diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 33bf7bf85..4b36daa1f 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1 +1 @@
-{".":"2.2.0"}
+{".":"2.3.0"}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f4306b1c4..733edb664 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,264 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * Unused API routes that no client called: `PUT /api/event-types/:id`, `DELETE /api/event-types/:id`, `POST /api/event-types/seed`, `GET /api/events/upcoming`, `GET /api/calendar/connections/:id/calendars`, `GET /api/inspections/{id}/full`, `GET /api/inspections/{id}/sign-status`, the `statusFlags` object on dashboard rows, `POST /api/auth/setup/skip` and `POST /api/auth/onboarding/flag`. Missing default event types are filled in by `POST /api/admin/data/install-bundled-content`; the signed state of an inspection is still returned as `signedByClient` by the inspection read.
 * The unreachable `feature-disabled` page and its translation strings.
 
+## [2.3.0](https://github.com/InspectorHub/OpenInspection/compare/openinspection-v2.2.0...openinspection-v2.3.0) (2026-10-18)
+
+
+### Features
+
+* **auth:** add the deleteInspection capability and restrict inspector deletes to their own inspections ([da01a6e](https://github.com/InspectorHub/OpenInspection/commit/da01a6edb2fd6e348ee6d4498e7c5ffeeaa267eb))
+* **auth:** add the inspection visibility predicate ([61cedc6](https://github.com/InspectorHub/OpenInspection/commit/61cedc6f0c76d7873dea8378928e28bab35e36f3))
+* **auth:** add the viewAllInspections capability (not yet settable) ([c77e2e4](https://github.com/InspectorHub/OpenInspection/commit/c77e2e44bcc6f318f2a52bf535578ecc089ebff9))
+* **auth:** count bookings awaiting an inspector over the caller's visible inspections ([5c3416e](https://github.com/InspectorHub/OpenInspection/commit/5c3416e20023fb340f041d168a247cb24fffd005))
+* **auth:** cover every place money is shown or changed with the financial capability ([e69bd75](https://github.com/InspectorHub/OpenInspection/commit/e69bd755218acec664c865ff93c30c2c66db6036))
+* **auth:** cover every place money is shown or changed with the financial capability ([569ce10](https://github.com/InspectorHub/OpenInspection/commit/569ce1085b69280a8a908059bb908bc103965344))
+* **auth:** hide inspections a restricted inspector is not assigned to behind a 404 ([1df4f05](https://github.com/InspectorHub/OpenInspection/commit/1df4f055075aa6e584d069eb69119b665899d739))
+* **auth:** hide Pending Invites from non-managers and add the deleteInspection capability ([64a65e2](https://github.com/InspectorHub/OpenInspection/commit/64a65e2e122bfbeb621580bf51cc11492393772e))
+* **auth:** inspection visibility scope - role gates, predicate, guard and scoped reads ([dff7f7d](https://github.com/InspectorHub/OpenInspection/commit/dff7f7d2089da87cbad31e3ff533f1b058c109fe))
+* **auth:** keep a restricted creator on the roster of an inspection they create ([1ec5187](https://github.com/InspectorHub/OpenInspection/commit/1ec5187f27a231a9df8dd4e0f623a6cc6b2fb79d))
+* **auth:** let administrators restrict an inspector to assigned inspections ([89e9963](https://github.com/InspectorHub/OpenInspection/commit/89e99631d9be5d6efe18ef4f94356dd812d4df5e))
+* **auth:** let administrators restrict an inspector to assigned inspections ([58eceb0](https://github.com/InspectorHub/OpenInspection/commit/58eceb068c0992edfce93cc6020142349de592a5))
+* **auth:** limit analytics and metrics to the caller's visible inspections ([98e5b08](https://github.com/InspectorHub/OpenInspection/commit/98e5b088dc3cb9ac1e854529a7491c07aa99479f))
+* **auth:** limit contact reads to the caller's visible inspections ([3a9a65a](https://github.com/InspectorHub/OpenInspection/commit/3a9a65a3b170b0e2ea5c8867b430398ebaf3b936))
+* **auth:** limit invoices, events, requests and the calendar to the caller's visible inspections ([62b9a7a](https://github.com/InspectorHub/OpenInspection/commit/62b9a7a88a80ce355f296d3e287aa746e0e9e59a))
+* **auth:** limit message threads to the caller's visible inspections ([e6a1510](https://github.com/InspectorHub/OpenInspection/commit/e6a15108711f5a0bec2d211eb93e37f7f80e0f0a))
+* **auth:** require a staff role on every per-inspection route ([096d47c](https://github.com/InspectorHub/OpenInspection/commit/096d47c5ee1f87b46e203421dc7d5d9e37ae2d83))
+* **auth:** return a reduced team roster to non-administrators ([a77c0de](https://github.com/InspectorHub/OpenInspection/commit/a77c0def44f955b69ee112bbca49970d6288e214))
+* **auth:** scope the inspection list, counts, stats and dashboard ([5e0f42e](https://github.com/InspectorHub/OpenInspection/commit/5e0f42e0d5314b9525337cd40ce8763bbd5b6ba8))
+* **config:** default a new workspace's Reply-To to its owner, with a dry-run backfill for existing ones ([4d367ee](https://github.com/InspectorHub/OpenInspection/commit/4d367ee711fb64e6f9e743080c8acbb36d345c0f))
+* **email:** absorb short rate limits, defer instead of fail on quota, throttle the automation flush ([c8e15cd](https://github.com/InspectorHub/OpenInspection/commit/c8e15cd36fd38b6fec142c178c48a089b6b40ae0))
+* **email:** carry the human check through delayed report emails ([d8d4113](https://github.com/InspectorHub/OpenInspection/commit/d8d41138f0562d95b9555357d68a46874ef3f63d))
+* **email:** confirm a person with Turnstile instead of refusing client email in a new company's first 24 hours ([57ec37b](https://github.com/InspectorHub/OpenInspection/commit/57ec37b088a20e841fa5654870a218150c8c0303))
+* **email:** report provider quota usage, classify rate limiting, honour send-only keys ([c316f64](https://github.com/InspectorHub/OpenInspection/commit/c316f64da8cbe9989addbd4c1568e519773d488d))
+* **email:** the human check on the repair-share email, one token per page action, and honest Outbox reasons ([541b319](https://github.com/InspectorHub/OpenInspection/commit/541b319817f5e830cd4c249e27bc2fbc79b1039e))
+* **gates:** every write route must name its guard; close three routes that had none ([ddefaff](https://github.com/InspectorHub/OpenInspection/commit/ddefaff2e79d1b1d5661f4c110af7134a9eb9e9e))
