join (team vs. meeting), poll vote labels.
• Translation standards added to SKILLS.md — every string written in future sessions must be translation-ready immediately.

Removed

• Debug logging purged. 23 JS (console.log / console.error) and 15 PHP (error_log) calls removed across App.vue, FeedbackModal.vue, FilesSharedWidget.vue, TeamView.vue, FeedbackController.php, FeedbackService.php, TeamService.php, TelemetryService.php. The console.warn in TeamView.menuItemUrl() is intentionally kept as a security signal.

Fixed

• Calendar widget now reloads automatically after adding an event, scheduling a meeting, or creating a team meeting — all three modal close handlers now call refreshCalendar() via the widget grid ref.
• Meeting notes public share link now grants read+write access (was read-only), so attendees can edit the notes file directly from the shared link.
• @nextcloud/vue no longer logs "missing appName / appVersion" console errors — webpack.DefinePlugin now injects appName and appVersion as compile-time bare globals, which is what the library reads at module evaluation time.
• Members widget: removed redundant border-top from .teamhub-memberships-list; Show all button width set to 90%; left-side padding unified to 12px across avatar stack, membership rows, and show-all button.
• Removed redundant "Team Messages" heading from the message stream body (the accordion header already shows this label).
• Removed duplicate "Post First Message" button from the empty-state — the header-level "+ Post Message" button already handles this.
• All semantic color text uses (--color-error, --color-success, --color-warning) replaced with their high-contrast -text variants across 21 components, improving readability. Backgrounds and borders retain the base variables.

Added

• Group and team members are now fully recognised. When a Nextcloud group or another team is added to a team, its users count towards the team's member total and gain access to the team. The members widget shows direct users as avatars (up to 16, sorted by role then last activity), followed by a flat list of added groups and teams with a GROUP or TEAM pill and their user count. A "Show all N members" link opens a searchable modal listing every effective user, deduplicated.
• Manage Team → Members tab displays three buckets: Direct Members, Groups & Teams (with name and effective user count), and Pending Join Requests. Admins can remove whole groups or teams, which also clears their users' indirect access.
• Invite modal can now search for and add other user-created teams (circles) in addition to users, groups, email invites, and federated contacts.
• New GET /api/v1/teams/{teamId}/members/all endpoint — returns the flat deduplicated list of all effective users (direct plus expanded from groups and sub-teams) for the Show All modal. Requires member-level access.
• New GET /api/v1/teams/{teamId}/members/manage endpoint — structured response (direct, groups, circles, effective_count) for the Manage Team members tab. Requires admin-level access.
• BrowseTeamsView teams now return an isDirectMember flag so indirect members see a disabled Leave button with an explanatory tooltip rather than being allowed to "leave" a team they were never directly added to.
• leaveTeam now detects indirect membership and returns a 403 with an indirect_member sentinel so the UI can show the tooltip explanation.

Changed

• The GET /api/v1/teams/{teamId}/members response shape changed from a flat array to {members, memberships, effective_count, has_more, is_direct_member}. members is limited to the top 16 direct users (sorted by role then last login), memberships is the flat list of added groups and teams for the widget.
• Admin Settings → Maintenance team member count column now reflects effective membership (direct users plus users from added groups and sub-teams) instead of only the three top-level rows in circles_member.
• removeMember() now correctly handles groups (user_type=2) and teams (user_type=16) by using single_id as the delete key. It also calls MembershipService::onUpdate() after deletion so removed indirect users actually disappear from share pickers.
• Pending Join Requests in Manage Team has extra top padding to separate it from the membership summary.
• Group and Team icons/pills use the primary-element (blue) and warning (amber) tones respectively — the previous success-green was too low-contrast.

Fixed

• Integrity check in Admin Settings → Maintenance no longer flags teams as mismatched just because they have a group or sub-team as a member. It now flags only teams whose circles_membership cache is genuinely empty while direct members exist.
• getTeamMembers no longer fails on the u.last_login column (which does not exist on oc_users); last-login sorting now reads from oc_user_preferences / oc_preferences.
• browseAllTeams correctly detects membership via groups or sub-teams in addition to direct rows.

Security

• getTeamMembers now enforces requireMemberLevel — previously any authenticated user could enumerate any team's member list by guessing a circle ID.
• lastLogin timestamps (used internally for sort order) are stripped from the members response so they are never exposed to the client.

Added

• Shared Files widget — new dashboard widget showing files and folders that team members have shared directly with the team circle (e.g. from Nextcloud Notes or Files). Displays item name, type icon (including a dedicated note icon for .md files), sharer display name with avatar, and share date. Paginated at 10 items per page, sorted newest first.
• New GET /api/v1/teams/{teamId}/files/shared endpoint — returns paginated list of files/folders shared with the team circle, excluding the team folder itself. Accepts page and limit query parameters.
• New shared_files app toggle in the Team Apps section of Manage Team — defaults to off; team owners enable it explicitly. Independent of the Files (team folder) toggle.

Fixed

• Fixed team folder query in ResourceService incorrectly picking up individual file shares (e.g. Notes shares) as the team folder when no folder was configured — query now filters on item_type = 'folder'.
• Fixed shared_files toggle defaulting to on in Manage Team UI for teams that had no saved state yet — default is now off.

