Bump versions for v11.02

Archive board deletion is available through the gated, confirmed board
multi-selection action. Card multi-selection now uses one awaited and
server-authorized bulk archive operation, preserving the selection and showing
the server error when it fails.

Thanks to Nissulya and xet7 !

Fixes #6608.

.codex/config.toml

@@ -0,0 +1,5 @@
+# Project-scoped Codex configuration.
+#
+# Claude has no non-default tool permissions or MCP servers configured for this
+# repository, so there are no settings to translate here. Project instructions
+# live in AGENTS.md and the nested AGENTS.md files.

.devcontainer/Dockerfile

@@ -126,6 +126,8 @@ ENV \
     HEADER_LOGIN_FIRSTNAME="" \
     HEADER_LOGIN_LASTNAME="" \
     HEADER_LOGIN_EMAIL="" \
+    HEADER_LOGIN_TRUSTED_IPS="" \
+    HEADER_LOGIN_TRUSTED_PROXIES="" \
     LOGOUT_WITH_TIMER=false \
     LOGOUT_IN="" \
     LOGOUT_ON_HOURS="" \

.devcontainer/docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3.7'
-
 services:
 
   wekandb-dev:

.eslintrc.json

@@ -20,7 +20,10 @@
     "strict": 0,
     "no-undef": 0,
     "accessor-pairs": 2,
-    "comma-dangle": [2, "always-multiline"],
+    "comma-dangle": [
+      2,
+      "always-multiline"
+    ],
     "consistent-return": 2,
     "dot-notation": 2,
     "eqeqeq": 2,
@@ -28,15 +31,28 @@
     "no-cond-assign": 2,
     "no-constant-condition": 2,
     "no-eval": 2,
-    "no-inner-declarations": [0],
+    "no-inner-declarations": [
+      0
+    ],
     "no-unneeded-ternary": 2,
     "radix": 2,
-    "semi": [2, "always"],
-    "camelcase": [2, { "properties": "never" }],
+    "semi": [
+      2,
+      "always"
+    ],
+    "camelcase": [
+      2,
+      {
+        "properties": "never"
+      }
+    ],
     "comma-spacing": 2,
     "comma-style": 2,
     "eol-last": 2,
-    "linebreak-style": [2, "unix"],
+    "linebreak-style": [
+      2,
+      "unix"
+    ],
     "meteor/audit-argument-checks": 0,
     "new-parens": 2,
     "no-lonely-if": 2,
@@ -45,7 +61,13 @@
     "no-spaced-func": 2,
     "no-trailing-spaces": 2,
     "operator-linebreak": 2,
-    "quotes": [2, "single", { "avoidEscape": true }],
+    "quotes": [
+      2,
+      "single",
+      {
+        "avoidEscape": true
+      }
+    ],
     "semi-spacing": 2,
     "space-unary-ops": 2,
     "arrow-spacing": 2,
@@ -57,6 +79,7 @@
     "prefer-spread": 2,
     "prefer-template": 2,
     "no-unused-vars": "warn",
+    "@typescript-eslint/no-floating-promises": "error",
     "prettier/prettier": [
       "error",
       {
@@ -72,11 +95,18 @@
   "settings": {
     "import/resolver": {
       "meteor": {
-        "extensions": [".js", ".jsx"]
+        "extensions": [
+          ".js",
+          ".jsx"
+        ]
       }
     }
   },
-  "plugins": ["prettier", "meteor"],
+  "plugins": [
+    "prettier",
+    "meteor",
+    "@typescript-eslint"
+  ],
   "globals": {
     "Meteor": false,
     "Session": false,
@@ -95,7 +125,6 @@
     "_": false,
     "Avatar": true,
     "Avatars": true,
-
     "CollectionHooks": false,
     "ESSearchResults": false,
     "FastRender": false,
@@ -110,7 +139,7 @@
     "Ps": true,
     "Restivus": false,
     "SimpleSchema": false,
-"T9n": false,
+    "T9n": false,
     "TAPi18n": false,
     "AccountsTemplates": true,
     "Activities": true,

.github/dependabot.yml

@@ -4,3 +4,40 @@ updates:
   directory: "/"
   schedule:
       interval: "weekly"
+- package-ecosystem: "npm"
+  directory: "/"
+  schedule:
+      interval: "weekly"
+  ignore:
+      # Build-time-only (devDependency) Rspack toolchain. These packages compile
+      # the bundle on the developer / CI machine and are NOT shipped in the
+      # deployed WeKan server or client bundle, so their advisories do not affect
+      # a running WeKan instance. (For example webpack-dev-server / @rspack/dev-
+      # server, pulled via @rspack/cli, and the socket.io/ws chain pulled via
+      # @rsdoctor/rspack-plugin, never run in WeKan — it builds with `meteor run`,
+      # not the Rspack CLI or dev-server.)
+      #
+      # They also cannot simply be removed or bumped:
+      #   * @meteorjs/rspack re-pins and re-installs @rspack/cli and
+      #     @rsdoctor/rspack-plugin into package.json on every build, so deleting
+      #     them does not stick.
+      #   * The only upgrades Dependabot/npm offer are build-breaking: a
+      #     @meteorjs/rspack downgrade, or @rspack/cli 2.0 / Rspack 2.0, which
+      #     needs Meteor 3.6 (see https://github.com/meteor/meteor/pull/14360).
+      #     WeKan currently runs METEOR@3.5-rc.2.
+      #
+      # So pin them here until Meteor 3.6 + Rspack 2.0 land, then revisit.
+    - dependency-name: "@meteorjs/rspack"
+    - dependency-name: "@rspack/core"
+    - dependency-name: "@rspack/cli"
+    - dependency-name: "@rsdoctor/rspack-plugin"
+    - dependency-name: "css-loader"
+    - dependency-name: "style-loader"
+# Playwright end-to-end test harness — pure test-only tooling that never ships in
+# WeKan. It now depends only on @playwright/test and the official `mongodb` driver
+# (the heavy, CVE-prone `mongosh` CLI was replaced by helpers/mongo-runner.js).
+# Watch this directory so those two stay patched.
+- package-ecosystem: "npm"
+  directory: "/tests/playwright"
+  schedule:
+      interval: "weekly"

.github/workflows/AppImage.yml

@@ -0,0 +1,417 @@
+name: AppImage
+
+# Build WeKan as an AppImage for every CPU an AppImage runtime exists for, and
+# attach them to the newest WeKan release.
+#
+# WHAT IS INSIDE IS WHAT WEKAN ALREADY SHIPS. release-all.yml already produces a
+# bundle that runs offline with nothing installed: the Meteor server (main.js),
+# the bundled Node.js the release was built against, the wekan/FerretDB v1 fork
+# with its embedded pure-Go SQLite backend, the wekan/mongo-tools-patches binaries, the
+# cpu-exec/qemu-user shim from #6458, and start-wekan.sh to bring them up. That
+# bundle is already relocatable and already self-contained - it is the offline
+# zip people download today - so this workflow does NOT rebuild WeKan. It takes
+# the wekan-<version>-<arch>.zip off the release and wraps it, which means the
+# AppImage is byte-for-byte the same server, Node and FerretDB as the zip beside
+# it rather than a second build that might differ.
+#
+# So there is no MongoDB to install, no Node to install, and no database server
+# to run: FerretDB v1 keeps everything in SQLite files under the AppImage's data
+# directory. One download, one file, double-click.
+#
+# WHICH CPUs. An AppImage needs a runtime binary for its architecture, and those
+# exist for x86_64, aarch64, armhf and i686. WeKan publishes Linux bundles for
+# amd64 and arm64, so those are the two that can be wrapped: x86_64 from amd64,
+# aarch64 from arm64. Each is built on a runner of its own CPU, because
+# appimagetool has to run on the architecture it is packing for. If a bundle for
+# another architecture appears on a release, add it to the matrix and it will be
+# wrapped the same way.
+#
+# WHERE THE DATA GOES. A .deb or a container has somewhere obvious to put its
+# data; an AppImage is one file that may live on a USB stick, and the one place
+# it can always write is the user's home. WRITABLE_PATH defaults to
+# ~/.local/share/wekan here, so running the AppImage twice keeps the same boards,
+# and setting WRITABLE_PATH yourself still overrides it - the launcher's own
+# variables all still work.
+
+on:
+  # Callable, so release-all-missing.yml can ask for just the architectures
+  # a release is short of. The build itself stays here - a second copy of the
+  # appimages build would drift from this one.
+  workflow_call:
+    inputs:
+      tag:
+        required: false
+        type: string
+      publish:
+        required: false
+        default: true
+        type: boolean
+      only:
+        description: 'Only build these architectures, as a JSON array (e.g. ["aarch64"]); empty = all'
+        required: false
+        default: ''
+        type: string
+
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to wrap and attach to (empty = newest release)'
+        required: false
+        type: string
+      publish:
+        description: 'Attach the AppImages to the release'
+        required: false
+        default: true
+        type: boolean
+      only:
+        description: 'Only build these architectures, as a JSON array (e.g. ["aarch64"]); empty = all'
+        required: false
+        default: ''
+        type: string
+
+permissions:
+  contents: write
+
+concurrency:
+  group: wekan-appimage-${{ inputs.tag || github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: find the release
+    runs-on: ubuntu-24.04
+    outputs:
+      tag: ${{ steps.find.outputs.tag }}
+      version: ${{ steps.find.outputs.version }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - id: find
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          tag='${{ inputs.tag }}'
+          # --repo on every gh call, whether or not the job happens to have
+          # checked out: a call that relies on an inferred remote breaks the day
+          # somebody removes the checkout, and the error it gives - "fatal: not
+          # a git repository" - names neither gh nor the workflow.
+          [ -n "$tag" ] || tag="$(gh release list --repo "${{ github.repository }}" \
+            --limit 1 --json tagName --jq '.[0].tagName')"
+          if [ -z "$tag" ]; then
+            echo "::error::No release to wrap, and no tag was given."
+            exit 1
+          fi
+          # The bundles are named wekan-10.57-amd64.zip against tag v10.57.
+          version="${tag#v}"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "Wrapping the bundles from $tag (version $version)"
+
+  build:
+    name: AppImage ${{ matrix.appimage_arch }}
+    needs: release
+    runs-on: ${{ matrix.runs_on }}
+    # A 32-bit job that cannot run on the runner it was given must not fail the
+    # release for the architectures that built fine.
+    continue-on-error: ${{ matrix.tolerate_failure || false }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - appimage_arch: x86_64
+            bundle_arch: amd64
+            runs_on: ubuntu-24.04
+          - appimage_arch: aarch64
+            bundle_arch: arm64
+            runs_on: ubuntu-24.04-arm
+          # The other two architectures an AppImage runtime EXISTS for. There
+          # are four in total - x86_64, aarch64, i686, armhf - and that is the
+          # whole limit: the runtime is the ELF the kernel executes, so an
+          # architecture with no runtime cannot have an AppImage at all. That is
+          # why ppc64le, s390x, riscv64 and loong64 are not here and never will
+          # be; they are served by the bundle zip and the .deb.
+          #
+          # i686 builds on the x86_64 runner, which runs 32-bit x86 natively -
+          # no emulation, no multiarch, and appimagetool-i686 runs as-is.
+          - appimage_arch: i686
+            bundle_arch: i386
+            runs_on: ubuntu-24.04
+          # armhf builds on the aarch64 runner, which runs 32-bit ARM only if
+          # the kernel was built with CONFIG_COMPAT and the 32-bit loader is
+          # installed. GitHub does not promise either, so this one is allowed to
+          # fail without taking the release with it - the same treatment TSC
+          # gives its emulated armhf job. If it turns out to work reliably,
+          # drop the flag; if it never does, drop the entry.
+          - appimage_arch: armhf
+            bundle_arch: armhf
+            runs_on: ubuntu-24.04-arm
+            tolerate_failure: true
+    # WHICH entries this run wants, decided here because it cannot be decided
+    # where it belongs. A job-level `if:` cannot see `matrix` - GitHub exposes
+    # that context to runs-on, env, name, steps and a few others, but not to a
+    # job's own condition - and a workflow that tries answers
+    #   Unrecognized named-value: 'matrix'
+    # and refuses to load at all, taking every workflow that CALLS it with it.
+    # A job-level env CAN see matrix, so the answer is computed once here and
+    # every step below asks for it.
+    env:
+      BUILD_THIS: ${{ inputs.only == '' || contains(fromJSON(inputs.only), matrix.appimage_arch) }}
+
+    steps:
+      - uses: actions/checkout@v7
+        if: ${{ env.BUILD_THIS == 'true' }}
+
+      # An AppImage only WRAPS an existing release bundle
+      # (wekan-<version>-<arch>.zip); it cannot build one. When this workflow is
+      # asked to fill a gap for a release whose base bundle is not published yet
+      # (release in progress, or it failed), `gh release download` finds "no
+      # assets to download" and the job failed hard. Turn that into a graceful
+      # skip: if the bundle this arch needs is not on the release, flip BUILD_THIS
+      # off so every step below (all gated on it) is skipped with a notice. The
+      # AppImage is built normally once the base bundle exists.
+      - name: Skip this arch if its release bundle is not published yet
+        if: ${{ env.BUILD_THIS == 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          zip="wekan-${{ needs.release.outputs.version }}-${{ matrix.bundle_arch }}.zip"
+          if gh release view --repo "${GITHUB_REPOSITORY:-wekan/wekan}" '${{ needs.release.outputs.tag }}' --repo "${{ github.repository }}" \
+               --json assets --jq '.assets[].name' 2>/dev/null | grep -qx "$zip"; then
+            echo "OK: $zip is on ${{ needs.release.outputs.tag }}; building its AppImage."
+          else
+            echo "::notice::$zip is not on ${{ needs.release.outputs.tag }} yet - skipping this AppImage (it can only wrap a bundle that exists)."
+            echo "BUILD_THIS=false" >> "$GITHUB_ENV"
+          fi
+
+      - name: Fetch the release bundle for this architecture
+        if: ${{ env.BUILD_THIS == 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          zip="wekan-${{ needs.release.outputs.version }}-${{ matrix.bundle_arch }}.zip"
+          gh release download '${{ needs.release.outputs.tag }}' \
+            --repo "${{ github.repository }}" --pattern "$zip" --clobber
+          unzip -q "$zip"
+          # A zip that exists is not a bundle that runs; these are the two files
+          # the AppImage is built around.
+          for f in bundle/main.js bundle/node bundle/ferretdb bundle/start-wekan.sh; do
+            if [ ! -e "$f" ]; then
+              echo "::error::$zip has no $f - it is not a runnable WeKan bundle."
+              exit 1
+            fi
+          done
+          chmod +x bundle/node bundle/ferretdb bundle/start-wekan.sh
+          du -sh bundle
+
+      - name: Build the AppDir
+        if: ${{ env.BUILD_THIS == 'true' }}
+        run: |
+          set -euo pipefail
+          version='${{ needs.release.outputs.version }}'
+          rm -rf AppDir
+          mkdir -p AppDir/usr/lib/wekan AppDir/usr/share/applications \
+                   AppDir/usr/share/icons/hicolor/512x512/apps
+          cp -a bundle AppDir/usr/lib/wekan/bundle
+
+          # WeKan's own icon, from public/. 512x512 is what appimagetool wants
+          # for the thumbnail a desktop shows.
+          cp public/android-chrome-512x512.png \
+             AppDir/usr/share/icons/hicolor/512x512/apps/wekan.png
+          cp AppDir/usr/share/icons/hicolor/512x512/apps/wekan.png AppDir/wekan.png
+
+          cat > AppDir/usr/share/applications/wekan.desktop <<'DESKTOP'
+          [Desktop Entry]
+          Type=Application
+          Name=WeKan
+          GenericName=Kanban board
+          Comment=Open Source kanban board with FerretDB and Node.js included
+          Exec=wekan
+          Icon=wekan
+          Terminal=true
+          Categories=Office;ProjectManagement;
+          Keywords=kanban;board;tasks;project;
+          DESKTOP
+          cp AppDir/usr/share/applications/wekan.desktop AppDir/wekan.desktop
+
+          # AppRun is what the AppImage runs. It does three things the launcher
+          # cannot do for itself: pick a writable place for the data (an AppImage
+          # is read-only and may sit on a USB stick), say where WeKan is once it
+          # has started, and then hand over to start-wekan.sh, which is the same
+          # launcher the offline zip uses - so every variable it documents
+          # (WRITABLE_PATH, PORT, ROOT_URL, MONGO_URL, WEKAN_DB, ...) still works.
+          cat > AppDir/AppRun <<'APPRUN'
+          #!/bin/sh
+          set -eu
+          HERE="$(dirname "$(readlink -f "$0")")"
+          BUNDLE="$HERE/usr/lib/wekan/bundle"
+
+          # An AppImage is read-only, so the data cannot live beside it.
+          : "${WRITABLE_PATH:=${XDG_DATA_HOME:-$HOME/.local/share}/wekan}"
+          export WRITABLE_PATH
+          : "${PORT:=8080}"
+          export PORT
+          : "${ROOT_URL:=http://localhost:$PORT}"
+          export ROOT_URL
+
+          mkdir -p "$WRITABLE_PATH"
+
+          echo "WeKan is starting."
+          echo "  Open:  $ROOT_URL"
+          echo "  Data:  $WRITABLE_PATH"
+          echo "  Stop:  Ctrl-C"
+          echo
+          echo "Set WRITABLE_PATH, PORT, ROOT_URL or MONGO_URL to change any of"
+          echo "this; WEKAN_DB=mongodb uses your own database instead of the"
+          echo "bundled FerretDB."
+          echo
+
+          exec "$BUNDLE/start-wekan.sh" "$@"
+          APPRUN
+          chmod +x AppDir/AppRun
+
+      - name: Pack the AppImage
+        if: ${{ env.BUILD_THIS == 'true' }}
+        run: |
+          set -euo pipefail
+          version='${{ needs.release.outputs.version }}'
+          arch='${{ matrix.appimage_arch }}'
+          name="WeKan-${version}-${arch}"
+
+          curl -fSL --retry 5 --retry-delay 10 -o appimagetool \
+            "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-${arch}.AppImage"
+          chmod +x appimagetool
+
+          mkdir -p dist
+          # A runner has no FUSE, so the tool cannot mount itself; this unpacks
+          # it to a temporary directory and runs it from there instead.
+          APPIMAGE_EXTRACT_AND_RUN=1 ARCH="$arch" \
+            ./appimagetool AppDir "dist/${name}.AppImage"
+
+          chmod +x "dist/${name}.AppImage"
+          # Checksum keeps the .AppImage extension in its name, matching the zip
+          # convention (wekan-<v>-<arch>.zip.sha256sum) and what
+          # releases/expected-assets.sh looks for. Naming it ${name}.sha256sum
+          # (extension dropped) meant "what is missing" never found the checksum,
+          # so every run rebuilt the AppImage even when it was already published.
+          ( cd dist
+            md5sum    "${name}.AppImage" > "${name}.AppImage.md5sum"
+            sha256sum "${name}.AppImage" > "${name}.AppImage.sha256sum" )
+          ls -lh dist
+
+      - name: Check that it starts
+        if: ${{ env.BUILD_THIS == 'true' }}
+        run: |
+          set -euo pipefail
+          version='${{ needs.release.outputs.version }}'
+          app="dist/WeKan-${version}-${{ matrix.appimage_arch }}.AppImage"
+          # An AppImage that packs is not an AppImage that runs. Start it, wait
+          # for WeKan to answer on its port, then stop it - so a broken bundle
+          # is caught here rather than by whoever downloads it.
+          export WRITABLE_PATH="$PWD/smoke-data" PORT=8080
+
+          # A CHECK THAT CANNOT RUN IS NOT A FAILED CHECK. The 32-bit builds are
+          # packed on a 64-bit runner, which executes them only if the kernel and
+          # loader for that word size are present - GitHub promises neither. If
+          # the binary cannot be executed AT ALL, the AppImage is as good as
+          # anything here knows and the release must not be withheld for it; say
+          # so and move on. Anything else - it starts and does not answer - is
+          # the bug this step exists for and still fails.
+          if ! APPIMAGE_EXTRACT_AND_RUN=1 "$app" --appimage-help >/dev/null 2>&1 \
+             && ! APPIMAGE_EXTRACT_AND_RUN=1 "$app" --help >/dev/null 2>&1; then
+            if ! file "$app" | grep -q "$(uname -m)"; then
+              echo "::warning::this runner cannot execute a ${{ matrix.appimage_arch }} binary, so the AppImage was packed but not started. It is uploaded unchecked."
+              exit 0
+            fi
+          fi
+
+          APPIMAGE_EXTRACT_AND_RUN=1 "$app" > smoke.log 2>&1 &
+          pid=$!
+          ok=false
+          for _ in $(seq 1 90); do
+            if curl -fsS -o /dev/null "http://localhost:8080/sign-in"; then ok=true; break; fi
+            kill -0 "$pid" 2>/dev/null || break
+            sleep 2
+          done
+          kill "$pid" 2>/dev/null || true
+          wait "$pid" 2>/dev/null || true
+          if [ "$ok" != true ]; then
+            echo "::error::the AppImage did not answer on port 8080; its log follows"
+            tail -n 100 smoke.log
+            exit 1
+          fi
+          echo "WeKan answered on port 8080."
+
+      - uses: actions/upload-artifact@v7
+        if: ${{ env.BUILD_THIS == 'true' }}
+        with:
+          name: appimage-${{ matrix.appimage_arch }}
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    name: attach to the release
+    needs: [release, build]
+    if: ${{ !cancelled() && inputs.publish != false }}
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: appimage-*
+          path: assets
+          merge-multiple: true
+
+      - name: Say what was built, and what was not
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          ls -lh assets 2>/dev/null || true
+          if ls assets/*.AppImage >/dev/null 2>&1; then
+            # Every architecture the matrix builds. A missing one WARNS rather
+          # than fails: the 32-bit pair is allowed not to build, and an
+          # architecture whose base bundle was never published has nothing to
+          # wrap. What must not happen silently is one going missing unnoticed.
+          for want in x86_64 aarch64 i686 armhf; do
+              ls assets/*"-$want.AppImage" >/dev/null 2>&1 || \
+                echo "::warning::no AppImage for $want - see that build job's log"
+            done
+          else
+            # No AppImage was produced. That is only a FAILURE if there was a base
+            # bundle to wrap: an AppImage cannot be built without one, and the
+            # build jobs skip (not fail) when the base bundle is not published yet.
+            published="$(gh release view --repo "${GITHUB_REPOSITORY:-wekan/wekan}" '${{ needs.release.outputs.tag }}' --repo "${{ github.repository }}" --json assets --jq '.assets[].name' 2>/dev/null || true)"
+            base_present=false
+            for arch in amd64 arm64 i386 armhf; do
+              printf '%s\n' "$published" | grep -qx "wekan-${{ needs.release.outputs.version }}-${arch}.zip" && base_present=true
+            done
+            if [ "$base_present" = false ]; then
+              echo "::notice::No base bundle (wekan-${{ needs.release.outputs.version }}-{amd64,arm64}.zip) is on ${{ needs.release.outputs.tag }} yet, so there is nothing to wrap - skipping. release-all.yml builds the AppImages once the base bundles are published."
+              exit 0
+            fi
+            echo "::error::A base bundle is published but no architecture produced an AppImage - every build job failed. Their logs say why; nothing is uploaded."
+            exit 1
+          fi
+
+      - name: Upload them
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          if ! ls assets/*.AppImage >/dev/null 2>&1; then
+            echo "Nothing to upload (no base bundle was published to wrap)."
+            exit 0
+          fi
+          # --repo, because this job does NOT check the repository out - it only
+          # downloads artifacts - so `gh` has no git remote to infer the repo
+          # from and fails with "fatal: not a git repository". Every other gh
+          # call in this workflow already passes it; these two did not, so the
+          # AppImages were built, smoke-tested and uploaded as artifacts, and
+          # then nothing was attached to the release.
+          gh release upload --repo "${GITHUB_REPOSITORY:-wekan/wekan}" '${{ needs.release.outputs.tag }}' assets/* \
+            --repo "${{ github.repository }}" --clobber
+          echo "Uploaded to $(gh release view --repo "${GITHUB_REPOSITORY:-wekan/wekan}" '${{ needs.release.outputs.tag }}' \
+            --repo "${{ github.repository }}" --json url --jq .url)"

.github/workflows/Flatpak.yml

@@ -0,0 +1,434 @@
+name: Flatpak
+
+# Build WeKan as a Flatpak for every CPU the runtime exists for, attach the
+# single-file bundles to the newest WeKan release, and publish a Flatpak
+# REPOSITORY that can be added with `flatpak remote-add`.
+#
+# Like AppImage.yml, this does NOT rebuild WeKan. release-all.yml already
+# produces a bundle that runs offline with nothing installed - the Meteor server
+# (main.js), the bundled Node.js the release was built against, the
+# wekan/FerretDB v1 fork with its embedded pure-Go SQLite backend, the
+# wekan/mongo-tools-patches binaries and start-wekan.sh - so this takes the
+# wekan-<version>-<arch>.zip off the release and packages it. The Flatpak is
+# therefore the same server, Node and FerretDB as the zip and the AppImage
+# beside it, not a third build that might differ.
+#
+# A BUNDLE AND A REPOSITORY are two different things and both come out of one
+# build here. A .flatpak bundle is one file you install by hand and update by
+# downloading the next one; a repository is what makes `flatpak update` work,
+# and one repository serves every architecture at once. The bundles go on the
+# GitHub release; the repository is uploaded as an artifact of static files, so
+# it can be copied to a website with no server to run.
+#
+# WHICH CPUs. org.freedesktop.Platform//24.08 is built for x86_64 and aarch64,
+# and WeKan publishes Linux bundles for amd64 and arm64, so those are the two.
+# Each builds on a runner of its own CPU rather than under emulation.
+#
+# AND THAT IS THE WHOLE LIST - there is no third to add. A flatpak runs against
+# a RUNTIME, not against the host's libraries, so an architecture exists here
+# only if freedesktop.org publishes org.freedesktop.Platform for it. It does so
+# for x86_64 and aarch64; the i386 and arm runtimes were discontinued. That is
+# the difference from AppImage.yml, which was able to grow from two
+# architectures to four: an AppImage carries its own runtime binary, and
+# runtimes exist for i686 and armhf as well. WeKan's ppc64le, s390x, riscv64,
+# loong64 and 32-bit bundles are served by the zip and the .deb.
+#
+# THE SANDBOX. WeKan is a server you reach in a browser, so it needs the network
+# and a place to keep its data, and nothing else - no X11, no audio, no access
+# to your files. --share=network and --persist=.wekan are the whole permission
+# list, and FerretDB keeps everything in SQLite inside that one directory.
+#
+# THE REPOSITORY IS UNSIGNED. Signing needs a GPG key, which is a secret rather
+# than something a workflow can invent. The README written into the repository
+# says exactly how to sign it when a key exists.
+
+on:
+  # Callable, so release-all-missing.yml can ask for just the architectures
+  # a release is short of. The build itself stays here - a second copy of the
+  # flatpaks build would drift from this one.
+  workflow_call:
+    inputs:
+      tag:
+        required: false
+        type: string
+      publish:
+        required: false
+        default: true
+        type: boolean
+      only:
+        description: 'Only build these architectures, as a JSON array (e.g. ["x86_64"]); empty = all'
+        required: false
+        default: ''
+        type: string
+
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to wrap and attach to (empty = newest release)'
+        required: false
+        type: string
+      publish:
+        description: 'Attach the bundles to the release'
+        required: false
+        default: true
+        type: boolean
+      publish_repo:
+        description: 'Build the Flatpak repository for the website'
+        required: false
+        default: true
+        type: boolean
+      only:
+        description: 'Only build these architectures, as a JSON array (e.g. ["x86_64"]); empty = all'
+        required: false
+        default: ''
+        type: string
+
+permissions:
+  contents: write
+
+concurrency:
+  group: wekan-flatpak-${{ inputs.tag || github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: find the release
+    runs-on: ubuntu-24.04
+    outputs:
+      tag: ${{ steps.find.outputs.tag }}
+      version: ${{ steps.find.outputs.version }}
+    steps:
+      - uses: actions/checkout@v7
+      - id: find
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          tag='${{ inputs.tag }}'
+          # --repo on every gh call, whether or not the job happens to have
+          # checked out: one that relies on an inferred remote breaks the day
+          # somebody removes the checkout.
+          [ -n "$tag" ] || tag="$(gh release list --repo "${{ github.repository }}" \
+            --limit 1 --json tagName --jq '.[0].tagName')"
+          if [ -z "$tag" ]; then
+            echo "::error::No release to wrap, and no tag was given."
+            exit 1
+          fi
+          version="${tag#v}"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "Wrapping the bundles from $tag (version $version)"
+
+  build:
+    name: flatpak ${{ matrix.flatpak_arch }}
+    needs: release
+    runs-on: ${{ matrix.runs_on }}
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - flatpak_arch: x86_64
+            bundle_arch: amd64
+            runs_on: ubuntu-24.04
+          - flatpak_arch: aarch64
+            bundle_arch: arm64
+            runs_on: ubuntu-24.04-arm
+    # WHICH entries this run wants, decided here because it cannot be decided
+    # where it belongs. A job-level `if:` cannot see `matrix` - GitHub exposes
+    # that context to runs-on, env, name, steps and a few others, but not to a
+    # job's own condition - and a workflow that tries answers
+    #   Unrecognized named-value: 'matrix'
+    # and refuses to load at all, taking every workflow that CALLS it with it.
+    # A job-level env CAN see matrix, so the answer is computed once here and
+    # every step below asks for it.
+    env:
+      BUILD_THIS: ${{ inputs.only == '' || contains(fromJSON(inputs.only), matrix.flatpak_arch) }}
+
+    steps:
+      - uses: actions/checkout@v7
+        if: ${{ env.BUILD_THIS == 'true' }}
+
+      - name: Install flatpak
+        if: ${{ env.BUILD_THIS == 'true' }}
+        run: |
+          set -euo pipefail
+          bash "$GITHUB_WORKSPACE/releases/apt-install.sh" --no-install-recommends flatpak ostree zip
+          flatpak remote-add --if-not-exists --user flathub \
+            https://flathub.org/repo/flathub.flatpakrepo
+          flatpak install --user -y --noninteractive flathub \
+            org.freedesktop.Platform//24.08 org.freedesktop.Sdk//24.08
+
+      - name: Fetch the release bundle for this architecture
+        if: ${{ env.BUILD_THIS == 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          zip="wekan-${{ needs.release.outputs.version }}-${{ matrix.bundle_arch }}.zip"
+          gh release download '${{ needs.release.outputs.tag }}' \
+            --repo "${{ github.repository }}" --pattern "$zip" --clobber
+          unzip -q "$zip"
+          for f in bundle/main.js bundle/node bundle/ferretdb bundle/start-wekan.sh; do
+            if [ ! -e "$f" ]; then
+              echo "::error::$zip has no $f - it is not a runnable WeKan bundle."
+              exit 1
+            fi
+          done
+          chmod +x bundle/node bundle/ferretdb bundle/start-wekan.sh
+          du -sh bundle
+
+      # flatpak-builder is for building from source. The bundle IS the build, so
+      # this uses `flatpak build` directly: make a build directory from the
+      # runtime, copy the bundle into it, finish it with its permissions, and
+      # export it into a repository.
+      - name: Build the Flatpak
+        if: ${{ env.BUILD_THIS == 'true' }}
+        run: |
+          set -euo pipefail
+          version='${{ needs.release.outputs.version }}'
+          arch='${{ matrix.flatpak_arch }}'
+
+          rm -rf build-dir repo
+          flatpak build-init --arch="$arch" build-dir \
+            io.github.wekan.WeKan org.freedesktop.Sdk org.freedesktop.Platform 24.08
+
+          mkdir -p build-dir/files/lib/wekan build-dir/files/bin \
+                   build-dir/files/share/applications \
+                   build-dir/files/share/icons/hicolor/512x512/apps \
+                   build-dir/files/share/metainfo
+          cp -a bundle build-dir/files/lib/wekan/bundle
+          cp public/android-chrome-512x512.png \
+             build-dir/files/share/icons/hicolor/512x512/apps/io.github.wekan.WeKan.png
+
+          # The command the Flatpak runs. --persist=.wekan gives the sandbox one
+          # writable directory that survives restarts, and that is where
+          # WRITABLE_PATH points, so FerretDB's SQLite files and the attachments
+          # live there. Everything start-wekan.sh documents still overrides.
+          cat > build-dir/files/bin/wekan <<'SH'
+          #!/bin/sh
+          set -eu
+          BUNDLE=/app/lib/wekan/bundle
+          : "${WRITABLE_PATH:=$HOME/.wekan}"
+          export WRITABLE_PATH
+          : "${PORT:=8080}"
+          export PORT
+          : "${ROOT_URL:=http://localhost:$PORT}"
+          export ROOT_URL
+          mkdir -p "$WRITABLE_PATH"
+          echo "WeKan is starting."
+          echo "  Open:  $ROOT_URL"
+          echo "  Data:  $WRITABLE_PATH  (inside the Flatpak sandbox)"
+          echo "  Stop:  Ctrl-C"
+          echo
+          exec "$BUNDLE/start-wekan.sh" "$@"
+          SH
+          chmod +x build-dir/files/bin/wekan
+
+          cat > build-dir/files/share/applications/io.github.wekan.WeKan.desktop <<'DESKTOP'
+          [Desktop Entry]
+          Type=Application
+          Name=WeKan
+          GenericName=Kanban board
+          Comment=Open Source kanban board with FerretDB and Node.js included
+          Exec=wekan
+          Icon=io.github.wekan.WeKan
+          Terminal=true
+          Categories=Office;ProjectManagement;
+          Keywords=kanban;board;tasks;project;
+          DESKTOP
+
+          cat > build-dir/files/share/metainfo/io.github.wekan.WeKan.metainfo.xml <<XML
+          <?xml version="1.0" encoding="UTF-8"?>
+          <component type="desktop-application">
+            <id>io.github.wekan.WeKan</id>
+            <name>WeKan</name>
+            <summary>Open Source kanban board</summary>
+            <metadata_license>CC0-1.0</metadata_license>
+            <project_license>MIT</project_license>
+            <description>
+              <p>
+                WeKan is an Open Source kanban board. This build carries everything
+                it needs to run: the WeKan server, Node.js, and FerretDB v1 with an
+                embedded SQLite backend, so no separate database is required.
+              </p>
+            </description>
+            <launchable type="desktop-id">io.github.wekan.WeKan.desktop</launchable>
+            <url type="homepage">https://wekan.fi</url>
+            <releases><release version="${version}"/></releases>
+          </component>
+          XML
+
+          # A server reached in a browser needs the network and its own data
+          # directory, and nothing else.
+          flatpak build-finish build-dir \
+            --share=network \
+            --persist=.wekan \
+            --command=wekan
+
+          flatpak build-export --arch="$arch" repo build-dir stable
+
+      - name: Make the single-file bundle
+        if: ${{ env.BUILD_THIS == 'true' }}
+        run: |
+          set -euo pipefail
+          version='${{ needs.release.outputs.version }}'
+          name="WeKan-${version}-${{ matrix.flatpak_arch }}"
+          mkdir -p dist
+          flatpak build-bundle repo "dist/${name}.flatpak" \
+            --arch='${{ matrix.flatpak_arch }}' io.github.wekan.WeKan stable
+          # Checksum keeps the .flatpak extension in its name, matching the zip
+          # convention and what releases/expected-assets.sh looks for; dropping it
+          # meant "what is missing" never found the checksum and rebuilt the
+          # Flatpak every run even when already published.
+          ( cd dist
+            md5sum    "${name}.flatpak" > "${name}.flatpak.md5sum"
+            sha256sum "${name}.flatpak" > "${name}.flatpak.sha256sum" )
+          ls -lh dist
+
+      - uses: actions/upload-artifact@v7
+        if: ${{ env.BUILD_THIS == 'true' }}
+        with:
+          name: flatpak-${{ matrix.flatpak_arch }}
+          path: dist/
+          if-no-files-found: error
+
+      - uses: actions/upload-artifact@v7
+        if: ${{ env.BUILD_THIS == 'true' }}
+        with:
+          name: flatpak-repo-${{ matrix.flatpak_arch }}
+          path: repo/
+          if-no-files-found: warn
+
+  publish:
+    name: attach to the release, and build the repository
+    needs: [release, build]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-24.04
+    steps:
+      # FIRST: this job runs releases/apt-install.sh, and actions/checkout cleans
+      # the workspace - so it has to happen before the artifacts are downloaded
+      # into it. Without the checkout the step fails with "No such file or
+      # directory", which is how the v10.88 run ended.
+      - uses: actions/checkout@v7
+
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: flatpak-[0-9a-z]*
+          path: assets
+          merge-multiple: true
+
+      - name: Say what was built, and what was not
+        run: |
+          set -euo pipefail
+          ls -lh assets 2>/dev/null || true
+          if ! ls assets/*.flatpak >/dev/null 2>&1; then
+            echo "::error::No architecture produced a Flatpak bundle; nothing is uploaded."
+            exit 1
+          fi
+          for want in x86_64 aarch64; do
+            ls assets/*"-$want.flatpak" >/dev/null 2>&1 || \
+              echo "::warning::no Flatpak for $want - see that build job's log"
+          done
+
+      - name: Upload the bundles
+        if: ${{ inputs.publish != false }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          # --repo, because this job does NOT check the repository out - it
+          # only downloads artifacts - so `gh` has no git remote to infer the
+          # repo from and fails with "fatal: not a git repository". The same
+          # line was wrong in AppImage.yml for the same reason.
+          #
+          # And the bundles BY NAME, not assets/*: the artifacts also carry the
+          # ostree repository the flatpak was exported through - config,
+          # objects/, refs/, summaries/, summary, summary.idx - which is build
+          # scaffolding, not something to attach to a release. TSC hit this
+          # exact thing ("upload only the bundle files, not the ostree repo").
+          gh release upload --repo "${GITHUB_REPOSITORY:-wekan/wekan}" '${{ needs.release.outputs.tag }}' \
+            assets/*.flatpak assets/*.flatpak.md5sum assets/*.flatpak.sha256sum \
+            --repo "${{ github.repository }}" --clobber
+          echo "Uploaded to $(gh release view --repo "${GITHUB_REPOSITORY:-wekan/wekan}" '${{ needs.release.outputs.tag }}' \
+            --repo "${{ github.repository }}" --json url --jq .url)"
+
+      # ---- the repository -------------------------------------------------
+      - uses: actions/download-artifact@v8
+        if: ${{ inputs.publish_repo != false }}
+        with:
+          pattern: flatpak-repo-*
+          path: repos
+
+      - name: Build the multi-architecture repository
+        if: ${{ inputs.publish_repo != false }}
+        run: |
+          set -euo pipefail
+          bash "$GITHUB_WORKSPACE/releases/apt-install.sh" --no-install-recommends flatpak ostree
+          shopt -s nullglob
+          parts=(repos/flatpak-repo-*)
+          if [ ${#parts[@]} -eq 0 ]; then
+            echo "::warning::no repository halves were produced; skipping"
+            exit 0
+          fi
+          ostree init --repo=flatpak-repo --mode=archive-z2
+          for part in "${parts[@]}"; do
+            name="$(basename "$part")"
+            echo "Pulling $name"
+            ostree --repo=flatpak-repo remote add --no-gpg-verify --if-not-exists \
+              "$name" "file://$PWD/$part"
+            ostree --repo=flatpak-repo pull --mirror "$name" || true
+          done
+          flatpak build-update-repo --prune flatpak-repo
+
+          cat > flatpak-repo/wekan.flatpakrepo <<'REPO'
+          [Flatpak Repo]
+          Title=WeKan
+          Url=https://wekan.fi/flatpak/
+          Homepage=https://wekan.fi
+          Comment=WeKan releases, built by the Flatpak workflow in wekan/wekan
+          Description=Flatpak repository for WeKan, the Open Source kanban board
+          REPO
+
+          cat > flatpak-repo/README.txt <<'TXT'
+          Flatpak repository for WeKan.
+
+          Copy this whole directory to the website under /flatpak/, then:
+
+            flatpak remote-add --if-not-exists wekan \
+              https://wekan.fi/flatpak/wekan.flatpakrepo
+            flatpak install wekan io.github.wekan.WeKan
+            flatpak run io.github.wekan.WeKan
+
+          Then open http://localhost:8080 . Everything is inside: the WeKan
+          server, Node.js, and FerretDB v1 with an embedded SQLite backend, so
+          there is no database to install. The data lives in the sandbox's
+          persistent .wekan directory.
+
+          THIS REPOSITORY IS NOT SIGNED. Signing needs a GPG key, which is a
+          secret rather than something a workflow can invent. To sign it:
+
+            1. Make a key, once, on a machine you trust:
+                 gpg --quick-generate-key "WeKan <security@wekan.fi>" default default never
+                 gpg --export KEYID > wekan-flatpak.gpg          # the public half
+                 gpg --export-secret-keys --armor KEYID          # the private half
+            2. Put the private half in the repository's Actions secrets as
+               GPG_PRIVATE_KEY.
+            3. In Flatpak.yml, import it before the export and add the two flags:
+                 flatpak build-export --gpg-sign=KEYID ...
+                 flatpak build-update-repo --gpg-sign=KEYID ...
+            4. Put wekan-flatpak.gpg beside this file on the website and add
+                 GPGKey=<base64 of wekan-flatpak.gpg>
+               to wekan.flatpakrepo.
+
+          Until then flatpak will say the remote is unsigned, and installing
+          from it trusts whoever serves the files.
+          TXT
+          du -sh flatpak-repo
+
+      - uses: actions/upload-artifact@v7
+        if: ${{ inputs.publish_repo != false }}
+        with:
+          name: flatpak-repository
+          path: flatpak-repo/
+          if-no-files-found: warn

