What's new

The audit trail no longer copies attachment contents

• Scheduled communications keep a copy of their attachments while the send is in

progress. Until now, every routine update to one of those sends copied the whole attachment into the audit trail twice — once as the previous value and once as the new one.

• The audit trail now records that an attachment column changed, along with its

size, instead of copying the contents. Nothing else about audit coverage changes: the same tables are audited, and the list of changed columns is still complete and accurate.

• A single scheduled send that could not complete had, in this way, written

6.1 GB into one month of audit history and doubled the platform's database disk. Measured on the repaired code, the same update writes about 1.9 kB instead of 1 MB.

• Historic audit rows from that failing send are cleared by a one-off, owner-run

cleanup that keeps the first and last entry as a record of what happened, and preserves every audit row belonging to any other table.

• The cleanup now aborts rather than claiming success when its exact incident is

absent or already reduced. Its result must explicitly approve the separate space rewrite before that operation is run.

Permanent member deletion preserves anonymous event records

• Permanently deleting a member now removes their identity from an external-event

roster without cancelling another participant's pair or team booking.

• The non-identifying participant slot, booking and financial history remain;

staff see “Removed member” rather than stale personal information.

• Voice-note files are removed only after the database purge succeeds, so a

database error can no longer leave a half-completed erasure.

Storage growth is now monitored

• A daily job records the database size and the largest objects in it, then

raises an operator-visible alert when growth exceeds 250 MB in a day, when usage passes 75% of the allocated disk, or when the disk is projected to need expanding within a fortnight.

• Previously nothing in the platform measured storage growth: the first sign of

the incident above was a billing notification from the hosting provider. Disk expansions cannot be undone, so the alert is deliberately set well before the point at which one would happen.

• The new sample table prunes itself to 400 days, so monitoring cannot become the

problem it monitors.

Abandoned shop orders release their stock again

• If a member started a shop checkout and the page failed part-way through —

before the payment was set up — the order could be left in a state the half-hour expiry sweep skipped entirely. Its items stayed reserved indefinitely, so other members saw them as unavailable with nothing to explain why.

• Those orders are now cancelled and their stock released on the normal

schedule. Orders already stranded this way become eligible again automatically at the next sweep; no manual repair is needed.

• Genuine bank transfers that are authorised but still clearing are unaffected

and remain protected from cancellation, exactly as before.

• Checkout now records the payment state as soon as the order is created, so the

gap that produced these orders no longer exists.

Security dependency kept current

• A newly published advisory affecting a build-time dependency has been resolved

by moving to a fixed release, rather than being recorded as an accepted exception. Nothing in the application used the affected code path.

Operational notes

• Follow the complete ordered batch in docs/rollout/RELEASE-CHECKLIST.md.

The destructive audit cleanup is separate after deployment; its postflight must be reviewed before any VACUUM FULL command is run.

• The External Events model apply now explicitly completes its deferred roster

checks after backfilling populated legacy pair and team bookings, before it validates the roster table. A failed apply remains fully transactional and is retried by running the complete corrected unit.

• No environment variable is required. SUPABASE_DISK_BYTES may optionally be

set when the disk is resized; it defaults to the current 12 GB allocation.

• Full write-up, developer rules and reusable read-only diagnostics:

docs/ops/audit-attachment-churn-2026-08-09.md.

What's new

More reliable scheduled communications

• Large scheduled SMS sends now continue across cron runs without waiting again

on—or re-texting—recipients whose delivery was already recorded. The gateway's 20-second pacing is retained for genuine provider attempts across the whole worker run.

• A broken recipient-data read is now settled with visible retry/backoff state,

allowing later scheduled jobs to continue instead of being blocked behind the oldest row.

• Attachment emails stop safely at the request budget and resume from their

remaining durable recipient rows on the next run.

• Personalised merge tags are now applied to scheduled email subjects as well

as bodies, including attachment sends.