+* **inspections:** let the Send report dialog hand off to adding a person ([522fff3](https://github.com/InspectorHub/OpenInspection/commit/522fff3ed8c8e086baf9c41f5314bba5e7c3b03b))
+* **inspections:** let the Send report dialog hand off to adding a person ([5912019](https://github.com/InspectorHub/OpenInspection/commit/59120193ae8ac1a96e8f7f616e5dc11b2ef2f911))
+* **inspections:** office staff can no longer publish or sign; the AI helpers need report-editing access ([485dea0](https://github.com/InspectorHub/OpenInspection/commit/485dea016e4ebc04aff4a8435468100e3018feb2))
+* **inspections:** split the order from the inspection for office staff (create, edit, cancel rules) ([d2e15d2](https://github.com/InspectorHub/OpenInspection/commit/d2e15d2e114ac136ee345c047bcb74bddf855a11))
+* **inspections:** the hub and the inspection list follow what office staff may actually do ([d7686d8](https://github.com/InspectorHub/OpenInspection/commit/d7686d885e46afb056254ef44e4778dbe83fe0a4))
+* **inspection:** the send dialogs say who was reached, who was not, and why ([75356a2](https://github.com/InspectorHub/OpenInspection/commit/75356a29304e8741ca084d3b6642238d229574f0))
+* **integrations:** an overview of every outside service on the Integrations page ([9e6557f](https://github.com/InspectorHub/OpenInspection/commit/9e6557fbe721140b33e6c926d149b7c6c6818d96))
+* **integrations:** email and SMS get their own pages with a Built-in / Your own choice ([b787787](https://github.com/InspectorHub/OpenInspection/commit/b7877879d74db1ab8c72b2a9d0db42f93c781a74))
+* **integrations:** resolve each outside service's source in one place ([719e7da](https://github.com/InspectorHub/OpenInspection/commit/719e7da85b1cb7b462dd16b6e73c29b0113d7fd0))
+* **integrations:** resolve each outside service's source in one place ([470b131](https://github.com/InspectorHub/OpenInspection/commit/470b13160215338dac75daa52f54f20ccdb42a2d))
+* **integrations:** step-by-step Stripe connection test behind one Test connection button ([1bbaf4d](https://github.com/InspectorHub/OpenInspection/commit/1bbaf4daa649669477f3f73b527950eedeb94198))
+* **integrations:** stepwise "test connection" for BYO email and Stripe ([9e2cb4d](https://github.com/InspectorHub/OpenInspection/commit/9e2cb4d8d97ace4fe60e95f5ac2b9d81d416f09b))
+* **isn:** add a published report's link to its ISN order ([acc1eb3](https://github.com/InspectorHub/OpenInspection/commit/acc1eb31b629234d13d8ae73d150ebe551010c93))
+* **lint:** ratchet placeholder descriptions toward zero ([e7862fd](https://github.com/InspectorHub/OpenInspection/commit/e7862fdcb490e405a0ab0e0e3ba6d707fdd8a8a9))
+* **native:** accept native OAuth access tokens on /api ([0dee762](https://github.com/InspectorHub/OpenInspection/commit/0dee76288121079bba69289de7c696b82936444e))
+* **native:** client-generated inspection ids and background media uploads ([0d1c3d1](https://github.com/InspectorHub/OpenInspection/commit/0d1c3d11467c878fd48076a4412b65f53b5daace))
+* **native:** CORS for app origins and one-time WebSocket tickets ([1262a20](https://github.com/InspectorHub/OpenInspection/commit/1262a2074b9dcd56b2b9df192f11107328e75e4d))
+* **native:** import an exported offline package on behalf of another member ([b6eafab](https://github.com/InspectorHub/OpenInspection/commit/b6eafab1aff85f8e2ab46e67641e2879d0adadb9))
+* **native:** import an offline Yjs update behind a mandatory snapshot ([ee3b000](https://github.com/InspectorHub/OpenInspection/commit/ee3b00097b9315401fd55353b03482d92fd6a448))
+* **native:** mount the OAuth provider when native clients are enabled ([ac16eef](https://github.com/InspectorHub/OpenInspection/commit/ac16eefe2fa418fc2f90074f6acb479f24f1ad15))
+* **native:** native API contract registry, snapshot and breaking-change gate ([f067f17](https://github.com/InspectorHub/OpenInspection/commit/f067f17c45d95341c44609baaaec591e799bd8be))
+* **native:** native authorization branch and token lifetimes ([ccd421b](https://github.com/InspectorHub/OpenInspection/commit/ccd421b980d3b2c634cf6b950dc14404cba2cf91))
+* **native:** native consent page ([2e5e940](https://github.com/InspectorHub/OpenInspection/commit/2e5e94034b27d0b9a911e883e4aadac4794fa844))
+* **native:** offline access limit input in compliance settings ([c097198](https://github.com/InspectorHub/OpenInspection/commit/c097198cf2c90cf315405b314c17b65962edd51f))
+* **native:** per-tenant offline access limit (schema, validation, API) ([b6b2dec](https://github.com/InspectorHub/OpenInspection/commit/b6b2decafaac958bdd05528f8a91d3070f3805ac))
+* **native:** resolve pending photo entries to storage keys inside the document ([a736db4](https://github.com/InspectorHub/OpenInspection/commit/a736db459b313c51bee085ca2851dbb15857d0b6))
+* **native:** server support for native offline clients ([0fa0a6a](https://github.com/InspectorHub/OpenInspection/commit/0fa0a6a35061f03a36ff070d1e3bd0d491939078))
+* **native:** size offline package imports for the free tier; make limits configurable ([9e3517e](https://github.com/InspectorHub/OpenInspection/commit/9e3517e934f2a4807b2920fb6b93de23f4bfcf13))
+* **native:** version handshake and native session endpoint ([442cb66](https://github.com/InspectorHub/OpenInspection/commit/442cb6618af06b636391923d836d5523e318ab5e))
+* office staff role, order/inspection split, manager grant ceiling, per-company SMS and email accounts ([cdc1e7d](https://github.com/InspectorHub/OpenInspection/commit/cdc1e7d5f22a883791a88e3e4f49ad768d4e707c))
+* **permissions:** a refusal says who you are, what you lack and how to get past it ([c8e8ca4](https://github.com/InspectorHub/OpenInspection/commit/c8e8ca46d74da541cbc36a7d82ca33b71635d0b2))
+* **permissions:** acting on an inspection you are not on needs scheduleOthers ([5e297be](https://github.com/InspectorHub/OpenInspection/commit/5e297be0b06c34035651f24bb2e5dfee9805ca06))
+* **permissions:** acting on an inspection you are not on needs scheduleOthers ([ae76c11](https://github.com/InspectorHub/OpenInspection/commit/ae76c11604f004d57cc373325fae7acb36fcc3ac))
+* **permissions:** an office staff role that takes no seat, report-content permission, role-change event ([9c2dfaa](https://github.com/InspectorHub/OpenInspection/commit/9c2dfaa1c4b9cdf6f09ae08b79dc28ba2dd792d8))