.github/workflows/depsreview.yaml

@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5

.github/workflows/docker-publish.yml

@@ -32,13 +32,38 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+
+      # The Dockerfile DOWNLOADS the prebuilt release zip that release-all.yml
+      # publishes (and `exit 8`s if it is missing), so this image can only be
+      # built once the release for the version pinned in the Dockerfile is up. On
+      # a tag push (the tag is created early in the release, ~30 min before the
+      # zips are attached), during the release window, or if the release failed,
+      # the asset 404s and this job failed hard. Check first and SKIP the build
+      # (a notice, green run) when the release is not published yet; the release
+      # image itself is built + pushed by release-all.yml's docker job.
+      - name: Is the release this Dockerfile needs published yet?
+        id: rel
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          VERSION="$(sed -n 's/^ARG VERSION=//p' Dockerfile | head -1)"
+          asset="wekan-${VERSION}-amd64.zip"
+          if gh release view "v${VERSION}" --repo "${{ github.repository }}" \
+               --json assets --jq '.assets[].name' 2>/dev/null | grep -qx "$asset"; then
+            echo "build=yes" >> "$GITHUB_OUTPUT"
+            echo "OK: $asset is on the v${VERSION} release; building the image."
+          else
+            echo "build=no" >> "$GITHUB_OUTPUT"
+            echo "::notice::$asset is not on the v${VERSION} release yet - skipping. release-all.yml builds and pushes the image once the release is published."
+          fi
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -48,16 +73,21 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        if: steps.rel.outputs.build == 'yes'
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          # Full build provenance (SLSA), not the minimal default that BuildKit
+          # attaches on its own. See release-all.yml for what it is and why the
+          # manifest list gains an `unknown/unknown` entry per platform.
+          provenance: mode=max

.github/workflows/docker-variant.yml

@@ -0,0 +1,159 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Publish a variant Docker image — MANUALLY, never as part of a release.
+#
+# wekanteam/wekan-gantt-gpl (and wekanteam/wekan-ondra) are the same WeKan as
+# wekanteam/wekan: the variant repositories are byte-identical to wekan/wekan
+# apart from the snap name in snapcraft.yaml, so the image content is the same
+# image. This workflow therefore does not rebuild anything - it points a variant
+# tag at the multi-arch manifest the release already built and verified, with
+# `docker buildx imagetools create`. Same digests, all five architectures, no
+# half-hour emulated build, and no way for the variant image to drift from the
+# release it claims to be.
+#
+# A RELEASE NO LONGER NEEDS THIS. release-all.yml's docker job tags both variants
+# on all three registries in its own `docker buildx build --push`, so every
+# release publishes them with the release's own digests. What this file is for now
+# is everything outside a release: publishing a variant for a version whose
+# release predates that change, repairing a tag, or pointing a variant at a
+# different version deliberately.
+#
+# `workflow_dispatch` ONLY, on purpose: nothing here runs on a push, a tag or a
+# schedule.
+#
+# If a variant repository ever stops being identical to wekan/wekan, this
+# retag becomes wrong: build that repository's own Dockerfile instead.
+#
+# Local equivalent, same behaviour: releases/docker-publish-variant.sh
+# ─────────────────────────────────────────────────────────────────────────────
+name: Publish variant Docker image (manual)
+
+on:
+  workflow_dispatch:
+    inputs:
+      image:
+        description: 'Docker Hub repository under wekanteam/ to publish'
+        required: true
+        default: 'wekan-gantt-gpl'
+        type: choice
+        options:
+          - wekan-gantt-gpl
+          - wekan-ondra
+      version:
+        description: 'WeKan version to publish, without the v (e.g. 10.49). Empty = newest GitHub release.'
+        required: false
+        default: ''
+        type: string
+      also_latest:
+        description: 'Also move the :latest tag of the variant image'
+        required: false
+        default: true
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  retag:
+    runs-on: ubuntu-latest
+    steps:
+      # First step on purpose: a missing or wrong credential is then ONE named
+      # line at the top of the log, not a failure deep inside a push.
+      - name: Check DOCKERHUB_AUTH is configured and works
+        env:
+          DOCKERHUB_AUTH: ${{ secrets.DOCKERHUB_AUTH }}
+        run: |
+          set -uo pipefail
+          if [ -z "${DOCKERHUB_AUTH:-}" ]; then
+            echo "::error::docker-variant: DOCKERHUB_AUTH is not set - the image cannot be pushed. It is base64 of 'username:token' for docker.io."
+            exit 1
+          fi
+          if ! creds="$(printf '%s' "$DOCKERHUB_AUTH" | base64 -d 2>/dev/null)"; then
+            echo "::error::docker-variant: DOCKERHUB_AUTH is not valid base64. Set it with: printf '%s' 'user:token' | base64 -w0"
+            exit 1
+          fi
+          case "$creds" in
+            *:*) ;;
+            *) echo "::error::docker-variant: DOCKERHUB_AUTH decodes to something without a ':' - it must be base64 of 'username:token'."; exit 1 ;;
+          esac
+          user="${creds%%:*}"
+          token="${creds#*:}"
+          if ! printf '%s' "$token" | docker login docker.io -u "$user" --password-stdin; then
+            echo "::error::docker-variant: DOCKERHUB_AUTH was REJECTED by docker.io (login failed as user '$user'). The token is wrong, expired, or lacks push rights for wekanteam/${{ inputs.image }}."
+            exit 1
+          fi
+          echo "docker-variant: DOCKERHUB_AUTH works for docker.io (user '$user')."
+
+      - name: Work out which version to publish
+        id: v
+        run: |
+          set -euo pipefail
+          version="${{ inputs.version }}"
+          if [ -z "$version" ]; then
+            # The newest release of wekan/wekan, asked of GitHub rather than guessed.
+            version="$(curl -sSL -H 'Accept: application/vnd.github+json' \
+              https://api.github.com/repos/wekan/wekan/releases/latest \
+              | sed -n 's/.*"tag_name": *"v\{0,1\}\([^"]*\)".*/\1/p' | head -1)"
+          fi
+          version="${version#v}"
+          if [ -z "$version" ]; then
+            echo "::error::docker-variant: no version given and the newest release could not be read from the GitHub API."
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "Publishing wekanteam/${{ inputs.image }} from wekanteam/wekan:v$version"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Retag wekanteam/wekan as wekanteam/${{ inputs.image }}
+        run: |
+          set -euo pipefail
+          src="wekanteam/wekan:v${{ steps.v.outputs.version }}"
+          dst="wekanteam/${{ inputs.image }}:v${{ steps.v.outputs.version }}"
+
+          # The source must exist and be the full multi-arch manifest, or the
+          # variant tag would quietly cover fewer architectures than wekan does.
+          if ! platforms="$(docker buildx imagetools inspect "$src" \
+                --format '{{range .Manifest.Manifests}}{{.Platform.OS}}/{{.Platform.Architecture}} {{end}}' 2>&1)"; then
+            echo "::error::docker-variant: $src cannot be inspected - is that version released and pushed? ($platforms)"
+            exit 1
+          fi
+          echo "$src covers: $platforms"
+          for want in linux/amd64 linux/arm64 linux/ppc64le linux/s390x linux/riscv64; do
+            case " $platforms " in
+              *" $want "*) ;;
+              *) echo "::error::docker-variant: $src has no $want, so the variant image would be missing it too."; exit 1 ;;
+            esac
+          done
+
+          tags=(-t "$dst")
+          if [ "${{ inputs.also_latest }}" = "true" ]; then
+            tags+=(-t "wekanteam/${{ inputs.image }}:latest")
+          fi
+          # imagetools create copies the MANIFEST, so the variant tag points at the
+          # very digests the release built and verified. Nothing is rebuilt.
+          docker buildx imagetools create "${tags[@]}" "$src"
+
+          # Pushed is not the same as pushed correctly: ask Docker Hub what it has.
+          got="$(docker buildx imagetools inspect "$dst" \
+            --format '{{range .Manifest.Manifests}}{{.Platform.OS}}/{{.Platform.Architecture}} {{end}}')"
+          echo "$dst covers: $got"
+          for want in linux/amd64 linux/arm64 linux/ppc64le linux/s390x linux/riscv64; do
+            case " $got " in
+              *" $want "*) ;;
+              *) echo "::error::docker-variant: $dst is missing $want after the push."; exit 1 ;;
+            esac
+          done
+          echo "OK: $dst published (same digests as $src)."
+
+      - name: Job result
+        if: always()
+        run: |
+          case "${{ job.status }}" in
+            success)   mark='OK       ' ;;
+            failure)   mark='FAILED   ' ;;
+            cancelled) mark='CANCELLED' ;;
+            *)         mark='${{ job.status }}' ;;
+          esac
+          echo "$mark docker-variant wekanteam/${{ inputs.image }}"
+          echo "$mark docker-variant wekanteam/${{ inputs.image }}" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/dockerimage.yml

@@ -15,6 +15,34 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
+
+    # The Dockerfile does not build WeKan from source — it DOWNLOADS the prebuilt
+    # release zip (wekan-<VERSION>-amd64.zip) that release-all.yml publishes, and
+    # `exit 8`s if it is missing. So this image can only be built once the release
+    # for the version pinned in the Dockerfile is up. On a push during the release
+    # window (the version was just bumped but the release job has not attached the
+    # zip yet), or if the release failed, the asset 404s and this job failed hard
+    # even though nothing here is wrong. Check first and SKIP (a notice, green run)
+    # when the release is not published yet; the real image is built by
+    # release-all.yml's docker job once the release is up.
+    - name: Is the release this Dockerfile needs published yet?
+      id: rel
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        set -euo pipefail
+        VERSION="$(sed -n 's/^ARG VERSION=//p' Dockerfile | head -1)"
+        asset="wekan-${VERSION}-amd64.zip"
+        if gh release view "v${VERSION}" --repo "${{ github.repository }}" \
+             --json assets --jq '.assets[].name' 2>/dev/null | grep -qx "$asset"; then
+          echo "build=yes" >> "$GITHUB_OUTPUT"
+          echo "OK: $asset is on the v${VERSION} release; building the image."
+        else
+          echo "build=no" >> "$GITHUB_OUTPUT"
+          echo "::notice::$asset is not on the v${VERSION} release yet - skipping. release-all.yml builds the image once the release is published."
+        fi
+
     - name: Build the Docker image
+      if: steps.rel.outputs.build == 'yes'
       run: docker build . --file Dockerfile --tag wekan:$(date +%s)

.github/workflows/meteor-spk.yml

@@ -0,0 +1,106 @@
+name: Build meteor-spk bundle
+
+# Manually triggered. Assembles WeKan's modernized meteor-spk (the Sandstorm packaging
+# tool + its meteor-spk.deps: Node 24, FerretDB, the Mongo 3.x CLIs and the modern
+# sandstorm-http-bridge) and zips it as meteor-spk-YYYY-MM-DD_HH_MM_SS.zip — the same kind
+# of self-contained meteor-spk bundle that https://github.com/sandstorm-io/meteor-spk
+# releases, but with WeKan's Node 24 / FerretDB deps baked in. Download it to `meteor-spk
+# pack` WeKan (or any Meteor 3.x app) without re-running build-deps.sh each time.
+#
+#   gh workflow run meteor-spk.yml
+#
+# This only assembles + zips the tool; it does NOT pack or sign a WeKan .spk, so it needs
+# no SANDSTORM_KEYRING. The .spk itself is built by sandstorm.yml; the Sandstorm App
+# Market publish is done by sandstorm-store.yml.
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch, tag or SHA to build the meteor-spk deps from (default: main)'
+        required: false
+        default: 'main'
+
+permissions:
+  contents: write
+
+env:
+  NODE_VERSION: '24'
+
+jobs:
+  meteor-spk:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.ref || 'main' }}
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
+        # Same as sandstorm.yml: Ubuntu 24.04's AppArmor blocks the unprivileged user
+        # namespaces the Sandstorm install relies on; relax it so the install (whose
+        # sandstorm-http-bridge build-deps.sh copies in) can run on the runner.
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+
+      - name: Install system dependencies
+        run: |
+          bash "$GITHUB_WORKSPACE/releases/apt-install.sh" p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git zip
+
+      - name: Install Sandstorm (dev, unattended)
+        # build-deps.sh's [bridge] step copies the modern
+        # /opt/sandstorm/latest/bin/sandstorm-http-bridge into the deps, so Sandstorm
+        # must be installed first — same ordering as sandstorm.yml.
+        run: curl https://install.sandstorm.io | sudo bash -s -- -d
+
+      - name: Assemble modern meteor-spk.deps (Node 24 + FerretDB + Mongo 3.x CLIs)
+        # Base = upstream meteor-spk 0.6.0 from dl.sandstorm.io; build-deps.sh swaps in
+        # Node 24, FerretDB, the Mongo 3.x CLIs, the migration launcher/importer, keeps
+        # niscud, and swaps in the modern sandstorm-http-bridge. Produces
+        # $HOME/projects/meteor-spk/meteor-spk-0.6.0 (the meteor-spk tool + deps).
+        run: bash sandstorm-src/build-deps.sh
+
+      - name: Zip the meteor-spk bundle
+        id: zip
+        run: |
+          set -euo pipefail
+          STAMP="$(date +'%Y-%m-%d_%H_%M_%S')"
+          ZIP="meteor-spk-${STAMP}.zip"
+          BUNDLE_DIR="$HOME/projects/meteor-spk"
+          if [ ! -d "$BUNDLE_DIR/meteor-spk-0.6.0" ]; then
+            echo "::error::Expected meteor-spk bundle at $BUNDLE_DIR/meteor-spk-0.6.0 was not produced by build-deps.sh."
+            exit 1
+          fi
+          # Zip so it extracts to a top-level meteor-spk-0.6.0/ directory, like the
+          # upstream meteor-spk release archives. Exclude the base tarball build-deps.sh
+          # downloaded next to it.
+          ( cd "$BUNDLE_DIR" && zip -r -y -q "$GITHUB_WORKSPACE/$ZIP" meteor-spk-0.6.0 -x '*.tar.xz' )
+          ZIP_BYTES=$(stat -c%s "$GITHUB_WORKSPACE/$ZIP")
+          echo "Packed $ZIP: $((ZIP_BYTES/1024/1024)) MiB ($ZIP_BYTES bytes)"
+          ls -la "$GITHUB_WORKSPACE/$ZIP"
+          echo "zip=$ZIP" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: ${{ steps.zip.outputs.zip }}
+          path: ${{ steps.zip.outputs.zip }}
+          retention-days: 7
+
+      - name: Upload the meteor-spk bundle to the newest WeKan release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || true)"
+          if [ -z "${TAG:-}" ] || [ "$TAG" = "null" ]; then
+            echo "::warning::No existing GitHub Release found; the meteor-spk bundle is available only as a workflow artifact."
+            exit 0
+          fi
+          echo "Uploading ${{ steps.zip.outputs.zip }} to the newest release: $TAG"
+          gh release upload --repo "${GITHUB_REPOSITORY:-wekan/wekan}" "$TAG" "${{ steps.zip.outputs.zip }}" --clobber

.github/workflows/playwright.yml.disabled

@@ -0,0 +1,298 @@
+name: Playwright E2E Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: playwright-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  unit-tests:
+    name: Meteor unit tests
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup Node 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'npm'
+
+      - name: Cache Meteor installation
+        uses: actions/cache@v6
+        with:
+          path: ~/.meteor
+          key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
+          restore-keys: meteor-
+
+      - name: Cache Meteor build (.meteor/local)
+        uses: actions/cache@v6
+        with:
+          path: .meteor/local
+          key: meteor-local-unit-${{ hashFiles('.meteor/versions') }}
+          restore-keys: meteor-local-unit-
+
+      - name: Install Meteor
+        run: |
+          if [ ! -x ~/.meteor/meteor ]; then
+            curl https://install.meteor.com/ | sh
+          fi
+          echo "$HOME/.meteor" >> "$GITHUB_PATH"
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Run Meteor unit tests
+        # First Meteor build is slow; allow time before the test driver starts.
+        timeout-minutes: 45
+        # NOTE: do not set TEST_WATCH here. meteortesting:mocha computes
+        # `testWatch: TEST_WATCH || …`, and the string '0' is truthy in JS, so
+        # TEST_WATCH=0 turns ON watch mode and the process never exits — that is
+        # what made this job hang until the 45-minute timeout. With TEST_WATCH
+        # unset, `meteor test --once` runs the server tests and exits with the
+        # correct status (matching the local build.sh run).
+        run: meteor test --once --driver-package meteortesting:mocha
+
+  e2e-tests:
+    name: Playwright E2E (${{ matrix.project }} ${{ matrix.shard }}/2)
+    runs-on: ubuntu-24.04
+    needs: unit-tests
+    strategy:
+      fail-fast: false
+      matrix:
+        # Playwright bundles Chromium, Firefox and WebKit builds that all run
+        # headless on the Linux runner (installed per-job below with --with-deps).
+        project: [chromium, firefox, webkit]
+        # Split each browser's ~245 specs across 2 parallel shards (6 jobs total)
+        # to cut wall-clock time. Each shard job starts its own WeKan + Mongo, so
+        # there is no shared-server contention between shards. Raise the shard
+        # count (here and in the --shard flag below) once the baseline is green
+        # and/or once E2E runs against a prebuilt bundle (cheaper per-job startup).
+        shard: [1, 2]
+
+    services:
+      mongodb:
+        image: mongo:7
+        ports: ['27017:27017']
+        options: >-
+          --health-cmd "mongosh --eval 'db.adminCommand(\"ping\")'"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup Node 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'npm'
+
+      - name: Cache Meteor installation
+        uses: actions/cache@v6
+        with:
+          path: ~/.meteor
+          key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
+          restore-keys: meteor-
+
+      - name: Cache Meteor build (.meteor/local)
+        uses: actions/cache@v6
+        with:
+          path: .meteor/local
+          key: meteor-local-e2e-${{ hashFiles('.meteor/versions') }}
+          restore-keys: meteor-local-e2e-
+
+      - name: Install Meteor
+        run: |
+          if [ ! -x ~/.meteor/meteor ]; then
+            curl https://install.meteor.com/ | sh
+          fi
+          echo "$HOME/.meteor" >> "$GITHUB_PATH"
+
+      - name: Install app npm dependencies
+        run: npm ci
+
+      - name: Install Playwright test dependencies
+        run: npm ci
+        working-directory: tests/playwright
+
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps ${{ matrix.project }}
+        working-directory: tests/playwright
+
+      - name: Build and start WeKan (production bundle)
+        run: |
+          # Run E2E against a PRODUCTION build instead of `meteor run` (dev mode).
+          # In dev the client JS is served by the rspack dev server, which did not
+          # serve the bundle reliably in headless CI: the browser received HTML for
+          # the bundle ("Unexpected token '<'"), Meteor never initialised, and every
+          # spec timed out. A production build bakes the client JS into the bundle,
+          # served statically by the Meteor server at :3000.
+          meteor build ./output --directory
+          ( cd output/bundle/programs/server && npm install )
+          # WeKan's server/00checkStartup.js refuses to start unless WRITABLE_PATH
+          # (used for attachment/file storage) is set and writable.
+          mkdir -p "$PWD/wekan-writable"
+          # Match the env the dev runner (build.sh) and the specs expect:
+          # WITH_API enables the REST API (specs 17/23/24/28), comment-editor
+          # flag matches dev.
+          MONGO_URL=mongodb://localhost:27017/wekan_test \
+          ROOT_URL=http://localhost:3000 \
+          PORT=3000 \
+          WRITABLE_PATH="$PWD/wekan-writable" \
+          WITH_API=true \
+          RICHER_CARD_COMMENT_EDITOR=false \
+          node output/bundle/main.js > wekan-run.log 2>&1 &
+          # The production server serves the client JS statically, so once :3000
+          # responds the bundle is being served. Wait up to 10 minutes.
+          for i in $(seq 1 60); do
+            if curl -sf http://localhost:3000 > /dev/null; then
+              echo "WeKan is up after $((i * 10))s"
+              break
+            fi
+            echo "Waiting for WeKan... attempt $i/60"
+            sleep 10
+          done
+          if ! curl -sf http://localhost:3000 > /dev/null; then
+            echo "WeKan failed to start. Last 250 log lines:"
+            tail -n 250 wekan-run.log
+            exit 1
+          fi
+        env:
+          TOOL_NODE_FLAGS: --max-old-space-size=8192
+          NODE_OPTIONS: --max-old-space-size=8192
+          DISABLE_CAPTCHA: 'true' 
+
+      - name: Run Playwright tests (${{ matrix.project }} shard ${{ matrix.shard }}/2)
+        run: |
+          npx playwright test \
+            --project=${{ matrix.project }} \
+            --shard=${{ matrix.shard }}/2 \
+            --reporter=github
+        working-directory: tests/playwright
+        env:
+          WEKAN_BASE_URL: http://localhost:3000
+          WEKAN_MONGO_URL: mongodb://localhost:27017/wekan_test
+          # Make the firefox and webkit projects available to --project
+          # (playwright.config.js only defines them when this is set).
+          WEKAN_PLAYWRIGHT_ALL: '1'
+
+      - name: Upload Playwright report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report-${{ matrix.project }}-shard${{ matrix.shard }}
+          path: tests/playwright/playwright-report/
+          retention-days: 14
+
+      - name: Upload test results (screenshots / videos)
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-results-${{ matrix.project }}-shard${{ matrix.shard }}
+          path: tests/playwright/test-results/
+          retention-days: 7
+
+  e2e-regression:
+    name: Puppeteer regression suite
+    runs-on: ubuntu-24.04
+    needs: unit-tests
+
+    services:
+      mongodb:
+        image: mongo:7
+        ports: ['27017:27017']
+        options: >-
+          --health-cmd "mongosh --eval 'db.adminCommand(\"ping\")'"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup Node 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'npm'
+
+      - name: Cache Meteor installation
+        uses: actions/cache@v6
+        with:
+          path: ~/.meteor
+          key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
+          restore-keys: meteor-
+
+      - name: Cache Meteor build (.meteor/local)
+        uses: actions/cache@v6
+        with:
+          path: .meteor/local
+          key: meteor-local-regression-${{ hashFiles('.meteor/versions') }}
+          restore-keys: meteor-local-regression-
+
+      - name: Install Meteor
+        run: |
+          if [ ! -x ~/.meteor/meteor ]; then
+            curl https://install.meteor.com/ | sh
+          fi
+          echo "$HOME/.meteor" >> "$GITHUB_PATH"
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Install Chromium
+        run: sudo apt-get install -y chromium-browser
+
+      - name: Build and start WeKan (production bundle)
+        run: |
+          # Run a PRODUCTION build, not `meteor run` (dev): exactly like the
+          # Playwright e2e job, because the rspack dev server does not serve the
+          # client JS bundle in headless CI, so Meteor never initialises and the
+          # puppeteer regression test times out in waitForMeteorGlobals(). The
+          # production bundle serves the client statically. WRITABLE_PATH is
+          # required by server/00checkStartup.js; WITH_API mirrors the dev runner.
+          meteor build ./output --directory
+          ( cd output/bundle/programs/server && npm install )
+          mkdir -p "$PWD/wekan-writable"
+          MONGO_URL=mongodb://localhost:27017/wekan_regression \
+          ROOT_URL=http://localhost:3000 \
+          PORT=3000 \
+          WRITABLE_PATH="$PWD/wekan-writable" \
+          WITH_API=true \
+          RICHER_CARD_COMMENT_EDITOR=false \
+          node output/bundle/main.js > wekan-run.log 2>&1 &
+          for i in $(seq 1 60); do
+            if curl -sf http://localhost:3000 > /dev/null; then
+              echo "WeKan is up after $((i * 10))s"
+              break
+            fi
+            echo "Waiting for WeKan... attempt $i/60"
+            sleep 10
+          done
+          if ! curl -sf http://localhost:3000 > /dev/null; then
+            echo "WeKan failed to start. Last 250 log lines:"
+            tail -n 250 wekan-run.log
+            exit 1
+          fi
+        env:
+          TOOL_NODE_FLAGS: --max-old-space-size=8192
+          NODE_OPTIONS: --max-old-space-size=8192
+          DISABLE_CAPTCHA: 'true'
+
+      - name: Run list-regressions e2e
+        run: node tests/e2e/list-regressions.js
+        env:
+          WEKAN_BASE_URL: http://localhost:3000
+          WEKAN_MONGO_URL: mongodb://localhost:27017/wekan_regression
+          CHROMIUM_PATH: /usr/bin/chromium-browser
+          HEADLESS: 'true'