• The minute worker again claims a bounded batch of ten jobs while preserving

per-provider pacing and releasing untouched claims before its deadline.

No SQL, environment variable or feature-flag change is required.

More reliable card, Link and Pay by Bank payments

• Card and Link are available together across Payment Element checkouts. Pay by

Bank remains limited to eligible GBP payments, while time-sensitive event places continue to exclude delayed bank settlement.

• Pro Shop payment webhooks now preserve Stripe's provider-event order. An old

processing delivery cannot overwrite a newer failure, but a genuinely later retry of the same payment can still continue normally.

• Payment reconciliation pages through its complete seven-day Stripe lifecycle

window instead of silently ignoring recent events after the first 600 rows.

• A late Stripe success against a cancelled or void invoice now creates durable

operator evidence instead of reviving the invoice or disappearing as a harmless zero-row update.

• Existing Stripe account recovery continues even when the optional Pay by Bank

capability request fails, with a clear retry message on return.

• Apply supabase/_proposed/stripe-pro-shop-event-ordering-01.sql before

deploying this application revision. Existing code is compatible with the additive SQL; the new webhook intentionally retries until the authority is present.

A simpler event creation flow

• Club Setup → Event Types now opens new event types in a focused modal instead

of expanding a large form into the settings list. Existing event types still edit in place.

• New events now open with a neutral Create your event heading and an empty

event name, instead of assuming the event is a grading.

• The configured event-type choice is always shown, even when a club currently

has only one type. The picker explains which defaults the type supplies and links directly to Club Setup → Event Types to add or manage more choices.

• Event descriptions use the same searchable merge-tag picker as

Communications and Automations, so supported details can be inserted without memorising tag names.

• Start and finish times now use predictable hour and quarter-hour choices.

Single-day events can be entered as either a length or a finish time, with quick 30, 60 and 90 minute choices plus a clearable custom length. Choosing Finish time reveals its selector directly beneath that choice so it is not missed above the controls.

• Entering a positive cost automatically enables Requires payment. Early-bird

prices can be calculated with 5%, 10%, 15% or 20% shortcuts, and Public listing now explains where the event will appear.

• Booking requirements can now collect text, number, date, yes/no and dropdown

answers, with quick starts for membership, insurance, progression level, weight and date-of-birth details.

• Booking requirements now use one clear Add booking requirement action before

asking for the type. Clubs can then combine or repeat equipment lists, text information, signed declarations, questions and acknowledgements without choosing the same thing twice in succession.

• Clubs can add signed declarations using an exact declaration, typed signer

name, signer role and acceptance. No signature image or biometric mark is collected.

• Questions, declarations, checklists, waivers and booking information can be

prepared before the first save. They are validated by the server, copied independently to every repeated occurrence, and retained in the booking's immutable staff-visible history.

• Opening an event from Calendar → Day now leads with the event name, type,

status, date, time, location and price. Bookings, attendance, invites and revenue use the same responsive summary cards as the rest of the app; bookings and invites are separated into clear tabs with proper empty states, and reschedule/cancel actions sit in a contained action menu.

• Manage Event now follows the same event-summary design, adds clear booking,

attendance, invitation and capacity figures, and keeps invitation creation inside the Invites workspace. Invite-only and publicly listed events are labelled honestly, and the unusable tokenless Copy public URL action has been removed; secure member invitations continue to carry individual links.

• External Events now loads through a tenant-bound server snapshot with exact

entry totals, pagination and distinct unavailable, empty and filtered states. Search, dated views and counted status tabs make current, upcoming and past events easier to find without a wide mobile filter strip.

• New external events are explicitly saved as drafts. The accessible creation

dialog starts without assuming a competition format, treats a single day as the default and explains when a starter template could not be applied after the draft itself was safely saved.

• External-event creation now asks for an entry structure rather than exposing

martial-arts database terms. Attendance-only, individual, pair, team and mixed choices give different club types clearer starting points while existing saved events remain compatible.