+* **permissions:** keep the screens in step with the server, and require every write route to name its guard ([c4f3f70](https://github.com/InspectorHub/OpenInspection/commit/c4f3f701b4237fcf1d079a6767073fd3e0e4dda6))
+* **permissions:** split the financial capability into inspection fees and company finances ([c3bd87c](https://github.com/InspectorHub/OpenInspection/commit/c3bd87c21b53f4190b60a4b43b25311a72f721c8))
+* **plan:** the Free plan has no platform text-message allowance ([194341c](https://github.com/InspectorHub/OpenInspection/commit/194341ca5ca547540b9beafdf39cc80ef9ee0fb5))
+* **qbo:** Check credentials button in the Your Intuit app section ([fbe338b](https://github.com/InspectorHub/OpenInspection/commit/fbe338bb0d3a673e061d6303d9df669de3662daa))
+* **qbo:** check that the Intuit app credentials are a matching pair ([a4f57c7](https://github.com/InspectorHub/OpenInspection/commit/a4f57c7a844271f75967e21774bf8d6e317b18be))
+* **qbo:** match a contact to a QuickBooks customer from the items that need attention ([5897a05](https://github.com/InspectorHub/OpenInspection/commit/5897a0565025700df43b4bc39aa8256f176bdf79))
+* **qbo:** match a contact to a QuickBooks customer, undo it, and read where it stands ([bb9a336](https://github.com/InspectorHub/OpenInspection/commit/bb9a336865dc94f6d1312aa7ad24fb3dcb0da837))
+* **qbo:** push again the invoices that were waiting for a QuickBooks customer once a contact is matched ([5a83857](https://github.com/InspectorHub/OpenInspection/commit/5a83857a9e5174717a7e1ab1e63e6c38518ee46d))
+* **qbo:** report the environment, connection time, match counts and credential origins in the status ([2a8c758](https://github.com/InspectorHub/OpenInspection/commit/2a8c75888a20f19913d234834f6725b06a5dc829))
+* **qbo:** rework the QuickBooks settings page around the connection ([2784d1c](https://github.com/InspectorHub/OpenInspection/commit/2784d1c55c24eaffe255bb5e33d41549412730c7))
+* **qbo:** search QuickBooks customers and expose the contact match routes ([c84a3dc](https://github.com/InspectorHub/OpenInspection/commit/c84a3dce4e9aaeb2533e9f584d958ade7f1972e9))
+* **qbo:** show and manage the QuickBooks match on the contact page ([deae121](https://github.com/InspectorHub/OpenInspection/commit/deae121989c95de2de6ef6ffd434f50f87619617))
+* **roles:** staff can never write report content; agents hold no seat ([3f1580d](https://github.com/InspectorHub/OpenInspection/commit/3f1580d727ad0fae9549b421e17bbf6b40ccb75e))
+* **roles:** staff can never write report content; agents hold no seat ([b0d6587](https://github.com/InspectorHub/OpenInspection/commit/b0d65872c8cd61faca22618efb1dc003bfa8af88))
+* **settings:** one "Test connection" button that runs a step-by-step Resend check ([54bbe74](https://github.com/InspectorHub/OpenInspection/commit/54bbe7402eacf740f680765ead36753580656491))
+* **team:** a manager can grant at most what the manager holds ([ccf1b0c](https://github.com/InspectorHub/OpenInspection/commit/ccf1b0c52b26a404e149da556f9e7cfe4d3cd6f1))
+* **team:** add a company default for whether new inspectors see all inspections ([df13fe0](https://github.com/InspectorHub/OpenInspection/commit/df13fe072d98605c0718a5b36bffc1427cf47132))
+* **team:** add the permission_templates table for company-defined templates ([542e16c](https://github.com/InspectorHub/OpenInspection/commit/542e16c7329436d2fc30772ae0e0d5acfbbebafa))
+* **team:** apply the new-inspector default when inviting, and audit the choices ([bcac557](https://github.com/InspectorHub/OpenInspection/commit/bcac55753d15832ff171f1a9870389c099fb5204))
+* **team:** choose which inspections an inspector can see, and the default for new ones ([3f39269](https://github.com/InspectorHub/OpenInspection/commit/3f392697f63abe325c9f49ced0c0aa474958cb3d))
+* **team:** permission templates for invites and member edits ([bc297fb](https://github.com/InspectorHub/OpenInspection/commit/bc297fb6aa120929d762f03ebde6d1b62f971dae))
+* **team:** permission templates, built-in and company-defined, applied by copy ([d39d376](https://github.com/InspectorHub/OpenInspection/commit/d39d3765a617ddd4a7c56185504149a3d1ca1638))
+* **team:** remove a member with an unsynced-data warning; app-mode sign-in ([c8708f9](https://github.com/InspectorHub/OpenInspection/commit/c8708f9e080a3504a90cc18692a2c2505f4e1198))
+* **team:** start an invite or a member edit from a permission template ([12d0e78](https://github.com/InspectorHub/OpenInspection/commit/12d0e786c1049b1a2f3819142c22dbe8690af7ef))
+
+
+### Bug Fixes
+
+* a batch of low-severity defects from the access review ([fae3135](https://github.com/InspectorHub/OpenInspection/commit/fae31354c8bf5768182649fee3b6226f26367565))
+* a failed cache write no longer costs the user a live response; one accessible name for the collapse button ([32e4605](https://github.com/InspectorHub/OpenInspection/commit/32e4605c2066c49031cddba3823a43e6b57da1c7))
+* **ai,team:** tell a company what an AI refusal needs, gate the comment library, and let a removed member's open work be handed over ([998b0a8](https://github.com/InspectorHub/OpenInspection/commit/998b0a8dfa68422a8abd35ece6b274452ffcfcee))
+* **api:** answer 400 for a template or agreement that is not the company's own ([dd81005](https://github.com/InspectorHub/OpenInspection/commit/dd810055c33b5839c0d9fc6d09a9105098851c47))
+* **api:** give the two routes that shared an operationId their own ([f256dc1](https://github.com/InspectorHub/OpenInspection/commit/f256dc145beafb7d66f43578212ea600819d7043))
+* **app:** pages that read the origin, the stored time zone or local columns no longer hydrate differently ([540acaf](https://github.com/InspectorHub/OpenInspection/commit/540acaf972051ce58d0b397a2a9670c7d06332d6))
+* **auth:** answer 404 for an inspection a restricted caller cannot open, in the callers the path guard does not cover ([a344b31](https://github.com/InspectorHub/OpenInspection/commit/a344b319ba4880fbbc2e3cc1a8c8983c0d5a5933))
+* **auth:** chain an explicit staff sign-out to the identity service, and forward SSO failure reasons ([79b17b6](https://github.com/InspectorHub/OpenInspection/commit/79b17b60eadb29e5ad91693453375e0b0f424a44))