.github/workflows/release-all-missing.yml

@@ -0,0 +1,422 @@
+name: Release all missing
+
+# Build only the bundles a release does not already carry.
+#
+# WHY: release-all.yml is one run that bumps versions, tags, builds every
+# platform, publishes Docker images, snaps, the website and the charts. It is
+# the right thing for MAKING a release and the wrong thing for FINISHING one.
+# When the v10.57 run ended with the six extra architectures missing - four of
+# them on a shell-quoting bug and two on a base image - there was no way to get
+# those six without running the whole thing again, version bump and all.
+#
+# This finishes a release that already exists. It never bumps a version, never
+# tags, and never touches Docker, snap or the website.
+#
+# It DOES publish the Helm chart, because that is a thing a release can be
+# missing like any other: the chart entry is written once, during the release it
+# belongs to, so a release whose charts job did not run leaves a hole that the
+# next release never goes back for - v10.80 is one of those, and it was not
+# alone. See the charts job at the end.
+#
+# WHAT IT CAN BUILD, and why that is not everything. Only build-amd64 runs
+# Meteor; every other bundle WeKan ships is that same bundle repacked. This job
+# downloads the PUBLISHED wekan-<v>-amd64.zip and repacks it, so it can rebuild:
+#
+#   the six extra architectures  s390x ppc64le riscv64 i386 armhf loong64
+#   the AppImages and Flatpaks   by calling their own workflows
+#
+# It cannot rebuild amd64 itself (that is the Meteor build), nor arm64, win64
+# and mac-arm64 (each needs its own kind of runner and its own steps), nor the
+# Sandstorm .spk. When one of those is missing it says so and names
+# release-all.yml, rather than pretending.
+#
+# The repack is releases/repack-bundle-for-arch.sh - the SAME script
+# release-all.yml's build-extra-arches runs, so a bundle added to a release
+# months later is built exactly like the ones already on it.
+#
+# What a complete release looks like is releases/expected-assets.sh, in one
+# place. An asset counts as present only when its .sha256sum is there too; the
+# Sandstorm .spk is signed rather than checksummed and is marked nosums.
+#
+# Usage:
+#   gh workflow run release-all-missing.yml -f version=10.58
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release to complete, without the v (e.g. 10.58). Empty = the newest release.'
+        required: false
+        type: string
+
+permissions:
+  contents: write
+
+env:
+  # Must match release-all.yml: the Node.js major the bundles carry.
+  NODE_VERSION: '24'
+
+# Never at the same time as a full release run, which would be uploading to the
+# same assets.
+concurrency:
+  group: wekan-release-${{ inputs.version || github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  plan:
+    name: what the release is missing
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.plan.outputs.version }}
+      extra: ${{ steps.plan.outputs.extra }}
+      appimage: ${{ steps.plan.outputs.appimage }}
+      flatpak: ${{ steps.plan.outputs.flatpak }}
+      manual: ${{ steps.plan.outputs.manual }}
+      total: ${{ steps.plan.outputs.total }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - id: plan
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          V='${{ inputs.version }}'
+          V="${V#v}"
+          if [ -z "$V" ]; then
+            V="$(gh release view --repo "${GITHUB_REPOSITORY:-wekan/wekan}" --json tagName --jq .tagName)"
+            V="${V#v}"
+            echo "No version given; the newest release is v$V."
+          fi
+          echo "version=$V" >> "$GITHUB_OUTPUT"
+
+          if gh release view --repo "${GITHUB_REPOSITORY:-wekan/wekan}" "v$V" >/dev/null 2>&1; then
+            gh release view --repo "${GITHUB_REPOSITORY:-wekan/wekan}" "v$V" --json assets --jq '.assets[].name' | sort > existing.txt
+          else
+            echo "::error::There is no release v$V to complete. This workflow FINISHES a release; release-all.yml makes one."
+            exit 1
+          fi
+          echo "v$V carries $(wc -l < existing.txt | tr -d ' ') asset(s)."
+
+          bash releases/expected-assets.sh "$V" > expected.txt
+
+          : > missing.txt
+          present=0
+          while read -r kind selector asset sums; do
+            need="$asset"
+            [ "$sums" = "sums" ] && need="$need ${asset}.sha256sum"
+            have=yes
+            for n in $need; do grep -qxF "$n" existing.txt || have=no; done
+            if [ "$have" = yes ]; then present=$((present + 1)); else echo "$kind $selector" >> missing.txt; fi
+          done < expected.txt
+
+          total="$(wc -l < missing.txt | tr -d ' ')"
+          echo "total=$total" >> "$GITHUB_OUTPUT"
+
+          for kind in extra appimage flatpak; do
+            sels="$(awk -v k="$kind" '$1 == k { print $2 }' missing.txt)"
+            json="$(printf '%s\n' $sels | sed '/^$/d' | jq -R . | jq -sc .)"
+            [ -n "$json" ] || json='[]'
+            echo "$kind=$json" >> "$GITHUB_OUTPUT"
+            echo "  $kind: $json"
+          done
+
+          # The ones this workflow cannot make. Named, not silently skipped.
+          manual="$(awk '$1 == "meteor" || $1 == "repack" || $1 == "sandstorm" { printf "%s/%s ", $1, $2 }' missing.txt)"
+          echo "manual=${manual% }" >> "$GITHUB_OUTPUT"
+
+          {
+            echo "### v$V"
+            echo ""
+            echo "$present of $((present + total)) assets already published."
+            echo ""
+            if [ "$total" -eq 0 ]; then
+              echo "Nothing is missing - the release is complete."
+            else
+              echo "Missing:"
+              echo ""
+              echo '```'
+              cat missing.txt
+              echo '```'
+              if [ -n "$manual" ]; then
+                echo ""
+                echo "Not buildable here (run release-all.yml): \`$manual\`"
+              fi
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+          echo "Missing $total. Needs release-all.yml: ${manual:-none}"
+
+      - name: Say plainly what this run will not do
+        if: ${{ steps.plan.outputs.manual != '' }}
+        run: |
+          echo "::warning::v${{ steps.plan.outputs.version }} is missing ${{ steps.plan.outputs.manual }}, which this workflow cannot build: amd64 is the Meteor build, arm64/win64/mac-arm64 each need their own runner, and the Sandstorm .spk is signed. Run release-all.yml for those."
+
+  # The six architectures nobody else builds for, repacked from the PUBLISHED
+  # amd64 bundle - which is what makes this possible without a Meteor build.
+  extra-arches:
+    name: ${{ matrix.arch }}
+    needs: plan
+    if: ${{ needs.plan.outputs.extra != '[]' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 300
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # The same table as release-all.yml's build-extra-arches, and it has
+          # to stay the same: `node_arch` is what the Node.js download is
+          # called (Node says x86 where we say i386, armv7l where we say
+          # armhf), `ferretdb_arch` is the asset name in the wekan/FerretDB
+          # release, and `image` must be a base image that PUBLISHES this
+          # platform - ubuntu:26.04 does not build 386, debian:trixie does.
+          - { arch: s390x,   platform: linux/s390x,   image: debian:trixie, node_arch: s390x,   ferretdb_arch: s390x }
+          - { arch: ppc64le, platform: linux/ppc64le, image: debian:trixie, node_arch: ppc64le, ferretdb_arch: ppc64le }
+          - { arch: riscv64, platform: linux/riscv64, image: debian:trixie, node_arch: riscv64, ferretdb_arch: riscv64 }
+          - { arch: i386,    platform: linux/386,     image: debian:trixie, node_arch: x86,     ferretdb_arch: i386 }
+          - { arch: armhf,   platform: linux/arm/v7,  image: debian:trixie, node_arch: armv7l,  ferretdb_arch: armhf }
+          # loong64 has NO base image on Docker Hub at any tag, so there is no
+          # loong64 userland to rebuild the native modules in. Its Node.js and
+          # its FerretDB both exist; the container does not. The preflight
+          # inside the script stops it saying exactly that, and it stays in the
+          # matrix so it is visible rather than quietly absent.
+          - { arch: loong64, platform: linux/loong64, image: debian:trixie, node_arch: loong64, ferretdb_arch: loong64 }
+    env:
+      VERSION: ${{ needs.plan.outputs.version }}
+    steps:
+      - name: Skip the architectures this release already has
+        id: want
+        run: |
+          if printf '%s' '${{ needs.plan.outputs.extra }}' | jq -e --arg a '${{ matrix.arch }}' 'index($a)' >/dev/null; then
+            echo "build=yes" >> "$GITHUB_OUTPUT"
+          else
+            echo "build=no" >> "$GITHUB_OUTPUT"
+            echo "v${VERSION} already has ${{ matrix.arch }}; nothing to do."
+          fi
+
+      - uses: actions/checkout@v7
+
+      - name: Install dependencies
+        if: ${{ steps.want.outputs.build == 'yes' }}
+        run: |
+          bash "$GITHUB_WORKSPACE/releases/apt-install.sh" curl unzip zip
+
+      - name: Set up QEMU for ${{ matrix.arch }} emulation
+        if: ${{ steps.want.outputs.build == 'yes' }}
+        uses: docker/setup-qemu-action@v4
+
+      # Before the download, because actions/checkout cleans the workspace.        if: ${{ steps.want.outputs.build == 'yes' }}
+
+      # THE DIFFERENCE from release-all.yml, and the whole point of this
+      # workflow: the amd64 bundle comes from the RELEASE, not from an artifact
+      # of a build that is not running. Its checksum is verified when the
+      # release has one - a bundle every other architecture is cut from is worth
+      # checking before it is cut.
+      - name: Download the published amd64 bundle
+        if: ${{ steps.want.outputs.build == 'yes' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          zip="wekan-${VERSION}-amd64.zip"
+          gh release download "v${VERSION}" --pattern "$zip" --clobber
+          if gh release download "v${VERSION}" --pattern "${zip}.sha256sum" --clobber 2>/dev/null; then
+            sha256sum -c "${zip}.sha256sum"
+            echo "amd64 bundle checksum verified."
+          else
+            echo "::warning::v${VERSION} publishes no ${zip}.sha256sum, so the bundle every other architecture is cut from could not be verified."
+          fi
+          unzip -q "$zip"
+          [ -d bundle ] || { echo "::error::$zip did not contain a bundle/ directory."; exit 1; }
+          rm -f "$zip" "${zip}.sha256sum"
+
+      - name: Repack it for ${{ matrix.arch }}
+        if: ${{ steps.want.outputs.build == 'yes' }}
+        env:
+          ARCH: ${{ matrix.arch }}
+          NODE_ARCH: ${{ matrix.node_arch }}
+          FERRETDB_ARCH: ${{ matrix.ferretdb_arch }}
+          IMAGE: ${{ matrix.image }}
+          PLATFORM: ${{ matrix.platform }}
+        run: bash releases/repack-bundle-for-arch.sh
+
+      - name: Attach ${{ matrix.arch }} to the release
+        if: ${{ steps.want.outputs.build == 'yes' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          asset="wekan-${VERSION}-${{ matrix.arch }}.zip"
+          # No --clobber: this architecture was absent, so an upload that would
+          # overwrite something means the release changed under this run.
+          gh release upload --repo "${GITHUB_REPOSITORY:-wekan/wekan}" "v${VERSION}" "$asset" "${asset}.sha256sum"
+          # Confirm from the other side. An upload that reports success and
+          # leaves no asset behind is the failure nobody notices until a
+          # download 404s.
+          gh release view --repo "${GITHUB_REPOSITORY:-wekan/wekan}" "v${VERSION}" --json assets --jq '.assets[].name' > release-assets.txt
+          grep -qxF "$asset" release-assets.txt || {
+            echo "::error::$asset is not on release v${VERSION} although the upload reported success."
+            exit 1
+          }
+          echo "OK: $asset attached ($(($(wc -c < "$asset")/1024/1024)) MiB)."
+
+  appimage:
+    name: AppImages
+    needs: plan
+    if: ${{ needs.plan.outputs.appimage != '[]' }}
+    uses: ./.github/workflows/AppImage.yml
+    permissions:
+      contents: write
+    with:
+      tag: v${{ needs.plan.outputs.version }}
+      publish: true
+      only: ${{ needs.plan.outputs.appimage }}
+
+  flatpak:
+    name: Flatpaks
+    needs: plan
+    if: ${{ needs.plan.outputs.flatpak != '[]' }}
+    uses: ./.github/workflows/Flatpak.yml
+    permissions:
+      contents: write
+    with:
+      tag: v${{ needs.plan.outputs.version }}
+      publish: true
+      only: ${{ needs.plan.outputs.flatpak }}
+
+
+  # ─── The Helm chart, for a release that never got one ───────────────────────
+  #
+  # Everything else here rebuilds a missing BUNDLE; this publishes a missing
+  # CHART, which goes missing the same way and for the same reason. A chart is
+  # written once, by release-charts.sh, during the release it belongs to, so a
+  # release whose charts job did not run has no chart and nothing ever goes back
+  # for it. That is not rare - 146 of the packages already on gh-pages had no
+  # index entry, and v10.80 has no package at all, because a cancelled
+  # build-mac-x64 cancelled its run before the charts job started.
+  #
+  # It is the one part of this workflow that PUSHES to another repository, so it
+  # is guarded twice: it does nothing unless a token that can push to
+  # wekan/charts is configured, and nothing if the chart for this version is
+  # already published. Re-publishing an existing version would re-tar the package
+  # and change the digest of a chart people have already pulled.
+  charts:
+    name: Helm chart
+    needs: plan
+    if: ${{ !cancelled() && needs.plan.outputs.version != '' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout wekan (for releases/release-charts.sh)
+        if: steps.check.outputs.skip != 'true'
+        uses: actions/checkout@v7
+        with:
+          path: wekan
+
+      - name: Is a chart already published for this version?
+        id: check
+        env:
+          V: ${{ needs.plan.outputs.version }}
+          REPO_TOKEN: ${{ secrets.WEKAN_REPO_TOKEN }}
+        run: |
+          set -uo pipefail
+          if [ -z "${REPO_TOKEN:-}" ]; then
+            echo "::warning::No WEKAN_REPO_TOKEN, so the Helm chart cannot be published. Add a token that can push to wekan/charts to have this finish the chart too."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          # The published index is the authority on what exists, not this
+          # checkout. An entry's own version is at EXACTLY four spaces; the
+          # mongodb subchart's version sits deeper and would match a loose grep.
+          bash wekan/releases/fetch.sh -o index.yaml https://wekan.github.io/charts/index.yaml || {
+            echo "::warning::Could not read the published chart index; not touching the charts repo."
+            echo "skip=true" >> "$GITHUB_OUTPUT"; exit 0; }
+          # -F, a FIXED string: the dots in a version are regex wildcards
+          # otherwise, so "10.80" would also match a line reading 10x80. -x so it
+          # is the whole line, and the four-space indent is what makes it an
+          # entry's own version rather than the mongodb subchart's, which sits
+          # deeper.
+          if grep -qxF "    version: ${V}.0" index.yaml; then
+            echo "::notice::v$V already has a published Helm chart (${V}.0); nothing to do."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "v$V has no published chart; publishing ${V}.0."
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+
+      - name: Checkout wekan/charts (main + gh-pages)
+        if: steps.check.outputs.skip != 'true'
+        uses: actions/checkout@v7
+        with:
+          repository: wekan/charts
+          token: ${{ secrets.WEKAN_REPO_TOKEN }}
+          fetch-depth: 0
+          path: charts
+
+      - name: Install Helm
+        if: steps.check.outputs.skip != 'true'
+        uses: azure/setup-helm@v5
+
+      - name: Publish the chart for this release
+        if: steps.check.outputs.skip != 'true'
+        env:
+          CHARTS_DIR: ${{ github.workspace }}/charts
+        run: |
+          set -euo pipefail
+          cd charts
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git fetch origin '+refs/heads/*:refs/remotes/origin/*'
+          git branch --track gh-pages origin/gh-pages 2>/dev/null || true
+          git checkout main
+          cd ..
+          ./wekan/releases/release-charts.sh "${{ needs.plan.outputs.version }}"
+
+      - name: Job result
+        if: always()
+        run: |
+          case "${{ job.status }}" in
+            success)   mark='OK       ' ;;
+            failure)   mark='FAILED   ' ;;
+            cancelled) mark='CANCELLED' ;;
+            *)         mark='${{ job.status }}' ;;
+          esac
+          echo "$mark charts" >> "$GITHUB_STEP_SUMMARY"
+
+  done:
+    name: what is still missing
+    needs: [plan, extra-arches, appimage, flatpak, charts]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          V: ${{ needs.plan.outputs.version }}
+          BEFORE: ${{ needs.plan.outputs.total }}
+        run: |
+          set -euo pipefail
+          if [ "$BEFORE" = "0" ]; then
+            echo "::notice::v$V was already complete - nothing was built."
+            exit 0
+          fi
+          gh release view --repo "${GITHUB_REPOSITORY:-wekan/wekan}" "v$V" --json assets --jq '.assets[].name' | sort > now.txt
+          bash releases/expected-assets.sh "$V" > expected.txt
+          still=""
+          while read -r kind selector asset sums; do
+            need="$asset"
+            [ "$sums" = "sums" ] && need="$need ${asset}.sha256sum"
+            for n in $need; do
+              grep -qxF "$n" now.txt || { still="$still $kind/$selector"; break; }
+            done
+          done < expected.txt
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          if [ -z "$still" ]; then
+            echo "v$V is complete."
+            echo "**v$V is complete.**" >> "$GITHUB_STEP_SUMMARY"
+          else
+            # A warning, not a failure: what is left may be the parts this
+            # workflow never claimed to build.
+            echo "::warning::v$V is still missing:${still}"
+            echo "Still missing:\`${still# }\`" >> "$GITHUB_STEP_SUMMARY"
+          fi

.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/sandstorm-store.yml

@@ -0,0 +1,144 @@
+name: Publish .spk to Sandstorm App Market
+
+# Manually triggered. Takes the Sandstorm .spk that sandstorm.yml already built and
+# attached to a WeKan GitHub Release, renames it to wekan-<VERSION>.spk (VERSION is the
+# WeKan release version, e.g. 9.88), and publishes it to the Sandstorm App Market with
+#   spk publish wekan-<VERSION>.spk
+# exactly like releases/release-sandstorm.sh does locally.
+#
+#   gh workflow run sandstorm-store.yml
+#   gh workflow run sandstorm-store.yml -f version=9.88
+#   gh workflow run sandstorm-store.yml -f version=9.88 -f tag=v9.88
+#
+# Needs SANDSTORM_KEYRING (base64 of ~/.sandstorm-keyring) — `spk publish` proves app
+# ownership with the WeKan Sandstorm app's private key from that keyring — and installs
+# Sandstorm + assembles meteor-spk the same way sandstorm.yml does, so `spk` is present.
+# It does NOT rebuild the .spk; it publishes the one already on the release.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'WeKan version for the store filename wekan-<VERSION>.spk (e.g. 9.88). Default: derived from the release tag.'
+        required: false
+        default: ''
+      tag:
+        description: 'Release tag whose .spk to publish (default: newest release).'
+        required: false
+        default: ''
+
+permissions:
+  contents: read
+
+env:
+  NODE_VERSION: '24'
+
+jobs:
+  sandstorm-store:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+
+      - name: Install system dependencies
+        run: |
+          bash "$GITHUB_WORKSPACE/releases/apt-install.sh" p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git
+
+      - name: Install Sandstorm (dev, unattended)
+        # Provides the `spk` command used to publish, and the sandstorm-http-bridge that
+        # build-deps.sh copies into the meteor-spk deps.
+        run: curl https://install.sandstorm.io | sudo bash -s -- -d
+
+      - name: Assemble modern meteor-spk.deps (same as sandstorm.yml)
+        run: |
+          bash sandstorm-src/build-deps.sh
+          echo "$HOME/projects/meteor-spk/meteor-spk-0.6.0" >> "$GITHUB_PATH"
+
+      - name: Restore the Sandstorm signing keyring
+        env:
+          SANDSTORM_KEYRING: ${{ secrets.SANDSTORM_KEYRING }}
+        run: |
+          if [ -n "${SANDSTORM_KEYRING:-}" ]; then
+            # spk publish reads the app signing key from ~/.sandstorm-keyring (a FILE in
+            # $HOME), same location meteor-spk pack uses.
+            printf '%s' "$SANDSTORM_KEYRING" | base64 -d > "$HOME/.sandstorm-keyring"
+            chmod 600 "$HOME/.sandstorm-keyring"
+            echo "Restored ~/.sandstorm-keyring ($(wc -c < "$HOME/.sandstorm-keyring") bytes)."
+          else
+            echo "::error::SANDSTORM_KEYRING secret is not set. 'spk publish' proves ownership of the WeKan Sandstorm app with the private key from this keyring, so publishing cannot proceed without it. Add the base64 of your ~/.sandstorm-keyring file as the SANDSTORM_KEYRING repository secret (e.g. 'base64 -w0 ~/.sandstorm-keyring')."
+            exit 1
+          fi
+
+      - name: Download the newest .spk from the WeKan release and name it wekan-<VERSION>.spk
+        id: fetch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          IN_TAG: ${{ github.event.inputs.tag }}
+          IN_VERSION: ${{ github.event.inputs.version }}
+        run: |
+          set -euo pipefail
+
+          # 1) Which release to publish from.
+          TAG="${IN_TAG:-}"
+          if [ -z "$TAG" ]; then
+            TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || true)"
+          fi
+          if [ -z "${TAG:-}" ] || [ "$TAG" = "null" ]; then
+            echo "::error::No release found to publish the .spk from."
+            exit 1
+          fi
+
+          # 2) VERSION for the store filename wekan-<VERSION>.spk. Use the input, else
+          #    derive it from the tag (strip a leading 'v', e.g. v9.88 -> 9.88).
+          VERSION="${IN_VERSION:-}"
+          if [ -z "$VERSION" ]; then
+            VERSION="${TAG#v}"
+          fi
+          echo "Release: $TAG  ->  store filename: wekan-${VERSION}.spk"
+
+          # 3) Download the newest .spk asset on that release. sandstorm.yml attaches it
+          #    as wekan-sandstorm-YYYY_MM_DD-HH_MM_SS.spk; if several exist, take the
+          #    lexicographically-newest (the timestamp sorts chronologically).
+          ASSET="$(gh release view --repo "${GITHUB_REPOSITORY:-wekan/wekan}" "$TAG" --json assets \
+            --jq '[.assets[].name | select(endswith(".spk"))] | sort | last' 2>/dev/null || true)"
+          if [ -z "${ASSET:-}" ] || [ "$ASSET" = "null" ]; then
+            echo "::error::Release $TAG has no .spk asset. Run sandstorm.yml first to build and attach one."
+            exit 1
+          fi
+          echo "Downloading .spk asset: $ASSET"
+          gh release download "$TAG" --pattern "$ASSET" --dir . --clobber
+
+          SPK="wekan-${VERSION}.spk"
+          mv -f "$ASSET" "$SPK"
+          ls -la "$SPK"
+          echo "spk=$SPK" >> "$GITHUB_OUTPUT"
+
+      - name: Publish to the Sandstorm App Market
+        env:
+          SPK: ${{ steps.fetch.outputs.spk }}
+        run: |
+          set -euo pipefail
+          # Resolve the spk binary: prefer PATH, then the Sandstorm install location.
+          SPK_BIN="$(command -v spk || true)"
+          if [ -z "$SPK_BIN" ]; then
+            for c in /opt/sandstorm/latest/bin/spk /opt/sandstorm/spk /usr/local/bin/spk; do
+              [ -x "$c" ] && SPK_BIN="$c" && break
+            done
+          fi
+          if [ -z "$SPK_BIN" ]; then
+            echo "::error::Could not find the 'spk' command from the Sandstorm install."
+            exit 1
+          fi
+          echo "Publishing $SPK with $SPK_BIN ..."
+          # Same command as releases/release-sandstorm.sh: spk publish wekan-<VERSION>.spk
+          "$SPK_BIN" publish "$SPK"

.github/workflows/sandstorm.yml

@@ -0,0 +1,143 @@
+name: Build Sandstorm .spk
+
+# Manually triggered. Builds ONLY the Sandstorm .spk package (nothing else) and
+# uploads it as wekan-sandstorm-YYYY_MM_DD-HH_MM_SS.spk to the NEWEST WeKan GitHub
+# Release as an attachment, so you can download it, test whether the Sandstorm
+# build works, and see any errors — without running a full release.
+#
+#   gh workflow run sandstorm.yml
+#
+# EXPERIMENTAL in CI (same caveats as the build-sandstorm job in release-all.yml):
+#   * Sandstorm needs unprivileged user namespaces; GitHub's Ubuntu runners are VMs
+#     that allow them, but this is the fragile part.
+#   * meteor-spk SIGNS the .spk with the app private key from the Sandstorm keyring;
+#     provide it as the SANDSTORM_KEYRING secret (base64 of ~/.sandstorm keyring).
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch, tag or SHA to build the .spk from (default: main)'
+        required: false
+        default: 'main'
+
+permissions:
+  contents: write
+
+env:
+  NODE_VERSION: '24'
+
+jobs:
+  sandstorm:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # Build the dispatched ref so a fix branch can be tested before it is
+          # merged to main; defaults to main for a plain `gh workflow run`.
+          ref: ${{ github.event.inputs.ref || 'main' }}
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
+        # Ubuntu 24.04's AppArmor defaults kernel.apparmor_restrict_unprivileged_userns=1,
+        # which blocks the unprivileged user namespaces that the Sandstorm install and
+        # the spk supervisor rely on (the "fragile part" noted above). Relax it so
+        # `install.sandstorm.io` and meteor-spk can create sandboxes on the runner.
+        # `|| true`: on kernels/runners without these knobs, setting them is a no-op.
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+
+      - name: Install system dependencies and Meteor
+        run: |
+          bash "$GITHUB_WORKSPACE/releases/apt-install.sh" p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git qemu-user-static
+          if [ ! -f "$HOME/.meteor/meteor" ]; then curl https://install.meteor.com/ | sh; fi
+          echo "$HOME/.meteor" >> "$GITHUB_PATH"
+
+      - name: Install Sandstorm (dev, unattended)
+        # Installed BEFORE assembling the deps: build-deps.sh's [bridge] step copies
+        # the modern /opt/sandstorm/latest/bin/sandstorm-http-bridge over the ancient
+        # bundled one, so the Sandstorm install must be in place first.
+        run: curl https://install.sandstorm.io | sudo bash -s -- -d
+
+      - name: Assemble modern meteor-spk.deps (Node 24 + FerretDB + Mongo 3.x CLIs)
+        # Base = upstream meteor-spk 0.6.0 from dl.sandstorm.io (has mongod 3.0 +
+        # niscud). build-deps.sh swaps in Node 24, adds FerretDB + the Mongo 3.x
+        # CLIs + the migration launcher/importer, keeps niscud, and swaps in the
+        # modern sandstorm-http-bridge from the Sandstorm install above. No dependency
+        # on the retired releases.wekan.team or the old projects.7z.
+        run: |
+          bash sandstorm-src/build-deps.sh
+          echo "$HOME/projects/meteor-spk/meteor-spk-0.6.0" >> "$GITHUB_PATH"
+
+      - name: Restore the Sandstorm signing keyring
+        env:
+          SANDSTORM_KEYRING: ${{ secrets.SANDSTORM_KEYRING }}
+        run: |
+          if [ -n "${SANDSTORM_KEYRING:-}" ]; then
+            # meteor-spk / spk read the app signing key from ~/.sandstorm-keyring —
+            # a FILE directly in $HOME (see the pack crash path
+            # "/home/runner/.sandstorm-keyring"). Write it exactly there, NOT to
+            # ~/.sandstorm/sandstorm-keyring, or `meteor-spk pack` aborts with
+            # "open(~/.sandstorm-keyring): No such file or directory".
+            printf '%s' "$SANDSTORM_KEYRING" | base64 -d > "$HOME/.sandstorm-keyring"
+            chmod 600 "$HOME/.sandstorm-keyring"
+            echo "Restored ~/.sandstorm-keyring ($(wc -c < "$HOME/.sandstorm-keyring") bytes)."
+          else
+            echo "::error::SANDSTORM_KEYRING secret is not set. meteor-spk pack signs the .spk with the WeKan Sandstorm app's private key, which lives in this keyring, so packing cannot proceed without it. Add the base64 of your ~/.sandstorm-keyring file as the SANDSTORM_KEYRING repository secret (e.g. 'base64 -w0 ~/.sandstorm-keyring')."
+            exit 1
+          fi
+
+      - name: Install Meteor npm dependencies
+        # PUPPETEER_SKIP_DOWNLOAD: puppeteer is a devDependency used only by tests,
+        # not by the server, so it never belongs in the packed .spk. Skipping its
+        # Chromium download (~150 MB) avoids any risk of it bloating the build and
+        # speeds up CI.
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: '1'
+        run: |
+          (meteor update --npm 2>/dev/null || true) && meteor npm install
+
+      - name: Build the Sandstorm .spk
+        id: build
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: '1'
+        run: |
+          set -euo pipefail
+          STAMP="$(date +'%Y_%m_%d-%H_%M_%S')"
+          SPK="wekan-sandstorm-${STAMP}.spk"
+          meteor-spk pack "$SPK"
+          # Report the packed size and warn if it exceeds Cloudflare's 100 MB upload
+          # cap (a proxied browser upload to a Cloudflare-fronted Sandstorm 413s above
+          # this; install via a DNS-only host / SSH tunnel, or trim further).
+          SPK_BYTES=$(stat -c%s "$SPK")
+          echo "Packed $SPK: $((SPK_BYTES/1024/1024)) MiB ($SPK_BYTES bytes)"
+          if [ "$SPK_BYTES" -gt $((100*1024*1024)) ]; then
+            echo "::warning::$SPK is $((SPK_BYTES/1024/1024)) MiB — over Cloudflare's 100 MB upload limit. Upload via a DNS-only host / SSH tunnel to Sandstorm, or trim the bundle further."
+          fi
+          ls -la "$SPK"
+          echo "spk=$SPK" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: ${{ steps.build.outputs.spk }}
+          path: ${{ steps.build.outputs.spk }}
+          retention-days: 7
+
+      - name: Upload the .spk to the newest WeKan release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || true)"
+          if [ -z "${TAG:-}" ] || [ "$TAG" = "null" ]; then
+            echo "::error::No existing GitHub Release found to attach the .spk to."
+            exit 1
+          fi
+          echo "Uploading ${{ steps.build.outputs.spk }} to the newest release: $TAG"
+          gh release upload --repo "${GITHUB_REPOSITORY:-wekan/wekan}" "$TAG" "${{ steps.build.outputs.spk }}" --clobber

.github/workflows/test_suite.yml

@@ -1,168 +0,0 @@
-name: Test suite
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-permissions:
-  contents: read # to fetch code (actions/checkout)
-
-jobs:
-# the following are optional jobs and need to be configured according
-# to this project's settings:
-#
-#  lintcode:
-#    name: Javascript lint
-#    runs-on: ubuntu-latest
-#    steps:
-#    - name: checkout
-#      uses: actions/checkout@v6
-#
-#    - name: setup node
-#      uses: actions/setup-node@v1
-#      with:
-#        node-version: '12.x'
-#
-#    - name: cache dependencies
-#      uses: actions/cache@v1
-#      with:
-#        path: ~/.npm
-#        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-#        restore-keys: |
-#          ${{ runner.os }}-node-
-#
-#    - run: npm install
-#    - run: npm run lint:code
-#
-#  lintstyle:
-#    name: SCSS lint
-#    runs-on: ubuntu-latest
-#    needs: [lintcode]
-#    steps:
-#    - name: checkout
-#      uses: actions/checkout@v6
-#
-#    - name: setup node
-#      uses: actions/setup-node@v1
-#      with:
-#        node-version: '12.x'
-#
-#    - name: cache dependencies
-#      uses: actions/cache@v1
-#      with:
-#        path: ~/.npm
-#        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-#        restore-keys: |
-#          ${{ runner.os }}-node-
-#    - run: npm install
-#    - run: npm run lint:style
-#
-#  lintdocs:
-#    name: documentation lint
-#    runs-on: ubuntu-latest
-#    needs: [lintcode,lintstyle]
-#    steps:
-#    - name: checkout
-#      uses: actions/checkout@v6
-#
-#    - name: setup node
-#      uses: actions/setup-node@v1
-#      with:
-#        node-version: '12.x'
-#
-#    - name: cache dependencies
-#      uses: actions/cache@v1
-#      with:
-#        path: ~/.npm
-#        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-#        restore-keys: |
-#          ${{ runner.os }}-node-
-#
-#    - run: npm install
-#    - run: npm run lint:markdown
-
-  tests:
-    name: Meteor ${{ matrix.meteor }} tests
-    runs-on: ubuntu-latest
-    steps:
-
-      # CHECKOUTS
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      # CACHING
-      - name: Install Meteor
-        id: cache-meteor-install
-        uses: actions/cache@v5
-        with:
-          path: ~/.meteor
-          key: v1-meteor-${{ hashFiles('.meteor/versions') }}
-          restore-keys: |
-                v1-meteor-
-
-      - name: Cache NPM dependencies
-        id: cache-meteor-npm
-        uses: actions/cache@v5
-        with:
-          path: ~/.npm
-          key: v1-npm-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-                v1-npm-
-
-      - name: Cache Meteor build
-        id: cache-meteor-build
-        uses: actions/cache@v5
-        with:
-          path: |
-            .meteor/local/resolver-result-cache.json
-            .meteor/local/plugin-cache
-            .meteor/local/isopacks
-            .meteor/local/bundler-cache/scanner
-          key: v1-meteor_build_cache-${{ github.ref }}-${{ github.sha }}
-          restore-keys: |
-            v1-meteor_build_cache-
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: '24.14.1'
-
-      - name: Setup meteor
-        uses: meteorengineer/setup-meteor@v3
-        with:
-          meteor-release: '3.5-beta.7'
-
-      - name: Install NPM Dependencies
-        run: meteor npm install
-
-      - name: Run Tests
-        run: sh ./test-wekan.sh -cv
-
-      - name: Upload coverage
-        uses: actions/upload-artifact@v7
-        with:
-          name: coverage-folder
-          path: .coverage/
-
-  coverage:
-    name: Coverage report
-    runs-on: ubuntu-latest
-    needs: [tests]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Download coverage
-        uses: actions/download-artifact@v8
-        with:
-          name: coverage-folder
-          path: .coverage/
-
-
-      - name: Coverage Report
-        uses: VeryGoodOpenSource/very_good_coverage@v3.0.0
-        with:
-          path: ".coverage/lcov.info"
-          min_coverage: 1 # TODO add tests and increase to 95!

.gitignore

@@ -1,5 +1,10 @@
 *~
+/*.log
+# vim swap files (.swp, .swo, .swn) - but NOT .swcrc, which is the SWC transpiler
+# configuration and has to be committed. Without this exception `git add .swcrc`
+# is silently a no-op and the fix for #6557 never leaves the working tree.
 *.sw*
+!.swcrc
 .meteor-spk
 *.sublime-workspace
 tmp/
@@ -31,6 +36,7 @@ Thumbs.db
 ehthumbs.db
 .eslintcache
 .meteor/local
+.meteor/local-test
 .devcontainer/docker-compose.extend.yml
 .devcontainer/volumes*/
 .coverage
@@ -53,3 +59,59 @@ _build
 */build-assets
 */build-chunks
 .rsdoctor
+
+# Tests
+playwright-report/
+test-results/
+
+# Claude AI
+.claude/
+
+# Companion repositories and tools, cloned INSIDE this checkout so they work in a
+# Flatpak sandbox that shares only this directory. One ignored directory for all
+# of them - it replaced an entry per clone (/FerretDB/, /node/, /mongo-tools/,
+# /mongosh/, /sandstorm/, /projects/, and the WeKan variants), which had to be
+# extended by hand for every new one. build.sh's ensure_tool_repo clones what a
+# test run needs into here: .tools/FerretDB, .tools/node-patches,
+# .tools/mongo-tools-patches. Nothing in here is WeKan's source, and Meteor is
+# told the same by /.tools/ in .meteorignore.
+.tools/
+
+# Meteor custom local directory (METEOR_LOCAL_DIR)
+_build-local-test
+*/build-assets-local-test
+*/build-chunks-local-test
+
+# Test and build logs, when they land INSIDE the repo. build.sh writes to
+# ../log/<datetime>/ by preference - one level up, so a test run does not show
+# up in git status - but the parent of the repo is not writable in a Flatpak
+# sandbox, which shares only the repository. There it falls back to ./log/,
+# which must not be committed.
+/log/
+
+# V8 heap snapshots from WEKAN_BUILD_HEAP_SNAPSHOT=1. Named
+# Heap.<date>.<pid>.<n>.heapsnapshot by Node, written into the repo root
+# because that is the build's working directory, and as large as the heap that
+# produced them - gigabytes.
+Heap.*.heapsnapshot
+
+# Linux core dumps (core.<pid>), e.g. from a crashing Playwright/WebKit browser
+# process. Written into the crashing process CWD (tests/playwright/) by
+# kernel.core_pattern; never source files.
+core.[0-9]*
+
+# The two variant repositories (wekan/wekan-ondra, wekan/wekan-gantt-gpl) when
+# they are cloned INSIDE this working copy to be synced by hand. They are whole
+# git repositories of their own; git would not commit them into this one, but
+# they should not show up as untracked noise either.
+/wekan-ondra/
+/wekan-gantt-gpl/
+
+# node-patches: a SEPARATE repo (github.com/wekan/node-patches) checked out here.
+node-patches/
+
+# mongo-tools-patches: a SEPARATE repo (github.com/wekan/mongo-tools-patches)
+# checked out here. Same story as node-patches: the PATCHES to the upstream
+# MongoDB Database Tools that WeKan's bundled bsondump/mongodump/... are built
+# from, replacing the wekan/mongo-tools source fork.
+mongo-tools-patches/

.meteor/packages

@@ -6,9 +6,12 @@
 meteor-base@1.5.2
 
 # Build system
-ecmascript@0.17.0
+ecmascript@0.19.0
 standard-minifier-js@3.2.0
-rspack@1.0.0
+rspack@1.2.0
+# Declared explicitly because server/modernBrowsers.js imports it, to say that
+# Yandex Browser is modern and must not be served the legacy bundle (#6557).
+modern-browsers@0.2.3
 
 blaze@3.0.2
 
@@ -16,18 +19,11 @@ blaze@3.0.2
 aldeed:collection2
 aldeed:schema-index@4.0.0-beta.5
 reywood:publish-composite
-mongo@2.3.0-beta350.7
-
-# The holy trifecta - this is a replacement for subs-manager
-# for IndexedDB persistence and auto-sync
-jam:offline 
-# for optimistic methods with offline queuing
-jam:method 
-# global subscription caching
-jam:pub-sub
+mongo@2.5.0
 
 # Account system
-accounts-password@3.2.3-beta350.7
+accounts-password@3.3.1
+accounts-express@1.0.0
 communitypackages:core
 communitypackages:unstyled
 communitypackages:flow-routing
@@ -44,7 +40,7 @@ wekan-accounts-oidc
 check@1.5.0
 random@1.2.2
 reactive-dict@1.3.2
-session@1.2.2
+session@1.2.3
 tracker@1.3.4
 audit-argument-checks@1.0.8
 
@@ -52,18 +48,18 @@ audit-argument-checks@1.0.8
 ostrio:i18n
 reactive-var@1.0.13
 shell-server@0.7.0
-email@3.2.0-beta350.7
+email@3.2.0
 dynamic-import@0.7.4
 wekan-markdown
 quave:synced-cron
 ostrio:cookies
 ostrio:files
 # lmieulet:meteor-coverage
-meteortesting:mocha
+meteortesting:mocha@3.0.0
 matb33:collection-hooks
 service-configuration@1.3.5
-minifier-css@2.0.1
-ejson@1.2.0-beta350.7
+minifier-css@2.0.2
+ejson@1.2.0
 logging@1.3.6
 wekan-fullcalendar
 wekan-fontawesome

.meteor/release

@@ -1 +1 @@
-METEOR@3.5-beta.7
+METEOR@3.5.1

.meteor/versions

@@ -1,88 +1,85 @@
-accounts-base@3.3.0-beta350.7
-accounts-oauth@1.4.6
-accounts-password@3.2.3-beta350.7
-aldeed:collection2@4.1.5
+accounts-base@3.3.0
+accounts-express@1.0.0
+accounts-oauth@1.4.7
+accounts-password@3.3.1
+aldeed:collection2@4.2.2
 aldeed:schema-index@4.0.0
 aldeed:simple-schema@1.13.1
 allow-deny@2.1.0
 audit-argument-checks@1.0.8
 autoupdate@2.0.1
-babel-compiler@7.13.0
+babel-compiler@7.15.0
 babel-runtime@1.5.2
-base64@1.0.13
-binary-heap@1.0.12
-blaze@3.0.2
-blaze-tools@2.0.0
+base64@1.0.14
+binary-heap@1.0.13
+blaze@3.0.3
+blaze-tools@2.0.1
 boilerplate-generator@2.1.0
 caching-compiler@2.0.1
-caching-html-compiler@2.0.0
-callback-hook@1.6.1
+caching-html-compiler@2.0.1
+callback-hook@1.8.0
 check@1.5.0
 communitypackages:core@2.0.3
 communitypackages:flow-routing@2.1.0
 communitypackages:unstyled@2.0.1
 core-runtime@1.0.0
 ddp@1.4.2
-ddp-client@3.2.0-beta350.7
-ddp-common@1.4.4
-ddp-rate-limiter@1.3.0-beta350.7
-ddp-server@3.2.0-beta350.7
+ddp-client@3.4.0
+ddp-common@1.4.5
+ddp-rate-limiter@1.3.0
+ddp-server@3.4.0
 diff-sequence@1.1.3
 dynamic-import@0.7.4
-ecmascript@0.17.0
+ecmascript@0.19.0
 ecmascript-runtime@0.8.3
-ecmascript-runtime-client@0.12.3
+ecmascript-runtime-client@0.13.0
 ecmascript-runtime-server@0.11.1
-ejson@1.2.0-beta350.7
-email@3.2.0-beta350.7
+ejson@1.2.0
+email@3.2.0
 es5-shim@4.8.1
 facts-base@1.0.2
-fetch@0.1.6
+fetch@0.2.0
 geojson-utils@1.0.12
 hot-code-push@1.0.5
-html-tools@2.0.0
-htmljs@2.0.1
-http@1.4.4
+html-tools@2.0.1
+htmljs@2.0.2
 id-map@1.2.0
-inter-process-messaging@0.1.2
-jam:method@1.9.1
-jam:offline@0.4.1
-jam:pub-sub@0.5.1
+inter-process-messaging@0.1.3
 jquery@3.0.2
 lai:collection-extensions@1.0.0
 localstorage@1.2.1
 logging@1.3.6
 matb33:collection-hooks@2.1.0
-meteor@2.2.0
+meteor@2.3.1
 meteor-base@1.5.2
-meteortesting:browser-tests@1.4.2
-meteortesting:mocha@2.1.0
-meteortesting:mocha-core@8.0.1
-minifier-css@2.0.1
-minifier-js@3.1.0
-minimongo@2.1.0-beta350.7
+meteortesting:browser-tests@1.8.0
+meteortesting:mocha@3.3.0
+meteortesting:mocha-core@8.2.0
+minifier-css@2.0.2
+minifier-js@3.3.0
+minimongo@2.2.0
 modern-browsers@0.2.3
 modules@0.20.3
 modules-runtime@0.13.2
-mongo@2.3.0-beta350.7
+mongo@2.5.0
 mongo-decimal@0.2.0
 mongo-dev-server@1.1.1
 mongo-id@1.0.9
-npm-mongo@6.16.1
-oauth@3.0.2
+npm-mongo@6.16.2
+oauth@3.0.4
 oauth2@1.3.3
-observe-sequence@2.0.0
+observe-sequence@2.0.1
 ordered-dict@1.2.0
-ostrio:cookies@2.9.1
+ostrio:cookies@2.9.2
 ostrio:cstorage@4.0.1
 ostrio:files@3.0.1
-ostrio:flow-router-extra@3.12.1
+ostrio:flow-router-extra@3.15.3
 ostrio:i18n@3.2.1
 promise@1.0.0
 quave:synced-cron@2.4.0
 raix:eventemitter@1.0.0
 random@1.2.2
-rate-limit@1.2.0-beta350.7
+rate-limit@1.2.0
 react-fast-refresh@0.3.0
 reactive-dict@1.3.2
 reactive-var@1.0.13
@@ -90,24 +87,24 @@ reload@1.3.2
 retry@1.1.1
 reywood:publish-composite@1.9.0
 routepolicy@1.1.2
-rspack@1.0.0
+rspack@1.2.1
 service-configuration@1.3.5
-session@1.2.2
+session@1.2.3
 sha@1.0.10
 shell-server@0.7.0
-socket-stream-client@0.7.0-beta350.7
-spacebars@2.0.0
-spacebars-compiler@2.0.0
+socket-stream-client@0.7.1
+spacebars@2.0.1
+spacebars-compiler@2.0.1
 standard-minifier-js@3.2.0
-templating@1.4.4
-templating-compiler@2.0.0
-templating-runtime@2.0.1
-templating-tools@2.0.0
-tools-core@1.0.0
+templating@1.4.5
+templating-compiler@2.0.1
+templating-runtime@2.0.2
+templating-tools@2.0.1
+tools-core@1.2.0
 tracker@1.3.4
-typescript@5.9.3
-url@1.3.5
-webapp@2.2.0-beta350.7
+typescript@5.11.0
+url@1.3.6
+webapp@2.3.0
 webapp-hashing@1.1.2
 wekan-accounts-cas@0.2.0
 wekan-accounts-lockout@1.1.0