• Apply supabase/_proposed/event-booking-response-fields-01.sql before this

application release. No environment change is required.

Safer external-event setup and entries

• External events now remain genuinely private while they are drafts. Entry

links, staff entry creation and invitation issuing only become available after the event is explicitly opened.

• Registration deadlines are now enforced by the server, event and division

date/range errors are blocked before saving, and entrant ages are evaluated on the event date rather than the day the form is opened.

• Cancelling an external event must use the protected cancellation and refund

action; ordinary editing can no longer bypass that workflow.

• External document links accept only valid HTTP or HTTPS destinations. Used

invitation links can show the entry and payment outcome for their one bound student without exposing another entrant or club.

• The saved-event workspace now opens on a concise overview with readiness,

entries, payment and collected-value summaries. Setup, roster, entry-finance and organiser-finance controls follow their separate effective permissions; denied permissions no longer send member or roster details to the browser.

• Staff entry and public invitation journeys now guide people through entrant,

division and review steps, explain deadlines and refund terms, show autosave state, and keep pending payments recoverable without creating a second charge.

• Opening an event is now checked by the server as well as the screen: event

dates, registration deadline, entry options and all fee values must be valid. Completed and cancelled events are shown as terminal rather than suggesting that staff can reopen them.

• No SQL or environment change is required for these protections.

Programme-first External Events v2

• New external events are attached to one of the club's active programmes, so

basketball, football, cheer, martial arts and multi-programme clubs all begin from their own real membership rather than a sport-specific preset.

• Starter setups are now generic: attendance, individual and pair entry, team

tournament, judged routine, or a blank mixed setup. The programme's vertical changes the recommended order only; it never hides an option.

• Entry divisions are presented as neutral categories with an attendance,

individual, pair or team participation mode. Clubs choose whether the fee is charged once per registration or once per participant and can set exact roster bounds, music and supporting-document requirements.

• Staff and public entry journeys now validate every participant against the

event programme. Public links can select an individual or pair; team rosters remain staff-managed so a public token cannot enumerate the club's members.

• One canonical entry remains the invoice, settlement, cancellation and refund

identity. Normalised participant rows prevent the same member being entered twice in one category while preserving existing links, invoices and legacy event records.

• Apply supabase/_proposed/external-events-v2-model-01.sql, then

supabase/_proposed/external-events-v2-authority-01.sql, before deploying the matching application revision. No environment flag is required.

Communication and audit reliability

• Immediate and queued automation deliveries now stop before contacting a

provider when the club identity or communication-secret read cannot be proved. A temporary database fault can no longer produce a partly blank club-branded message.

• Legacy event automation metadata can once again populate the supported

booking link and booking button tags. Only relative application paths and HTTP(S) destinations are accepted.

• The communications recipient snapshot now includes the real SMS opt-out

state, so the Opted out filter and recipient counts agree with the final SMS compliance gate.

• Monthly audit archiving now writes bounded, deterministic JSON parts followed

by a completion manifest. Partitions larger than 100,000 rows no longer wedge, and no source partition is dropped after a failed or incomplete archive.

• Apply supabase/_proposed/comms-snapshot-sms-optout-01.sql with the matching

application release. It is safe to reapply and requires no environment flag.

Faster, steadier live data

• Recording an assessment from the register now keeps the assessment grid on

screen. The member who was edited stays current without the panel refreshing itself, while other open readers and browser tabs still receive the update.

• Register-day and member-profile snapshots now queue one fresh read when a

confirmed change arrives during an existing request. The older response is prevented from replacing the newer state.

• Club-wide attendance, insurance and renewal reports batch rapid member

updates into one authoritative refresh instead of reloading once per row.

• Admin attention totals and their preview now both exclude demo environments.

Successful admin states also use the established success styling, and a disabled secondary action no longer mutes the label for an otherwise active mixed form field.

• No SQL or environment change is required.