+* **auth:** close the envelope and AI-summary reads and keep a stored restriction across member edits ([a8a4d16](https://github.com/InspectorHub/OpenInspection/commit/a8a4d16be5341b87b82cebe28ad2d2dd93b3f19c))
+* **auth:** complete standalone TOTP sign-in through the /login page ([eec2ea7](https://github.com/InspectorHub/OpenInspection/commit/eec2ea7c68eade6e764fee5d9e65517fba4dc8de))
+* **auth:** give /login its own response schema; correct the token-relay rule ([8421d45](https://github.com/InspectorHub/OpenInspection/commit/8421d4540677de7ce347f0129ef410945beb35f9))
+* **auth:** keep a restricted creator on the roster of a plain create ([e165b25](https://github.com/InspectorHub/OpenInspection/commit/e165b25dd0c2adbbf7dfb9e6f270d26f8231e697))
+* **auth:** keep contact writes inside a restricted inspector's set ([3665205](https://github.com/InspectorHub/OpenInspection/commit/3665205b23d5e53ea56770ffe74852a4ac22006d))
+* **auth:** keep the calendar inside the inspection list's scope ([3767707](https://github.com/InspectorHub/OpenInspection/commit/37677076a7b0ddb838ccc586b833fa36e2f33502))
+* **auth:** make invite links resolve, latch same-frame form submits, keep hints under reserved error space ([fa7e6aa](https://github.com/InspectorHub/OpenInspection/commit/fa7e6aac84594a003a297ed3c9375346249bfa63))
+* **auth:** read the caller's capabilities only when money is involved ([cb48542](https://github.com/InspectorHub/OpenInspection/commit/cb485425b89d0a76897f891d230e821b3f7b5cb6))
+* **auth:** refuse anonymous API access by default and tighten send, assign and delete rules ([6336718](https://github.com/InspectorHub/OpenInspection/commit/6336718a3510da5e57d8a344df24735d6130be67))
+* **auth:** refuse anonymous API access by default and tighten who may send, assign and change inspections ([c0b1026](https://github.com/InspectorHub/OpenInspection/commit/c0b1026460153d5268bbcf71846382a83aaaa76b))
+* **auth:** require a role on analytics, usage, billing, integration status and the leaderboard ([a681fa2](https://github.com/InspectorHub/OpenInspection/commit/a681fa20fdd0489aa8aac94c98c9d2a102ba1b99))
+* **auth:** satisfy the two CI-only gates for the delete audit record ([1fe2dff](https://github.com/InspectorHub/OpenInspection/commit/1fe2dff997d0b5fbab3d8f3acfe3b615c46f71e0))
+* **auth:** stop exporting the path guard factory, nothing imports it ([ced989c](https://github.com/InspectorHub/OpenInspection/commit/ced989c50d7bf2802e41055bdf1d0a1a524d4be7))
+* **auth:** withhold open-inspection ids from a restricted viewer of the presence roster ([b3b8df2](https://github.com/InspectorHub/OpenInspection/commit/b3b8df27f241cf027d83791a3b2e232eb8709b9c))
+* **automation:** a suspended company sends nothing from cron; put the remaining full-screen overlays on the layer stack ([07c603a](https://github.com/InspectorHub/OpenInspection/commit/07c603a00f40d9399313954256795eef3f9e6d6a))
+* **availability:** answer 409 for a repeated blocking override and 400 for an unknown inspector ([88fc2c6](https://github.com/InspectorHub/OpenInspection/commit/88fc2c6237749310e85e4bb4e84a75aeb3963b86))
+* close review findings on the human check and the stepwise tests ([de721c3](https://github.com/InspectorHub/OpenInspection/commit/de721c344a4e45faa40200f2fc0c7a1112e77cbe))
+* close the findings of the independent code review (SMS, AI, send limits, removal, signatures, pay link) ([a16f380](https://github.com/InspectorHub/OpenInspection/commit/a16f380033bfff3de5c6ba395e633b7ee60d7fba))
+* close the second review's findings on the human check ([d579146](https://github.com/InspectorHub/OpenInspection/commit/d579146f55c6f69126ab1b668105ba03d4f03b3a))
+* contact update defaults, report-send allowance, send dialog polish and a real wiring test ([0029593](https://github.com/InspectorHub/OpenInspection/commit/00295939552d08c2eea2fda357fd42f2a740ce24))
+* **contacts:** an update that does not name the type leaves it alone ([aa3d425](https://github.com/InspectorHub/OpenInspection/commit/aa3d42563044b95cedbadefe870dad845af54310))
+* **contacts:** reuse a visible same-name client when a restricted creator gives no email ([c1a7fbb](https://github.com/InspectorHub/OpenInspection/commit/c1a7fbb774dfb4e1c41bc7a9673a59913163a5c5))
+* **create:** skip the pre-write look ahead when the request writes no contact ([07b427e](https://github.com/InspectorHub/OpenInspection/commit/07b427e0a339f0d12421a6dd1b0c4f84a1e242ee))
+* **cron:** ack on self-continuation send failure instead of retrying ([8384c14](https://github.com/InspectorHub/OpenInspection/commit/8384c149b7419497b98fbeeaf753fb1012a22e80))
+* **cron:** ack on self-continuation send failure instead of retrying (CF 10250) ([97aabf6](https://github.com/InspectorHub/OpenInspection/commit/97aabf6dfec2967cd80155e0415e4ccd1b668482))
+* **cron:** stop idle KV deletes and the always-true retention probe ([bf46dc3](https://github.com/InspectorHub/OpenInspection/commit/bf46dc36983fa814f0e8d3b0979d5f71c2a05c32))
+* **cron:** stop spending KV deletes on ticks that have nothing to do ([e279c06](https://github.com/InspectorHub/OpenInspection/commit/e279c0656d9819b725d7b9d4f180b433783f646e))
+* **deps:** patch dompurify and fast-uri advisories ([cf53eb7](https://github.com/InspectorHub/OpenInspection/commit/cf53eb76660553f598ac1c8861d91663207fc739))
+* **deps:** patch ip-address SSRF advisory ([cfe07c2](https://github.com/InspectorHub/OpenInspection/commit/cfe07c22873875f3c8ec2c46e1a90dc050833cb0))
+* **deps:** update dompurify and fast-uri ([d1a88a4](https://github.com/InspectorHub/OpenInspection/commit/d1a88a487a2b2cf32a46f39fb05b87cf7b597777))
+* **editor:** ask for the human check when publishing from the full-screen editor ([abda844](https://github.com/InspectorHub/OpenInspection/commit/abda844f4fa21906bab30299479e23bde1edfdeb))
+* **editor:** keep focus on the Publish button while the readiness check runs, so closing the dialog returns it ([11983dc](https://github.com/InspectorHub/OpenInspection/commit/11983dc5dbc1c1fa4fc25faf6cf035dbed5fec7e))
+* **editor:** keep the row and section "..." buttons focusable so a dialog they open can return focus ([a419cd6](https://github.com/InspectorHub/OpenInspection/commit/a419cd69fc907f7b3edcab2a634365020efed09d))