.meteorignore

@@ -1 +1,42 @@
 npm-packages/
+# Root tests/ holds Playwright specs, Node E2E and node-based unit tests - none
+# of it is Meteor code, and Meteor's file watcher otherwise churns on the
+# tests/playwright/test-results/ tree (inotify errors). The leading slash anchors
+# this to the repo root only, so it does NOT match server/lib/tests/ or
+# client/lib/tests/ (the Mocha suites, loaded via meteor.testModule in
+# package.json). A naked "tests/" would match a dir named tests at any depth and
+# would hide those suites, making `meteor test` report "0 passing".
+/tests/
+
+# Build/tool scratch space: a full Node 24 install (headers for EVERY openssl arch),
+# a Go toolchain with its module/build caches, build logs and repro dirs. 20,535
+# DIRECTORIES, none of it app code. Meteor's watcher takes one inotify watch per
+# directory, and the per-user limit (fs.inotify.max_user_watches, 65536 here) is
+# shared with every other watcher the user runs - editors included. Watching this
+# tree is what made `meteor` fail with
+#   inotify_add_watch on '.tools/node-.../openssl/archs/BSD-x86_64/asm_avx2'
+#   failed: No space left on device
+# ENOSPC from inotify_add_watch means "watch limit reached", NOT a full disk.
+/.tools/
+
+# DO NOT ADD /_build/ OR /_build-local-test/ HERE. They look like build output
+# that should be ignored - they are gitignored, and they are the first two
+# entries of the 296 KB pattern list above - and excluding them breaks the
+# build outright:
+#
+#   error: Could not find mainModule for 'os' architecture:
+#   _build/main-prod/server-meteor.js
+#   Check the "meteor" section of your package.json file?
+#
+# They are not leftovers, they are the HANDOFF. rspack compiles the app into
+# _build/main-prod/ (and _build/test/ for a test run), and Meteor then reads
+# _build/main-prod/server-meteor.js and client-meteor.js as the application's
+# main modules - package.json names client/main.js and server/main.js, and the
+# rspack integration repoints mainModule at its own output. Ignoring them hides
+# the files Meteor is about to be handed. They cost 3 directories each, so there
+# was nothing to win here anyway.
+
+# Local build and test logs. WEKAN_LOG_ROOT prefers ../log/<datetime>/, but
+# falls back to ./log when the parent is not writable - which is exactly the
+# case inside the Flatpak sandbox, so this directory does appear here.
+/log/

.swcrc

@@ -0,0 +1,5 @@
+{
+  "jsc": {
+    "externalHelpers": false
+  }
+}

.tx/config

@@ -1,6 +1,6 @@
 [main]
 host     = https://www.transifex.com
-lang_map = te_IN: te-IN, es_AR: es-AR, es_419: es-LA, es_TX: es-TX, he_IL: he-IL, zh_CN: zh-CN, ar_EG: ar-EG, cs_CZ: cs-CZ, fa_IR: fa-IR, ms_MY: ms-MY, nl_NL: nl-NL, de_CH: de-CH, en_IT: en-IT, uz_UZ: uz-UZ, fr_CH: fr-CH, hi_IN: hi-IN, et_EE: et-EE, es_PE: es-PE, es_MX: es-MX, gl_ES: gl-ES, mn_MN: mn, zh_TW: zh-TW, ast_ES: ast-ES, es_CL: es-CL, ja_JP: ja, lv_LV: lv, ro_RO: ro-RO, az_AZ: az-AZ, cy_GB: cy-GB, gu_IN: gu-IN, pl_PL: pl-PL, vep: ve-PP, en_BR: en-BR, en@ysv: en-YS, hu_HU: hu, ko_KR: ko-KR, pt_BR: pt-BR, zh_HK: zh-HK, zu_ZA: zu-ZA, en_MY: en-MY, ja-Hira: ja-HI, fi_FI: fi, vec: ve-CC, vi_VN: vi-VN, fr_FR: fr-FR, id_ID: id, zh_Hans: zh-Hans, en_DE: en-DE, en_GB: en-GB, el_GR: el-GR, uk_UA: uk-UA, az@latin: az-LA, de_AT: de-AT, uz@Latn: uz-LA, vls: vl-SS, ar_DZ: ar-DZ, bg_BG: bg, es_PY: es-PY, fy_NL: fy-NL, uz@Arab: uz-AR, ru_UA: ru-UA, war: wa-RR, zh_CN.GB2312: zh-GB
+lang_map = te_IN: te-IN, es_AR: es-AR, es_419: es-LA, es_TX: es-TX, he_IL: he-IL, zh_CN: zh-CN, ar_EG: ar-EG, cs_CZ: cs-CZ, fa_IR: fa-IR, ms_MY: ms-MY, nl_NL: nl-NL, de_CH: de-CH, en_IT: en-IT, uz_UZ: uz-UZ, fr_CH: fr-CH, hi_IN: hi-IN, et_EE: et-EE, es_PE: es-PE, es_MX: es-MX, gl_ES: gl-ES, mn_MN: mn, zh_TW: zh-TW, ast_ES: ast-ES, es_CL: es-CL, ja_JP: ja-JP, lv_LV: lv, ro_RO: ro-RO, az_AZ: az-AZ, cy_GB: cy-GB, gu_IN: gu-IN, pl_PL: pl-PL, vep: ve-PP, en_BR: en-BR, en@ysv: en-YS, hu_HU: hu, ko_KR: ko-KR, pt_BR: pt-BR, zh_HK: zh-HK, zu_ZA: zu-ZA, en_MY: en-MY, ja-Hira: ja-HI, fi_FI: fi, vec: ve-CC, vi_VN: vi-VN, fr_FR: fr-FR, id_ID: id, zh_Hans: zh-Hans, en_DE: en-DE, en_GB: en-GB, el_GR: el-GR, uk_UA: uk-UA, az@latin: az-LA, de_AT: de-AT, uz@Latn: uz-LA, vls: vl-SS, ar_DZ: ar-DZ, bg_BG: bg, es_PY: es-PY, fy_NL: fy-NL, uz@Arab: uz-AR, ru_UA: ru-UA, war: wa-RR, zh_CN.GB2312: zh-GB
 
 [o:wekan:p:wekan:r:application]
 file_filter = imports/i18n/data/<lang>.i18n.json

AGENTS.md

@@ -0,0 +1,754 @@
+# AGENTS.md — instructions Codex reads first
+
+Codex reads this file at the repo root before doing work here. Follow it.
+
+## First: who maintains this, and who is committing?
+
+**WeKan, the `wekan/` repositories cloned under `.tools/`, and
+[Secretchronicles/TSC](https://github.com/Secretchronicles/TSC) are all maintained by
+Lauri Ojansivu (xet7) `<x@xet7.org>`** — [wekan/wekan](https://github.com/wekan/wekan),
+[wekan/FerretDB](https://github.com/wekan/FerretDB),
+[wekan/node-patches](https://github.com/wekan/node-patches),
+[wekan/mongo-tools-patches](https://github.com/wekan/mongo-tools-patches) and TSC,
+which is under the **Secretchronicles** organisation rather than **wekan** and is his
+all the same — his GitHub profile, [xet7](https://github.com/xet7), says exactly that:
+*"WeKan and TSC maintainer"*. Work done on the maintainer's behalf is committed as
+**`Lauri Ojansivu <x@xet7.org>`** — that author, in every one of those repositories,
+every time. Two rules follow from it and neither has an exception:
+
+- **Never attribute a commit to an AI.** No `Co-Authored-By:` trailer, no "Generated
+  with", no assistant or model name — not in the commit message, not in a pull-request
+  body, not in the CHANGELOG. [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) is where this
+  comes from: *"For pull requests, mention only those participants that are
+  **human**."* A `Thanks to ... and xet7 !` line credits people — the issue reporter
+  and xet7 — never a tool.
+- **If the git identity is missing or wrong in one of these checkouts, set it; do not
+  commit under something else.** The `.tools/` clones are made by `build.sh` inside
+  this checkout and can come up with no `user.name`/`user.email` of their own, which
+  would silently author a commit as whatever the machine's default is:
+
+  ```
+  git -C .tools/<repo> config user.name  'Lauri Ojansivu'
+  git -C .tools/<repo> config user.email 'x@xet7.org'
+  ```
+
+Check the current git identity before committing or releasing:
+
+```
+git config user.name && git config user.email
+```
+
+- **Maintainer mode** — the identity is `Lauri Ojansivu <x@xet7.org>` (name
+  `Lauri Ojansivu`, email `x@xet7.org`), or it is unset in a checkout of one of the
+  repositories above, which means it is to be SET to that as above rather than worked
+  around. Then: commit **directly to the current branch** as
+  `Lauri Ojansivu <x@xet7.org>` with no AI trailer and no pull request, and the
+  **publishing / release steps** below are available.
+- **Contributor mode** — the identity is somebody ELSE, in a fork or a clone of your
+  own. Then: do **not** commit directly to the branch and do **not** run any
+  release/publishing step. Make changes on a branch and open a **pull request** for
+  the maintainer to review, and keep that pull request free of AI attribution too.
+  The "commit as Lauri Ojansivu", "commit directly", and all release instructions
+  below are **maintainer-only and do not apply to you**.
+
+Maintainer mode covers TSC as well: commit directly to its `devel` branch, no pull
+request, same author and no AI attribution. What it does NOT bring along is WeKan's
+house style — TSC keeps its own **GNU ChangeLog** `CHANGELOG` and its own release
+process, because a project is read on its own terms (see the CHANGELOG section below).
+The one repository under `.tools/` that is somebody else's is `sandstorm-io/sandstorm`,
+cloned for reference only.
+
+Everything below marked as maintainer-specific (committing directly, the exact commit
+author, and the entire "Making a release" / publishing flow) applies only in maintainer
+mode. The rest (translation policy, CHANGELOG structure, tests, validating from code) is
+good practice for everyone.
+
+## Process: "Fix open issues"
+
+When asked to fix an open issue (one issue at a time):
+
+1. **Read the whole issue** — the description AND all comments (e.g.
+   `gh issue view <n> --comments`, or the GitHub API `.../issues/<n>/comments`).
+2. **If it is a bug, first check whether it is already fixed** in the current WeKan
+   AND FerretDB source code (read the actual code, not just changelogs). It may have
+   been fixed already.
+3. **If it is NOT fixed yet, fix it**, using the newest documentation and issues of
+   the dependencies involved, checking where the newest MAINTAINED dependency lives and
+   reading its source and issues:
+   - Meteor 3 docs — https://docs.meteor.com/
+   - Meteor 3 source + issues — https://github.com/meteor/meteor/issues
+   - other Meteor software docs/code (e.g. Rocket.Chat) for how they solved it
+   - Meteor forums — https://forums.meteor.com
+   - AtmosphereJS — https://atmospherejs.com/ ; Packosphere — https://packosphere.com/
+   - Meteor Community Packages — https://github.com/meteor-community-packages
+   - Meteor-Files — https://github.com/veliovgroup/Meteor-Files
+   - npm — https://www.npmjs.com
+4. **After fixing, add tests** — unit tests, negative tests, and UI tests where
+   appropriate — and **run the new tests to verify they pass** (see Tests / the sandbox
+   build+test instructions in `docs/Security/Sandboxes/vscode/README.md`).
+5. **Commit** (maintainer only — when the current git user is `Lauri Ojansivu
+   <x@xet7.org>`), with no "Co-Authored" / AI trailer, a message body ending:
+
+   ```
+   Thanks to (GitHub nickname of the issue creator) and xet7 !
+
+   Fixes #1234,
+   ```
+6. **If the bug is already fixed**, still add a commit that CLOSES the issue (a commit
+   whose message ends `Fixes #1234,`), noting where/when it was fixed.
+
+Fix from source and test — do not guess. If the environment cannot run the relevant
+test (e.g. Docker is unavailable in this sandbox), reproduce as closely as possible
+from source and say clearly what was and was not verified.
+
+## Translations (Transifex ↔ direct LLM fill, no external service)
+
+WeKan translations live in `imports/i18n/data/<lang>.i18n.json` (flat
+`key -> string`, 2-space indent, key order matches `en.i18n.json`). Transifex holds
+the human translations. **The policy is: never overwrite a human translation with a
+filled (or English) one, but always take the newest translations from Transifex.**
+
+- Pull with `releases/translations/pull-translations.sh`. It runs `tx pull -a -f`
+  (which fills every string that is UNtranslated on Transifex with the English source)
+  and then a **per-key merge** (`releases/translations/merge-translations.mjs`) that,
+  for every language file and every key:
+  - Transifex has a real translation (pulled value differs from English) → **keep it**
+    (the newest human translation always wins);
+  - the pull reverted it to English but a human translation is committed in git →
+    **restore the committed translation** (a pull never reverts a human translation,
+    even in files that also received real new Transifex translations);
+  - **no translation anywhere** (untranslated on Transifex AND never committed) → leave
+    the English source as a placeholder. **This is the only case a non-human value is
+    used.** A separate fill step may fill *only* these English placeholders, so a filled
+    string can never overwrite a human translation.
+- Restored languages are pushed back to Transifex so they stop reverting.
+
+### Filling the remaining untranslated strings — directly, no translation service
+
+The strings still equal to the English source after the merge are the ones untranslated
+**everywhere** (Transifex + git). Translate these **directly** — the maintainer or the
+assistant (an LLM) writes the translation itself, using that language's **existing
+translations** and general **kanban terminology** for the language as the reference.
+**Do NOT wire up any external translation service, API, endpoint, key or password** — an
+earlier `machine-translate.mjs` that called LibreTranslate/DeepL is removed on purpose
+(it did not work and needed a password). There is **no `WEKAN_MT*` env var** anymore.
+
+- **EVERY language gets translated — including the ones nobody has volunteered for.**
+  Klingon, Volapük, Wolof, Venda, Tamazight, Acehnese and the rest are not exceptions:
+  WeKan cannot find a speaker for every language, and a file left in English stays in
+  English for years. **Look the words up.** Any dictionary, word list, grammar or
+  Wiktionary page on the Internet is a legitimate source — read it, take the terms it
+  gives, and write the translation from them. Where a file is already written in ANOTHER
+  language (several are seeded from French, German, Malay or Zulu), complete it in the
+  language that file is actually in rather than leaving half of it English.
+- **Add the languages WeKan does not have yet.** The 154 files under
+  `imports/i18n/data/` are not the list of languages worth supporting - they are the
+  list somebody happened to start. When a language has a dictionary, a word list or a
+  Wiktionary anywhere on the Internet, it can have a WeKan. Adding one is three edits,
+  and all three are needed or the language is invisible:
+  1. `imports/i18n/data/<tag>.i18n.json` — the strings, in `en.i18n.json`'s key ORDER
+     (`tests/boardItemLinks.test.cjs` checks that), 2-space indent.
+  2. `imports/i18n/languages.js` — `{ code, tag, name, load, rtl }`. The **name is
+     written in that language itself** ("Suomi", "tlhIngan Hol"), the way every entry
+     there already is, because it is read by somebody who does not read English. `rtl:
+     true` for Arabic, Hebrew, Persian, Uyghur and the rest that are written
+     right-to-left.
+  3. `client/components/users/userHeader.js` — the `flagMap` in `languageFlag()`, so the
+     picker shows a **flag** beside the name. A language without a country of its own
+     takes the flag of where it is spoken, and a constructed one (Esperanto, Klingon,
+     Volapük) keeps the `🌐` fallback rather than being given somebody's country.
+- **A bad translation beats no translation.** An imperfect string is readable, it is
+  obviously improvable, and it is an *invitation*: somebody who speaks the language sees
+  it is wrong and fixes it, which an English placeholder never provokes. So: do not skip
+  a language because the result would be imperfect. Translate it, say in the commit which
+  ones were done with low confidence, and let a human correct it — the merge rules below
+  guarantee that when that human translation arrives on Transifex, it REPLACES the filled
+  one and is never overwritten by it.
+
+- `node releases/translations/fill-translations.mjs --missing` — per-language count of
+  strings still needing translation (English + `en-*` variants are skipped: English by
+  design). Also printed at the end of `pull-translations.sh`.
+- `node releases/translations/fill-translations.mjs --list <lang> [--limit N]` — dump the
+  untranslated keys of a language as `{ key: englishSource }` for the translator to fill.
+- `node releases/translations/fill-translations.mjs --apply <lang> <translated.json>` —
+  merge the translations back. It writes **only** into placeholder keys, so it can
+  **never** overwrite a human translation, and a value still equal to English/empty is
+  ignored. Key order and 2-space indent are preserved.
+
+**Both directions are safe, and it is verified:**
+`node releases/translations/verify-human-preference.mjs` proves (pure-logic, no network)
+that the pull-merge keeps/restores human translations and that a fill only touches
+placeholders. Filled strings stay **local** — they are **NOT** pushed to Transifex (only
+the merge-restored human languages are pushed), so a filled string can never masquerade
+as human there. So: **only missing strings are ever filled, only when missing
+everywhere, human strings are always preferred and merged**, and nothing you fill is
+pushed to Transifex as if it were human.
+
+## General practices (from ../log/v10/Claude.txt)
+
+- **[maintainer only]** Commit as `Lauri Ojansivu <x@xet7.org>`, with **no**
+  "Co-Authored-By" or any other AI trailer, directly to the `main` branch of WeKan and
+  the `main-v1` branch of the FerretDB fork. **Do not make pull requests.** (Contributors
+  do the opposite: work on a branch and open a pull request — see the top section.)
+  This is the same rule as the top section, restated where the release work is: one
+  author, `Lauri Ojansivu <x@xet7.org>`, and no AI attribution anywhere.
+- Lauri Ojansivu (xet7) maintains WeKan (https://wekan.fi), the FerretDB v1 fork, and
+  the two patch repositories under `.tools/` — node-patches and mongo-tools-patches.
+- Directory structure:
+  - `wekan` — this repo (https://github.com/wekan/wekan); see
+    `docs/DeveloperDocs/Directory-Structure.md`; `CHANGELOG.md` at root.
+  - `../w/wekan.fi` — the WeKan website.
+  - `.tools/` — everything that is NOT part of this repository but is needed to
+    build, test and release it, in ONE directory that `.gitignore` and
+    `.meteorignore` already exclude (each used to need its own ignore entry at
+    the repo root), so nothing in it can reach a commit or a Meteor rebuild. Two
+    different kinds of thing live there, and the difference matters:
+
+    **Companion git repositories.** Separate repositories with their own history,
+    branches, changelog and release flow — a commit here is never a commit there.
+    `build.sh`'s `ensure_tool_repo` clones one on demand (SSH first, HTTPS
+    second), so a fresh checkout needs no manual setup:
+
+    | Path | Repository | Branch | What it is |
+    | --- | --- | --- | --- |
+    | `.tools/FerretDB` | wekan/FerretDB | `main-v1` | the FerretDB v1 fork WeKan ships as its default database |
+    | `.tools/node-patches` | wekan/node-patches | `main` | patches to upstream Node.js; builds the `node-<platform>` binaries the bundles, the Docker image and the snap embed |
+    | `.tools/mongo-tools-patches` | wekan/mongo-tools-patches | `main` | patches to the MongoDB Database Tools; builds `<tool>-<arch>` |
+    | `.tools/TSC` | Secretchronicles/TSC | `devel` | the game xet7 also maintains — same author and maintainer mode, its own GNU ChangeLog and release process |
+    | `.tools/sandstorm` | sandstorm-io/sandstorm | — | upstream Sandstorm, when present — somebody else's project, cloned for reference |
+
+    **Unpacked toolchains and caches.** Downloads, not repositories — put there by
+    the sandbox instructions in `docs/Security/Sandboxes/vscode/README.md`, deleted
+    and re-fetched freely, never committed anywhere:
+    `node-v<version>-linux-<arch>/` (the Node.js the test suites are run with),
+    `go/` with `gopath/`, `gomodcache/` and `gocache/` (FerretDB's Go builds),
+    `.meteor/` when `HOME` is pointed at `.tools`, and the `TSC*` AppImage.
+  - **Do NOT add a `CLAUDE.md` or an `AGENTS.md` to any repository under
+    `.tools/`.** node-patches and mongo-tools-patches each had a pair and they were
+    REMOVED on purpose: the rules are the same for every one of these repositories,
+    and a second copy of a rule drifts from the first. THIS file, and its `AGENTS.md`
+    twin beside it, are where they live for all of them. Something true of only one
+    of those repositories goes in that repository's own `README.md` or `docs/`,
+    never in a new instruction file — and if you find one there, remove it rather
+    than updating it.
+  - `.tools/FerretDB` specifics — FerretDB `.go` files must contain **no**
+    application-specific names (say "the client" / "a Meteor 3 driver" / a bare
+    `#NNNN`); its `CHANGELOG.md` may use `wekan/wekan#NNNN`.
+
+### CHANGELOG
+
+- **Every repository writes its changelog in the format that repository's own file
+  already uses.** Open its changelog, read the entries above the place you are
+  adding one, and match them — never import another project's shape into it. The
+  five that come up here:
+
+  | Repository | File | Format |
+  | --- | --- | --- |
+  | `wekan/wekan` | `CHANGELOG.md` | the WeKan format this section describes: `# Platforms`, `# TODO Later`, then `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` sections of `<details>` entries whose `<summary>` links the commit |
+  | `wekan/node-patches` | `CHANGELOG.md` | the same WeKan format, with `# Upcoming node-patches release` |
+  | `wekan/mongo-tools-patches` | `CHANGELOG.md` | the same WeKan format, with `# Upcoming mongo-tools-patches release` |
+  | `wekan/FerretDB` | `CHANGELOG.md` | **upstream FerretDB's** format, not WeKan's: `## [v1.48.0](tag URL) (YYYY-MM-DD)` and `### New Features 🎉` / `### Fixed 🐛` / `### Other Changes 🤖` bullets ending `by @xet7. Thanks to xet7.` |
+  | `Secretchronicles/TSC` | `CHANGELOG` (no extension) | **GNU ChangeLog** format: a `YYYY-MM-DD  Name  <email>` header line, then TAB-indented `* Version …` / `* Fix: …` / `* Misc: …` entries, wrapped and continued with further tabs, each ending `(by Name)` |
+
+  The reason is the reader, not consistency for its own sake: a FerretDB release is
+  read beside upstream FerretDB's releases, and a TSC entry beside a decade of GNU
+  ChangeLog entries. A WeKan-shaped `<details>` block in either would be the odd one
+  out and would break the tooling that parses them. When this file and the file being
+  edited disagree, **the file being edited wins** — and everything below in this
+  section is about the WeKan format specifically.
+- During development, add entries under a new `# Upcoming WeKan ® release` section above
+  the newest release (FerretDB uses `## Upcoming FerretDB release`; the patch repos use
+  `# Upcoming <repo> release`). Do **not** hand-edit
+  `package.json` or any other version reference — the release workflow bumps those.
+- **Whenever `# Upcoming WeKan ® release` is updated, audit every feature, bug fix
+  and security fix in that section for regression coverage.** If coverage does not
+  exist yet, add a positive test, a negative test and a UI test wherever that kind
+  of test is possible and relevant. Run the tests that can run in the current
+  environment; when a UI stack or another required service is unavailable, still
+  add and syntax-check/register the test and state clearly what could not be run.
+  Do not duplicate an existing test merely to satisfy the audit — extend it when
+  that keeps one behavior in one suite.
+- **CHANGELOG.md holds the CURRENT MONTH only.** It reached 2.6 MB and 51,365
+  lines over 1,100 releases back to 2015 (#6580), which is slow to open and
+  slower to read. Moving whole years out left 1.9 MB, still too large, because
+  releases here are frequent: 2026 alone is 272 releases over eight months and
+  July was 80 on its own. So:
+
+  | | |
+  | --- | --- |
+  | `CHANGELOG.md` | the current month, plus `# Platforms`, `# TODO Later`, `# Upcoming` |
+  | `old-CHANGELOG/<year>/<MM>.md` | earlier months of the current year |
+  | `old-CHANGELOG/<year>.md` | years that are over, whole |
+
+  Past years stay one file each because they are already small (30–107 KB);
+  splitting them further would trade a size problem nobody has for a hundred
+  more files. Each archive opens with a **release count** — per month in a year
+  file, per day in a month file — and a bullet in `# Platforms` links every one.
+  That `git blame` is less useful on the split file is accepted: the history is
+  still in git (`gitk`, `git-gui`, `git log --follow`), and being small enough
+  to open is worth more.
+
+  Run `node releases/changelog-archive.mjs` at the start of a month. It is
+  idempotent — a run with nothing to move only refreshes the tables — and it
+  takes the month to keep from the FILE rather than the clock, so two people
+  running it on the same day agree. An archived section is never edited, for the
+  same reason a released one is not.
+- **The file's shape, top to bottom** — keep it exactly as it is now:
+  1. `# Platforms` — the line `Newest WeKan at these platforms:` and the Install /
+     Upgrade / Docs / Mac ChangeLog bullets, the `Older releases:` bullet linking
+     the per-year archives, then a `<details>` whose `<summary>` is `Version`
+     holding "which WeKan version uses what". There is no `# Version` heading of
+     its own.
+  2. `# TODO Later` — a `<details>` whose `<summary>` is `Carried to a future
+     release.` explaining the list, then one `<details>` per category (below).
+  3. The releases, newest first, each `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release`.
+
+  Nothing else is an `#` heading. A `##`/`###` inside a release would break the
+  version list, and a wrapped line that BEGINS with `#` (e.g. an issue number such
+  as `#6514`) becomes a heading too — escape it `\#6514` or keep it off the line
+  start.
+- **A release's order of subsections** — CRITICAL SECURITY ISSUES first, then new
+  features, then the Admin Panel / UI reorganisation if there is one, then dependency
+  updates (`Thanks to dependabot.`), then bug fixes, then developer-facing changes,
+  documentation and translations. The section ends with the line `Thanks to above
+  GitHub users for their contributions and translators for their translations.`
+- **Every entry is a `<details>` block, and they are what a release is made of.**
+  The `<summary>` is the SHORT description of what was done and IS the link to the
+  commit — the hash lives in the `href` and is never on the page — followed by the
+  `Thanks to …` sentence. Clicking it reveals the long description:
+
+  ```
+  <details>
+  <summary><a href="https://github.com/wekan/wekan/commit/<hash>">Short description of
+  what was done</a>. Thanks to (issue creator's GitHub nickname) and xet7.</summary>
+
+  The long description: what was wrong, why, what it does now, what the test pins.
+  Word-wrapped at 80 characters, ordinary markdown - links, `code`, emphasis.
+
+  </details>
+  ```
+
+  Exactly as above: `<details>` and `</details>` each on their own line, the whole
+  `<summary>…</summary>` on ONE line, a blank line under it, the body, a blank line,
+  the close — and a blank line between two blocks.
+- **The summary is one line at a glance** — aim for ≤ 110 characters — and PLAIN text:
+  no `[text](url)`, no `**bold**`, no backticks inside `<summary>`, because a link
+  cannot nest inside the `<a>` and the rest renders literally. It ends with a full
+  stop, then `Thanks to …`. Every summary in a release links its own commit.
+- **A change with nothing more to say stays a plain bullet** —
+  `- [Short description](https://github.com/wekan/wekan/commit/<hash>). Thanks to xet7.`
+  — and a dependency batch keeps its `- **package 1.2.3 → 1.2.4** — one line on what
+  it is` bullets, closing with `Thanks to dependabot.` A `<details>` whose body only
+  repeats its summary is noise; use one when there IS a longer story to reveal, which
+  is most fixes.
+- **`# TODO Later` blocks are the same shape with two differences:** the `<summary>` is
+  the short category text (no `<a>`, because nothing was committed), and there is **no
+  `Thanks to`** — nothing is done yet, so there is nobody to thank. The body lists the
+  issues as `[#NNNN](https://github.com/wekan/wekan/issues/NNNN) (one-line reason)`.
+- **The hash is never the link text.** `[f1c89548e](…)` shows a hash to a reader who
+  cannot do anything with it; the link text says what changed. Same for `[merge
+  commit](…)` and for a bare URL — see the next rule.
+- **Never show a long URL as visible text.** A link is always
+  `[short text](url)` — an issue is `[#6524](…/issues/6524)`, an advisory is
+  `[GHSA-xxxx](…)`, a security page is `[ZipBleed](https://wekan.fi/hall-of-fame/zipbleed/)`.
+- **Subsection headers read as ONE flowing sentence.** The FIRST subsection of a release
+  starts with `This release ` (e.g. `This release fixes the following bugs:`); every LATER
+  subsection in the SAME release starts with a lowercase `and ` instead of repeating
+  `This release ` — e.g.
+  `This release fixes the following bugs:` … `and updates the following dependencies:` …
+  `and has the following developer-tooling fix:` … `and improves the translation workflow:`
+  … then the closing `Thanks to above GitHub users …` line. A release with only one
+  subsection just keeps its single `This release …:` header. Use `and adds the following
+  new features:`, `and fixes the following bugs:`, `and updates the following
+  dependencies:`, etc., matching the verb to the subsection.
+- **The Upcoming section opens with an `**In short:**` paragraph.** One paragraph,
+  right under the `# Upcoming WeKan ® release` line and above the first
+  `This release …:` header, saying what the whole release amounts to — the areas
+  that changed and what changed about them, with the notable names in `**bold**`
+  so it can be skimmed. It is a SUMMARY, not a list: it does not link commits, it
+  does not repeat an entry's wording, and it ends by accounting for the rest in a
+  clause (`Below that: dependency updates, nine bug fixes … and the usual
+  documentation and translation work.`). Keep it current as entries are added —
+  it is the first thing a reader sees, so a stale one misdescribes the release.
+  A finished release keeps the paragraph it was written with.
+- **Under the summary comes the BINARIES TABLE: what each platform ships.** So the
+  top of a release section is, in order, (1) the `**In short:**` paragraph and
+  (2) this table, and only then the `This release …:` subsections. A WeKan bundle
+  is not only WeKan — it carries a Node.js, a FerretDB and the MongoDB Database
+  Tools that other projects publish, and WHICH source has a given CPU changes
+  from release to release: nodejs.org builds some architectures,
+  unofficial-builds others, and [wekan/node-patches](https://github.com/wekan/node-patches)
+  the ones neither of them does. "Which Node.js is in the arm64 bundle of 10.69,
+  and was it checked" must be answerable from the CHANGELOG, not from a build log
+  that expires.
+
+  ```
+  | Platform | Binary | From | Version | SHA256 |
+  | --- | --- | --- | --- | --- |
+  | amd64 | Node.js | [nodejs.org](https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-x64.tar.xz) | v24.19.0 | `a1b2…` |
+  | amd64 | FerretDB | [wekan/FerretDB](https://github.com/wekan/FerretDB/releases/download/v1.24.0/ferretdb-amd64) | v1.24.0 | `c3d4…` |
+  | arm64 | Node.js | [nodejs.org](https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-arm64.tar.xz) | v24.19.0 | `e5f6…` |
+  ```
+
+  **GROUPED BY PLATFORM**: rows are sorted by platform and then by binary, so one
+  platform's binaries stay together and the table is read a platform at a time.
+  The URL is the LINK ON THE "From" CELL — never a bare URL as visible text, the
+  same rule as everywhere else — and it is the exact file that was downloaded, not
+  the project's front page. The SHA256 is the checksum the source published and the
+  build verified, in backticks; a source that publishes none says *no checksum
+  published*, which is not a failed check but a source worth fixing. Table rows
+  carry links, so the 80-character wrap does not apply to them.
+
+  It is the same table `releases/provenance-table.sh` puts at the top of the GitHub
+  release notes, from the `provenance.tsv` rows each build job records — so the two
+  are filled from the same data and cannot disagree. **A platform that was NOT built
+  has no rows**, which is how the table also answers "why is there no i386 bundle
+  this time": no source published a Node.js for it (see
+  `releases/resolve-node-source.sh`).
+- **Inside a subsection, entries are GROUPED BY AREA.** A release touches a handful
+  of areas and repeating the area's name in every summary is the noise this
+  removes — twelve entries that each begin "All Boards:" say "All Boards" twelve
+  times and the part that differs starts halfway through the line. Instead the area
+  is named ONCE, as a bold line with a short description of what the group covers,
+  and every entry under it drops the prefix:
+
+  ```
+  and fixes the following bugs:
+
+  **The first header bar** - how it lays itself out, and what sits under it.
+
+  <details>
+  <summary><a href="…">It fills each row before starting the next one</a>. Thanks to xet7.</summary>
+  …
+  </details>
+
+  <details>
+  <summary><a href="…">It wraps to a second row instead of hiding the buttons that do not fit</a>. Thanks to xet7.</summary>
+  …
+  </details>
+
+  **All Boards** - the overview and its search.
+
+  <details>
+  …
+  ```
+
+  The group line is `**Area** - short description.` on ONE line, wrapped at 80 like
+  everything else, with a blank line under it. It is NOT a heading: a `##` inside a
+  release breaks the version list (see above). Group labels are the areas of the
+  app — `All Boards`, `The first header bar`, `The left menus`, `The Admin Panel`,
+  `Board views`, `Public Boards`, `Member Settings`, `Board roles` — and the same
+  label is reused across subsections when an area has both a feature and a fix.
+  EVERY entry of a grouped subsection belongs to a group, including a group with
+  one entry: a section that is half grouped and half loose reads as a mistake. A
+  subsection with only one entry, and the dependency bullets, stay flat.
+- **CRITICAL security header — match the previous releases' wording.** A security release
+  leads with `This release fixes the following CRITICAL SECURITY ISSUE of
+  [Name](https://wekan.fi/hall-of-fame/namebleed/):` for a single named *Bleed, or
+  `This release fixes the following CRITICAL SECURITY ISSUES:` for several — NOT
+  `CRITICAL VULNERABILITIES`. Each security bullet still links its own
+  `https://wekan.fi/hall-of-fame/...bleed/`. CodeQL-only releases use the established
+  `This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:`.
+  Because CRITICAL comes first, it keeps the `This release ` prefix; a following non-security
+  subsection becomes `and …` per the rule above.
+- **`# TODO Later` section** — a triage backlog near the TOP of `CHANGELOG.md` (above the
+  version sections), for open issues that were **investigated but not fixed here**, each
+  recorded with a concrete REASON so whoever picks it up next knows why. Use it when working
+  through open issues (the "Fix open issues" process): for each issue, either **fix it** (commit
+  ending `Fixes #NNNN,`), **close it** if already fixed in current code (commit `Close #NNNN` /
+  `Fixes #NNNN,`), or — when it can't be fixed/verified in this environment — **add it to `TODO
+  Later` under the matching category with the reason**. Group issues by category bullet, e.g.:
+  *Need specific infrastructure / a running server stack* (LDAP/WebHooks/Sandstorm/proxy —
+  environment owners), *Need the running app to reproduce/verify* (runtime UI / publication /
+  mergebox / router state, not unit-testable), *Already correct in the current code* (verified by
+  reading; could not reproduce), *Feature requests / behaviour-by-design rather than bugs*, and
+  *Needs a maintainer decision on the intended contract*. Each category is a `<details>`
+  whose `<summary>` is the SHORT category text and whose body lists the issues with their
+  reasons — and with **no `Thanks to` line**, because nothing is done yet, so there is
+  nobody to thank. Each entry is a normal issue link
+  `[#NNNN](https://github.com/wekan/wekan/issues/NNNN) (one-line reason)` — issue links here, NOT
+  commit links (nothing was committed). **Keep it current:** when an issue in `TODO Later` gets
+  fixed, REMOVE it from the list (its fix commit's `Fixes #NNNN` closes it); do not leave fixed
+  issues in the backlog. This is the only CHANGELOG place that uses issue links and lives above
+  the releases; everything else uses the per-release commit-link bullets above.
+- FerretDB Upcoming structure — `### New Features 🎉`, `### Fixed 🐛`, `### Other Changes
+  🤖`; entries end `... by @xet7. Thanks to xet7.`
+- Word-wrap both CHANGELOGs at 80 chars, but never break a long link across lines (a
+  `<summary>` line, or any other line carrying a link, may be longer). Continuation
+  lines of a plain bullet are indented by two spaces.
+
+### Commit message structure
+
+```
+Do something.
+
+Thanks to (original creator of issue) and xet7 !
+
+Fixes #1234,
+Fixes #1235.
+```
+
+- **A commit that fixes a GitHub issue ENDS with `Fixes #NNNN`** — last lines of
+  the message, one per issue, comma after each and a full stop on the last. That
+  trailer is what closes the issue when the commit is pushed; a fix that only
+  *mentions* the number in prose leaves the issue open, and somebody has to close
+  it by hand later or it stays open forever. Several issues in one commit get
+  several lines. The same applies to an issue that turns out to be **already
+  fixed**: commit the test or the note that proves it and end with `Fixes #NNNN,`
+  so the issue closes with a reference to where it was fixed.
+- **Only when the commit really fixes it.** A commit that improves the
+  diagnostics, narrows the cause, or fixes one of several reported problems
+  references the issue in the body (`#6585 comment 5276581923`) and does NOT
+  carry the trailer — closing an issue whose reporter is still stuck is worse
+  than leaving it open. If an issue was closed and then REOPENED for follow-up
+  items (as #6586 was), it is fixed again only when those items are done.
+- **A commit with no issue behind it has no trailer** — the email reports, the
+  release-tooling fixes found in build logs, refactors. `Thanks to ... and xet7 !`
+  still names whoever reported it.
+
+### Making a release — no version number needed  **[maintainer only]**
+
+All publishing / release steps below are maintainer-only. Contributors never run them.
+
+**Releases are FREQUENT, and that is the normal state of this repository — not an
+interruption to it.** The maintenance loop is:
+
+1. `./build.sh` (or `build.bat` on Windows) → **option 1, "git pull and git
+   push"**. Both directions do the whole job: a pull rebases and then repairs the
+   CHANGELOG commit links the rebase made stale, and a push repairs them again
+   BEFORE publishing, because a stale link that reaches GitHub 404s for everyone
+   who reads the release notes.
+2. `./releases/release-all.sh`, **with no arguments**, whenever there is something
+   worth shipping — which is often, several times a day when a fault is being
+   chased. It takes the version from the CHANGELOG and needs nothing typed.
+
+So a release happening "in the middle" of a piece of work is not a special case
+to reason about; it is what always happens, and anything that only works when
+releases are rare is broken here. Two consequences worth stating, because both
+have cost a released section its accuracy:
+
+- **Work continues immediately after a release**, so `release-all.sh` renames
+  `# Upcoming WeKan ® release` to `# v<NEW> …` and then OPENS A NEW EMPTY
+  `# Upcoming` (`releases/changelog-open-next.mjs`), so the next entry has
+  somewhere correct to go. Without it an entry appended above the closing
+  `Thanks to above GitHub users …` line lands INSIDE the release just published.
+  The new section carries an `**In short:** nothing here yet.` placeholder and
+  the binaries table, so the file stays valid; replace the placeholder as entries
+  are added. `tests/changelogEntriesBelongToTheirRelease.test.cjs` checks the
+  newest few releases against git and fails when a section links a commit that
+  release does not contain.
+- **A released section is a RECORD, not a draft.** When a release turns out to be
+  broken, its section keeps saying what it shipped — including the part that was
+  wrong — and the fix goes in a new `# Upcoming` above it. Do NOT edit a
+  published entry to describe the smaller, tidier change you wish had shipped;
+  add to it that it was wrong and where the fix is. Somebody reading v10.97's
+  notes is most likely somebody whose v10.97 just died.
+
+- WeKan: run `./releases/release-all.sh` (no arguments). It renames
+  `# Upcoming WeKan ® release` to the next version (same increment as the last release;
+  9.99 → 10.00) dated today, commits + pushes, and triggers
+  `.github/workflows/release-all.yml` — whose `bump` job bumps `package.json` and every
+  version reference and rebuilds the API docs, whose `prepare` job then pushes the tag
+  `v<new>` and checks the notes exist, and whose `release` job publishes the GitHub
+  Release the bundle jobs attach to. An explicit `oldversion newversion` pair still
+  overrides. Adding entries under Upcoming is the only hand step.
+- **A release that FAILED and one that shipped BROKEN are handled differently, and
+  the difference is whether anything was PUBLISHED.** Both happened with v10.92, so
+  neither is hypothetical:
+  - **Nothing published** (the workflow died before the GitHub Release existed): there
+    is no release for that number, so `# v<new> …` must not claim there is one. Rename
+    the heading back to `# Upcoming WeKan ® release`, add the fix under it, and run
+    `release-all.sh` again — it will take the same number, since the newest release is
+    still the previous one.
+  - **It published, and something in it is broken**: the release exists and people can
+    download it, so its section STAYS as it is — a released section is a record, not a
+    draft. Add a NEW `# Upcoming WeKan ® release` above it with the fix, exactly as
+    during ordinary development, and the next run takes the next number.
+  What decides it is the GitHub Release, not the tag: `prepare` pushes the tag early,
+  so a tag can exist for a release that never published.
+- FerretDB: run `./build.sh release-ferretdb` from `.tools/FerretDB` (no
+  version). It renames `## Upcoming FerretDB release` to the next version with the
+  correct git-tag link, commits + tags + pushes, then triggers `release-all.yml` (which
+  in turn triggers `docker.yml` for the multi-arch image). It refuses to re-release an
+  already-tagged version.
+
+### Security issues
+
+- Fix the vulnerability, add a CRITICAL section to the WeKan CHANGELOG like previous
+  entries, and update `../w/wekan.fi/hall-of-fame/index.html` and the vuln-name
+  subdirectory `index.html` like previous security issues.
+- **Every security fix gets a TEST and a NEGATIVE TEST, and they are written so the
+  fault cannot exist ANYWHERE in the codebase — not just at the place it was
+  reported.** A test that pins one call site leaves the same mistake free to live in
+  the other five, and that is how most of these arrive: SignupBleed's guard read an
+  option nothing sets, and the same shape sat in a second endpoint; the source-map
+  trim was safe on the client and fatal on the server. So:
+  - the **test** proves the fix does what it claims, driving the decision itself
+    where that is possible. A pure module — `loginFailureDecision.js`,
+    `lockoutDecision.js` — can be tested as arithmetic, without a server or a
+    database, and reproduces the reporter's attack exactly rather than approximately;
+  - the **negative test** proves the fault is gone rather than moved. Search the
+    whole tree for the SHAPE of it and assert nothing matches: no other endpoint
+    reads the dead option, no other counter is global, no other caller skips the
+    check. When the shape is a pattern, pin the pattern.
+  - and a test that reads the source is a real test here. `tests/*.test.cjs` may
+    parse a file and fail on a construct — that is what makes "and nowhere else"
+    checkable at all.
+- **If somebody ATTEMPTS the attack, and the secure default DENIES it, that denial
+  has to be visible in Admin Panel → Problems** — in every case where the denial can
+  be attributed. This applies to every security fix added to Upcoming. That is the
+  difference between a hole that is closed and a hole that is closed and watched:
+  an administrator should be able to see that somebody tried.
+  - Add a key to the catalog in `models/lib/securityCategories.js` (category, the
+    hall-of-fame `bleed` name, severity, CWE), and call
+    `require('/server/lib/securityLog').record({ key, action: 'blocked', source, detail })`
+    on the refusal path. `action` is `'blocked'` when the fix stopped it and
+    `'detected'` when it was only noticed.
+  - **Wrap the call so logging can never break the guard**:
+    `try { ... } catch (e) { /* logging must never break the guard */ }`. The refusal
+    matters more than the record of it.
+  - **Only log an ATTEMPT, never ordinary use.** The test to apply is whether a
+    legitimate user can reach that line. Registration refused while registration is
+    off has no legitimate caller, so it is logged; an admin endpoint whose fault was
+    in what its answer CARRIED fires on every normal call, so it is NOT — that is why
+    HashBleed (GHSA-6qpx-x7vr-p9w6) deliberately has no key. A log that fills with
+    normal traffic hides the one line that mattered.
+  - Where the denial cannot be attributed to an attempt — a fix that changes what a
+    response contains, or one that only takes effect at build time — there is nothing
+    to record, and that is a decision to state in the entry rather than an omission.
+- **Admin Panel → Problems is a SUMMARY, never a row per event.** A guard on a path
+  an attacker controls fires as fast as they can send, so a document per occurrence
+  grows the database with the attack, turns the page into a scroll of near-identical
+  lines, and buries the one event that mattered under ten thousand that did not. The
+  admin's question is never *list every attempt* — it is *what is happening, how
+  much, since when, and who*. So each problem is ONE row that accumulates
+  (`models/lib/eventLogSummary.js`, written through `server/lib/eventLogFold.js`,
+  shared by the security, speed and test loggers):
+
+  | field | what it holds |
+  | --- | --- |
+  | `count` | how many times this problem has happened |
+  | `firstAt` … `at` | the window it happened in |
+  | `actors` | who, each with their own count — `username1 25, 100.100.100.100 30` |
+  | `username` / `ip` / `detail` | the MOST RECENT occurrence |
+
+  - **Identity is the KIND of thing that happened** — stream, `bleed`, category,
+    action, source, severity, CWE (and `type`/`db`/`kind` for the database stream).
+    The actor is NOT part of it: putting a username or an address in the key gives a
+    row per attacker per attempt, which is the cost being removed.
+  - **A username and an address are tallied SEPARATELY**, not as a pair. They answer
+    different questions — which account, and where from — and an unauthenticated
+    attempt has an address and no name.
+  - **The tally is CAPPED** (`MAX_ACTORS`), with the remainder counted in
+    `actorsOverflow`. Otherwise an attacker rotating addresses grows the row with the
+    attack and reintroduces the same bug one level down — and *"and 9,412 others"* is
+    itself the signal that the source is spread rather than single.
+  - **A logger that writes per event is a bug to fix, not a style.** If one is added
+    or found, route it through the shared fold and migrate what it already wrote
+    (`server/lib/eventLogSummaryMigration.js` folds legacy rows in place, in batches,
+    idempotently).
+- **Every hall-of-fame vulnerability that CAN be detected at runtime should have a
+  catalog key**, so Admin Panel → Problems groups attempts under the same name the
+  Hall of Fame uses and an admin can go from one to the other.
+  `tests/hallOfFameProblemsCoverage.test.cjs` lists the names that have no key and
+  requires each to be accounted for — a *Bleed with nothing to detect (a fix that
+  changed what a response carried, or one that only applies at build time) is
+  recorded there as a deliberate omission with its reason, not left silent.
+- **A Hall of Fame row has EIGHT cells**, in this order: CVE, Icon, Vulnerability
+  name, Date, Responsible Security Disclosure by, Stars, Process, Vulnerabilities.
+  One thing per cell — the name without its icons, the Font Awesome icons alone in
+  Icon (still wrapped in `<h2>`), the reporter alone in "by", the `GoldStar.png`
+  images alone in Stars, and the sentence about how the report arrived (coordinated
+  disclosure, GitHub advisory, code scanning, found while reviewing …) in Process.
+  In "by", the reporter's NICKNAME is the link —
+  `<b><a href="https://github.com/nick">nick</a></b>`, never the name followed by a
+  separate "(GitHub)" link. **Check the account exists before linking it** (a 404 or,
+  worse, somebody else's profile is the failure here); a real name, a company or a
+  tool such as GitHub CodeQL is not a GitHub user and stays plain text. Do not write
+  a role note after a name — no `(fix)`, `(found)` or `(found and fix)`: this column
+  is the credit, and the Process cell beside it already says how the report arrived.
+  Stars is a column so it can be compared down the page; do not put a star, an icon
+  or the process sentence back into another cell. A page-local `<style>` in
+  `index.html` keeps a row's stars on ONE line from 900px up (they are a count) and
+  sizes them at 24px, and keeps the icon and its red drop on one line at every width
+  (they are one icon) — the table itself stays percentage-sized with no fixed or
+  minimum width, so it fills the page at every browser width.
+- **On the Hall of Fame index page, the Process and Vulnerabilities cells are
+  collapsed.** Those two columns carry the prose — how the report arrived, and the
+  whole story of the vulnerability — so the page would be one wall of text and the
+  columns that identify a row (CVE, name, date, reporter, stars) would be far apart.
+  In `hall-of-fame/index.html`, and ONLY in those two `<td>`s, the cell's content
+  sits inside a `<details>` whose summary is the column's own name — `Process` for
+  the Process cell, `Details` for the Vulnerabilities cell:
+
+  ```
+  <td valign="top">
+    <details>
+    <summary>Details</summary>
+
+    <ul>
+      <li>… the same list as before …</li>
+    </ul>
+    </details>
+  </td>
+  ```
+
+  The summary is that plain word, there is a blank line under it, and the cell's
+  contents are otherwise unchanged. The other six cells of the row stay as they are
+  — they are what a reader scans — and so does the header row.
+- **The vuln-name subdirectory page is NOT collapsed.** `hall-of-fame/<name>bleed/index.html`
+  is the page a reader opened on purpose, for one vulnerability: its table cell stays
+  open and its `<h2 class="hof">Details</h2>` prose section below the table stays as
+  it is. Only the index, which lists them all, hides them behind the summary.
+
+### Tests
+
+- `build.sh` / `build.bat` have a menu to install dependencies, build
+  WeKan and run tests.
+- Add tests, negative tests and UI tests for all new features and fixes that do not yet
+  have tests. When adding a test, run or validate it and fix it until it works.
+- **"Check newest test logs":** test logs go into a `log/<datetime>/` directory,
+  one per run (e.g. `2026-07-21_20-58-09/`). That is **`../log/`**, one level up
+  from the repo, so a run does not show up in `git status` - **unless the parent
+  is not writable**, as in a Flatpak sandbox that shares only the repository;
+  there it is **`./log/`** inside the repo (gitignored). `build.sh` prints which
+  one when a run starts. The
+  newest datetime directory is the latest run. Each holds the Playwright per-browser
+  logs (`wekan-alltests-chromium.log`, `-firefox.log`, `-webkit.log`), the mocha/unit
+  log (`wekan-alltests-mocha.log`), the e2e/import logs, and `wekan-test-server.log`
+  (the WeKan test server + database output). A whole-run directory also holds the
+  database-conformance logs (`db-conformance-*.log`, `-report.md`, `-summary.txt`)
+  and FerretDB's own (`ferretdb-unit.log`, `-vet.log`, `-integration.log`). "Check
+  the newest test logs" means: open the most recent `log/<datetime>/` - look in
+  `../log/` first, then `./log/` - and read those.
+- **Check and fix WHILE the tests are still running.** A full run takes a long time
+  (three browsers, then every database with an image for this CPU, then FerretDB's
+  own suites), and its stages finish one at a time. Do not wait for the end: read
+  the logs that are already written, fix what they show, and then look again for the
+  stages that have finished since — repeat until every stage has run and everything
+  found is fixed. Two things make this work:
+  - A stage's log file is complete when its `===== ... finished` line is there; a
+    file whose mtime is still moving is a stage in progress, and its failures so far
+    are already real and worth fixing.
+  - The node suites are run by `tests/run-node-suites.cjs`, which runs ALL of them
+    and lists every failure at the end (`===== node suites: N run, M failed`). They
+    are the fastest signal - about 15 seconds for 260 suites - so they are usually
+    what to fix first while the browsers are still going.
+- **A failing guard is not automatically a broken app.** Most of these suites read
+  the source and pin a behaviour. When one fails, decide which side is wrong: fix
+  the CODE when the guard still describes what WeKan should do, and fix the GUARD
+  when the behaviour deliberately changed - and then say in the test WHY, so the
+  next reader knows it was a decision and not a slip. Every fixed test keeps the
+  assertion that made it valuable; do not delete a test to make a run green.
+
+## Environment
+
+- The editor (VSCode) runs inside a **Flatpak sandbox**, launched by
+  `docs/Security/Sandboxes/vscode/vscode-sandbox.sh`. What the sandbox allows/blocks and
+  how it is set up is documented in `docs/Security/Sandboxes/vscode/README.md` in that
+  same directory — read it when something behaves differently than a normal host (file
+  access, network, running services).
+
+### Always validate from the actual code
+
+- When doing anything, check how it actually works in the code first.