What's new

Dashboard member totals no longer flash as zero

• Current Members now counts active and new members directly from the dashboard

snapshot instead of waiting for the separate progression reference list.

• Members without an assigned progression remain included under Not assigned,

so the headline total and programme breakdown cannot silently undercount.

• The dashboard keeps its existing cached loading path. No SQL is required.

Clearer member profile actions

• The member Actions drawer now groups related controls inside softly coloured

bordered sections, making status, personal details, progression, communications and administration easier to scan.

• Status-changing actions show the destination status badge alongside the

action, with Leaver consistently shown in red so staff can distinguish it immediately from Active, New and Paused.

• Impersonate Portal now has a distinctive, gently animated theme-aware

gradient border so this important testing action is easier to find without appearing destructive. The movement is removed when reduced motion is set.

• This is a code-only visual improvement and requires no SQL.

Member Experience v2 now follows the selected family member

• On family accounts, Consistency & Momentum, Coming up and Recent now show

only the member currently selected in the portal header.

• Switching between siblings loads each member's own latest updates rather

than retaining a household-wide result chosen from whichever sibling had the newest activity.

• The server validates the selected member against both the signed-in

household and club before loading any experience data. The narrower query also avoids unnecessary work for other family members. No SQL is required.

• Coming up now compares that member's next recurring class with any separately

booked session and shows whichever occurs first. Archived classes, club closures and classes that have already started are excluded, and the card opens What's On. This is also a code-only change with no SQL requirement.

Register unlocking no longer interrupts the signed-in session

• Confirming a password to unlock a register now uses an isolated verification

session, so it cannot replace the staff member's active browser session and trigger a repeated refresh/sign-in loop.

• After a successful unlock, the register refreshes its saved lock state

immediately instead of briefly retaining a cached locked view.

• Opening the unlock confirmation now smoothly returns a long register to the

top and keeps the confirmation centred in the visible screen.

• Existing club, lesson and role-based unlock permissions remain unchanged.

This is a code-only fix and requires no SQL or environment change.

Member progress now follows the awarded rank

• The member portal Progress screen now refreshes its rank, journey and syllabus

when a member is promoted, including while an existing portal session remains open.

• A previously viewed grade can no longer mask the member's newly awarded rank

after the portal header has refreshed.

• Staff impersonation and normal household access use the same corrected read

path. This is a code-only fix and requires no SQL or environment change.

Rank-dependent screens now refresh together

• Promotion changes now refresh rank-targeted LMS courses and lessons, shop

eligibility, certificate lists and the member-experience feed at the same time as the portal identity header.

• Staff grading panels also leave an earlier syllabus preview automatically

when the member's authoritative rank changes.

• Attendance, payments, events, pathways and general achievements were audited

and remain unchanged because their results do not depend on the current rank.

Member information now stays consistent across open screens

• Confirmed changes to ranks, assessments, memberships, payments, insurance,

classes, attendance, households and member details now refresh the matching staff and member-portal views immediately, including another open AllSorted tab.

• Refreshes are scoped to the signed-in club, the affected member and the data

area that changed. They do not broadcast names, contact details or record contents, and they do not introduce database polling.

• Member, date and report switches now reject superseded responses, preventing

a slower request for the previous member, register day or date range from replacing the current view.

• Removed household members can no longer remain selected in the portal, and

sibling-specific fixture updates stay attached to the correct child.

• External payment webhooks and scheduled jobs retain the existing focus and

visibility refresh fallback. This is a code-only change with no SQL or environment update.

Clearer member names

• Member names in the directory now keep a small amount of space on their

italic edge, so the final letter is no longer clipped.

More responsive forms and page headings

• Page titles and supporting copy now wrap cleanly when their own panel is

narrow, while header actions move onto a usable row instead of squeezing the title.

• Form previews now choose one or two columns from the space actually available

to the form, which keeps embedded previews readable on wide and narrow pages.