+* **editor:** portal the row and section "..." menus to the page body and keep keys inside them ([c621a23](https://github.com/InspectorHub/OpenInspection/commit/c621a2303d9ba5cd70bb764a637a61aaa0e529f7))
+* **email:** address PR 364 CI failures ([425f7cd](https://github.com/InspectorHub/OpenInspection/commit/425f7cdb0417d5df8558af776963963cd15f5b64))
+* **email:** resolve the email service per tenant on late-tenant routes; report Resend usage ([f8c86b4](https://github.com/InspectorHub/OpenInspection/commit/f8c86b454b343ab259cfe61b06982ebe18e36548))
+* **email:** resolve the email service per tenant on routes that learn their tenant late ([450a958](https://github.com/InspectorHub/OpenInspection/commit/450a95833680aaa401a6a616d886140c32ec36ee))
+* **email:** structured error handling and delivery_failed signer status ([049731c](https://github.com/InspectorHub/OpenInspection/commit/049731cf7385ca24040d18a8db6142f02dd741cb))
+* **email:** structured error handling, delivery_failed status, and type fixes ([b84a42e](https://github.com/InspectorHub/OpenInspection/commit/b84a42e3092b4ab9af3638386c6ff6d6d5362b0d))
+* **events:** a visit can only be created under an inspection of the caller's own company ([3cf12e4](https://github.com/InspectorHub/OpenInspection/commit/3cf12e4aaf9227b672aee860915945f1f5f11428))
+* **gate:** a bare aria-disabled does not protect a submit, only pendingProps' inert click does ([769878d](https://github.com/InspectorHub/OpenInspection/commit/769878db3e9b84c2fb1dd2799e4449037dbeef8c))
+* **gate:** escape every regex metacharacter in the tag name jsx-scan builds a pattern from ([41cbfe2](https://github.com/InspectorHub/OpenInspection/commit/41cbfe2951144210d10b79a3b2a29d38db9d7d8d))
+* **gate:** harden the jsx gate scanner and the three detectors against the shapes the review constructed ([18c520d](https://github.com/InspectorHub/OpenInspection/commit/18c520d79af7a38a34c854bed771acaabea061f6))
+* harden the pr-readiness check after independent review ([006525d](https://github.com/InspectorHub/OpenInspection/commit/006525d9963da890b980d2d4d1e839ee1ab8fd5e))
+* hosted sign-out also ends the identity service's session; explain a failed return; invitation page; remove the pr-readiness check ([4ed08b7](https://github.com/InspectorHub/OpenInspection/commit/4ed08b71f065283d2e9540212c7a1d2c308f3f4e))
+* **hub:** keep HubPayLinkGap module-private (dead-code gate) ([1356ff5](https://github.com/InspectorHub/OpenInspection/commit/1356ff532918813a1487a3b2e36ac37104cd6762))
+* **hub:** load the inspection hub without a pay link when one cannot be produced ([fc7ac2a](https://github.com/InspectorHub/OpenInspection/commit/fc7ac2a15d2834d1310c7629ffcab5602050ada9))
+* **i18n:** reuse the shared Back label and keep the skipped-recipient type private ([b5e3840](https://github.com/InspectorHub/OpenInspection/commit/b5e38405576c7e62eb3e952abb062322b6c160f2))
+* **i18n:** use the glossary term for Settings in the Check credentials message ([e38b27d](https://github.com/InspectorHub/OpenInspection/commit/e38b27d62e7750add3e104873441396c47d5255f))
+* **import:** a restricted caller cannot tell a hidden inspection from a missing one ([ca7a8e3](https://github.com/InspectorHub/OpenInspection/commit/ca7a8e392d30dc8f7fab73b15e8d924ac4b3824d))
+* **inspection:** a send that reached nobody keeps its dialog open and says why ([9e7c045](https://github.com/InspectorHub/OpenInspection/commit/9e7c045acf1e7405897e2aba11b69d7f07cdf746))
+* **inspections:** close the review findings on the order/inspection split ([421da77](https://github.com/InspectorHub/OpenInspection/commit/421da771aa3bfd8d859e14b69de7a2a13b4d1b7d))
+* **inspections:** office staff no longer see an inspector or a Submit button they cannot use ([6edb0ec](https://github.com/InspectorHub/OpenInspection/commit/6edb0ec502739b5b8cc99ec6f4bdffb421d1f6bf))
+* **isn:** tenant-scope the report lookup, fix the settings save fan-out ([1d0b351](https://github.com/InspectorHub/OpenInspection/commit/1d0b351391c6d1b0a5cda968c6e99491d6b44ce7))
+* **join:** give an invalid invitation a way forward, and tell returning users their password stays ([cc5caff](https://github.com/InspectorHub/OpenInspection/commit/cc5caffedc1d8be4062e70914f45491027707671))
+* **logging:** stop 4xx scanner traffic reading as errors, and mark alertable failures ([5eef03f](https://github.com/InspectorHub/OpenInspection/commit/5eef03f07c1e2dff3647552641ad259c69742cb4))
+* **logging:** stop 4xx scanner traffic reading as errors, and mark alertable failures ([9119e8e](https://github.com/InspectorHub/OpenInspection/commit/9119e8e9d455d7e206c2e3085ee2f97b52d84809))
+* make the pr-readiness text rules honest-friendly and mutation-resistant ([6a4341d](https://github.com/InspectorHub/OpenInspection/commit/6a4341d5b49f6f8c021ebacd63120e46256b0167))
+* **mcp:** answer resources/read of a missing record with InvalidParams ([a01cb72](https://github.com/InspectorHub/OpenInspection/commit/a01cb726a7c1a59573e7c0280dfac142730744e5))
+* **mcp:** stop offering multipart upload routes as MCP tools ([0e50aa1](https://github.com/InspectorHub/OpenInspection/commit/0e50aa1ce7c075e8a8f52b091e9062143a751222))
+* **native:** bound archive inflation, repair half-created inspections, tighten import and credential rules ([c277223](https://github.com/InspectorHub/OpenInspection/commit/c277223444de9eb4ad265fe96f8ac9fd1876a545))
+* **native:** clear the remaining import and results-document debts ([a402e9a](https://github.com/InspectorHub/OpenInspection/commit/a402e9a1c58830ddc237865418a4ebde6e2e2680))
+* **native:** close the MCP surface on native-only deployments; harden grants and the version handshake ([0347fb3](https://github.com/InspectorHub/OpenInspection/commit/0347fb35e235d6e1cd106e0030358d0021f1d885))
+* **native:** do not revoke a healthy grant on a transient marker read error ([8ad3eba](https://github.com/InspectorHub/OpenInspection/commit/8ad3eba036f7d3a86409e8433b7d72e2bd1cbbb4))
+* **native:** durable replay record for package writes; import media and results before queued writes ([4ad302b](https://github.com/InspectorHub/OpenInspection/commit/4ad302b0dd34b4731f583f35db9ef444fb408617))