CLAUDE.md

@@ -0,0 +1,754 @@
+# CLAUDE.md — instructions Claude reads first
+
+Claude Code reads this file at the repo root before doing work here. Follow it.
+
+## First: who maintains this, and who is committing?
+
+**WeKan, the `wekan/` repositories cloned under `.tools/`, and
+[Secretchronicles/TSC](https://github.com/Secretchronicles/TSC) are all maintained by
+Lauri Ojansivu (xet7) `<x@xet7.org>`** — [wekan/wekan](https://github.com/wekan/wekan),
+[wekan/FerretDB](https://github.com/wekan/FerretDB),
+[wekan/node-patches](https://github.com/wekan/node-patches),
+[wekan/mongo-tools-patches](https://github.com/wekan/mongo-tools-patches) and TSC,
+which is under the **Secretchronicles** organisation rather than **wekan** and is his
+all the same — his GitHub profile, [xet7](https://github.com/xet7), says exactly that:
+*"WeKan and TSC maintainer"*. Work done on the maintainer's behalf is committed as
+**`Lauri Ojansivu <x@xet7.org>`** — that author, in every one of those repositories,
+every time. Two rules follow from it and neither has an exception:
+
+- **Never attribute a commit to an AI.** No `Co-Authored-By:` trailer, no "Generated
+  with", no assistant or model name — not in the commit message, not in a pull-request
+  body, not in the CHANGELOG. [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) is where this
+  comes from: *"For pull requests, mention only those participants that are
+  **human**."* A `Thanks to ... and xet7 !` line credits people — the issue reporter
+  and xet7 — never a tool.
+- **If the git identity is missing or wrong in one of these checkouts, set it; do not
+  commit under something else.** The `.tools/` clones are made by `build.sh` inside
+  this checkout and can come up with no `user.name`/`user.email` of their own, which
+  would silently author a commit as whatever the machine's default is:
+
+  ```
+  git -C .tools/<repo> config user.name  'Lauri Ojansivu'
+  git -C .tools/<repo> config user.email 'x@xet7.org'
+  ```
+
+Check the current git identity before committing or releasing:
+
+```
+git config user.name && git config user.email
+```
+
+- **Maintainer mode** — the identity is `Lauri Ojansivu <x@xet7.org>` (name
+  `Lauri Ojansivu`, email `x@xet7.org`), or it is unset in a checkout of one of the
+  repositories above, which means it is to be SET to that as above rather than worked
+  around. Then: commit **directly to the current branch** as
+  `Lauri Ojansivu <x@xet7.org>` with no AI trailer and no pull request, and the
+  **publishing / release steps** below are available.
+- **Contributor mode** — the identity is somebody ELSE, in a fork or a clone of your
+  own. Then: do **not** commit directly to the branch and do **not** run any
+  release/publishing step. Make changes on a branch and open a **pull request** for
+  the maintainer to review, and keep that pull request free of AI attribution too.
+  The "commit as Lauri Ojansivu", "commit directly", and all release instructions
+  below are **maintainer-only and do not apply to you**.
+
+Maintainer mode covers TSC as well: commit directly to its `devel` branch, no pull
+request, same author and no AI attribution. What it does NOT bring along is WeKan's
+house style — TSC keeps its own **GNU ChangeLog** `CHANGELOG` and its own release
+process, because a project is read on its own terms (see the CHANGELOG section below).
+The one repository under `.tools/` that is somebody else's is `sandstorm-io/sandstorm`,
+cloned for reference only.
+
+Everything below marked as maintainer-specific (committing directly, the exact commit
+author, and the entire "Making a release" / publishing flow) applies only in maintainer
+mode. The rest (translation policy, CHANGELOG structure, tests, validating from code) is
+good practice for everyone.
+
+## Process: "Fix open issues"
+
+When asked to fix an open issue (one issue at a time):
+
+1. **Read the whole issue** — the description AND all comments (e.g.
+   `gh issue view <n> --comments`, or the GitHub API `.../issues/<n>/comments`).
+2. **If it is a bug, first check whether it is already fixed** in the current WeKan
+   AND FerretDB source code (read the actual code, not just changelogs). It may have
+   been fixed already.
+3. **If it is NOT fixed yet, fix it**, using the newest documentation and issues of
+   the dependencies involved, checking where the newest MAINTAINED dependency lives and
+   reading its source and issues:
+   - Meteor 3 docs — https://docs.meteor.com/
+   - Meteor 3 source + issues — https://github.com/meteor/meteor/issues
+   - other Meteor software docs/code (e.g. Rocket.Chat) for how they solved it
+   - Meteor forums — https://forums.meteor.com
+   - AtmosphereJS — https://atmospherejs.com/ ; Packosphere — https://packosphere.com/
+   - Meteor Community Packages — https://github.com/meteor-community-packages
+   - Meteor-Files — https://github.com/veliovgroup/Meteor-Files
+   - npm — https://www.npmjs.com
+4. **After fixing, add tests** — unit tests, negative tests, and UI tests where
+   appropriate — and **run the new tests to verify they pass** (see Tests / the sandbox
+   build+test instructions in `docs/Security/Sandboxes/vscode/README.md`).
+5. **Commit** (maintainer only — when the current git user is `Lauri Ojansivu
+   <x@xet7.org>`), with no "Co-Authored" / AI trailer, a message body ending:
+
+   ```
+   Thanks to (GitHub nickname of the issue creator) and xet7 !
+
+   Fixes #1234,
+   ```
+6. **If the bug is already fixed**, still add a commit that CLOSES the issue (a commit
+   whose message ends `Fixes #1234,`), noting where/when it was fixed.
+
+Fix from source and test — do not guess. If the environment cannot run the relevant
+test (e.g. Docker is unavailable in this sandbox), reproduce as closely as possible
+from source and say clearly what was and was not verified.
+
+## Translations (Transifex ↔ direct LLM fill, no external service)
+
+WeKan translations live in `imports/i18n/data/<lang>.i18n.json` (flat
+`key -> string`, 2-space indent, key order matches `en.i18n.json`). Transifex holds
+the human translations. **The policy is: never overwrite a human translation with a
+filled (or English) one, but always take the newest translations from Transifex.**
+
+- Pull with `releases/translations/pull-translations.sh`. It runs `tx pull -a -f`
+  (which fills every string that is UNtranslated on Transifex with the English source)
+  and then a **per-key merge** (`releases/translations/merge-translations.mjs`) that,
+  for every language file and every key:
+  - Transifex has a real translation (pulled value differs from English) → **keep it**
+    (the newest human translation always wins);
+  - the pull reverted it to English but a human translation is committed in git →
+    **restore the committed translation** (a pull never reverts a human translation,
+    even in files that also received real new Transifex translations);
+  - **no translation anywhere** (untranslated on Transifex AND never committed) → leave
+    the English source as a placeholder. **This is the only case a non-human value is
+    used.** A separate fill step may fill *only* these English placeholders, so a filled
+    string can never overwrite a human translation.
+- Restored languages are pushed back to Transifex so they stop reverting.
+
+### Filling the remaining untranslated strings — directly, no translation service
+
+The strings still equal to the English source after the merge are the ones untranslated
+**everywhere** (Transifex + git). Translate these **directly** — the maintainer or the
+assistant (an LLM) writes the translation itself, using that language's **existing
+translations** and general **kanban terminology** for the language as the reference.
+**Do NOT wire up any external translation service, API, endpoint, key or password** — an
+earlier `machine-translate.mjs` that called LibreTranslate/DeepL is removed on purpose
+(it did not work and needed a password). There is **no `WEKAN_MT*` env var** anymore.
+
+- **EVERY language gets translated — including the ones nobody has volunteered for.**
+  Klingon, Volapük, Wolof, Venda, Tamazight, Acehnese and the rest are not exceptions:
+  WeKan cannot find a speaker for every language, and a file left in English stays in
+  English for years. **Look the words up.** Any dictionary, word list, grammar or
+  Wiktionary page on the Internet is a legitimate source — read it, take the terms it
+  gives, and write the translation from them. Where a file is already written in ANOTHER
+  language (several are seeded from French, German, Malay or Zulu), complete it in the
+  language that file is actually in rather than leaving half of it English.
+- **Add the languages WeKan does not have yet.** The 154 files under
+  `imports/i18n/data/` are not the list of languages worth supporting - they are the
+  list somebody happened to start. When a language has a dictionary, a word list or a
+  Wiktionary anywhere on the Internet, it can have a WeKan. Adding one is three edits,
+  and all three are needed or the language is invisible:
+  1. `imports/i18n/data/<tag>.i18n.json` — the strings, in `en.i18n.json`'s key ORDER
+     (`tests/boardItemLinks.test.cjs` checks that), 2-space indent.
+  2. `imports/i18n/languages.js` — `{ code, tag, name, load, rtl }`. The **name is
+     written in that language itself** ("Suomi", "tlhIngan Hol"), the way every entry
+     there already is, because it is read by somebody who does not read English. `rtl:
+     true` for Arabic, Hebrew, Persian, Uyghur and the rest that are written
+     right-to-left.
+  3. `client/components/users/userHeader.js` — the `flagMap` in `languageFlag()`, so the
+     picker shows a **flag** beside the name. A language without a country of its own
+     takes the flag of where it is spoken, and a constructed one (Esperanto, Klingon,
+     Volapük) keeps the `🌐` fallback rather than being given somebody's country.
+- **A bad translation beats no translation.** An imperfect string is readable, it is
+  obviously improvable, and it is an *invitation*: somebody who speaks the language sees
+  it is wrong and fixes it, which an English placeholder never provokes. So: do not skip
+  a language because the result would be imperfect. Translate it, say in the commit which
+  ones were done with low confidence, and let a human correct it — the merge rules below
+  guarantee that when that human translation arrives on Transifex, it REPLACES the filled
+  one and is never overwritten by it.
+
+- `node releases/translations/fill-translations.mjs --missing` — per-language count of
+  strings still needing translation (English + `en-*` variants are skipped: English by
+  design). Also printed at the end of `pull-translations.sh`.
+- `node releases/translations/fill-translations.mjs --list <lang> [--limit N]` — dump the
+  untranslated keys of a language as `{ key: englishSource }` for the translator to fill.
+- `node releases/translations/fill-translations.mjs --apply <lang> <translated.json>` —
+  merge the translations back. It writes **only** into placeholder keys, so it can
+  **never** overwrite a human translation, and a value still equal to English/empty is
+  ignored. Key order and 2-space indent are preserved.
+
+**Both directions are safe, and it is verified:**
+`node releases/translations/verify-human-preference.mjs` proves (pure-logic, no network)
+that the pull-merge keeps/restores human translations and that a fill only touches
+placeholders. Filled strings stay **local** — they are **NOT** pushed to Transifex (only
+the merge-restored human languages are pushed), so a filled string can never masquerade
+as human there. So: **only missing strings are ever filled, only when missing
+everywhere, human strings are always preferred and merged**, and nothing you fill is
+pushed to Transifex as if it were human.
+
+## General practices (from ../log/v10/Claude.txt)
+
+- **[maintainer only]** Commit as `Lauri Ojansivu <x@xet7.org>`, with **no**
+  "Co-Authored-By" or any other AI trailer, directly to the `main` branch of WeKan and
+  the `main-v1` branch of the FerretDB fork. **Do not make pull requests.** (Contributors
+  do the opposite: work on a branch and open a pull request — see the top section.)
+  This is the same rule as the top section, restated where the release work is: one
+  author, `Lauri Ojansivu <x@xet7.org>`, and no AI attribution anywhere.
+- Lauri Ojansivu (xet7) maintains WeKan (https://wekan.fi), the FerretDB v1 fork, and
+  the two patch repositories under `.tools/` — node-patches and mongo-tools-patches.
+- Directory structure:
+  - `wekan` — this repo (https://github.com/wekan/wekan); see
+    `docs/DeveloperDocs/Directory-Structure.md`; `CHANGELOG.md` at root.
+  - `../w/wekan.fi` — the WeKan website.
+  - `.tools/` — everything that is NOT part of this repository but is needed to
+    build, test and release it, in ONE directory that `.gitignore` and
+    `.meteorignore` already exclude (each used to need its own ignore entry at
+    the repo root), so nothing in it can reach a commit or a Meteor rebuild. Two
+    different kinds of thing live there, and the difference matters:
+
+    **Companion git repositories.** Separate repositories with their own history,
+    branches, changelog and release flow — a commit here is never a commit there.
+    `build.sh`'s `ensure_tool_repo` clones one on demand (SSH first, HTTPS
+    second), so a fresh checkout needs no manual setup:
+
+    | Path | Repository | Branch | What it is |
+    | --- | --- | --- | --- |
+    | `.tools/FerretDB` | wekan/FerretDB | `main-v1` | the FerretDB v1 fork WeKan ships as its default database |
+    | `.tools/node-patches` | wekan/node-patches | `main` | patches to upstream Node.js; builds the `node-<platform>` binaries the bundles, the Docker image and the snap embed |
+    | `.tools/mongo-tools-patches` | wekan/mongo-tools-patches | `main` | patches to the MongoDB Database Tools; builds `<tool>-<arch>` |
+    | `.tools/TSC` | Secretchronicles/TSC | `devel` | the game xet7 also maintains — same author and maintainer mode, its own GNU ChangeLog and release process |
+    | `.tools/sandstorm` | sandstorm-io/sandstorm | — | upstream Sandstorm, when present — somebody else's project, cloned for reference |
+
+    **Unpacked toolchains and caches.** Downloads, not repositories — put there by
+    the sandbox instructions in `docs/Security/Sandboxes/vscode/README.md`, deleted
+    and re-fetched freely, never committed anywhere:
+    `node-v<version>-linux-<arch>/` (the Node.js the test suites are run with),
+    `go/` with `gopath/`, `gomodcache/` and `gocache/` (FerretDB's Go builds),
+    `.meteor/` when `HOME` is pointed at `.tools`, and the `TSC*` AppImage.
+  - **Do NOT add a `CLAUDE.md` or an `AGENTS.md` to any repository under
+    `.tools/`.** node-patches and mongo-tools-patches each had a pair and they were
+    REMOVED on purpose: the rules are the same for every one of these repositories,
+    and a second copy of a rule drifts from the first. THIS file, and its `AGENTS.md`
+    twin beside it, are where they live for all of them. Something true of only one
+    of those repositories goes in that repository's own `README.md` or `docs/`,
+    never in a new instruction file — and if you find one there, remove it rather
+    than updating it.
+  - `.tools/FerretDB` specifics — FerretDB `.go` files must contain **no**
+    application-specific names (say "the client" / "a Meteor 3 driver" / a bare
+    `#NNNN`); its `CHANGELOG.md` may use `wekan/wekan#NNNN`.
+
+### CHANGELOG
+
+- **Every repository writes its changelog in the format that repository's own file
+  already uses.** Open its changelog, read the entries above the place you are
+  adding one, and match them — never import another project's shape into it. The
+  five that come up here:
+
+  | Repository | File | Format |
+  | --- | --- | --- |
+  | `wekan/wekan` | `CHANGELOG.md` | the WeKan format this section describes: `# Platforms`, `# TODO Later`, then `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release` sections of `<details>` entries whose `<summary>` links the commit |
+  | `wekan/node-patches` | `CHANGELOG.md` | the same WeKan format, with `# Upcoming node-patches release` |
+  | `wekan/mongo-tools-patches` | `CHANGELOG.md` | the same WeKan format, with `# Upcoming mongo-tools-patches release` |
+  | `wekan/FerretDB` | `CHANGELOG.md` | **upstream FerretDB's** format, not WeKan's: `## [v1.48.0](tag URL) (YYYY-MM-DD)` and `### New Features 🎉` / `### Fixed 🐛` / `### Other Changes 🤖` bullets ending `by @xet7. Thanks to xet7.` |
+  | `Secretchronicles/TSC` | `CHANGELOG` (no extension) | **GNU ChangeLog** format: a `YYYY-MM-DD  Name  <email>` header line, then TAB-indented `* Version …` / `* Fix: …` / `* Misc: …` entries, wrapped and continued with further tabs, each ending `(by Name)` |
+
+  The reason is the reader, not consistency for its own sake: a FerretDB release is
+  read beside upstream FerretDB's releases, and a TSC entry beside a decade of GNU
+  ChangeLog entries. A WeKan-shaped `<details>` block in either would be the odd one
+  out and would break the tooling that parses them. When this file and the file being
+  edited disagree, **the file being edited wins** — and everything below in this
+  section is about the WeKan format specifically.
+- During development, add entries under a new `# Upcoming WeKan ® release` section above
+  the newest release (FerretDB uses `## Upcoming FerretDB release`; the patch repos use
+  `# Upcoming <repo> release`). Do **not** hand-edit
+  `package.json` or any other version reference — the release workflow bumps those.
+- **Whenever `# Upcoming WeKan ® release` is updated, audit every feature, bug fix
+  and security fix in that section for regression coverage.** If coverage does not
+  exist yet, add a positive test, a negative test and a UI test wherever that kind
+  of test is possible and relevant. Run the tests that can run in the current
+  environment; when a UI stack or another required service is unavailable, still
+  add and syntax-check/register the test and state clearly what could not be run.
+  Do not duplicate an existing test merely to satisfy the audit — extend it when
+  that keeps one behavior in one suite.
+- **CHANGELOG.md holds the CURRENT MONTH only.** It reached 2.6 MB and 51,365
+  lines over 1,100 releases back to 2015 (#6580), which is slow to open and
+  slower to read. Moving whole years out left 1.9 MB, still too large, because
+  releases here are frequent: 2026 alone is 272 releases over eight months and
+  July was 80 on its own. So:
+
+  | | |
+  | --- | --- |
+  | `CHANGELOG.md` | the current month, plus `# Platforms`, `# TODO Later`, `# Upcoming` |
+  | `old-CHANGELOG/<year>/<MM>.md` | earlier months of the current year |
+  | `old-CHANGELOG/<year>.md` | years that are over, whole |
+
+  Past years stay one file each because they are already small (30–107 KB);
+  splitting them further would trade a size problem nobody has for a hundred
+  more files. Each archive opens with a **release count** — per month in a year
+  file, per day in a month file — and a bullet in `# Platforms` links every one.
+  That `git blame` is less useful on the split file is accepted: the history is
+  still in git (`gitk`, `git-gui`, `git log --follow`), and being small enough
+  to open is worth more.
+
+  Run `node releases/changelog-archive.mjs` at the start of a month. It is
+  idempotent — a run with nothing to move only refreshes the tables — and it
+  takes the month to keep from the FILE rather than the clock, so two people
+  running it on the same day agree. An archived section is never edited, for the
+  same reason a released one is not.
+- **The file's shape, top to bottom** — keep it exactly as it is now:
+  1. `# Platforms` — the line `Newest WeKan at these platforms:` and the Install /
+     Upgrade / Docs / Mac ChangeLog bullets, the `Older releases:` bullet linking
+     the per-year archives, then a `<details>` whose `<summary>` is `Version`
+     holding "which WeKan version uses what". There is no `# Version` heading of
+     its own.
+  2. `# TODO Later` — a `<details>` whose `<summary>` is `Carried to a future
+     release.` explaining the list, then one `<details>` per category (below).
+  3. The releases, newest first, each `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release`.
+
+  Nothing else is an `#` heading. A `##`/`###` inside a release would break the
+  version list, and a wrapped line that BEGINS with `#` (e.g. an issue number such
+  as `#6514`) becomes a heading too — escape it `\#6514` or keep it off the line
+  start.
+- **A release's order of subsections** — CRITICAL SECURITY ISSUES first, then new
+  features, then the Admin Panel / UI reorganisation if there is one, then dependency
+  updates (`Thanks to dependabot.`), then bug fixes, then developer-facing changes,
+  documentation and translations. The section ends with the line `Thanks to above
+  GitHub users for their contributions and translators for their translations.`
+- **Every entry is a `<details>` block, and they are what a release is made of.**
+  The `<summary>` is the SHORT description of what was done and IS the link to the
+  commit — the hash lives in the `href` and is never on the page — followed by the
+  `Thanks to …` sentence. Clicking it reveals the long description:
+
+  ```
+  <details>
+  <summary><a href="https://github.com/wekan/wekan/commit/<hash>">Short description of
+  what was done</a>. Thanks to (issue creator's GitHub nickname) and xet7.</summary>
+
+  The long description: what was wrong, why, what it does now, what the test pins.
+  Word-wrapped at 80 characters, ordinary markdown - links, `code`, emphasis.
+
+  </details>
+  ```
+
+  Exactly as above: `<details>` and `</details>` each on their own line, the whole
+  `<summary>…</summary>` on ONE line, a blank line under it, the body, a blank line,
+  the close — and a blank line between two blocks.
+- **The summary is one line at a glance** — aim for ≤ 110 characters — and PLAIN text:
+  no `[text](url)`, no `**bold**`, no backticks inside `<summary>`, because a link
+  cannot nest inside the `<a>` and the rest renders literally. It ends with a full
+  stop, then `Thanks to …`. Every summary in a release links its own commit.
+- **A change with nothing more to say stays a plain bullet** —
+  `- [Short description](https://github.com/wekan/wekan/commit/<hash>). Thanks to xet7.`
+  — and a dependency batch keeps its `- **package 1.2.3 → 1.2.4** — one line on what
+  it is` bullets, closing with `Thanks to dependabot.` A `<details>` whose body only
+  repeats its summary is noise; use one when there IS a longer story to reveal, which
+  is most fixes.
+- **`# TODO Later` blocks are the same shape with two differences:** the `<summary>` is
+  the short category text (no `<a>`, because nothing was committed), and there is **no
+  `Thanks to`** — nothing is done yet, so there is nobody to thank. The body lists the
+  issues as `[#NNNN](https://github.com/wekan/wekan/issues/NNNN) (one-line reason)`.
+- **The hash is never the link text.** `[f1c89548e](…)` shows a hash to a reader who
+  cannot do anything with it; the link text says what changed. Same for `[merge
+  commit](…)` and for a bare URL — see the next rule.
+- **Never show a long URL as visible text.** A link is always
+  `[short text](url)` — an issue is `[#6524](…/issues/6524)`, an advisory is
+  `[GHSA-xxxx](…)`, a security page is `[ZipBleed](https://wekan.fi/hall-of-fame/zipbleed/)`.
+- **Subsection headers read as ONE flowing sentence.** The FIRST subsection of a release
+  starts with `This release ` (e.g. `This release fixes the following bugs:`); every LATER
+  subsection in the SAME release starts with a lowercase `and ` instead of repeating
+  `This release ` — e.g.
+  `This release fixes the following bugs:` … `and updates the following dependencies:` …
+  `and has the following developer-tooling fix:` … `and improves the translation workflow:`
+  … then the closing `Thanks to above GitHub users …` line. A release with only one
+  subsection just keeps its single `This release …:` header. Use `and adds the following
+  new features:`, `and fixes the following bugs:`, `and updates the following
+  dependencies:`, etc., matching the verb to the subsection.
+- **The Upcoming section opens with an `**In short:**` paragraph.** One paragraph,
+  right under the `# Upcoming WeKan ® release` line and above the first
+  `This release …:` header, saying what the whole release amounts to — the areas
+  that changed and what changed about them, with the notable names in `**bold**`
+  so it can be skimmed. It is a SUMMARY, not a list: it does not link commits, it
+  does not repeat an entry's wording, and it ends by accounting for the rest in a
+  clause (`Below that: dependency updates, nine bug fixes … and the usual
+  documentation and translation work.`). Keep it current as entries are added —
+  it is the first thing a reader sees, so a stale one misdescribes the release.
+  A finished release keeps the paragraph it was written with.
+- **Under the summary comes the BINARIES TABLE: what each platform ships.** So the
+  top of a release section is, in order, (1) the `**In short:**` paragraph and
+  (2) this table, and only then the `This release …:` subsections. A WeKan bundle
+  is not only WeKan — it carries a Node.js, a FerretDB and the MongoDB Database
+  Tools that other projects publish, and WHICH source has a given CPU changes
+  from release to release: nodejs.org builds some architectures,
+  unofficial-builds others, and [wekan/node-patches](https://github.com/wekan/node-patches)
+  the ones neither of them does. "Which Node.js is in the arm64 bundle of 10.69,
+  and was it checked" must be answerable from the CHANGELOG, not from a build log
+  that expires.
+
+  ```
+  | Platform | Binary | From | Version | SHA256 |
+  | --- | --- | --- | --- | --- |
+  | amd64 | Node.js | [nodejs.org](https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-x64.tar.xz) | v24.19.0 | `a1b2…` |
+  | amd64 | FerretDB | [wekan/FerretDB](https://github.com/wekan/FerretDB/releases/download/v1.24.0/ferretdb-amd64) | v1.24.0 | `c3d4…` |
+  | arm64 | Node.js | [nodejs.org](https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-arm64.tar.xz) | v24.19.0 | `e5f6…` |
+  ```
+
+  **GROUPED BY PLATFORM**: rows are sorted by platform and then by binary, so one
+  platform's binaries stay together and the table is read a platform at a time.
+  The URL is the LINK ON THE "From" CELL — never a bare URL as visible text, the
+  same rule as everywhere else — and it is the exact file that was downloaded, not
+  the project's front page. The SHA256 is the checksum the source published and the
+  build verified, in backticks; a source that publishes none says *no checksum
+  published*, which is not a failed check but a source worth fixing. Table rows
+  carry links, so the 80-character wrap does not apply to them.
+
+  It is the same table `releases/provenance-table.sh` puts at the top of the GitHub
+  release notes, from the `provenance.tsv` rows each build job records — so the two
+  are filled from the same data and cannot disagree. **A platform that was NOT built
+  has no rows**, which is how the table also answers "why is there no i386 bundle
+  this time": no source published a Node.js for it (see
+  `releases/resolve-node-source.sh`).
+- **Inside a subsection, entries are GROUPED BY AREA.** A release touches a handful
+  of areas and repeating the area's name in every summary is the noise this
+  removes — twelve entries that each begin "All Boards:" say "All Boards" twelve
+  times and the part that differs starts halfway through the line. Instead the area
+  is named ONCE, as a bold line with a short description of what the group covers,
+  and every entry under it drops the prefix:
+
+  ```
+  and fixes the following bugs:
+
+  **The first header bar** - how it lays itself out, and what sits under it.
+
+  <details>
+  <summary><a href="…">It fills each row before starting the next one</a>. Thanks to xet7.</summary>
+  …
+  </details>
+
+  <details>
+  <summary><a href="…">It wraps to a second row instead of hiding the buttons that do not fit</a>. Thanks to xet7.</summary>
+  …
+  </details>
+
+  **All Boards** - the overview and its search.
+
+  <details>
+  …
+  ```
+
+  The group line is `**Area** - short description.` on ONE line, wrapped at 80 like
+  everything else, with a blank line under it. It is NOT a heading: a `##` inside a
+  release breaks the version list (see above). Group labels are the areas of the
+  app — `All Boards`, `The first header bar`, `The left menus`, `The Admin Panel`,
+  `Board views`, `Public Boards`, `Member Settings`, `Board roles` — and the same
+  label is reused across subsections when an area has both a feature and a fix.
+  EVERY entry of a grouped subsection belongs to a group, including a group with
+  one entry: a section that is half grouped and half loose reads as a mistake. A
+  subsection with only one entry, and the dependency bullets, stay flat.
+- **CRITICAL security header — match the previous releases' wording.** A security release
+  leads with `This release fixes the following CRITICAL SECURITY ISSUE of
+  [Name](https://wekan.fi/hall-of-fame/namebleed/):` for a single named *Bleed, or
+  `This release fixes the following CRITICAL SECURITY ISSUES:` for several — NOT
+  `CRITICAL VULNERABILITIES`. Each security bullet still links its own
+  `https://wekan.fi/hall-of-fame/...bleed/`. CodeQL-only releases use the established
+  `This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:`.
+  Because CRITICAL comes first, it keeps the `This release ` prefix; a following non-security
+  subsection becomes `and …` per the rule above.
+- **`# TODO Later` section** — a triage backlog near the TOP of `CHANGELOG.md` (above the
+  version sections), for open issues that were **investigated but not fixed here**, each
+  recorded with a concrete REASON so whoever picks it up next knows why. Use it when working
+  through open issues (the "Fix open issues" process): for each issue, either **fix it** (commit
+  ending `Fixes #NNNN,`), **close it** if already fixed in current code (commit `Close #NNNN` /
+  `Fixes #NNNN,`), or — when it can't be fixed/verified in this environment — **add it to `TODO
+  Later` under the matching category with the reason**. Group issues by category bullet, e.g.:
+  *Need specific infrastructure / a running server stack* (LDAP/WebHooks/Sandstorm/proxy —