• Shared form labels react to focus, validation and disabled controls, while

signed-in form controls use the active club theme for selection, cursor and native control colours.

• Selected note and description fields now grow with their content up to a safe

limit. Older browsers retain the existing rows and manual resize behaviour.

• This is a code-only visual improvement and requires no SQL or environment

change.

The RPC caller index can no longer go stale

• The Phase 2D security caller index — the machine-parsed inventory of every

privileged database call — is now regenerated automatically inside the standard pre-commit check loop whenever app code changes, instead of relying on a manual final step that was repeatedly forgotten.

• The CI freshness test remains byte-strict; the index stays script-generated

and is never hand-edited.

Clearer, safer communication merge tags

• New templates now use the vertical-neutral progression tags

progression_stage, progression_system and last_assessment_date rather than martial-arts-specific wording.

• Existing templates using belt_rank, belt_system or last_grading_date

continue to work. They are highlighted for review instead of being broken.

• Communications and event-invite editors now show only values their delivery

path can actually supply. Optional spaces inside tags are handled consistently across email, SMS and Telegram.

• A failed club or member merge-data read now stops an automation with an

explicit internal failure rather than sending a partly blank message.

• This is a code-only compatibility improvement and requires no SQL.

Safer permanent member deletion

• Permanently deleting a member now has a separate final confirmation after the

exact member name and a reason have both been entered.

• The final Delete control must be held continuously for five seconds. A fixed

doughnut visibly counts from 5 to 0 while filling clockwise from the top, and releasing, moving away or cancelling early resets it without sending the deletion request.

• The same protection works with a mouse, touch or keyboard, and the request has

an additional synchronous duplicate-submit guard.

• This is a code-only safety improvement and requires no SQL or environment change.

Clearer programme selectors

• Programme choices now use consistent uppercase labels in the main programme

switcher and the Reports lens selector, including archived programmes.

• This changes display only: authored programme names and submitted identifiers

remain untouched. No SQL or environment change is required.

What's new

The guided Messages workspace is now the standard composer

• The guided Purpose, Recipients, Compose and Review journey now opens directly

from Messages for every communications user.

• The previous composer and the temporary Comms 2 comparison link have been

removed, leaving one clear place to create messages and event invitations.

• Existing links to /communications, including links that preselect members,

continue to work. Old workspace=v2 bookmarks also reach the same standard Messages workspace because the obsolete comparison parameter is ignored.

• This is a code-only interface change and requires no SQL, environment setting

or feature-flag change.

Guided message recipient selection is clearer

• The guided Messages workspace now follows the same content width as the rest

of the application.

• On larger screens, the familiar member picker now runs at full height down the

far-left side of Step 2. It is slightly wider than the original selector and scrolls independently from the message workspace.

• The selected-recipient table now uses the full main workspace, with more room

for each member and clear Email, SMS and Telegram readiness at a glance.

• Back and Continue now sit in a dedicated bottom action bar that remains visible

while either recipient list is scrolled.

• The Continue action now uses the app's stronger primary-button styling. On

smaller screens, the picker retains a compact selected-recipient count.

• In Step 3, changing between Email, SMS and Telegram now switches the editor

and live preview together. The preview is visually marked as live and view-only so it cannot be mistaken for another field to complete.

• This is a code-only interface improvement and requires no SQL, environment

setting or feature-flag change.

Automation and message delivery close silent failure edges

• Communication flows now load the member's Direct Debit status and the club's

current name, contact details and logo before rendering merge fields. Blank message data can no longer erase trusted club branding in the email skin.

• A database failure for one club no longer stops the whole automation

evaluation pass. Healthy clubs are queued independently while the overall run still reports a failure for operational attention.

• Trigger.dev wait continuations now refuse to claim work until execution,

run-logging and delivery-idempotency safeguards are all enabled.

• Audit archives and orphan-video cleanup now have explicit regression proof

that incomplete source evidence can never trigger a destructive delete.