+* **native:** fail closed when native clients are off; restrict native redirect URIs ([6c418d7](https://github.com/InspectorHub/OpenInspection/commit/6c418d7ffea7be70d533cd82d95b06c75c565d45))
+* **native:** finish a client-id create on replay ([8a53eba](https://github.com/InspectorHub/OpenInspection/commit/8a53eba2cf59b1158a8685a3cd50813f79400af4))
+* **native:** keep the contract tooling out of the product tree; order the e2e project after two-factor ([c2db941](https://github.com/InspectorHub/OpenInspection/commit/c2db941b0afc623a2826b4b9432f828cc7185ec6))
+* **native:** keep ticket, presence and video upload calls out of the 426 rule ([c8d116d](https://github.com/InspectorHub/OpenInspection/commit/c8d116d53a3fd2824aa8d289f5d5da21a71bc429))
+* **native:** re-check membership when redeeming a socket ticket; drop credentials for app origins ([96936b4](https://github.com/InspectorHub/OpenInspection/commit/96936b477c392936bbc558c3785666e3c8875e69))
+* **native:** record package creates; refuse a package whose created inspection was deleted ([fe7bb0c](https://github.com/InspectorHub/OpenInspection/commit/fe7bb0ce0f027c3bd76aa724b45b90a7df8d3e3c))
+* **native:** require PKCE S256, show the redirect scheme, harden flag-off paths ([c08b954](https://github.com/InspectorHub/OpenInspection/commit/c08b954dfee6bde358ab49f7ed6f99b62436ceb9))
+* **native:** reuse an existing contact when a client-id create names the client ([1526f2e](https://github.com/InspectorHub/OpenInspection/commit/1526f2edaa9b279747e7c2bb815ae106e8067e11))
+* **native:** revoke grants on credential change; resolve role, scope from current state ([3faf605](https://github.com/InspectorHub/OpenInspection/commit/3faf605236fd62d4f134e49c287283d04ff7af9f))
+* **native:** scope package replay records to their inspection ([6a2ffc9](https://github.com/InspectorHub/OpenInspection/commit/6a2ffc9d4dd2e2ed44206030c12f42c5e80f27b1))
+* **native:** single-spend concurrent creates; check inspection and issuer on public uploads ([cdd502a](https://github.com/InspectorHub/OpenInspection/commit/cdd502ae188f70d2f36615e3b172c55369a11699))
+* **native:** skip snapshot for no-op imports; expose a bytes-in import function ([e05ab70](https://github.com/InspectorHub/OpenInspection/commit/e05ab702fc48690e6814cdd5e52c9f21afd32401))
+* owner hub 500; Free plan has no platform texts; clearer permission refusals ([17fd868](https://github.com/InspectorHub/OpenInspection/commit/17fd868908fd7d29dea7eda832635f3d73cd95b0))
+* **permissions:** keep the screens in step with the server's rules, and pin them with tables ([090df9c](https://github.com/InspectorHub/OpenInspection/commit/090df9c3510c745b3e1e137d1eb9a820bdef4cfd))
+* **permissions:** one scheduleOthers rule for messaging and deleting, honest refusal copy, account mail exempt from the free cap ([f09a2c6](https://github.com/InspectorHub/OpenInspection/commit/f09a2c6913d4d0112108aeab7c8b5873d5d6e380))
+* **permissions:** remaining refusals name the role and the way forward; staff create paths documented ([03fd187](https://github.com/InspectorHub/OpenInspection/commit/03fd187e717ea2b30e788f751d62e3be31475a51))
+* **permissions:** the agent-area refusal says to sign in with an agent account ([e7fed3d](https://github.com/InspectorHub/OpenInspection/commit/e7fed3d05a0f7e7a5f8e1677f227c203b61941b3))
+* **permissions:** the rest of the refusals with a request context name the role and the way forward ([263335e](https://github.com/InspectorHub/OpenInspection/commit/263335e3f0d1ceb67a2310db8c0d027c6a867b1e))
+* **qbo:** accept the session token as a Bearer credential on the QuickBooks API routes ([fa79de8](https://github.com/InspectorHub/OpenInspection/commit/fa79de8c58e5e72750bd6385c31c2e0a2475a1f3))
+* **qbo:** build the search literal character by character ([e9a5aba](https://github.com/InspectorHub/OpenInspection/commit/e9a5abaa22db434a92fe3deb42a22c9f537be2a0))
+* **qbo:** escape the search text for LIKE in a single pass ([2a05d3d](https://github.com/InspectorHub/OpenInspection/commit/2a05d3daaa1fab526222b9355b94937d50ff7a0a))
+* **qbo:** keep the re-send time budget private ([cf7a4b6](https://github.com/InspectorHub/OpenInspection/commit/cf7a4b6ce98cb63e6c94399c44bff7197e35ceaa))
+* **qbo:** make Sync now report what it did, name the contact on attention rows, search without escapes Intuit ignores ([bd30362](https://github.com/InspectorHub/OpenInspection/commit/bd30362baceda9b9cc278811e799fa0d8ab01f52))
+* **qbo:** send the session JWT as Bearer on the settings page's API calls ([b2d3143](https://github.com/InspectorHub/OpenInspection/commit/b2d314382a16e5dab7c69e02cebd5bb659675b0a))
+* read the Chrome observation after the tokens, not after the last dash ([2558870](https://github.com/InspectorHub/OpenInspection/commit/2558870c6299b127fa11dc0b5bd5b74da06f8fa3))
+* register the no-store header after the inspection path guard ([fa341b0](https://github.com/InspectorHub/OpenInspection/commit/fa341b08f20cc88b589488461fc89d8fd5f8fc32))
+* replace free-text Chrome interpretation with explicit tokens ([886ea65](https://github.com/InspectorHub/OpenInspection/commit/886ea6572ca88c0ed03f75c1e09ba981123ec01f))
+* **reports:** keep the allowance for recipients delivered before a batch-wide refusal, and the hour of earlier sends ([b96eaf0](https://github.com/InspectorHub/OpenInspection/commit/b96eaf084ca56fad7d82e12d616675ad7388b418))
+* **reports:** note a delivery before the audit write that follows it ([8df0b82](https://github.com/InspectorHub/OpenInspection/commit/8df0b8255c3c7751d1567f2c5bab8dfb4a32bebe))
+* **reports:** separate the stored count and expiry with a bar ([c175282](https://github.com/InspectorHub/OpenInspection/commit/c175282cf1a578d80902eace3d82403347cb24dd))
+* **reports:** the hourly send allowance counts reports delivered, not requests ([fb2f09a](https://github.com/InspectorHub/OpenInspection/commit/fb2f09a487deaad2ba274ff2fdc5874f4e3bf8d3))
+* restricted-creator contact reuse, FK 500s, drawer and send feedback, hydration errors ([5478d0b](https://github.com/InspectorHub/OpenInspection/commit/5478d0bc3558cd8fb0ee2da89e6343f5965c2eb9))