+  environment owners), *Need the running app to reproduce/verify* (runtime UI / publication /
+  mergebox / router state, not unit-testable), *Already correct in the current code* (verified by
+  reading; could not reproduce), *Feature requests / behaviour-by-design rather than bugs*, and
+  *Needs a maintainer decision on the intended contract*. Each category is a `<details>`
+  whose `<summary>` is the SHORT category text and whose body lists the issues with their
+  reasons — and with **no `Thanks to` line**, because nothing is done yet, so there is
+  nobody to thank. Each entry is a normal issue link
+  `[#NNNN](https://github.com/wekan/wekan/issues/NNNN) (one-line reason)` — issue links here, NOT
+  commit links (nothing was committed). **Keep it current:** when an issue in `TODO Later` gets
+  fixed, REMOVE it from the list (its fix commit's `Fixes #NNNN` closes it); do not leave fixed
+  issues in the backlog. This is the only CHANGELOG place that uses issue links and lives above
+  the releases; everything else uses the per-release commit-link bullets above.
+- FerretDB Upcoming structure — `### New Features 🎉`, `### Fixed 🐛`, `### Other Changes
+  🤖`; entries end `... by @xet7. Thanks to xet7.`
+- Word-wrap both CHANGELOGs at 80 chars, but never break a long link across lines (a
+  `<summary>` line, or any other line carrying a link, may be longer). Continuation
+  lines of a plain bullet are indented by two spaces.
+
+### Commit message structure
+
+```
+Do something.
+
+Thanks to (original creator of issue) and xet7 !
+
+Fixes #1234,
+Fixes #1235.
+```
+
+- **A commit that fixes a GitHub issue ENDS with `Fixes #NNNN`** — last lines of
+  the message, one per issue, comma after each and a full stop on the last. That
+  trailer is what closes the issue when the commit is pushed; a fix that only
+  *mentions* the number in prose leaves the issue open, and somebody has to close
+  it by hand later or it stays open forever. Several issues in one commit get
+  several lines. The same applies to an issue that turns out to be **already
+  fixed**: commit the test or the note that proves it and end with `Fixes #NNNN,`
+  so the issue closes with a reference to where it was fixed.
+- **Only when the commit really fixes it.** A commit that improves the
+  diagnostics, narrows the cause, or fixes one of several reported problems
+  references the issue in the body (`#6585 comment 5276581923`) and does NOT
+  carry the trailer — closing an issue whose reporter is still stuck is worse
+  than leaving it open. If an issue was closed and then REOPENED for follow-up
+  items (as #6586 was), it is fixed again only when those items are done.
+- **A commit with no issue behind it has no trailer** — the email reports, the
+  release-tooling fixes found in build logs, refactors. `Thanks to ... and xet7 !`
+  still names whoever reported it.
+
+### Making a release — no version number needed  **[maintainer only]**
+
+All publishing / release steps below are maintainer-only. Contributors never run them.
+
+**Releases are FREQUENT, and that is the normal state of this repository — not an
+interruption to it.** The maintenance loop is:
+
+1. `./build.sh` (or `build.bat` on Windows) → **option 1, "git pull and git
+   push"**. Both directions do the whole job: a pull rebases and then repairs the
+   CHANGELOG commit links the rebase made stale, and a push repairs them again
+   BEFORE publishing, because a stale link that reaches GitHub 404s for everyone
+   who reads the release notes.
+2. `./releases/release-all.sh`, **with no arguments**, whenever there is something
+   worth shipping — which is often, several times a day when a fault is being
+   chased. It takes the version from the CHANGELOG and needs nothing typed.
+
+So a release happening "in the middle" of a piece of work is not a special case
+to reason about; it is what always happens, and anything that only works when
+releases are rare is broken here. Two consequences worth stating, because both
+have cost a released section its accuracy:
+
+- **Work continues immediately after a release**, so `release-all.sh` renames
+  `# Upcoming WeKan ® release` to `# v<NEW> …` and then OPENS A NEW EMPTY
+  `# Upcoming` (`releases/changelog-open-next.mjs`), so the next entry has
+  somewhere correct to go. Without it an entry appended above the closing
+  `Thanks to above GitHub users …` line lands INSIDE the release just published.
+  The new section carries an `**In short:** nothing here yet.` placeholder and
+  the binaries table, so the file stays valid; replace the placeholder as entries
+  are added. `tests/changelogEntriesBelongToTheirRelease.test.cjs` checks the
+  newest few releases against git and fails when a section links a commit that
+  release does not contain.
+- **A released section is a RECORD, not a draft.** When a release turns out to be
+  broken, its section keeps saying what it shipped — including the part that was
+  wrong — and the fix goes in a new `# Upcoming` above it. Do NOT edit a
+  published entry to describe the smaller, tidier change you wish had shipped;
+  add to it that it was wrong and where the fix is. Somebody reading v10.97's
+  notes is most likely somebody whose v10.97 just died.
+
+- WeKan: run `./releases/release-all.sh` (no arguments). It renames
+  `# Upcoming WeKan ® release` to the next version (same increment as the last release;
+  9.99 → 10.00) dated today, commits + pushes, and triggers
+  `.github/workflows/release-all.yml` — whose `bump` job bumps `package.json` and every
+  version reference and rebuilds the API docs, whose `prepare` job then pushes the tag
+  `v<new>` and checks the notes exist, and whose `release` job publishes the GitHub
+  Release the bundle jobs attach to. An explicit `oldversion newversion` pair still
+  overrides. Adding entries under Upcoming is the only hand step.
+- **A release that FAILED and one that shipped BROKEN are handled differently, and
+  the difference is whether anything was PUBLISHED.** Both happened with v10.92, so
+  neither is hypothetical:
+  - **Nothing published** (the workflow died before the GitHub Release existed): there
+    is no release for that number, so `# v<new> …` must not claim there is one. Rename
+    the heading back to `# Upcoming WeKan ® release`, add the fix under it, and run
+    `release-all.sh` again — it will take the same number, since the newest release is
+    still the previous one.
+  - **It published, and something in it is broken**: the release exists and people can
+    download it, so its section STAYS as it is — a released section is a record, not a
+    draft. Add a NEW `# Upcoming WeKan ® release` above it with the fix, exactly as
+    during ordinary development, and the next run takes the next number.
+  What decides it is the GitHub Release, not the tag: `prepare` pushes the tag early,
+  so a tag can exist for a release that never published.
+- FerretDB: run `./build.sh release-ferretdb` from `.tools/FerretDB` (no
+  version). It renames `## Upcoming FerretDB release` to the next version with the
+  correct git-tag link, commits + tags + pushes, then triggers `release-all.yml` (which
+  in turn triggers `docker.yml` for the multi-arch image). It refuses to re-release an
+  already-tagged version.
+
+### Security issues
+
+- Fix the vulnerability, add a CRITICAL section to the WeKan CHANGELOG like previous
+  entries, and update `../w/wekan.fi/hall-of-fame/index.html` and the vuln-name
+  subdirectory `index.html` like previous security issues.
+- **Every security fix gets a TEST and a NEGATIVE TEST, and they are written so the
+  fault cannot exist ANYWHERE in the codebase — not just at the place it was
+  reported.** A test that pins one call site leaves the same mistake free to live in
+  the other five, and that is how most of these arrive: SignupBleed's guard read an
+  option nothing sets, and the same shape sat in a second endpoint; the source-map
+  trim was safe on the client and fatal on the server. So:
+  - the **test** proves the fix does what it claims, driving the decision itself
+    where that is possible. A pure module — `loginFailureDecision.js`,
+    `lockoutDecision.js` — can be tested as arithmetic, without a server or a
+    database, and reproduces the reporter's attack exactly rather than approximately;
+  - the **negative test** proves the fault is gone rather than moved. Search the
+    whole tree for the SHAPE of it and assert nothing matches: no other endpoint
+    reads the dead option, no other counter is global, no other caller skips the
+    check. When the shape is a pattern, pin the pattern.
+  - and a test that reads the source is a real test here. `tests/*.test.cjs` may
+    parse a file and fail on a construct — that is what makes "and nowhere else"
+    checkable at all.
+- **If somebody ATTEMPTS the attack, and the secure default DENIES it, that denial
+  has to be visible in Admin Panel → Problems** — in every case where the denial can
+  be attributed. This applies to every security fix added to Upcoming. That is the
+  difference between a hole that is closed and a hole that is closed and watched:
+  an administrator should be able to see that somebody tried.
+  - Add a key to the catalog in `models/lib/securityCategories.js` (category, the
+    hall-of-fame `bleed` name, severity, CWE), and call
+    `require('/server/lib/securityLog').record({ key, action: 'blocked', source, detail })`
+    on the refusal path. `action` is `'blocked'` when the fix stopped it and
+    `'detected'` when it was only noticed.
+  - **Wrap the call so logging can never break the guard**:
+    `try { ... } catch (e) { /* logging must never break the guard */ }`. The refusal
+    matters more than the record of it.
+  - **Only log an ATTEMPT, never ordinary use.** The test to apply is whether a
+    legitimate user can reach that line. Registration refused while registration is
+    off has no legitimate caller, so it is logged; an admin endpoint whose fault was
+    in what its answer CARRIED fires on every normal call, so it is NOT — that is why
+    HashBleed (GHSA-6qpx-x7vr-p9w6) deliberately has no key. A log that fills with
+    normal traffic hides the one line that mattered.
+  - Where the denial cannot be attributed to an attempt — a fix that changes what a
+    response contains, or one that only takes effect at build time — there is nothing
+    to record, and that is a decision to state in the entry rather than an omission.
+- **Admin Panel → Problems is a SUMMARY, never a row per event.** A guard on a path
+  an attacker controls fires as fast as they can send, so a document per occurrence
+  grows the database with the attack, turns the page into a scroll of near-identical
+  lines, and buries the one event that mattered under ten thousand that did not. The
+  admin's question is never *list every attempt* — it is *what is happening, how
+  much, since when, and who*. So each problem is ONE row that accumulates
+  (`models/lib/eventLogSummary.js`, written through `server/lib/eventLogFold.js`,
+  shared by the security, speed and test loggers):
+
+  | field | what it holds |
+  | --- | --- |
+  | `count` | how many times this problem has happened |
+  | `firstAt` … `at` | the window it happened in |
+  | `actors` | who, each with their own count — `username1 25, 100.100.100.100 30` |
+  | `username` / `ip` / `detail` | the MOST RECENT occurrence |
+
+  - **Identity is the KIND of thing that happened** — stream, `bleed`, category,
+    action, source, severity, CWE (and `type`/`db`/`kind` for the database stream).
+    The actor is NOT part of it: putting a username or an address in the key gives a
+    row per attacker per attempt, which is the cost being removed.
+  - **A username and an address are tallied SEPARATELY**, not as a pair. They answer
+    different questions — which account, and where from — and an unauthenticated
+    attempt has an address and no name.
+  - **The tally is CAPPED** (`MAX_ACTORS`), with the remainder counted in
+    `actorsOverflow`. Otherwise an attacker rotating addresses grows the row with the
+    attack and reintroduces the same bug one level down — and *"and 9,412 others"* is
+    itself the signal that the source is spread rather than single.
+  - **A logger that writes per event is a bug to fix, not a style.** If one is added
+    or found, route it through the shared fold and migrate what it already wrote
+    (`server/lib/eventLogSummaryMigration.js` folds legacy rows in place, in batches,
+    idempotently).
+- **Every hall-of-fame vulnerability that CAN be detected at runtime should have a
+  catalog key**, so Admin Panel → Problems groups attempts under the same name the
+  Hall of Fame uses and an admin can go from one to the other.
+  `tests/hallOfFameProblemsCoverage.test.cjs` lists the names that have no key and
+  requires each to be accounted for — a *Bleed with nothing to detect (a fix that
+  changed what a response carried, or one that only applies at build time) is
+  recorded there as a deliberate omission with its reason, not left silent.
+- **A Hall of Fame row has EIGHT cells**, in this order: CVE, Icon, Vulnerability
+  name, Date, Responsible Security Disclosure by, Stars, Process, Vulnerabilities.
+  One thing per cell — the name without its icons, the Font Awesome icons alone in
+  Icon (still wrapped in `<h2>`), the reporter alone in "by", the `GoldStar.png`
+  images alone in Stars, and the sentence about how the report arrived (coordinated
+  disclosure, GitHub advisory, code scanning, found while reviewing …) in Process.
+  In "by", the reporter's NICKNAME is the link —
+  `<b><a href="https://github.com/nick">nick</a></b>`, never the name followed by a
+  separate "(GitHub)" link. **Check the account exists before linking it** (a 404 or,
+  worse, somebody else's profile is the failure here); a real name, a company or a
+  tool such as GitHub CodeQL is not a GitHub user and stays plain text. Do not write
+  a role note after a name — no `(fix)`, `(found)` or `(found and fix)`: this column
+  is the credit, and the Process cell beside it already says how the report arrived.
+  Stars is a column so it can be compared down the page; do not put a star, an icon
+  or the process sentence back into another cell. A page-local `<style>` in
+  `index.html` keeps a row's stars on ONE line from 900px up (they are a count) and
+  sizes them at 24px, and keeps the icon and its red drop on one line at every width
+  (they are one icon) — the table itself stays percentage-sized with no fixed or
+  minimum width, so it fills the page at every browser width.
+- **On the Hall of Fame index page, the Process and Vulnerabilities cells are
+  collapsed.** Those two columns carry the prose — how the report arrived, and the
+  whole story of the vulnerability — so the page would be one wall of text and the
+  columns that identify a row (CVE, name, date, reporter, stars) would be far apart.
+  In `hall-of-fame/index.html`, and ONLY in those two `<td>`s, the cell's content
+  sits inside a `<details>` whose summary is the column's own name — `Process` for
+  the Process cell, `Details` for the Vulnerabilities cell:
+
+  ```
+  <td valign="top">
+    <details>
+    <summary>Details</summary>
+
+    <ul>
+      <li>… the same list as before …</li>
+    </ul>
+    </details>
+  </td>
+  ```
+
+  The summary is that plain word, there is a blank line under it, and the cell's
+  contents are otherwise unchanged. The other six cells of the row stay as they are
+  — they are what a reader scans — and so does the header row.
+- **The vuln-name subdirectory page is NOT collapsed.** `hall-of-fame/<name>bleed/index.html`
+  is the page a reader opened on purpose, for one vulnerability: its table cell stays
+  open and its `<h2 class="hof">Details</h2>` prose section below the table stays as
+  it is. Only the index, which lists them all, hides them behind the summary.
+
+### Tests
+
+- `build.sh` / `build.bat` have a menu to install dependencies, build
+  WeKan and run tests.
+- Add tests, negative tests and UI tests for all new features and fixes that do not yet
+  have tests. When adding a test, run or validate it and fix it until it works.
+- **"Check newest test logs":** test logs go into a `log/<datetime>/` directory,
+  one per run (e.g. `2026-07-21_20-58-09/`). That is **`../log/`**, one level up
+  from the repo, so a run does not show up in `git status` - **unless the parent
+  is not writable**, as in a Flatpak sandbox that shares only the repository;
+  there it is **`./log/`** inside the repo (gitignored). `build.sh` prints which
+  one when a run starts. The
+  newest datetime directory is the latest run. Each holds the Playwright per-browser
+  logs (`wekan-alltests-chromium.log`, `-firefox.log`, `-webkit.log`), the mocha/unit
+  log (`wekan-alltests-mocha.log`), the e2e/import logs, and `wekan-test-server.log`
+  (the WeKan test server + database output). A whole-run directory also holds the
+  database-conformance logs (`db-conformance-*.log`, `-report.md`, `-summary.txt`)
+  and FerretDB's own (`ferretdb-unit.log`, `-vet.log`, `-integration.log`). "Check
+  the newest test logs" means: open the most recent `log/<datetime>/` - look in
+  `../log/` first, then `./log/` - and read those.
+- **Check and fix WHILE the tests are still running.** A full run takes a long time
+  (three browsers, then every database with an image for this CPU, then FerretDB's
+  own suites), and its stages finish one at a time. Do not wait for the end: read
+  the logs that are already written, fix what they show, and then look again for the
+  stages that have finished since — repeat until every stage has run and everything
+  found is fixed. Two things make this work:
+  - A stage's log file is complete when its `===== ... finished` line is there; a
+    file whose mtime is still moving is a stage in progress, and its failures so far
+    are already real and worth fixing.
+  - The node suites are run by `tests/run-node-suites.cjs`, which runs ALL of them
+    and lists every failure at the end (`===== node suites: N run, M failed`). They
+    are the fastest signal - about 15 seconds for 260 suites - so they are usually
+    what to fix first while the browsers are still going.
+- **A failing guard is not automatically a broken app.** Most of these suites read
+  the source and pin a behaviour. When one fails, decide which side is wrong: fix
+  the CODE when the guard still describes what WeKan should do, and fix the GUARD
+  when the behaviour deliberately changed - and then say in the test WHY, so the
+  next reader knows it was a decision and not a slip. Every fixed test keeps the
+  assertion that made it valuable; do not delete a test to make a run green.
+
+## Environment
+
+- The editor (VSCode) runs inside a **Flatpak sandbox**, launched by
+  `docs/Security/Sandboxes/vscode/vscode-sandbox.sh`. What the sandbox allows/blocks and
+  how it is set up is documented in `docs/Security/Sandboxes/vscode/README.md` in that
+  same directory — read it when something behaves differently than a normal host (file
+  access, network, running services).
+
+### Always validate from the actual code
+
+- When doing anything, check how it actually works in the code first.

CODE_OF_CONDUCT.md

@@ -2,10 +2,15 @@
 
 For all code at WeKan GitHub Organization https://github.com/wekan
 
+- For pull requests, mention only those participants that are **human**.
 - All code in pull requests need to have permission already to add it to WeKan with MIT license, and will become MIT license.
-- All code xet7 add is MIT license.
 - For any dependencies, permissive licenses like https://copyfree.org are preferred
 - For anything currently that is non-permissive (like GPL, AGPL, SSPL), those will be replaced with permissive-licensed alternatives
+- All code is checked and validated by xet7 and many different security AI. If code is real working fix or feature, it usually will be merged.
+- All known vulnerabilities have been fixed at newest WeKan, please upgrade https://wekan.fi/upgrade/
+- There is no known backdoors. If WeKan is installed by someone else, first registered user is Admin and has Admin Panel access.
+- Maintainer of WeKan has no access to someone elses installed WeKan.
+- For someone elses installed WeKan, see [Forgot Password](https://github.com/wekan/wekan/blob/main/docs/Features/Login/Forgot-Password.md)
 
 # Reporting about violations or something else
 

CONTRIBUTING.md

@@ -34,6 +34,16 @@ and click send PR.
 
 ## Contributing code
 
+Use build.sh to run all tests to verify you don't break any features, before sending PR.
+
+Only send one feature or fix at one PR. Do not add many unrelated changes.
+
+Only send those changed code lines, that are related to your one feature or fix.
+
+Do not format unrelated code. Do not use code formatting or linting like eslist or prettier.
+
+Send your code ASAP, because there are daily releases of WeKan with major features and fixes added.
+
 [Building WeKan and sending PR](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md).
 
 WeKan code contributors Hall of Fame is at ChangeLog, where
@@ -49,10 +59,6 @@ Also see other docs:
 
 https://github.com/wekan/wekan/tree/main/docs/DeveloperDocs
 
-Do not use code formatting or linting like eslist or prettier.
-
-Only send minimal changed code lines, that are related to feature or fix.
-
 WeKan code has MIT license.
 
 About 300 persons have contributed to WeKan, stats at:

Dockerfile

@@ -1,23 +1,37 @@
-FROM ubuntu:24.04
+# debian:trixie (Debian 13), not ubuntu:26.04: Ubuntu publishes no linux/386
+# image, which stopped the image from ever building for i386. Debian ships every
+# arch this image targets - amd64, arm64, 386, arm/v7, ppc64le, riscv64, s390x -
+# so ONE base covers them all, and it is the same base WeKan's per-arch .zip
+# bundles are already built in (releases/... build-extra-arches).
+#
+# The ONE it does not ship is arm/v6: debian:trixie's manifest list has arm/v5
+# and arm/v7 and nothing between them. That matters because containerd treats a
+# LOWER ARM variant as compatible, so a linux/arm/v6 request does not fail - it
+# quietly resolves to the arm/v5 (armel, SOFT-float) image, whose loader and
+# glibc cannot run the hard-float node-armv6 in the armv6 bundle. The docker job
+# therefore asks this base what it publishes and drops a platform it lacks; see
+# docs/Platforms/FOSS/Container/Docker/CPU-platforms.md.
+FROM debian:trixie
 LABEL maintainer="wekan"
-LABEL org.opencontainers.image.ref.name="ubuntu"
-LABEL org.opencontainers.image.version="24.04"
+LABEL org.opencontainers.image.ref.name="debian"
+LABEL org.opencontainers.image.version="trixie"
 LABEL org.opencontainers.image.source="https://github.com/wekan/wekan"
 
 # TARGETARCH and TARGETVARIANT are automatically provided by Docker Buildx
 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=8.78
+ARG VERSION=11.02
 ARG DEBIAN_FRONTEND=noninteractive
 
 ENV BUILD_DEPS="apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip"
 
 ENV \
     DEBUG=false \
-    NODE_VERSION=v24.14.1 \
-    METEOR_RELEASE=METEOR@3.5-beta.7 \
+    DDP_TRANSPORT=sockjs \
+    NODE_VERSION=v24.19.0 \
+    METEOR_RELEASE=METEOR@3.5-rc.2 \
     USE_EDGE=false \
-    NPM_VERSION=11.11.0 \
+    NPM_VERSION=11.12.1 \
     SRC_PATH=./ \
     WITH_API=true \
     MONGO_OPLOG_URL="" \
@@ -42,6 +56,7 @@ ENV \
     IMAGE_COMPRESS_RATIO="" \
     NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE="" \
     BIGEVENTS_PATTERN=NONE \
+    NOTIFY_ON_ASSIGN="true" \
     NOTIFY_DUE_DAYS_BEFORE_AND_AFTER="" \
     NOTIFY_DUE_AT_HOUR_OF_DAY="" \
     EMAIL_NOTIFICATION_TIMEOUT=30000 \
@@ -66,8 +81,11 @@ ENV \
     OAUTH2_AUTH_ENDPOINT="" \
     OAUTH2_USERINFO_ENDPOINT="" \
     OAUTH2_TOKEN_ENDPOINT="" \
+    OAUTH2_LOGOUT_ENDPOINT="" \
     OAUTH2_ID_MAP="" \
     OAUTH2_USERNAME_MAP="" \
+    OAUTH2_AUTO_REGISTRATION="true" \
+    OAUTH2_ADMIN_GROUPS="" \
     OAUTH2_FULLNAME_MAP="" \
     OAUTH2_ID_TOKEN_WHITELIST_FIELDS="" \
     OAUTH2_REQUEST_PERMISSIONS='openid profile email' \
@@ -93,6 +111,7 @@ ENV \
     LDAP_BACKGROUND_SYNC_INTERVAL="" \
     LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false \
     LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false \
+    LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false \
     LDAP_ENCRYPTION=false \
     LDAP_CA_CERT="" \
     LDAP_REJECT_UNAUTHORIZED=false \
@@ -122,10 +141,16 @@ ENV \
     LDAP_DEFAULT_DOMAIN="" \
     LDAP_SYNC_ADMIN_STATUS="" \
     LDAP_SYNC_ADMIN_GROUPS="" \
+    LDAP_SYNC_ORGANIZATIONS=false \
+    LDAP_SYNC_ORGANIZATIONS_GROUPS="" \
+    LDAP_SYNC_TEAMS=false \
+    LDAP_SYNC_TEAMS_GROUPS="" \
     HEADER_LOGIN_ID="" \
     HEADER_LOGIN_FIRSTNAME="" \
     HEADER_LOGIN_LASTNAME="" \
     HEADER_LOGIN_EMAIL="" \
+    HEADER_LOGIN_TRUSTED_IPS="" \
+    HEADER_LOGIN_TRUSTED_PROXIES="" \
     LOGOUT_WITH_TIMER=false \
     LOGOUT_IN="" \
     LOGOUT_ON_HOURS="" \
@@ -158,39 +183,144 @@ ENV \
     MONGO_PASSWORD_FILE="" \
     S3_SECRET_FILE=""
 
+# Where this image's Node.js comes from is decided by the SAME script the .zip
+# bundles and the snap use - official nodejs.org, then unofficial-builds, then
+# wekan/node-patches - so the image and the bundle of the same architecture can
+# never end up on Node.js from different places. It is copied in rather than
+# reimplemented here; a second copy of that order would drift from the first.
+COPY --chmod=755 releases/resolve-node-source.sh /tmp/resolve-node-source.sh
+# It asks nodejs.org and github.com which builds exist, through releases/fetch.sh
+# - which retries a 503 instead of reading it as "that build does not exist".
+# The two travel together: without this line the resolve step dies on the first
+# lookup. tests/releaseDownloads.test.cjs pins the pair.
+COPY --chmod=755 releases/fetch.sh /tmp/fetch.sh
+# The bundle's `npm install` leaves node-gyp's whole tree - 83 of the 120
+# packages in programs/server/node_modules - in a bundle that compiles nothing at
+# run time, and a scan of the published image reads it as what it is. The same
+# script runs in every per-arch leg of release-all.yml, so the .zip bundles and
+# this image are pruned identically. tests/imageBuildOnlyModules.test.cjs pins it.
+COPY --chmod=755 releases/prune-build-only-modules.mjs /tmp/prune-build-only-modules.mjs
+# Its companion, and its manifest: the npm packages Meteor's own packages bundle,
+# which nothing in package.json can reach. The .zip is built with these already
+# applied; what this run has to redo is the part `npm install` puts back.
+COPY --chmod=755 releases/bump-bundle-npm-deps.mjs /tmp/bump-bundle-npm-deps.mjs
+COPY --chmod=644 releases/bundle-npm-security-bumps.json /tmp/bundle-npm-security-bumps.json
+# And the third of the same kind: WeKan talks DDP over sockjs on every platform,
+# so no bundle carries uWebSockets.js. ddp-server requires that module only
+# inside the uws transport's setup(), which a sockjs server never calls, and it
+# is 121M of prebuilt binaries for OS/CPU/ABI combinations one machine cannot
+# use. The entrypoint coerces DDP_TRANSPORT=uws to sockjs, so an existing
+# compose file that asks for uws keeps working rather than crash-looping.
+COPY --chmod=755 releases/bundle-trim.mjs /tmp/bundle-trim.mjs
+# Its companion: the same idea applied to programs/server/npm/node_modules.
+COPY --chmod=755 releases/prune-unreachable-npm.mjs /tmp/prune-unreachable-npm.mjs
+
 RUN <<EOR
 set -o xtrace
+# Fail hard on any error so a missing release zip / failed download can never
+# produce a "successful" image with an empty /build (Cannot find /build/main.js).
+set -eo pipefail
 
-# Create Wekan user
-useradd --user-group --system --home-dir /home/wekan wekan
+# Create Wekan user. --create-home is required because --system users do not
+# get a home directory by default; without it /home/wekan never exists and the
+# later `chown ... /home/wekan/` aborts the build (now that set -e is active).
+useradd --user-group --system --create-home --home-dir /home/wekan wekan
 
 # OS Updates
 apt-get update --assume-yes
 apt-get upgrade --assume-yes
 apt-get install --assume-yes --no-install-recommends ${BUILD_DEPS}
 
-# Multi-arch mapping: Docker TARGETARCH -> Node.js arch name + WeKan bundle name
-# arm/v7 uses TARGETARCH=arm; armhf has no MongoDB Community -> uses FerretDB
+# Multi-arch mapping: Docker TARGETARCH -> WeKan's own platform name, which is
+# both the bundle .zip's name and what resolve-node-source.sh is asked about.
+# amd64/arm64 have MongoDB Community; ppc64le/s390x/riscv64 have no MongoDB
+# server and ship FerretDB v1 instead (the ferretdb binary is baked into their
+# .zip and started by wekan-entrypoint.sh). Debian's 32-bit ARM port is armhf
+# (ARMv7, VFPv3-D16), which is what linux/arm/v7 runs.
 case "${TARGETARCH}" in
-    "amd64")   NODE_ARCH="x64"     WEKAN_ARCH="amd64"   ;;
-    "arm64")   NODE_ARCH="arm64"   WEKAN_ARCH="arm64"   ;;
-    "arm")     NODE_ARCH="armv7l"  WEKAN_ARCH="armhf"   ;;
-    "ppc64le") NODE_ARCH="ppc64le" WEKAN_ARCH="ppc64le" ;;
-    "s390x")   NODE_ARCH="s390x"   WEKAN_ARCH="s390x"   ;;
-    *) echo "Unsupported architecture: ${TARGETARCH}"; exit 1 ;;
+    "amd64")   WEKAN_ARCH="amd64"   ;;
+    "arm64")   WEKAN_ARCH="arm64"   ;;
+    "ppc64le") WEKAN_ARCH="ppc64le" ;;
+    "s390x")   WEKAN_ARCH="s390x"   ;;
+    "riscv64") WEKAN_ARCH="riscv64" ;;
+    "386")     WEKAN_ARCH="i386"    ;;
+    # BOTH linux/arm/v6 and linux/arm/v7 arrive here as TARGETARCH=arm - the CPU
+    # generation is in TARGETVARIANT, not in TARGETARCH - so this branch MUST read
+    # the variant. Mapping "arm" straight to armhf, as it did, would hand an ARMv6
+    # board (Raspberry Pi 1, Zero) the armhf bundle, which is built to Debian's
+    # ARMv7-A baseline and whose instructions that board cannot execute.
+    "arm")
+        case "${TARGETVARIANT}" in
+            "v6")    WEKAN_ARCH="armv6" ;;
+            # v7, and an unset variant, are Debian's armhf port: ARMv7-A,
+            # VFPv3-D16 hard-float. That is what linux/arm/v7 runs.
+            "v7"|"") WEKAN_ARCH="armhf" ;;
+            # v5 is armel: FerretDB and the MongoDB tools publish it (they are Go),
+            # but Node.js does not exist for ARMv5 at all, so there is no bundle to
+            # put in an image and refusing is the only honest answer.
+            *) echo "Unsupported 32-bit ARM variant: ${TARGETVARIANT} (only v6 and v7 have a WeKan bundle)"; exit 1 ;;
+        esac ;;
+    *) echo "Unsupported architecture: ${TARGETARCH}${TARGETVARIANT:+/${TARGETVARIANT}}"; exit 1 ;;
 esac
 
