Changelog — September 23, 2026

✨ New Features

• Automatic delivery — Assets are delivered automatically when a project reaches DONE; the client gets the delivery email once downloads are unlocked. #941
• Dashboard calendar widget — The dashboard calendar tile gets the "+" shortcut to create a reservation and shows the studio's actual sessions next to project deadlines. #905
• Web vitals — Core web vitals are captured in PostHog. #907

🔒 Security

• Integration secrets encrypted at rest — Pennylane, e-do, Dropbox and AI provider keys and FTP passwords are stored encrypted (AES-256-GCM) instead of in clear. #945
• Debug endpoint and committed keys removed — An unauthenticated diagnostic endpoint, R2 keys committed as development defaults and a CSRF-bypass shim in the web proxy were removed; production refuses placeholder secrets. #938

🐛 Bug Fixes

• Project pages failing to load (incident of 23/09) — A Prisma engine panic on projects with retouches broke thumbnails, previews and uploads until a restart. The API now detects and survives the panic, batches the lookups, and always sends the asset id with the latest retouch version. #943 #946
• User deletion no longer erases business records — Deleting a user keeps the assets, comments, invoices and workflow history they created instead of cascading into them. #944
• Deleted Pennylane clients recreated — Deleted clients are tombstoned so the Pennylane sync does not bring them back. #942
• Workers — Video transcoding works again (ffmpeg was missing from the image), storage purge really deletes R2 objects, reminder tiers, secret redaction in logs and Pennylane product sync were fixed. #939
• Reservation import on slug collisions — A reservation whose client slug already existed was never imported; the slug is now resolved before the insert. #912
• Archived projects — The archived tab shows its real count, and archived projects open from the list. #909 #911
• Price-list operations removed — GraphQL operations backed by models that no longer exist crashed when called and were removed. #940

⚡ Performance

• Project detail and web lifecycle — N+1 queries on project assets removed and heavy web features loaded on demand. #906

📝 Other Changes

• Codebase map — docs/codebase-map.md documents the architecture, data model, flows and known issues. #924 #949