+* **restricted-inspector:** atomic create, contact reuse that cannot redirect notices, scoped FK answers, agent-link scope ([932e72f](https://github.com/InspectorHub/OpenInspection/commit/932e72f4f673355dea200891379955bcda2a9787))
+* review findings on role messages, restricted-inspector scope and send dialogs ([2a84181](https://github.com/InspectorHub/OpenInspection/commit/2a84181bbffcb1eb1c077a1904c1712b426abe27))
+* **review:** right guidance on two denial screens; no client email in the hub warning ([f4caf92](https://github.com/InspectorHub/OpenInspection/commit/f4caf928ea5fa2a3024751fda48488d3a7eb081c))
+* say so when the server cannot be reached, align QuickBooks panel tokens, tidy public docs ([5c148d8](https://github.com/InspectorHub/OpenInspection/commit/5c148d8ba1e3df7a3f80f31a67c47d6b8076ec28))
+* **scope:** creating an inspection cannot reuse or link a contact the caller cannot see ([66deaa6](https://github.com/InspectorHub/OpenInspection/commit/66deaa6406b7383d661efc56fa01c79c5aff4b97))
+* **scope:** ids in a request body cannot be used to probe or widen a restricted caller's view ([4a911fb](https://github.com/InspectorHub/OpenInspection/commit/4a911fbac39065557bf893ce760b2be62ed35cb1))
+* **scope:** make the referrer guard's scope a required parameter ([cb4932a](https://github.com/InspectorHub/OpenInspection/commit/cb4932ae095c2e4e14ef3e24ffab2299dbb22d3b))
+* second review pass on the human check, and put the code back in the file's own style ([fa2ced9](https://github.com/InspectorHub/OpenInspection/commit/fa2ced9973e2227640e4b39e493268bba9fc9b21))
+* **send:** a permanent status region for the result announcement, and a plainer plan-limit sentence ([9bf705d](https://github.com/InspectorHub/OpenInspection/commit/9bf705d202fad8454003c9029ed444bdb9396bd4))
+* **send:** announce the result, say Back and Done are not ready, scope the plan mapping, neutral wording ([1c07eb1](https://github.com/InspectorHub/OpenInspection/commit/1c07eb13929b56c0f7124978725167409b5c487b))
+* **send:** keep the server-error mapper module-private ([83fe0fb](https://github.com/InspectorHub/OpenInspection/commit/83fe0fb7bdfa6fe9e70cf9dd5bd9a62f2020d897))
+* **send:** keep the settle interval module-private ([e3704e7](https://github.com/InspectorHub/OpenInspection/commit/e3704e7d553ebe16cb906b479ae4eda5991f7b8f))
+* **send:** plan refusals in the viewer's language, a self-explanatory Back, and no stray click on Done ([a17f487](https://github.com/InspectorHub/OpenInspection/commit/a17f487b10d8b922781390809977e0102caafdd0))
+* service worker no longer serves one user's cached data to the next user; sidebar shows who is signed in and a visible collapse button ([08265b6](https://github.com/InspectorHub/OpenInspection/commit/08265b61ae909453701cdc9a69db3ced8f997ec0))
+* sidebar shows who is signed in, not the company again; collapse button is always visible ([bd16ea6](https://github.com/InspectorHub/OpenInspection/commit/bd16ea6eb8a613b8cf2fca1e1caebb08e516cf0d))
+* **sms:** drop the shared sender, scope STOP/START to one company, align dedicated numbers and wording ([e704c2e](https://github.com/InspectorHub/OpenInspection/commit/e704c2ec8bcfddbd37d61f8545f29e780621f80f))
+* strip HTML comments to a fixed point in pr-readiness ([1290e45](https://github.com/InspectorHub/OpenInspection/commit/1290e458a6d2e4f0cb67b0e2735c1173408eae31))
+* submit the gated forms reliably, and satisfy the CI-tier gates ([cc44043](https://github.com/InspectorHub/OpenInspection/commit/cc44043483def76bfabf6ffd04464a6e1aaac3a8))
+* **team:** choosing "all inspections" beside a permission template is saved ([06555ef](https://github.com/InspectorHub/OpenInspection/commit/06555ef89daa053d535f6b2b4e15b267765e2efd))
+* **team:** close the follow-ups on the manager grant limit ([2b32631](https://github.com/InspectorHub/OpenInspection/commit/2b32631b1c39d6e4082433d7a6d5d996886017dc))
+* **team:** drop three unused exports and record the template routes' API calls in the fan-out baseline ([00e1dc7](https://github.com/InspectorHub/OpenInspection/commit/00e1dc72e106bc5c15d2bfbe9be16de3fdcb62ee))
+* **team:** hide the Pending Invites tab from people who cannot manage the team ([59eca31](https://github.com/InspectorHub/OpenInspection/commit/59eca31d5947cb13a42bbe95c4e6ca0449427a01))
+* **team:** only owners may remove, demote, invite or promote owners ([92b297b](https://github.com/InspectorHub/OpenInspection/commit/92b297b2f20c3df42a545a8a970c2b77ca8e93cd))
+* **team:** the "Assigned only" badge reads at 4.5:1 or better in light mode ([d97fd72](https://github.com/InspectorHub/OpenInspection/commit/d97fd72e7a642b8f06e711d83a24333c8e90fcbe))
+* **team:** the invite drawer opens empty after a send or a cancel ([81459f6](https://github.com/InspectorHub/OpenInspection/commit/81459f66da52fde118207ff28aef5abc299e3ae9))
+* **team:** the legacy invite route refuses templateId instead of granting the plain role ([350eeb7](https://github.com/InspectorHub/OpenInspection/commit/350eeb764a4b8485d4b11a93d184da6f91f9aa09))
+* the service worker no longer serves one user's cached API data to the next user ([fff3c31](https://github.com/InspectorHub/OpenInspection/commit/fff3c31a52ab46fda8a674ea3dd65a78fbde1870))
+* third review pass on the human check ([51d7885](https://github.com/InspectorHub/OpenInspection/commit/51d788535b0654a759316f90abff59dc4538e50a))
+* **types:** resolve all type-check errors from email provider refactor ([59fc28e](https://github.com/InspectorHub/OpenInspection/commit/59fc28e73471831915b0baa7d24b81a5e2c610bd))
+* **types:** resolve paraglide TS7016 by including generated .d.ts in tsconfig ([aba24b8](https://github.com/InspectorHub/OpenInspection/commit/aba24b844ac675f1d55765aab761bb85f0b72721))
+* **ui:** absorb the second click of a double click on a confirm that closes on the first ([5a95b1c](https://github.com/InspectorHub/OpenInspection/commit/5a95b1ce322b886aa9320bc044acd3fe6394562c))
+* **ui:** drawers and modals reopen after a successful save ([4aae6c7](https://github.com/InspectorHub/OpenInspection/commit/4aae6c787dcb79ca07be773a8c4ae0c36a516dcc))