-# Node.js Installation (official nodejs.org builds for Node 22)
+# Node.js installation - official nodejs.org, then unofficial-builds.nodejs.org,
+# then wekan/node-patches, in that order, for EVERY architecture.
+#
+# The choice is made by releases/resolve-node-source.sh, copied in above and used
+# by the .zip bundles and the snap as well, so the image and the bundle of one
+# architecture always carry the same Node.js from the same place. It is asked
+# about the MAJOR, so a CPU whose newest build lags a release still gets its
+# newest: it answers with the exact file, what shape that file is, and the
+# SHA256 the source published for it.
+#
+# npm is arch-independent JavaScript, so it is grafted from the official amd64
+# tarball of the version that was resolved - a build-time tool, not the shipped
+# node. (node-patches publishes a bare node binary and no npm at all, which is
+# why npm is fetched separately rather than taken from the archive above.)
 cd /tmp
-wget "https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz"
-wget "https://nodejs.org/dist/${NODE_VERSION}/SHASUMS256.txt.asc"
-grep "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt.asc | shasum -a 256 -c -
-tar xzf "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" -C /usr/local --strip-components=1 --no-same-owner
-rm -f "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt.asc
+NODE_MAJOR="${NODE_VERSION#v}"; NODE_MAJOR="${NODE_MAJOR%%.*}"
+if ! NODE_META="$(bash /tmp/resolve-node-source.sh "${WEKAN_ARCH}" "${NODE_MAJOR}")"; then
+    echo "No Node.js ${NODE_MAJOR}.x for ${WEKAN_ARCH} at nodejs.org, unofficial-builds.nodejs.org or wekan/node-patches, so this image cannot be built for it. Build node-${WEKAN_ARCH} in wekan/node-patches, or drop ${TARGETARCH} from the image's platform list." >&2
+    exit 1
+fi
+eval "${NODE_META}"
+echo "Node.js ${node_full} for ${WEKAN_ARCH}: ${node_from} (${node_url})"
+wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 -O node-download "${node_url}"
+echo "${node_sha256}  node-download" | sha256sum -c -
+case "${node_kind}" in
+    binary)
+        cp node-download /usr/local/bin/node
+        ;;
+    tar.xz|tar.gz|tar)
+        # bsdtar (libarchive-tools) is installed below for the bundle; plain tar
+        # here, letting it detect the compression rather than naming it.
+        tar -xf node-download --no-same-owner "${node_member}"
+        cp "${node_member}" /usr/local/bin/node
+        ;;
+    *)
+        echo "resolve-node-source.sh returned an unknown kind '${node_kind}'." >&2
+        exit 1
+        ;;
+esac
+chmod +x /usr/local/bin/node
+# npm + npx from the official amd64 tarball of the SAME version; extract only
+# those paths, not the amd64 node binary.
+# Same flags as the download above: a bare wget treats a 503 as fatal, and
+# nodejs.org has them.
+wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \
+  "https://nodejs.org/dist/${node_full}/node-${node_full}-linux-x64.tar.gz"
+wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 \
+  "https://nodejs.org/dist/${node_full}/SHASUMS256.txt"
+grep " node-${node_full}-linux-x64.tar.gz\$" SHASUMS256.txt | sha256sum -c -
+tar xzf "node-${node_full}-linux-x64.tar.gz" -C /usr/local --strip-components=1 --no-same-owner \
+    "node-${node_full}-linux-x64/lib/node_modules/npm" \
+    "node-${node_full}-linux-x64/bin/npm" \
+    "node-${node_full}-linux-x64/bin/npx"
+rm -rf node-download "node-${node_full}-linux-x64.tar.gz" "node-${node_full}-linux-x64" SHASUMS256.txt
 ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs"
 
 # NPM configuration
-npm install -g npm@${NPM_VERSION} --production
+npm install -g npm@${NPM_VERSION}
 chown --recursive wekan:wekan /home/wekan/
 
 # Temporary Tar swap for Meteor bundle
@@ -200,16 +330,56 @@ ln -sf $(which bsdtar) $(which tar)
 # WeKan Bundle Installation
 mkdir -p /home/wekan/app
 cd /home/wekan/app
-wget "https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-${WEKAN_ARCH}.zip"
+# Retry the release-asset download: even though the CI `docker` job needs the
+# `release` job (so the asset is already uploaded), GitHub's
+# releases/download/<tag>/<asset> URL can briefly return 404 right after upload
+# (CDN/propagation lag). A plain wget treats 404 as fatal, which failed the
+# build; retry on transient HTTP errors so propagation lag no longer breaks it.
+WEKAN_ZIP_URL="https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-${WEKAN_ARCH}.zip"
+wget --tries=20 --waitretry=20 --retry-on-http-error=404,403,500,502,503 "${WEKAN_ZIP_URL}" \
+  || { echo "Failed to download ${WEKAN_ZIP_URL} after retries"; exit 8; }
 unzip "wekan-${VERSION}-${WEKAN_ARCH}.zip"
 rm "wekan-${VERSION}-${WEKAN_ARCH}.zip"
-npm install --production --no-audit --prefix ./bundle/programs/server
+npm install --prefix ./bundle/programs/server
+# node-gyp and @mapbox/node-pre-gyp compiled nothing here - every native module
+# in the bundle is a prebuilt .node - and nothing in boot.js reaches them. Their
+# tree is what shipped `tar` 6.2.1 (CRITICAL) and npm's networking stack to the
+# published image, so it goes now that the install is done.
+node /tmp/prune-build-only-modules.mjs ./bundle
+# The .zip already carries the bumped meteor/ tree; this install put back
+# meteor-dev-bundle's own underscore 1.13.7 pin (CVE-2026-27601) over it, so the
+# same pass runs here.
+node /tmp/bump-bundle-npm-deps.mjs ./bundle
+# No uWebSockets.js, no legacy client, no source maps: this image runs sockjs,
+# serves web.browser to every browser, and has no debugger attached to it.
+node /tmp/bundle-trim.mjs ./bundle --transport sockjs --drop-legacy-client
+# And the npm tree rspack cannot tree-shake, because Atmosphere packages load it
+# through Npm.require(). Only what it can prove nothing requires.
+node /tmp/prune-unreachable-npm.mjs ./bundle
 mv /home/wekan/app/bundle /build
 
+# The .zip bundle now ships a self-contained launcher + its own Node.js for the
+# offline downloads; the Docker image installs its own Node and uses
+# wekan-entrypoint.sh, so drop the redundant bundled node + launchers. Keeps
+# /build/ferretdb (used by the entrypoint) and the per-arch MongoDB Database Tools
+# (bsondump, mongodump, mongorestore, … from wekan/mongo-tools-patches, embedded in the
+# bundle) for backup/restore inside the container. Saves ~80 MB per arch.
+rm -f /build/node /build/start-wekan.sh /build/start-wekan.bat
+
 # Restore original tar
 mv $(which tar)~ $(which tar)
 
 # Cleanup
+# npm is a BUILD tool in this image and nothing else: the only thing it does is
+# the `npm install` above, and the container starts bash + wekan-entrypoint.sh,
+# which never calls it. Shipping it shipped npm's own bundled dependencies - its
+# `tar` (CRITICAL), `sigstore`, `@sigstore/*`, `ip-address`, `brace-expansion` -
+# as image content that no code path can reach. node itself stays, because that
+# is what runs WeKan.
+rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
+# Remove unused Go-based pebble binary shipped by base image to reduce CVE surface.
+apt-get remove --purge --assume-yes pebble || true
+rm -f /usr/bin/pebble
 apt-get remove --purge --assume-yes ${BUILD_DEPS}
 apt-get autoremove --assume-yes
 apt-get clean --assume-yes
@@ -221,10 +391,24 @@ mkdir -p /data
 chown wekan:wekan --recursive /data
 EOR
 
+# Database-backend selector entrypoint. Every arch's bundle now ships a FerretDB
+# binary (baked into the .zip and moved to /build/ferretdb above); this script
+# starts FerretDB v1 (SQLite) or leaves the DB external based on WEKAN_DB and the
+# /build/.ferretdb-default marker (present only on MongoDB-less arches). See
+# releases/ferretdb/wekan-entrypoint.sh.
+COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh
+# #6492: standalone "recovering data" page the entrypoint serves as a brief bridge on
+# the web port while a just-restored FerretDB comes back up during a data recovery.
+COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs
+# #6595: the entrypoint asks this whether the database answers yet, so it can
+# serve the "waiting for database" page instead of leaving the web port unbound
+# for a reverse proxy to time out on.
+COPY --chmod=644 releases/ferretdb/db-ready.mjs /build/db-ready.mjs
+
 USER wekan
 ENV PORT=8080
 EXPOSE $PORT
 STOPSIGNAL SIGKILL
 WORKDIR /build
 
-CMD ["bash", "-c", "ulimit -s 65500; exec node main.js"]
+CMD ["bash", "/build/wekan-entrypoint.sh"]

README.md

@@ -47,12 +47,13 @@ See bottom of https://github.com/wekan/wekan/issues/3874
 ## FAQ
 
 **NOTE**:
+
 - Please read the [FAQ](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md) first
 - Please don't feed the [trolls](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md#why-am-i-called-a-troll) and [spammers](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md#why-am-i-called-a-spammer) that are mentioned in the FAQ :)
 
 ## About WeKan ®
 
-WeKan ® is an completely [Open Source][open_source] and [Free software][free_software]
+WeKan ® is a completely [Open Source][open_source] and [Free software][free_software]
 collaborative kanban board application with MIT license.
 
 Whether you’re maintaining a personal todo list, planning your holidays with some friends,
@@ -66,7 +67,8 @@ that by providing one-click installation on various platforms.
 
 - WeKan ® is used in [most countries of the world](https://snapcraft.io/wekan).
 - WeKan ® largest user has 30k users using WeKan ® in their company.
-- WeKan ® has been [translated](https://app.transifex.com/wekan/) to about 105 languages.
+- WeKan ® has been [translated](https://app.transifex.com/wekan/) to 234 languages,
+  142 of them essentially complete.
 - [Features][features]: WeKan ® has real-time user interface.
 - [Platforms](https://wekan.fi/install/): WeKan ® supports many platforms.
   WeKan ® is critical part of new platforms Wekan is currently being integrated to.
@@ -76,15 +78,15 @@ that by providing one-click installation on various platforms.
 - 1 GB RAM minimum free for WeKan ®. Production server should have minimum total 4 GB RAM.
   For thousands of users, for example with [Docker](https://github.com/wekan/wekan/blob/main/docker-compose.yml): 3 frontend servers,
   each having 2 CPU and 2 wekan-app containers. One backend wekan-db server with many CPUs.
-- Enough disk space and alerts about low disk space. If you run out disk space, MongoDB database gets corrupted.
+- Enough disk space and alerts about low disk space. If you run out of disk space, MongoDB database gets corrupted.
 - SECURITY: Updating to newest WeKan ® version very often. Please check you do not have automatic updates of Sandstorm or Snap turned off.
   Old versions have security issues because of old versions Node.js etc. Only newest WeKan ® is supported.
   WeKan ® on Sandstorm is not usually affected by any Standalone WeKan ® (Snap/Docker/Source) security issues.
 - [Reporting all new bugs immediately](https://github.com/wekan/wekan/issues).
   New features and fixes are added to WeKan ® [many times a day](https://github.com/wekan/wekan/blob/main/CHANGELOG.md).
-- [Backups](https://github.com/wekan/wekan/blob/main/docs/Backup/Backup.md) of WeKan ® database once a day miminum.
+- [Backups](https://github.com/wekan/wekan/blob/main/docs/Backup/Backup.md) of WeKan ® database once a day minimum.
   Bugs, updates, users deleting list or card, harddrive full, harddrive crash etc can eat your data. There is no undo yet.
-  Some bug can cause WeKan ® board to not load at all, requiring manual fixing of database content.
+  Some bugs can cause WeKan ® board to not load at all, requiring manual fixing of database content.
 
 ## Roadmap and Demo
 
@@ -92,7 +94,7 @@ that by providing one-click installation on various platforms.
 
 [Developer Documentation][dev_docs]
 
-- There is many companies and individuals contributing code to WeKan ®, to add features and bugfixes
+- There are many companies and individuals contributing code to WeKan ®, to add features and bugfixes
   [many times a day](https://github.com/wekan/wekan/blob/main/CHANGELOG.md).
 - [Please add Add new Feature Requests and Bug Reports immediately](https://github.com/wekan/wekan/issues).
 - [Commercial Support](https://wekan.fi/commercial-support/).
@@ -102,12 +104,83 @@ By working directly with WeKan ® you get the benefit of active maintenance and
 
 ## Getting Started with Development
 
-The default branch uses [Meteor 2 with Node.js 14](https://wekan.fi/install/).
+The main branch uses Meteor 3.5 with Node.js 24.x.
+See [CHANGELOG.md](https://github.com/wekan/wekan/blob/main/CHANGELOG.md) for the latest runtime updates.
 
-To contribute, [create a fork](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#2-create-fork-of-httpsgithubcomwekanwekan-at-github-web-page) and run `./rebuild-wekan.sh` (or `./rebuild-wekan.bat` on Windows) as detailed [here](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#3-select-option-1-to-install-dependencies-and-then-enter). Once you're ready, please test your code and [submit a pull request (PR)](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#7-test).
+To contribute, [create a fork](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#2-create-fork-of-httpsgithubcomwekanwekan-at-github-web-page) and run `./build.sh` (or `./build.bat` on Windows) as detailed [here](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#3-install-dependencies-build-wekan-and-run-the-dev-server). Once you're ready, please test your code and [submit a pull request (PR)](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#7-test).
 
 Please refer to the [developer documentation](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Developer-Documentation.md) for more information.
 
+## First-Time Setup for Development
+
+### Prerequisites
+
+Before building WeKan from source, ensure you have:
+
+- **Git** - for cloning the repository
+- **Node.js 24.x** - WeKan requires Node.js 24.x
+- **Meteor** - the JavaScript framework WeKan is built with
+
+### Installing Node.js 24.x
+
+```bash
+# Using nvm (recommended)
+curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
+source ~/.zshrc  # or ~/.bashrc
+nvm install 24
+nvm use 24
+```
+
+### Installing Meteor
+
+```bash
+curl https://install.meteor.com/ | sh
+```
+
+### Building WeKan
+
+The `build.sh` script shows a two-level menu. The top level groups options into categories:
+
+```
+1) Setup   2) Dev server   3) Tests   4) Docker   5) Tools   6) Quit
+```
+
+You pick a category number, then the item number inside it (each submenu also has a `Back` entry). Building from source is a three-stage process:
+
+1. **Setup -> Install dependencies** - Downloads all required Meteor packages and npm modules
+2. **Setup -> Build WeKan** - Compiles the application
+3. **Dev server -> localhost:3000** - Starts the development server at http://localhost:3000
+
+```bash
+# Clone your fork
+git clone git@github.com:YOUR_USERNAME/wekan.git
+cd wekan
+
+# Make the script executable
+chmod +x build.sh
+
+# Step 1: Install dependencies (Setup -> Install dependencies)
+./build.sh
+# Press 1 (Setup) and Enter, then 1 (Install dependencies) and Enter
+
+# Step 2: Build WeKan (Setup -> Build WeKan, after dependencies complete)
+./build.sh
+# Press 1 (Setup) and Enter, then 2 (Build WeKan) and Enter
+
+# Step 3: Run WeKan in development mode (Dev server -> localhost:3000)
+./build.sh
+# Press 2 (Dev server) and Enter, then 1 (localhost:3000) and Enter
+```
+
+If a dev server is already running on that port, the **Dev server** options stop it automatically and start a fresh server on the same port.
+ 
+
+### WSL Users
+
+WSL users can use Snap Candidate. See [install docs](https://wekan.fi/install/).
+
+The development server will start at http://localhost:3000. Any changes you make to the source code will automatically trigger a rebuild and refresh your browser.
+
 ## Screenshot
 
 [More screenshots at Features page](https://github.com/wekan/wekan/tree/main/docs/Features)

SECURITY.md

@@ -1,84 +1,92 @@
-## About money
+## About Money: No bounty
 
-See [CONTRIBUTING](CONTRIBUTING.md)
+There is no bounty, like described at [CONTRIBUTING.md](CONTRIBUTING.md),
+because WeKan is NOT Big Tech. WeKan is FLOSS.
 
-## Responsible Security Disclosure
+## Steps for Coordinated Vulnerability Disclosure
 
-1. To send email, if possible, use PGP key [security-at-wekan.fi.asc](security-at-wekan.fi.asc)
-2. Send info about security issue ONLY to security@wekan.fi . NOT TO ANYWHERE ELSE. NO CC, NO BCC.
-3. Wait for new WeKan release that fixes security issue to appear to top of
-   https://github.com/wekan/wekan/blob/main/CHANGELOG.md
-4. We will thank you by adding you to Hall of Fame: https://wekan.fi/hall-of-fame/
-5. All vulnerability details will be private to security@wekan.fi ,
-   unless you help all WeKan platforms to have a way to upgrade, like sending
-   database migrations code to security@wekan.fi or PRs to https://github.com/wekan/wekan/pulls .
-   There is no benefit to Wordwide Security Community to have more details about vulnerabilities,
-   if Worldwide Security Community does not help to make upgrades possible.
-6. If there some day becomes available a way to upgrade all WeKan platforms,
-   this page will be updated to add permission for security researchers
-   to request new GHSA or CVE ID and publish your vulnerability details at your blog, talks, etc,
-   and send that info also to security@wekan.fi to be added to
-   Hall of Fame: https://wekan.fi/hall-of-fame/ to get Upgrade Bonus Point Stars.
-   In that case, it will become possible for security@wekan.fi to publish all
-   remaining private security details, and publicly thank Worldwide Security Community.
+### 1. Security Researcher:
 
-## Bonus Points
+- **Report**: Click "New draft security advisory" at [WeKan Security Advisories](https://github.com/wekan/wekan/security/advisories).
+  More info at [GitHub Docs about reporting privately](https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-privately).
+- **Proof of Concept (PoC)**: If possible, include a fix or a reproduction script/code.
+- DO NOT EMAIL [security@wekan.fi](security-at-wekan.fi.asc), because:
+  - Email is NOT secure or private.
+  - Using GitHub directly verifies that:
+    - You are:
+      - Saving my time by filling all details at GitHub, so that I can easily click request CVE at GitHub
+      - A correct GitHub user
+      - Really reading this SECURITY.md
+      - Knowing what you are doing
+    - You are not:
+      - Someone that tries to waste my time
+      - Trying to impersonate as some other GitHub user
+      - Spammer
+      - Bot
 
-- If you include code for fixing security issue
+### 2. WeKan Security Team:
 
-## Losing Points
+- **Remediation**: Please wait for a new WeKan release that addresses the issue.
+  Fixes are announced at the top of the [ChangeLog](https://github.com/wekan/wekan/blob/main/CHANGELOG.md).
+- **Recognition**: We will acknowledge your contribution by adding you to our
+  [Hall of Fame](https://wekan.fi/hall-of-fame/).
+- **CVE Policy**: WeKan Security requests CVE at GitHub when releasing Security Advisory.
 
-- If you ask about [bounty](CONTRIBUTING.md). There is no bounty. WeKan is NOT Big Tech. WeKan is FLOSS.
-- If you forget to include vulnerability details.
-- If you send info about security issue to somewhere else than security@wekan.fi
+### 3. Post-Release and Public Disclosure:
 
-## How should reports be formatted?
-
-```
-Name: %name
-Twitter: %twitter
-Bug type: %bugtype
-Domain: %domain
-Severity: %severity
-URL: %url
-PoC: %poc
-CVSS (optional): %cvss
-CWSS (optional): %cwss
-```
+- Advisories reported at GitHub are listed at [WeKan Security Advisories](https://github.com/wekan/wekan/security/advisories).
+- DO NOT EMAIL [security@wekan.fi](security-at-wekan.fi.asc), because:
+  - Email is NOT secure or private.
+  - Using GitHub directly verifies that:
+    - You are:
+      - Saving my time by filling all details at GitHub, so that I can easily click request CVE at GitHub
+      - A correct GitHub user
+      - Really reading this SECURITY.md
+      - Knowing what you are doing
+    - You are not:
+      - Someone that tries to waste my time
+      - Trying to impersonate as some other GitHub user
+      - Spammer
+      - Bot
 
 ## Who can participate in the program
 
 Anyone who reports a unique security issue in scope and does not disclose it to
-a third party before we have patched and updated may be upon their approval
-added to the WeKan Hall of Fame https://wekan.fi/hall-of-fame/
+a third party before we have patched, and is able to add
+"New draft security advisory" at [WeKan Security Advisories](https://github.com/wekan/wekan/security/advisories).
 
 ## Which domains are in scope?
 
-No public domains, because all those are donated to Wekan Open Source project,
+No public domains, because all those are donated to WeKan Open Source project,
 and we don't have any permissions to do security scans on those donated servers.
 
-Please don't perform research that could impact other users. Secondly, please keep
-the reports short and succinct. If we fail to understand the logics of your bug, we will tell you.
+Please don't perform research that could impact other users. Second, please keep
+the reports short and succinct. If we fail to understand the logic of your bug, we will tell you.
 
-You can [Install Wekan](https://github.com/wekan/wekan/releases) to your own computer
+You can [Install WeKan](https://wekan.fi/install/) on your own computer
 and scan it's vulnerabilities there.
 
-## About Wekan versions
+## About WeKan Versions
 
-There are only 2 versions of Wekan: Standalone Wekan, and Sandstorm Wekan.
+There are 2 versions of WeKan: Standalone WeKan, and Sandstorm WeKan.
 
-### Standalone Wekan Security
+## Meteor Security
 
-Standalone Wekan includes all non-Sandstorm platforms. Some Standalone Wekan platforms
+https://guide.meteor.com/security
+
+### Standalone WeKan Security
+
+Standalone WeKan includes all non-Sandstorm platforms. Some Standalone WeKan platforms
 like Snap and Docker have their own specific sandboxing etc features.
 
-Standalone Wekan by default does not load any files from Internet, like fonts, CSS, etc.
-This also means all Standalone Wekan functionality works in offline local networks.
-WeKan is used at most countries of the world https://snapcraft.io/wekan
-and by by companies that have 30k users.
+Standalone WeKan by default does not load any files from Internet, like fonts, CSS, etc.
+This also means all Standalone WeKan functionality works in offline local networks.
+WeKan is used in most countries of the world https://snapcraft.io/wekan
+and by companies that have 30k users.
 
-- Wekan private board attachments are not accessible without logging in.
-- There is feature to set board public, so that board is visible without logging in in readonly mode, with realtime updates.
+- WeKan private board attachments are not accessible without logging in.
+- There is feature to set board public, so that board is visible without logging
+  in readonly mode, with realtime updates.
 - Admin Panel has feature to disable all public boards, so all boards are private.
 
 ## SSL/TLS
@@ -90,24 +98,25 @@ and by by companies that have 30k users.
 
 ## XSS
 
-- Dompurify https://www.npmjs.com/package/dompurify
-  - WeKan uses dompurify npm package to filter for XSS at fields like cards, as you can see from
+- DOMPurify https://www.npmjs.com/package/dompurify
+  - WeKan uses DOMPurify npm package to filter for XSS at fields like cards, as you can see from
     [package.json](https://github.com/wekan/wekan/blob/main/package.json). Other used versions can be seen from
     [Meteor versions file](https://github.com/wekan/wekan/blob/main/.meteor/versions).
-  - Forms can include markdown links, html, image tags etc like you see at https://wekan.github.io .
+  - Forms can include markdown links, html, image tags etc like you see at https://wekan.fi .
   - It's possible to add attachments to cards, and markdown/html links to files.
-  - Dompurify cleans up viewed code, so Javascript in input fields does not execute
-    - https://wekan.github.io/hall-of-fame/fieldbleed/
+  - DOMPurify cleans up viewed code, so JavaScript in input fields does not execute
+    - https://wekan.fi/hall-of-fame/fieldbleed/
 - Reaction in comment is now checked, that it does not have extra added code
-  - https://wekan.github.io/hall-of-fame/reactionbleed/
+  - https://wekan.fi/hall-of-fame/reactionbleed/
 - https://github.com/wekan/wekan/blob/main/packages/markdown/src/template-integration.js#L76
 
-## QA about PubSub
+## QA About PubSub
 
 Q:
 
 Hello,
-I have just seen the Meteor DevTools Evolved extension and was wondering if anyone had asked themselves the question of security.
+I have just seen the Meteor DevTools Evolved extension and was wondering if anyone
+had asked themselves the question of security.
 Insofar as all data is shown in the minimongo tab in plain text.
 How can data be hidden from this extension?
 
@@ -115,32 +124,36 @@ A:
 
 ## PubSub
 
-- It is not security issue to show some text or image, that user has permission to see. It is a security issue, if browserside is some text or image that user should not see.
-- Meteor has browserside minimongo database, made with Javascript, updated with Publish/Subscribe, PubSub.
-- Publish/Subscribe means, that realtime web framework reads database changes stream, and then immediately updates webpage,
-  like like dashboards, chat, kanban. That is the point in any realtime web framework in any programming language.
-- Yes, you should check with Meteor DevTools Evolved Chromium/Firefox extension that at minimongo is only text that user has permission to see.
-- Do checking as logged in user, and logged out user.
+- It is not a security issue to show text or images that the user has permission to see.
+  It is a security issue, if browserside is some text or image that user should not see.
+- Meteor has browserside minimongo database, made with JavaScript, updated with Publish/Subscribe, PubSub.
+- Publish/Subscribe means, that realtime web framework reads database changes stream,
+  and then immediately updates webpage, like dashboards, chat, kanban.
+  That is the point of any realtime web framework in any programming language.
+- Yes, you should check with Meteor DevTools Evolved Chromium/Firefox extension that
+  at minimongo is only text that user has permission to see.
+- Check as a logged-in user and as a logged-out user.
 - Check permissions and sanitize before allowing some change, because someone could modify content of input field,
   PubSub/websocket data (for example with Burp Suite Community Edition), etc.
-- If you have REST API, also check that only those that have login token, and have permission, can view or edit text
+- If you have a REST API, also check that only those who have a login token and permission can view or edit text.
 - You should not include any data user is not allowed to see. Not to webpage text, not to websockets/PubSub, etc.
-- Minimongo should not have password hashes PubSub https://wekan.github.io/hall-of-fame/userbleed/
-- PubSub uses Websockets, so you need those to be enabled at webserver like Caddy/Nginx/Apache etc, examples of settings
+- Minimongo should not have password hashes PubSub https://wekan.fi/hall-of-fame/userbleed/
+- PubSub uses WebSockets, so you need those to be enabled on the webserver like Caddy/Nginx/Apache etc, examples of settings
   at right menu of https://github.com/wekan/wekan/wiki
-- Clientside https://github.com/wekan/wekan/tree/main/client/components subscribes to 
-  PubSub https://github.com/wekan/wekan/tree/main/server/publications or calls meteor methods at https://github.com/wekan/wekan/tree/main/models
+- Clientside https://github.com/wekan/wekan/tree/main/client/components subscribes to
+  PubSub https://github.com/wekan/wekan/tree/main/server/publications or calls meteor methods
+  at https://github.com/wekan/wekan/tree/main/models
 - For Admin:
   - You can have input field for password https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
   - You can save password to database https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
   - Check that only current user or Admin can change password https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
     - Note that currentUser uses code like Meteor.user() in .js file
-  - Do not have password hashes in PubSub https://github.com/wekan/wekan/blob/main/server/publications/users.js
+  - Do not include password hashes in PubSub https://github.com/wekan/wekan/blob/main/server/publications/users.js
   - Only show Admin Panel to Admin https://github.com/wekan/wekan/blob/main/client/components/settings/settingBody.jade#L3
-- If there is a lot of data, use pagination https://github.com/wekan/wekan/blob/main/client/components/settings/peopleBody.js
-- Only have limited amount of data published in PubSub. Limit in MongoDB query in publications how much is published. Too much could make browser too slow.
-- Use Environment variables for any email etc passwords.
-- But what if you would like to remove minimongo? And only use Meteor methods for saving? In that case, you don't have realtime updates,
+- If there is a large amount of data, use pagination https://github.com/wekan/wekan/blob/main/client/components/settings/peopleBody.js
+- Only publish a limited amount of data in PubSub. Limit in MongoDB query in publications how much is published. Too much could make browser too slow.
+- Environment variables for email and other passwords.
+- But what if you would like to remove Minimongo and only use Meteor methods for saving? In that case, you don't have realtime updates,
   and you need to write much more code to load and save data yourself, handle any multi user data saving conflicts yourself,
   and many Meteor Atmospherejs.com PubSub using packages would not work anymore https://github.com/wekan/we
 
@@ -148,14 +161,14 @@ A:
 
 - With PubSub, there is checking, that someone modifying Websockets content, like permission isAdmin, can not change to Admin.
 - https://github.com/wekan/wekan/commit/cbad4cf5943d47b916f64b4582f8ca76a9dfd743
-- https://wekan.github.io/hall-of-fame/adminbleed/
+- https://wekan.fi/hall-of-fame/adminbleed/
 
 ## Permissions and Roles
 
-- For any user permissions, it's best to use Meteor package package https://github.com/Meteor-Community-Packages/meteor-roles .
-- Currently WeKan has custom hardcoded permissions, WeKan does not yet use that meteor-roles package.
+- For any user permissions, it's best to use Meteor package https://github.com/Meteor-Community-Packages/meteor-roles .
+- Currently, WeKan has custom hardcoded permissions and does not yet use the meteor-roles package.
   - Using permissions at WeKan sidebar https://github.com/wekan/wekan/blob/main/client/components/sidebar/sidebar.js#L1854-L1875
-  - List of roles https://github.com/wekan/wekan/wiki/REST-API-Role . Change at board or Admin Panel. Also Organizations/Teams.
+  - List of roles: https://github.com/wekan/wekan/wiki/REST-API-Role . Change at board or Admin Panel. Also Organizations/Teams.
   - Worker role: https://github.com/wekan/wekan/issues/2788
   - Not implemented yet: Granular Roles https://github.com/wekan/wekan/issues/3022
 - Check is user logged in, with `if (Meteor.user()) {`
@@ -164,8 +177,8 @@ A:
 
 ## Environment variables
 
-- For any passwords, use environment variables, those are serverside
-- Do not copy environment variable to public variable that is visible browserside https://github.com/wekan/wekan/blob/main/server/max-size.js
+- For any passwords, use environment variables; those are serverside
+- Do not copy environment variables to public variables that are visible on the browserside https://github.com/wekan/wekan/blob/main/server/max-size.js
 
 ```
 Meteor.startup(() => {
@@ -176,20 +189,20 @@ Meteor.startup(() => {
 ```
 
 - For serverside, you can set Meteor.settings.variablename, without text public
-- For WeKan kanban, there is feature for setting board public, it can be viewed by anyone, there is realtime updates. But 
+- For WeKan kanban, there is a feature for setting a board to public; it can be viewed by anyone, with realtime updates. But
 - Some of those permissions are checked at users.js models at https://github.com/wekan/wekan/tree/main/models
 - Environment variables are used for email server passwords, etc, at all platforms https://github.com/wekan/wekan/commit/a781c0e7dcfdbe34c1483ee83cec12455b7026f7
 
 ## Escape HTML comment tags so that HTML comments are visible
 
-- Someone reported, that it is problem that content of HTML comments in edit mode, are not visible at at view mode, so this makes HTML comments visible.
+- Someone reported that it was a problem that the content of HTML comments in edit mode was not visible in view mode, so this change makes HTML comments visible.
 - https://github.com/wekan/wekan/commit/167863d95711249e69bb3511175d73b34acbbdb3
-- https://wekan.github.io/hall-of-fame/invisiblebleed/
+- https://wekan.fi/hall-of-fame/invisiblebleed/
 
 ## Attachments: XSS in filename is sanitized
 
 - https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
-- https://wekan.github.io/hall-of-fame/filebleed/
+- https://wekan.fi/hall-of-fame/filebleed/
 
 ### Attachments: Forced download to prevent stored XSS
 
@@ -247,22 +260,20 @@ Meteor.startup(() => {
 - https://github.com/wekan/wekan/commit/23e5e1e3bd081699ce39ce5887db7e612616014d
 - https://github.com/wekan/wekan/tree/main/packages/wekan-accounts-lockout
 
-### Sandstorm Wekan Security
+### Sandstorm WeKan Security
 
-On Sandstorm platform using environment variable Standalone Wekan features like Admin Panel etc are
-turned off, because Sandstorm platform provides SSO for all apps running on Sandstorm. 
+On the Sandstorm platform, Standalone WeKan features like the Admin Panel are turned off using environment variables, because Sandstorm platform provides SSO for all apps running on Sandstorm.
 
-[Sandstorm](https://sandstorm.io) is separate Open Source platform that has been
+[Sandstorm](https://sandstorm.io) is a separate Open Source platform that has been
 [security audited](https://sandstorm.io/news/2017-03-02-security-review) and found bugs fixed.
-Sandstorm also has passwordless login, LDAP, SAML, Google etc auth options already.
-At Sandstorm code is read-only and signed by app maintainers, only grain content can be modified.
-Wekan at Sandstorm runs in sandboxed grain, it does not have access elsewhere without user-visible
-PowerBox request or opening randomly-generated API key URL.
+Sandstorm also has passwordless login, LDAP, SAML, Google, and other auth options already.
+On Sandstorm, code is read-only and signed by app maintainers; only grain content can be modified.
+WeKan on Sandstorm runs in a sandboxed grain; it does not have access elsewhere without a user-visible PowerBox request or opening a randomly-generated API key URL.
 Also read [Sandstorm Security Practices](https://docs.sandstorm.io/en/latest/using/security-practices/) and
 [Sandstorm Security non-events](https://docs.sandstorm.io/en/latest/using/security-non-events/).
-For Sandstorm specific security issues you can contact [kentonv](https://github.com/kentonv) by email. 
+For Sandstorm specific security issues you can contact [kentonv](https://github.com/kentonv) by email.
 
-## What Wekan bugs are eligible?
+## What WeKan bugs are eligible?
 
 Any typical web security bugs. If any of the previously mentioned is somehow problematic and
 a security issue, we'd like to know about it, and also how to fix it:
@@ -274,18 +285,12 @@ a security issue, we'd like to know about it, and also how to fix it:
 - Authentication bypass
 - Server-side code execution
 
-## What Wekan bugs are NOT eligible?
+## What WeKan bugs are NOT eligible?
 
-Typical already known or "no impact" bugs such as:
+Typical already-known or 'no impact' bugs such as:
 
-- [Wekan API old tokens not replaced correctly](https://github.com/wekan/wekan/issues/1437)
-- Missing Cookie flags on non-session cookies or 3rd party cookies
-- Logout CSRF
 - Social engineering
 - Denial of service
-- SSL BEAST/CRIME/etc. Wekan does not have SSL built-in, it uses Caddy/Nginx/Apache etc at front.
-  Integrated Caddy support is updated often.
-- Email spoofing, SPF, DMARC & DKIM. Wekan does not include email server.
+- SSL BEAST/CRIME/etc. WeKan does not have SSL built-in; it uses Caddy/Nginx/Apache on the front end.
 
-Wekan is Open Source with MIT license, and free to use also for commercial use.
-We welcome all fixes to improve security by email to security@wekan.fi
+WeKan is Open Source with MIT license, and free to use also for commercial use.