• This closure is code-only and requires no SQL. Trigger.dev remains subject to

the existing owner-controlled environment rollout gate.

Pay by Bank is ready for controlled non-event testing

• Eligible GBP one-off payments can now show Stripe Pay by Bank when the

connected club account reports the capability active. Cards remain available.

• Event bookings, waitlist claims and external-event entries are card-only by

design so delayed settlement cannot hold a time-sensitive place.

• A bank payment in processing remains unpaid everywhere. Payers see a clear

authorised/awaiting-funds message and are told not to pay twice; enrolments, invoices, renewals, orders and course access complete only after Stripe sends the succeeded event.

• Shop stock remains reserved while bank funds are processing. A provider

failure returns the order to its normal expiry and stock-release path.

• Admin Health now distinguishes stuck processing payments, succeeded payments

whose invoice is still unpaid, refunds pending over seven days and failed refunds. The daily payments reconciliation job rechecks these states without treating a normal short processing window as an incident.

• Stripe Settings shows whether Pay by Bank is available and can send an

owner-initiated capability request for Express accounts. Allsorted never assumes the capability is active.

• This delivery needs the additive, re-applicable

supabase/_proposed/stripe-pay-by-bank-01.sql ledger CHECK update before a live pilot. No agent applied SQL or enabled a Stripe capability.

What's new

Staff invitations now stay inside AllSorted

• Club owners can invite staff, create their secure login and resend access

entirely from Settings; no Supabase dashboard work is part of the journey.

• A person who already uses AllSorted keeps their existing password and is sent

to normal sign-in. Only a new or never-activated account receives a secure password-setup link.

• Multi-club staff now appear in each club from their per-club access record,

with that club's role and invitation date rather than their original club's.

• The screen distinguishes delivered, queued, suppressed, failed and uncertain

invitation email outcomes instead of treating every successful request as a sent email. Resends are limited to one per staff member per minute.

• Failed provisioning removes a newly-created login so a retry does not inherit

a half-built account. This change uses the existing Auth and email-outbox foundations and requires no new SQL or feature flag.

Action Centre opens reliably during its pilot

• Opening the Action Centre no longer fails before an action is selected for

history review. The history request now starts only from a valid selected action, while the closed dialog remains safely idle.

• This is a code-only correction. It requires no SQL, flag or operational

change beyond deploying the repaired application build.

Onboarding v2 becomes the standard club setup journey

• New and incomplete clubs now use the clearer, vertical-aware onboarding

journey automatically; there is no Vercel environment switch or per-club pilot flag to configure.

• Clubs that have already completed setup are unaffected because

setup_complete remains the sole onboarding-completion authority.

• The server-derived readiness checklist is now the standard dashboard setup

checklist. Existing production tables already satisfy the feature, so this graduation requires no additional SQL.

Platform admin becomes an action-led control surface

• The super-admin overview now starts with work that may need a decision, then

separates real-club commercial health from demo environments and clearly labels its capped activity previews.

• The former estimated MRR figure has been removed. Trial, signup and attention

totals now use exact counts, and an unavailable data source degrades only its own card or section instead of hiding the whole dashboard.

• The club directory now shows onboarding, payments and automation readiness,

reads every club through deterministic pagination, and distinguishes a failed member-count read from a genuine zero.

• Mobile admin navigation now has an explicit grouped menu, while every admin

page gains larger focus and touch targets plus shared loading and safe error states.

• Cross-club Overview and Club pages now repeat the platform-owner check inside

each server page before creating a service-role database client. Club-owner status remains entirely separate and never grants access to /admin.

Referral administration is ready for a controlled future launch

• The existing referral console now explains programme rules and safeguards,

shows exact funnel totals and recent activity, and distinguishes Preview, Recovery and Live modes in plain language.

• While the referral programme is off, new codes, manual flags and qualification

runs are blocked in both the interface and server routes. Existing rewards, flags and codes remain available for safe recovery work.