+* **ui:** drop LayerHandle.isTop, nothing reads it since the trap uses coverage() ([0f0d3b8](https://github.com/InspectorHub/OpenInspection/commit/0f0d3b891e386ee231c5441bbc873ac331bdf403))
+* **ui:** finish moving busy-disabled actions to pending, and give IconButton the same state ([d279c45](https://github.com/InspectorHub/OpenInspection/commit/d279c45414db41566108a9962b47ced808992e5f))
+* **ui:** gate the two defect classes found by hand, and clear what the gates found ([2e689ae](https://github.com/InspectorHub/OpenInspection/commit/2e689ae1598eb4c5e61dd093983688bb8a5e9711))
+* **ui:** give dialog triggers one shared way to keep focus, so closing a dialog returns it ([b07a0b3](https://github.com/InspectorHub/OpenInspection/commit/b07a0b3ff32a5ede28218b51c17d91c93d1a72fe))
+* **ui:** give every bare submit a busy guard, stop forms that empty themselves from dropping focus, park closed drawers ([793a416](https://github.com/InspectorHub/OpenInspection/commit/793a416176382e2d142797aa0e8ef9578691df37))
+* **ui:** give every trigger that opens or closes a dialog while busy one shared way to keep focus ([25015df](https://github.com/InspectorHub/OpenInspection/commit/25015df682338dfa215db552f25acc271396dcc9))
+* **ui:** guard every remaining write that a render-based pending state cannot stop, and make the gate see them ([8cf1e1d](https://github.com/InspectorHub/OpenInspection/commit/8cf1e1d1ecbaa6e059f27a8fdae1709248b84160))
+* **ui:** guard remaining writes and check the double-submit guard per call ([9317cd7](https://github.com/InspectorHub/OpenInspection/commit/9317cd7eb0a3957166f223b281f8631b9f36e316))
+* **ui:** guard the writes the wider gate now sees, and drop two latches that could swallow a real action ([8b406a7](https://github.com/InspectorHub/OpenInspection/commit/8b406a728aea569b9bcdf662b40e3453447222c9))
+* **ui:** harden the shared dialog stack, move the remaining hand-rolled overlays onto it, and gate new ones ([71ba3c6](https://github.com/InspectorHub/OpenInspection/commit/71ba3c64c35e83d5fe3c5305108ae3d451459136))
+* **ui:** keep focus on busy actions and latch every submit ([6923c8b](https://github.com/InspectorHub/OpenInspection/commit/6923c8b2510af0eb33f8eb5d7b7c6a724302f515))
+* **ui:** keep focus on every button that starts async work, and latch the signing submits ([0b7d08e](https://github.com/InspectorHub/OpenInspection/commit/0b7d08e9aa2ca8b10bf2a546da393e988b72f1da))
+* **ui:** latch every form whose submit button only goes inert after a render, and gate the class ([c7b10ba](https://github.com/InspectorHub/OpenInspection/commit/c7b10ba3901b35bc38a305d4b98b09be83d0b0c9))
+* **ui:** latch forms and shield closing dialogs against double clicks ([106a876](https://github.com/InspectorHub/OpenInspection/commit/106a87650951a406c7b4696378d76f1368d98049))
+* **ui:** layer stack review fixes — visibility-gated layers, trap awareness, focus restore ([8701194](https://github.com/InspectorHub/OpenInspection/commit/8701194015ab7adb49ef6ef492bbd5850e893a52))
+* **ui:** let Escape reach a focused menu item, keep the open menu's trigger visible, and give the bottom drawer a real dialog ([925e081](https://github.com/InspectorHub/OpenInspection/commit/925e08136ffed167fc153ac75bb8941a60b98633))
+* **ui:** move focus into a popover only once it is visible, so the first open takes it too ([76d887d](https://github.com/InspectorHub/OpenInspection/commit/76d887dfa38a79ef348a9d7bd1c2e79b5f8fcceb))
+* **ui:** one overlay layer stack so only the topmost dialog answers the keyboard ([f82bb61](https://github.com/InspectorHub/OpenInspection/commit/f82bb612a04610a6a3c552cd8152aba36729b45d))
+* **ui:** only the topmost dialog answers the keyboard, and the page stays locked until the last one closes ([4eb91c2](https://github.com/InspectorHub/OpenInspection/commit/4eb91c266b8a9741468b4410b19e78181859287a))
+* **ui:** raise the close shield for dialogs that unmount, and not over a dialog that is standing ([881ce55](https://github.com/InspectorHub/OpenInspection/commit/881ce5535d33de64186965b48a8745ab300f07df))
+* **ui:** reopen the in-flight latches that waited for a busy flag their callers never raise ([38dbfb7](https://github.com/InspectorHub/OpenInspection/commit/38dbfb721380aec6f7dda3b7aefd17d3382eb13b))
+* **ui:** send dialogs, drawers and hub explain themselves and cannot repeat a send ([68616aa](https://github.com/InspectorHub/OpenInspection/commit/68616aa48777aa6d3529674b384f8b78b6638d3f))
+* **ui:** size the reserved Input slot to the taller of hint and error so a blur error cannot move the button ([c511b9e](https://github.com/InspectorHub/OpenInspection/commit/c511b9e97418160014b5fbc6cf647ccd3eb2dac6))
+* **webhooks:** register the two webhook limiters and follow the limiter's new shape in its source check ([df7541a](https://github.com/InspectorHub/OpenInspection/commit/df7541afbc0afde4fb4bd4e73ca75b125da88de7))
+* **webhooks:** verify inbound webhooks with the company's own secret and bound unauthenticated ingress ([785fd87](https://github.com/InspectorHub/OpenInspection/commit/785fd877f57337e3b9cf338d6f81bc105f099160))
+* **webhooks:** verify with the company's own secret and bound unauthenticated ingress ([e4307ed](https://github.com/InspectorHub/OpenInspection/commit/e4307ed0e171a814223305fd20a5c8e2a38213d8))
+* **workflow:** send the signed-evidence email when only a tenant provider is configured ([28d05e6](https://github.com/InspectorHub/OpenInspection/commit/28d05e64580635d1d34714bff1ff10cb621afb37))
+
 ## [2.2.0](https://github.com/InspectorHub/OpenInspection/compare/openinspection-v2.1.0...openinspection-v2.2.0) (2026-09-15)
 
 
diff --git a/package-lock.json b/package-lock.json
index 368ecf4f5..b9eb099f0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "openinspection",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "openinspection",
-      "version": "2.2.0",
+      "version": "2.3.0",
       "hasInstallScript": true,
       "dependencies": {
         "@cloudflare/workers-oauth-provider": "1.2.3",
diff --git a/package.json b/package.json
index 40458b9ef..789a5e4e2 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "openinspection",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "private": false,
   "type": "module",
   "repository": {