Added

• Upcoming Tasks widget now shows personal tasks alongside Deck tasks. When the NC Tasks app is installed and the team has a calendar, VTODO tasks from the team calendar are fetched server-side (Sabre/VObject, direct DB query on calendarobjects) and merged with Deck cards into a single sorted list. Each task row shows a source pill — blue "Deck" or teal "Personal task" — so users can distinguish at a glance. The two task types also use different badge icons.
• New GET /api/v1/teams/{teamId}/tasks endpoint — returns upcoming (≤14 days, non-completed) VTODO tasks from the team calendar.
• New POST /api/v1/teams/{teamId}/tasks endpoint — creates a VTODO in the team calendar via CalDavBackend (QB fallback if unavailable).
• New Create personal task action in the Upcoming Tasks widget header, which opens a modal (title, optional description, optional due date/time). Shown only when Tasks app is installed and team has a calendar.
• The existing Add task action renamed to Create Deck task to distinguish it from personal tasks. Shown only when team has a Deck board.
• resources payload from GET /teams/{teamId}/resources now includes a tasks: bool flag indicating whether the NC Tasks app is installed.
• New AddPersonalTaskModal.vue component.
• New lib/Service/TaskService.php service.
• New migration Version000310001 — ensures teamhub_integ_registry exists and drops the legacy teamhub_integration_registry table if it survived an NC uninstall. Fixes a scenario where NC's "delete all data" uninstall keeps migration history, causing the new-name table to never be created on reinstall.

Fixed

• Fixed oc_teamhub_integ_registry does not exist error on installs where NC's uninstall-with-delete-data flow preserved migration history, causing migration 000209000 to be skipped on reinstall while the old teamhub_integration_registry table survived.

Added

• Upcoming Tasks widget now shows personal tasks alongside Deck tasks. When the NC Tasks app is installed and the team has a calendar, VTODO tasks from the team calendar are fetched server-side (Sabre/VObject, direct DB query on calendarobjects) and merged with Deck cards into a single sorted list. Each task row shows a source pill — blue "Deck" or teal "Personal task" — so users can distinguish at a glance. The two task types also use different badge icons.
• New GET /api/v1/teams/{teamId}/tasks endpoint — returns upcoming (≤14 days, non-completed) VTODO tasks from the team calendar.
• New POST /api/v1/teams/{teamId}/tasks endpoint — creates a VTODO in the team calendar via CalDavBackend (QB fallback if unavailable).
• New Create personal task action in the Upcoming Tasks widget header, which opens a modal (title, optional description, optional due date/time). Shown only when Tasks app is installed and team has a calendar.
• The existing Add task action renamed to Create Deck task to distinguish it from personal tasks. Shown only when team has a Deck board.
• resources payload from GET /teams/{teamId}/resources now includes a tasks: bool flag indicating whether the NC Tasks app is installed.
• New AddPersonalTaskModal.vue component.
• New lib/Service/TaskService.php service.
• New migration Version000310001 — ensures teamhub_integ_registry exists and drops the legacy teamhub_integration_registry table if it survived an NC uninstall. Fixes a scenario where NC's "delete all data" uninstall keeps migration history, causing the new-name table to never be created on reinstall.

Fixed

• Fixed oc_teamhub_integ_registry does not exist error on installs where NC's uninstall-with-delete-data flow preserved migration history, causing migration 000209000 to be skipped on reinstall while the old teamhub_integration_registry table survived.

Fixed

• Fixed fresh-install failure: teamhub_team_apps.enabled was declared BOOLEAN NOT NULL which Doctrine rejects when storing false on MySQL/MariaDB; changed to SMALLINT NOT NULL DEFAULT 1.
• Fixed same BOOLEAN/NOT NULL issue on teamhub_integration_registry.is_builtin; changed to SMALLINT NOT NULL DEFAULT 0.
• Added migration Version000300801 to apply both column type fixes to existing installations.

Added

• Telemetry payload expanded with six new anonymous metrics: nc_version, user_count, member_total, message_count, builtin_integrations (per-builtin-app team counts), and link_domains (custom-link hostname frequency map).
• link_domains aggregates custom web-link URLs down to their bare lowercase hostname before sending — no paths, query strings, ports, fragments, localhost entries, or numeric IPs leave the instance.

Changed

• GET /api/v1/admin/telemetry preview object now includes all new fields; admin UI automatically renders them via the existing JSON preview.
• TelemetryService now depends on IUserManager for user counting.

Security

• All new collection paths are read-only DB queries using QueryBuilder with named parameters — no new user-input surface.
• No new endpoints; existing telemetry endpoint remains #[AuthorizedAdminSetting]-guarded.

TeamHub v3.5 — Changes

Admin Maintenance tab — full teams grid

Replaced the old "Orphaned teams" section with a full teams management grid covering every user-created team on the NC instance. What it does: Paginated table with search by name, "orphans only" toggle, and per-page selector (10/20/50/100). Each row shows team name, description, member count, owner (display name + uid), and creation date. Two icon-only action buttons per row: set owner and delete.

Set owner

Admin can assign any NC user as owner of any team — whether or not that user is currently a member.

Delete team (admin)

Admin can delete any team regardless of ownership. Cleans up all associated data before destroying the circle.

TeamHub v3.6 — Changes

Activity widget

Deck activity now scoped to the team's board only — card events (deck_card) and board events (deck_board) handled separately Talk activity scoped to the team's room via numeric room ID — eliminates cross-team bleed Calendar/DAV activity subject strings corrected to match real oc_activity values Friendly human-readable labels for all Deck, Calendar, and Circles activity subjects

Manage Team — Maintenance tab

"Danger Zone" tab renamed to "Maintenance" Transfer ownership added — team owner can promote any current team member to owner Ownership transfer requires two-step confirmation and demotes the current owner to admin Leave team now shows the real server error message (e.g. "Transfer ownership before leaving")

Admin Settings — Membership cache integrity

New section in the Maintenance tab: scan all teams for stale membership cache Compares circles_member (source of truth) against circles_membership (share picker cache) Per-team Repair button rebuilds the cache — fixes teams invisible to Files, Calendar and Deck share pickers

Files

Re-enabling the Files app for a team now works correctly Favourite Files and Recently Modified widgets no longer appear on teams without a connected Files resource