• Referrals remain disabled. This is a code-only admin refinement with no SQL,

feature-flag or production activation step.

Large clubs get complete reports, audiences and scheduled work

• Birthday, automation, billing, annual-requirement, financial-report and

communications reads now page through complete club data and stop safely if the database reports an error or an explicit safety ceiling is reached.

• Audit archives and video cleanup no longer delete source data or stored files

from incomplete evidence.

• Communication previews and scheduled delivery now use the same audience and

merge-variable rules. A soft email bounce pauses bulk mail for 48 hours rather than forever, and SMS history uses the real timeline schema.

• Long scheduled SMS jobs now pause cleanly and continue on the next minute

instead of relying on a platform timeout. Cron starts are visible even if a run is killed, high-frequency jobs are staggered, and module trials now expire through a monitored daily job.

• The legacy automation queue now works in a bounded batch and immediately

returns untouched messages for the next run when a provider is slow.

• Immediate and scheduled email now use the same sender-name and default-theme

rules, preventing club branding from drifting between delivery paths.

• Both email paths now use the same renderer for safe merge fields, preview

text, unsubscribe details and plain-text fallback.

• Interactive and scheduled event messages now use the same club-bound token

loader and stop safely if token preparation is incomplete. Existing used links remain used; the system does not silently reopen an invitation.

• Shared payment/request fingerprints preserve their existing byte-for-byte

identities, including external-event objects with integer-like keys; GoCardless mandate starts share one provider operation, and key event-booking screens use one confirmed-status vocabulary.

Templates surface problems before staff open them

• Communication templates with missing channel content, unknown merge tags or

tags that do not resolve for an assigned automation/event are marked on the Templates list. A Needs review view appears only while there is work to fix.

• {{renewal_link}} now resolves for configured Portal Insurance renewals and

sends the member to the signed-in Insurance page. Other annual requirements are not misdirected to that journey.

On-the-mat assessments reopen instantly

• A member's assessment details are loaded on first expansion and retained when

their row is closed, so reopening the same person does not fetch the whole assessment snapshot again.

Comms 2 is available beside the existing composer

• Staff can compare the existing Messages composer with a new guided Comms 2

workspace: Purpose, Recipients, Compose, then Review & send.

• The connected progress bar now makes the four stages easier to distinguish

and reopens later stages once their required choices are complete.

• The recipient picker now scrolls inside its workspace instead of clipping a

long club list, and all workspace actions use the app's established buttons.

• Channel choice now sits beside the writing task, while email, SMS and

Telegram previews update concurrently with the editor. Raw HTML remains available to every authorised communications user through the email toolbar.

• The final stage is now a compact Final checks summary, keeping recipients,

channels, delivery timing and email options visible without repeated panels.

• Switching between a normal message and an event invitation now asks before

replacing a draft, and event-only links and authority are cleared before a normal message can be queued.

• Household email grouping no longer drops a selected member's SMS or Telegram

delivery. Immediate sends and scheduled snapshots now use the same audience plan, including household-phone fallback and opt-out checks.

• Filter-based schedules retain the visible search term, show the current match

set and refuse an empty audience or an incomplete date/time. Their final confirmation cannot silently change the choices already reviewed in Step 4.

• Moving between stages resets the workspace to its heading, the live email

preview reflects the selected skin, and cancelling a final confirmation no longer resets a carefully chosen schedule.

• Scheduling, recipient grouping, reachability checks, test sends, templates

and final delivery continue to use the existing guarded communications authorities rather than a second send implementation.

Register assessment access is clearer

• The lesson-register shortcut is now labelled Assessments, with the same

present-or-late count, so it is not confused with the attendance total.

Used event invitations are never sent by a schedule

• Static and dynamic scheduled event invitations now re-check the one-time

invitation immediately before delivery. An already-used invitation is not sent on any channel and is recorded as Not sent — invitation already used.

• Staff retain deliberate control through Resend, which only replaces a used

invitation when the member has no active booking.