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v8.78.0"
+appVersion: "v11.02.0"
 files:
   userUploads:
     - README.md

client/00-startup.js

@@ -1,7 +1,58 @@
-// PWA
+// Fix dynamic-import chunk loading when Wekan runs under a sub-path (ROOT_URL includes a pathname,
+// e.g. https://example.com/wekan). Rspack's runtime builds every chunk URL as
+// __webpack_public_path__ + chunkName, and the chunk name ALREADY includes the "build-chunks/"
+// prefix (its runtime does `u = e => "build-chunks/" + e + "." + hash + ".js"`). The default
+// public path is "/", so at the site root chunks correctly resolve to "/build-chunks/<chunk>".
+// Under a sub-path we must prefix that sub-path — but must NOT re-add "build-chunks/" ourselves,
+// or the URL becomes "/wekan/build-chunks/build-chunks/<chunk>" and 404s (issue #6445, which broke
+// the lazy-loaded language chunks). So set the public path to "<sub-path>/" and let rspack append
+// "build-chunks/" itself. Done here at module evaluation time, before any import() expression runs
+// (those are deferred to Meteor.startup callbacks).
+/* global __webpack_public_path__:writable */
+try {
+  const _cfg = typeof window !== 'undefined' && window.__meteor_runtime_config__;
+  const _rootUrl = _cfg && _cfg.ROOT_URL;
+  if (_rootUrl) {
+    const _rootPath = new URL(_rootUrl).pathname.replace(/\/+$/, '');
+    if (_rootPath && _rootPath !== '/') {
+      __webpack_public_path__ = _rootPath + '/';
+    }
+  }
+} catch (_) {}
+
+// Expose Meteor on window. Under the Meteor 3.5 + rspack build, bare `Meteor`
+// references in app code are rewritten by rspack's ProvidePlugin into per-module
+// imports, so `Meteor` is NOT placed on the browser `window` the way the classic
+// Meteor linker did. Re-expose it so the browser console and the Playwright e2e
+// tests (which call Meteor.loginWithToken / Meteor.userId / Meteor.subscribe etc.
+// via page.evaluate in window scope) can reach it. This matches the long-standing
+// classic-Meteor behaviour where `Meteor` is a global.
+if (typeof window !== 'undefined') {
+  window.Meteor = Meteor;
+}
+
+// Fix bug in jam:offline 0.4.1: s?.message.includes() crashes when s.message is
+// undefined (e.g. during WebSocket reconnect errors that don't carry a .message).
+// Wrap _debug so the optional chain is complete: s?.message?.includes().
+(function patchJamOfflineDebug() {
+  const patched = Meteor._debug;
+  Meteor._debug = function (m, s) {
+    try {
+      return patched.call(this, m, s);
+    } catch (e) {
+      // jam:offline's override threw — fall back to the bare console log.
+      if (typeof console !== 'undefined') {
+        console.log(m, s);
+      }
+    }
+  };
+})();
+
+// PWA — use Meteor.absoluteUrl so the path is correct under sub-URL deployments
 if ('serviceWorker' in navigator) {
   window.addEventListener('load', function() {
-    navigator.serviceWorker.register('/pwa-service-worker.js');
+    const swPath = new URL('pwa-service-worker.js', Meteor.absoluteUrl()).pathname;
+    navigator.serviceWorker.register(swPath);
   });
 }
 
@@ -17,8 +68,6 @@ import { Utils } from '/client/lib/utils';
 // import '/client/lib/attachmentMigrationManager';
 // import '/client/components/settings/migrationProgress';
 
-// Import cron settings - COMMENTED OUT
-// import '/client/components/settings/cronSettings';
 // Custom head tags
 
 // Mirror Meteor login token into a cookie for server-side file route auth
@@ -26,6 +75,22 @@ import { Utils } from '/client/lib/utils';
 // Token already lives in localStorage; cookie adds same-origin send-on-request semantics
 Meteor.startup(() => {
   const COOKIE_NAME = 'meteor_login_token';
+  const USER_ID_COOKIE = 'meteor_user_id';
+  const TOKEN_EXPIRES_COOKIE = 'meteor_login_token_expires';
+
+  const getCookie = (name) => {
+    try {
+      const parts = document.cookie ? document.cookie.split(';') : [];
+      for (const part of parts) {
+        const [k, ...rest] = part.trim().split('=');
+        if (decodeURIComponent(k) === name) {
+          return decodeURIComponent(rest.join('='));
+        }
+      }
+    } catch (_) {}
+    return '';
+  };
+
   const cookieAttrs = () => {
     const attrs = ['Path=/', 'SameSite=Lax'];
     try {
@@ -53,6 +118,37 @@ Meteor.startup(() => {
     }
   };
 
+  const bootstrapTokenFromCookie = () => {
+    try {
+      const currentToken = Accounts && typeof Accounts._storedLoginToken === 'function'
+        ? Accounts._storedLoginToken()
+        : null;
+      if (currentToken) {
+        return;
+      }
+
+      const token = getCookie(COOKIE_NAME);
+      const userId = getCookie(USER_ID_COOKIE);
+      const tokenExpiresRaw = getCookie(TOKEN_EXPIRES_COOKIE);
+      const tokenExpires = tokenExpiresRaw ? new Date(tokenExpiresRaw) : null;
+
+      if (!token || !userId || !tokenExpires || Number.isNaN(tokenExpires.getTime())) {
+        return;
+      }
+
+      if (Accounts && typeof Accounts._storeLoginToken === 'function') {
+        Accounts._storeLoginToken(userId, token, tokenExpires);
+        if (Meteor.status && !Meteor.status().connected && typeof Meteor.reconnect === 'function') {
+          Meteor.reconnect();
+        }
+      }
+    } catch (_) {
+      // ignore
+    }
+  };
+
+  bootstrapTokenFromCookie();
+
   // Initial sync on startup
   syncCookie();
 
@@ -73,7 +169,6 @@ Meteor.startup(() => {
 Meteor.startup(() => {
   Tracker.autorun(() => {
     if (Meteor.userId()) {
-      Meteor.subscribe('userGreyIcons');
       Meteor.subscribe('userDesktopDragHandles');
     }
   });

client/components/activities/activities.css

@@ -1,16 +1,22 @@
+/* The board sidebar's Activities heading. It is the section's own control now -
+   a caret, the icon and the name, clicked to show the activities under it - so
+   it is a row of three things beside each other rather than a heading with a
+   toggle pushed to the far end. client/components/sidebar/sidebar.jade */
 .activity-title {
-  margin: 0 0.7vw 1vh;
+  margin: 0 10px 9px;
   display: flex;
-  justify-content: space-between;
+  align-items: center;
+  gap: 0.4em;
+  cursor: pointer;
 }
 .reactions-popup .add-comment-reaction {
   display: inline-block;
   cursor: pointer;
-  border-radius: 0.7vw;
-  font-size: clamp(18px, 4vw, 22px);
+  border-radius: 10px;
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1));
   text-align: center;
   line-height: 1.3;
-  width: 5vw;
+  width: 70px;
 }
 .reactions-popup .add-comment-reaction:hover {
   background-color: #b0c4de;
@@ -19,13 +25,13 @@
   clear: both;
 }
 .activities .activity {
-  margin: 0.1vh 0;
-  padding: 0.8vh 0;
+  margin: 1px 0;
+  padding: 7px 0;
   display: flex;
 }
 .activities .activity .member {
-  width: 4vw;
-  height: 4vw;
+  width: 56px;
+  height: 56px;
 }
 .activities .activity .activity-member {
   font-weight: 700;
@@ -36,18 +42,18 @@
   flex: 1;
   align-self: center;
   margin: 0;
-  margin-left: 0.4vw;
+  margin-inline-start: 6px;
   overflow: hidden;
   word-break: break-word;
 }
 .activities .activity .activity-desc .activity-comment {
   display: block;
-  border-radius: 0.4vw;
+  border-radius: 6px;
   background: #fff;
   text-decoration: none;
-  box-shadow: 0 0.2vh 0.3vh rgba(0,0,0,0.2);
-  margin-top: 0.7vh;
-  padding: 0.7vh 0.7vw;
+  box-shadow: 0 2px 3px rgba(0,0,0,0.2);
+  margin-top: 6px;
+  padding: 6px 10px;
 }
 .activities .activity .activity-desc .activity-checklist {
   display: block;

client/components/activities/activities.jade

@@ -106,10 +106,10 @@ template(name="activity")
 
       //- comment activity ----------------------------------------------------
       if($eq activity.activityType 'deleteComment')
-        | {{{_ 'activity-deleteComment' activity.commentId}}}.
+        | {{{_ 'activity-deleteComment' (sanitize activity.commentDisplayText)}}}.
 
       if($eq activity.activityType 'editComment')
-        | {{{_ 'activity-editComment' activity.commentId}}}.
+        | {{{_ 'activity-editComment' (sanitize activity.commentDisplayText)}}}.
 
       if($eq activity.activityType 'addComment')
         | {{{_ 'activity-on' cardLink}}}
@@ -130,6 +130,12 @@ template(name="activity")
       if($eq activity.activityType 'a-endAt')
         | {{{_ 'activity-endDate' (sanitize endDate) cardLink}}}.
 
+      if($eq activity.activityType 'a-changedTitle')
+        | {{{_ 'activity-changedTitle' (sanitize activity.value) cardLink}}}.
+
+      if($eq activity.activityType 'a-changedDescription')
+        | {{{_ 'activity-changedDescription' cardLink}}}.
+
       //- customField activity ------------------------------------------------
       if($eq activity.activityType 'createCustomField')
         | {{_ 'activity-customfield-created' customField}}.

client/components/activities/activities.js

@@ -6,8 +6,14 @@ import { sanitizeHTML, sanitizeText } from '/imports/lib/secureDOMPurify';
 import { TAPi18n } from '/imports/i18n';
 import { Utils } from '/client/lib/utils';
 import { getSidebarInstance } from '/client/features/sidebar/service';
+import { activityCardLinkData } from '/models/lib/activityCardLink';
 
-const activitiesPerPage = 500;
+// #6480/#6481: 500 was far more than the sidebar/card activity feed ever shows
+// at once, and with FerretDB (no oplog) every live cursor is re-run on a timer —
+// so a 500-row activities cursor was re-fetched and re-diffed on every poll for
+// each open board/card. 50 covers the visible feed; infinite scroll still pulls
+// the next page on demand (the server cursor is index-bounded either way).
+const activitiesPerPage = 50;
 
 Template.activities.onCreated(function () {
   // Register with sidebar so it can call loadNextPage on us
@@ -69,6 +75,12 @@ Template.activities.onCreated(function () {
 });
 
 function _showActivities(data) {
+  // Instance-wide switch (Admin Panel / Settings / Hide board activities on all
+  // boards). Read ONCE from the global settings; when it is on, no board shows
+  // its activities and the per-board value is not consulted at all.
+  if (ReactiveCache.getCurrentSetting()?.hideBoardActivitiesOnAllBoards) {
+    return false;
+  }
   let ret = false;
   let mode = data?.mode;
   if (mode) {
@@ -76,9 +88,20 @@ function _showActivities(data) {
       const currentCard = Utils.getCurrentCard();
       ret = currentCard.showActivities ?? false;
     } else if (mode === 'card') {
-      // For card mode, get showActivities from data context or fallback to current card
+      // The card's Activities section is COLLAPSED by default and renders this
+      // template only when its caret has been opened - so being here means the
+      // reader asked for the history, and the history is what they get.
+      //
+      // Until the section had a caret, the card carried a `showActivities` flag
+      // toggled by an eye beside the heading, and `false` - the default -
+      // subscribed to comments ONLY (server/publications/activities.js). The eye
+      // is gone: one control for one idea. Nothing is fetched at all while the
+      // section is closed, which is the cheaper half of what the flag was for,
+      // and opening it now means the whole history rather than a filtered part
+      // of it. `card.showActivities` still overrides when it was explicitly set
+      // to false, so a card somebody had set that way keeps its setting.
       const card = data?.card || Utils.getCurrentCard();
-      ret = card?.showActivities ?? false;
+      ret = card?.showActivities ?? true;
     } else {
       ret = Utils.getCurrentBoard().showActivities ?? false;
     }
@@ -139,23 +162,23 @@ Template.activity.helpers({
       return TAPi18n.__('this-card');
     }
     else if (this.mode !== 'board') {
-      return createCardLink(this.activity.card(), null);
+      return createCardLink(this.activity, this.activity.card(), null);
     }
     else if (currentBoardId != this.activity.boardId) {
-      return createCardLink(this.activity.card(), this.activity.board().title);
+      return createCardLink(this.activity, this.activity.card(), this.activity.board().title);
     }
-    return createCardLink(this.activity.card(), null);
+    return createCardLink(this.activity, this.activity.card(), null);
   },
 
   cardLink() {
     const currentBoardId = Session.get('currentBoard');
     if (this.mode !== 'board') {
-      return createCardLink(this.activity.card(), null);
+      return createCardLink(this.activity, this.activity.card(), null);
     }
     else if (currentBoardId != this.activity.boardId) {
-      return createCardLink(this.activity.card(), this.activity.board().title);
+      return createCardLink(this.activity, this.activity.card(), this.activity.board().title);
     }
-    return createCardLink(this.activity.card(), null);
+    return createCardLink(this.activity, this.activity.card(), null);
   },
 
   receivedDate() {
@@ -234,7 +257,13 @@ Template.activity.helpers({
   sourceLink() {
     const source = this.activity.source;
     if (source) {
-      if (source.url) {
+      // XSS fix (reported by meifukun): source.url is imported from an external
+      // board (e.g. a Trello board's `url`) and was rendered as an <a href> with
+      // no scheme check, so a `javascript:` (or data:/vbscript:) URL executed in
+      // the board admin's session on click and could exfiltrate Meteor.loginToken.
+      // Only render a link for an http(s) URL; otherwise show the plain (sanitized)
+      // source name with no href.
+      if (source.url && /^https?:\/\//i.test(String(source.url))) {
         return Blaze.toHTML(
           HTML.A(
             {
@@ -243,9 +272,8 @@ Template.activity.helpers({
             sanitizeHTML(source.system),
           ),
         );
-      } else {
-        return sanitizeHTML(source.system);
       }
+      return sanitizeHTML(source.system);
     }
     return null;
   },
@@ -258,14 +286,18 @@ Template.activity.helpers({
 
   attachmentLink() {
     const attachment = this.activity.attachment();
+    const attachmentUrl = attachment && typeof attachment.link === 'function'
+      ? attachment.link()
+      : '';
     // trying to display url before file is stored generates js errors
     return (
       (attachment &&
         attachment.path &&
+        attachmentUrl &&
         Blaze.toHTML(
           HTML.A(
             {
-              href: `${attachment.link()}?download=true`,
+              href: `${attachmentUrl}?download=true`,
               target: '_blank',
             },
             sanitizeText(attachment.name),
@@ -290,7 +322,8 @@ Template.activity.helpers({
 
 Template.commentReactions.events({
   'click .reaction'(event) {
-    if (ReactiveCache.getCurrentUser().isBoardMember()) {
+    const user = ReactiveCache.getCurrentUser();
+    if (user && user.isBoardMember()) {
       const codepoint = event.currentTarget.dataset['codepoint'];
       const commentId = Template.instance().data.commentId;
       const cardComment = ReactiveCache.getCardComment(commentId);
@@ -302,7 +335,8 @@ Template.commentReactions.events({
 
 Template.addReactionPopup.events({
   'click .add-comment-reaction'(event) {
-    if (ReactiveCache.getCurrentUser().isBoardMember()) {
+    const user = ReactiveCache.getCurrentUser();
+    if (user && user.isBoardMember()) {
       const codepoint = event.currentTarget.dataset['codepoint'];
       const commentId = Template.instance().data.commentId;
       const cardComment = ReactiveCache.getCardComment(commentId);
@@ -343,21 +377,36 @@ Template.commentReactions.helpers({
   }
 })
 
-function createCardLink(card, board) {
-  if (!card) return '';
-  let text = card.title;
-  if (board) text = `${board} > ` + text;
-  return (
-    card &&
-    Blaze.toHTML(
-      HTML.A(
-        {
-          href: card.originRelativeUrl(),
-          class: 'action-card',
-        },
-        sanitizeHTML(text),
-      ),
-    )
+// #3144: the card is not always here. An ARCHIVED card is not published to the
+// client, so `activity.card()` returned nothing and every sentence that named it
+// was rendered around a hole - "Activities for archived card displayed as
+// undefined on board settings".
+//
+// The activity itself recorded the title in most cases (`cardTitle`), and a card
+// URL can be built from the ids it carries, so the link survives the card not
+// being here. models/lib/activityCardLink.js decides what to show;
+// this turns it into the anchor, and marks an archived card the way the reporter
+// asked for: "{{ card title }} [archived]".
+function createCardLink(activity, card, boardTitle) {
+  const link = activityCardLinkData(activity, card, card ? card.board && card.board() : null);
+  if (!link) {
+    // Nothing named the card - an old activity from before the titles were
+    // recorded, on a card this client cannot see. Say "this card" rather than
+    // leaving a gap in the middle of a sentence.
+    return sanitizeHTML(TAPi18n.__('this-card'));
+  }
+  let text = link.title;
+  if (link.archived) text = `${text} [${TAPi18n.__('archived')}]`;
+  if (boardTitle) text = `${boardTitle} > ` + text;
+  if (!link.url) return sanitizeHTML(text);
+  return Blaze.toHTML(
+    HTML.A(
+      {
+        href: link.url,
+        class: 'action-card',
+      },
+      sanitizeHTML(text),
+    ),
   );
 }
 

client/components/activities/comments.css

@@ -6,7 +6,7 @@
   opacity: 0.7;
   position: absolute;
   top: 1px;
-  left: -38px;
+  inset-inline-start: -38px;
 }
 .new-comment.is-open .member {
   opacity: 1;
@@ -84,7 +84,7 @@
   flex: 1;
   align-self: center;
   margin: 0;
-  margin-left: 3px;
+  margin-inline-start: 3px;
   overflow: hidden;
   word-break: break-word;
 }
@@ -110,10 +110,10 @@
 }
 .comments .comment .comment-desc .reactions .open-comment-reaction-popup span {
   display: inline-block;
-  font-size: clamp(14px, 2vw, 18px);
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1));
   font-weight: 500;
   line-height: 1;
-  margin-left: 4px;
+  margin-inline-start: 4px;
 }
 .comments .comment .comment-desc .reactions .reaction {
   cursor: pointer;
@@ -129,9 +129,55 @@
   background-color: #b0c4de;
 }
 .comments .comment .comment-desc .reactions .reaction .reaction-count {
-  font-size: 12px;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1));
 }
 .comments .comment .comment-desc .comment-meta {
   font-size: 0.8em;
   color: #999;
 }
+/* Threaded replies (issue #5907): indent replies under their parent. */
+.comments .comment.is-reply {
+  margin-inline-start: 24px;
+  border-inline-start: 2px solid #e0e0e0;
+  padding-inline-start: 8px;
+}
+.comments .comment .comment-desc .comment-in-reply-to {
+  font-size: 0.8em;
+  color: #999;
+  border-inline-start: 2px solid #ccc;
+  padding-inline-start: 6px;
+  margin: 3px 0;
+  display: block;
+}
+.comments .comment .comment-desc .comment-in-reply-to .comment-in-reply-to-label {
+  font-weight: 700;
+  margin-inline-end: 4px;
+}
+.comments .comment .comment-desc .comment-in-reply-to .comment-in-reply-to-text {
+  font-style: italic;
+}
+/* "In reply to" banner above the new-comment form. */
+.new-comment .comment-reply-banner {
+  background: #f4f4f4;
+  border-inline-start: 2px solid #ccc;
+  padding: 4px 6px;
+  margin: 0 4px 6px 0;
+  font-size: 0.85em;
+  color: #666;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+}
+.new-comment .comment-reply-banner .comment-reply-banner-label {
+  font-weight: 700;
+}
+.new-comment .comment-reply-banner .comment-reply-banner-text {
+  flex: 1;
+  font-style: italic;
+  overflow: hidden;
+  white-space: nowrap;
+  text-overflow: ellipsis;
+}
+.new-comment .comment-reply-banner a {
+  cursor: pointer;
+}

client/components/activities/comments.jade

@@ -2,6 +2,14 @@ template(name="commentForm")
   .new-comment.js-new-comment(
     class="{{#if commentFormIsOpen}}is-open{{/if}}")
     +userAvatar(userId=currentUser._id noRemove=true)
+    if replyToComment
+      .comment-reply-banner.js-reply-banner
+        span.comment-reply-banner-label {{_ 'comment-in-reply-to'}}:
+        span.comment-reply-banner-text
+          +viewer
+            = replyToComment.text
+        a.js-cancel-reply(title="{{_ 'close' }}")
+          i.fa.fa-times-thin
     form.js-new-comment-form
       +editor(class="js-new-comment-input")
         | {{getUnsavedValue 'cardComment' currentCard._id}}
@@ -14,12 +22,19 @@ template(name="comments")
       +comment(commentData)
 
 template(name="comment")
-  .comment
+  .comment(class="{{#if parentId}}is-reply{{/if}}")
     +userAvatar(userId=userId)
     p.comment-desc
       span.comment-member
         +memberName(user=user)
 
+      if parentComment
+        .comment-in-reply-to
+          span.comment-in-reply-to-label {{_ 'comment-in-reply-to'}}:
+          span.comment-in-reply-to-text
+            +viewer
+              = parentComment.text
+
       +inlinedForm(classNames='js-edit-comment')
         +editor(autofocus=true)
           = text
@@ -33,9 +48,10 @@ template(name="comment")
             = text
         +commentReactions(reactions=reactions commentId=_id)
         span(title=createdAt).comment-meta {{ displayDate createdAt }}
-          if($eq currentUser._id userId)
-            +editOrDeleteComment
-          else if currentUser.isBoardAdmin
+          if currentUser.isBoardMember
+            = ' - '
+            a.js-reply-comment {{_ "comment-reply"}}
+          if canEditThisComment
             +editOrDeleteComment
 
 template(name="editOrDeleteComment")
@@ -58,8 +74,8 @@ template(name="commentReactions")
       unless currentUser.isReadOnly
         unless currentUser.isReadAssignedOnly
           a.open-comment-reaction-popup(title="{{_ 'addReactionPopup-title'}}")
-            span(title="{{_ 'reaction' }}") 😀
-            span(title="{{_ 'add' }}") ➕
+            i.fa.fa-smile-o(title="{{_ 'reaction' }}")
+            i.fa.fa-plus(title="{{_ 'add' }}")
 
 template(name="addReactionPopup")
   .reactions-popup

client/components/activities/comments.js

@@ -1,13 +1,70 @@
 import { ReactiveCache } from '/imports/reactiveCache';
-import CardComments from '/models/cardComments';
+import CardComments, { canEditComment } from '/models/cardComments';
 import { UnsavedEdits } from '/client/lib/unsavedEdits';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { Utils } from '/client/lib/utils';
 import autosize from 'autosize';
 
 const commentFormIsOpen = new ReactiveVar(false);
+// _id of the comment currently being replied to (threaded replies, issue #5907).
+// Empty string means a new top-level comment.
+const replyToCommentId = new ReactiveVar('');
+
+// #5547: persist the comment draft (debounced) into UnsavedEdits while the user
+// types, so a comment in progress survives closing the card, clicking outside
+// it, or navigating away — the form prefills from {{getUnsavedValue
+// 'cardComment' ...}} on the next open. Historical note: the click-open flag
+// that armed the old escape-time draft save was removed in 2019 (3b3950369)
+// because the escape handler CLEARED the visible text; since then nothing saved
+// the draft at all, so any close of the card discarded the comment.
+let commentDraftTimer = null;
+let commentDraftPending = null; // { cardId, value }
+
+function commentDraftWrite({ cardId, value }) {
+  if (!cardId) return;
+  const draftKey = { fieldName: 'cardComment', docId: cardId };
+  if ((value || '').trim()) {
+    UnsavedEdits.set(draftKey, value);
+  } else {
+    UnsavedEdits.reset(draftKey);
+  }
+}
+
+function scheduleCommentDraftSave(cardId, value) {
+  commentDraftPending = { cardId, value };
+  if (commentDraftTimer) clearTimeout(commentDraftTimer);
+  commentDraftTimer = setTimeout(() => {
+    commentDraftTimer = null;
+    const pending = commentDraftPending;
+    commentDraftPending = null;
+    if (pending) commentDraftWrite(pending);
+  }, 300);
+}
+
+// Run a pending (debounced) save immediately — e.g. the card is closing.
+function flushCommentDraftSave() {
+  if (commentDraftTimer) {
+    clearTimeout(commentDraftTimer);
+    commentDraftTimer = null;
+  }
+  const pending = commentDraftPending;
+  commentDraftPending = null;
+  if (pending) commentDraftWrite(pending);
+}
+
+// Drop any pending save — the comment was submitted, so there is no draft.
+function cancelCommentDraftSave() {
+  if (commentDraftTimer) {
+    clearTimeout(commentDraftTimer);
+    commentDraftTimer = null;
+  }
+  commentDraftPending = null;
+}
 
 Template.commentForm.onDestroyed(function () {
+  // #5547: the card can close without the escape handler ever running (the X
+  // button, a route change); make sure the last keystrokes reach the draft.
+  flushCommentDraftSave();
   commentFormIsOpen.set(false);
   $('.note-popover').hide();
 });
@@ -16,9 +73,24 @@ Template.commentForm.helpers({
   commentFormIsOpen() {
     return commentFormIsOpen.get();
   },
+  // The comment being replied to, if any, so the form can show an
+  // "In reply to ..." banner with a way to cancel.
+  replyToComment() {
+    const id = replyToCommentId.get();
+    return id ? ReactiveCache.getCardComment(id) : undefined;
+  },
 });
 
 Template.commentForm.events({
+  // #5547: arm the escape handler below (it saves the draft and closes the
+  // form); this flag had no setter since 2019, so the handler never ran.
+  'focus .js-new-comment-input'() {
+    commentFormIsOpen.set(true);
+  },
+  // #5547: keep the draft continuously saved (debounced) while typing.
+  'input .js-new-comment-input'(evt) {
+    scheduleCommentDraftSave(Utils.getCurrentCardId(), evt.currentTarget.value);
+  },
   'submit .js-new-comment-form'(evt, tpl) {
     const input = tpl.$('.js-new-comment-input');
     const text = input.val().trim();
@@ -32,11 +104,21 @@ Template.commentForm.events({
       boardId = card.linkedId;
     }
     if (text) {
+      const parentId = replyToCommentId.get();
       CardComments.insert({
         text,
         boardId,
         cardId,
+        parentId: parentId || '',
       });
+      // #5547: the comment is saved — cancel any debounced draft save still in
+      // flight and remove the stored draft so it does not resurface next open.
+      cancelCommentDraftSave();
+      UnsavedEdits.reset({
+        fieldName: 'cardComment',
+        docId: Utils.getCurrentCardId(),
+      });
+      replyToCommentId.set('');
       resetCommentInput(input);
       Tracker.flush();
       autosize.update(input);
@@ -44,6 +126,10 @@ Template.commentForm.events({
     }
     evt.preventDefault();
   },
+  'click .js-cancel-reply'(evt) {
+    evt.preventDefault();
+    replyToCommentId.set('');
+  },
   // Pressing Ctrl+Enter should submit the form
   'keydown form textarea'(evt, tpl) {
     if (evt.keyCode === 13 && (evt.metaKey || evt.ctrlKey)) {
@@ -60,17 +146,52 @@ Template.comments.helpers({
   },
 });
 
+Template.comment.helpers({
+  // Whether the current user may edit/delete this comment, honouring the
+  // board's restrictCommentEditing setting (issue #5906). Mirrors the
+  // server-side enforcement so the UI hides buttons the server would reject.
+  canEditThisComment() {
+    const user = ReactiveCache.getCurrentUser();
+    if (!user) return false;
+    const isAuthor = user._id === this.userId;
+    const board = ReactiveCache.getBoard(this.boardId);
+    const isBoardAdmin = !!board && board.hasAdmin(user._id);
+    const restrictCommentEditing = !!board && !!board.restrictCommentEditing;
+    return canEditComment({ isAuthor, isBoardAdmin, restrictCommentEditing });
+  },
+  // The parent comment this one replies to, or undefined.
+  parentComment() {
+    return this.parentId ? ReactiveCache.getCardComment(this.parentId) : undefined;
+  },
+});
+
 Template.comment.events({
+  'click .js-reply-comment'(evt) {
+    evt.preventDefault();
+    replyToCommentId.set(this._id);
+    // Open and focus the new-comment form.
+    const input = $('.js-new-comment-input');
+    input.click();
+    Tracker.afterFlush(() => {
+      $('.js-new-comment-input').focus();
+    });
+  },
   'click .js-delete-comment': Popup.afterConfirm('deleteComment', function () {
     const commentId = this._id;
-    CardComments.remove(commentId);
+    // #3252: only remove if the doc is still in the local cache. Under heavy
+    // archive/delete churn the comment can already be evicted from Minimongo,
+    // and CardComments.remove() of a missing _id throws "Removed nonexistent
+    // document" on the client.
+    if (commentId && CardComments.findOne(commentId)) {
+      CardComments.remove(commentId);
+    }
     Popup.back();
   }),
   'submit .js-edit-comment'(evt, tpl) {
     evt.preventDefault();
     const textarea = tpl.find('.js-edit-comment textarea,input[type=text]');
     const commentText = textarea && textarea.value ? textarea.value.trim() : '';
-    const commentId = this._id;
+    const commentId = tpl.data._id;
     if (commentText) {
       CardComments.update(commentId, {
         $set: {
@@ -108,13 +229,20 @@ EscapeActions.register(
       docId: Utils.getCurrentCardId(),
     };
     const commentInput = $('.js-new-comment-input');
-    const draft = commentInput.val().trim();
+    const draft = (commentInput.val() || '').trim();
+    cancelCommentDraftSave();
     if (draft) {
       UnsavedEdits.set(draftKey, draft);
     } else {
       UnsavedEdits.reset(draftKey);
     }
-    resetCommentInput(commentInput);
+    // #5547: do NOT clear the input — clearing it on every click outside the
+    // comment box is exactly the "comment text disappearing" bug that got this
+    // handler disarmed in 2019 (3b3950369). The draft is saved above; if the
+    // card stays open, the text stays visible; if the card closes, the next
+    // open prefills the form from the draft.
+    commentInput.blur();
+    commentFormIsOpen.set(false);
   },
   () => {
     return commentFormIsOpen.get();

client/components/boardConversionProgress.css

@@ -2,7 +2,7 @@
 .board-conversion-overlay {
   position: fixed;
   top: 0;
-  left: 0;
+  inset-inline-start: 0;
   width: 100%;
   height: 100%;
   background-color: rgba(0, 0, 0, 0.7);
@@ -47,19 +47,19 @@
 .board-conversion-header h3 {
   margin: 0 0 8px 0;
   color: #333;
-  font-size: 20px;
+  font-size: calc(20px * var(--wekan-ui-font-scale, 1));
   font-weight: 500;
 }
 
 .board-conversion-header h3 i {
-  margin-right: 8px;
+  margin-inline-end: 8px;
   color: #2196F3;
 }
 
 .board-conversion-header p {
   margin: 0;
   color: #666;
-  font-size: 14px;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1));
 }
 
 .board-conversion-content {
@@ -91,8 +91,8 @@
   content: '';
   position: absolute;
   top: 0;
-  left: 0;
-  right: 0;
+  inset-inline-start: 0;
+  inset-inline-end: 0;
   bottom: 0;
   background: linear-gradient(
     90deg,
@@ -116,25 +116,25 @@
   text-align: center;
   font-weight: 600;
   color: #2196F3;
-  font-size: 16px;
+  font-size: calc(16px * var(--wekan-ui-font-scale, 1));
 }
 
 .conversion-status {
   text-align: center;
   margin-bottom: 16px;
   color: #333;
-  font-size: 16px;
+  font-size: calc(16px * var(--wekan-ui-font-scale, 1));
 }
 
 .conversion-status i {
-  margin-right: 8px;
+  margin-inline-end: 8px;
   color: #2196F3;
 }
 
 .conversion-time {
   text-align: center;
   color: #666;
-  font-size: 14px;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1));
   background-color: #f5f5f5;
   padding: 8px 12px;
   border-radius: 4px;
@@ -142,7 +142,7 @@
 }
 
 .conversion-time i {
-  margin-right: 6px;
+  margin-inline-end: 6px;
   color: #FF9800;
 }
 
@@ -155,12 +155,12 @@
 .conversion-info {
   text-align: center;
   color: #666;
-  font-size: 13px;
+  font-size: calc(13px * var(--wekan-ui-font-scale, 1));
   line-height: 1.4;
 }
 
 .conversion-info i {
-  margin-right: 6px;
+  margin-inline-end: 6px;
   color: #2196F3;
 }
 
@@ -174,11 +174,11 @@
   .board-conversion-header,
   .board-conversion-content,
   .board-conversion-footer {
-    padding-left: 16px;
-    padding-right: 16px;
+    padding-inline-start: 16px;
+    padding-inline-end: 16px;
   }
 
   .board-conversion-header h3 {
-    font-size: 18px;
+    font-size: calc(18px * var(--wekan-ui-font-scale, 1));
   }
 }

client/components/boards/allBoardsSidebar.jade

@@ -0,0 +1,116 @@
+//- The All Boards right sidebar.
+//-
+//- The board sidebar (client/components/sidebar/) is built around a board - its
+//- members, labels, activities and settings - and All Boards has no board, so
+//- this is its own. What it borrows is the SHELL: the same
+//- `.board-sidebar.sidebar` classes, the same `.sidebar-actions` row with the ✕,
+//- the same `.sidebar-content` with a title and a back arrow above the view. So
+//- it looks and behaves like the one on a board without pretending to be it.
+//-
+//- docs/Features/Page/Search.md, docs/Features/Page/Multi-Selection.md
+
+template(name="allBoardsSidebar")
+  //- The theme class goes on an ANCESTOR of `.sidebar`, never on it: every
+    themed sidebar rule is a DESCENDANT selector -
+    `.board-color-belize .sidebar .sidebar-content .sidebar-btn` - so a class on
+    the sidebar element itself matches nothing at all, which is how the first
+    attempt at this left the buttons white on light grey anyway. On a board the
+    class sits on a container around the sidebar; this is that container.
+
+    It wraps ONLY the sidebar, so the theme cannot bleed into the board icons
+    behind it. It is out of flow (the sidebar inside is fixed), so it costs no
+    layout.
+  .all-boards-sidebar-theme(class="{{themeClass}}")
+    .board-sidebar.sidebar.all-boards-sidebar(class="{{#if isSidebarOpen}}is-open{{/if}}")
+      .sidebar-actions
+        a.sidebar-xmark.js-close-all-boards-sidebar(aria-label="{{_ 'close'}}") ✕
+      .sidebar-content.js-all-boards-sidebar-content
+        //- A title and a back arrow on every view EXCEPT home, which is where
+          back would go - exactly as the board sidebar does it.
+        if sidebarViewTitle
+          h2
+            a.fa.fa-arrow-left.js-all-boards-sidebar-home(aria-label="{{_ 'go-back'}}")
+            = sidebarViewTitle
+        if isSidebarOpen
+          +Template.dynamic(template=sidebarViewTemplate)
+
+//- What the hamburger opens: the page's own menu, the counterpart of
+//- `homeSidebar` on a board.
+template(name="allBoardsHomeSidebar")
+  //- Sort, which was a button in this page's second header bar. The VIEW menu
+    was too, and it is in the first top header bar instead - a view menu says
+    what you are looking at, which belongs beside the page's name rather than
+    behind a panel you have to open. Search and Multi-Selection were in that bar
+    as well and are NOT repeated here: this view has offered both as rows since
+    it was written. docs/Features/Page/All-Boards.md
+  a.sidebar-btn.js-open-boards-sort(class="{{#unless isBoardsSort 'custom'}}emphasis{{/unless}}")
+    i.fa.fa-sort
+    span {{_ 'sort-boards'}}
+  hr
+  ul.sidebar-list
+    li
+      a.js-all-boards-sidebar-search
+        i.fa.fa-search
+        span.sidebar-list-item-description {{_ 'search-boards'}}
+    if canMultiSelectBoards
+      li
+        a.js-all-boards-sidebar-multiselection
+          i.fa.fa-check-square-o
+          span.sidebar-list-item-description {{_ 'multi-selection'}}
+  hr
+  //- Archived boards had a handler in the header bar and no button to reach it.
+  a.sidebar-btn.js-open-archived-board
+    i.fa.fa-archive
+    span {{_ 'archived-boards'}}
+
+template(name="allBoardsSearchSidebar")
+  //- The SAME term the page filters by, so the board list behind the sidebar
+    narrows as you type - which is what the search field in the header bar did
+    before this became a sidebar view.
+  input.js-board-search-input(
+    type="text"
+    aria-label="{{_ 'search-boards'}}"
+    value="{{boardSearch}}"
+    autofocus
+    autocomplete="off"
+    dir="auto")
+  if boardSearch
+    a.sidebar-btn.js-board-search-clear
+      i.fa.fa-times
+      span {{_ 'filter-clear'}}
+
+//- The actions on a selection, as sidebar rows - the same place a board puts
+//- them. They were four icons crowded into the header bar; here each one has
+//- its name beside it.
+template(name="allBoardsMultiSelectionSidebar")
+  if isArchiveSelection
+    if canPermanentlyDeleteArchivedBoards
+      p.sidebar-multiselection-hint {{_ 'multi-selection-active'}}
+      button.sidebar-btn.negate.wide.js-delete-selected-boards(type="button")
+        i.fa.fa-trash
+        span {{_ 'delete'}}
+    else
+      p.sidebar-multiselection-hint {{_ 'archive-permanent-delete-disabled-hint'}}
+  else
+    p.sidebar-multiselection-hint {{_ 'multi-selection-active'}}
+    a.sidebar-btn.js-star-selected
+      i.fa.fa-star
+      span {{selectedStarTitle}}
+    a.sidebar-btn.js-home-selected
+      i.fa.fa-home
+      if isHomeSelection
+        span {{_ 'unset-selected-home'}}
+      else
+        span {{_ 'set-selected-home'}}
+    unless isHomeSelection
+      hr
+      a.sidebar-btn.js-archive-selected-boards
+        i.fa.fa-archive
+        span {{_ 'archive-board'}}
+      a.sidebar-btn.js-duplicate-selected-boards
+        i.fa.fa-clipboard
+        span {{_ 'duplicate-board'}}
+  hr
+  a.sidebar-btn.js-multiselection-reset
+    i.fa.fa-times-thin
+    span {{_ 'multi-selection-off'}}

client/components/boards/allBoardsSidebar.js

@@ -0,0 +1,260 @@
+import { ReactiveCache } from '/imports/reactiveCache';
+import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
+const {
+  allBoardsPath,
+  SECTION_HOME,
+  SECTION_ARCHIVE,
+} = require('/models/lib/allBoardsUrls');
+import { TAPi18n } from '/imports/i18n';
+import { BoardMultiSelection } from '/client/lib/boardMultiSelection';
+import { allBoardsSearchVar, allBoardsMenuVar } from '/client/lib/allBoardsView';
+import {
+  allBoardsSidebarView,
+  isAllBoardsSidebarOpen,
+  openAllBoardsSidebar,
+  closeAllBoardsSidebar,
+} from '/client/lib/allBoardsSidebar';
+import {
+  SIDEBAR_HOME,
+  SIDEBAR_SEARCH,
+  SIDEBAR_MULTISELECTION,
+  sidebarViewTitleKey,
+  sidebarViewTemplate,
+} from '/models/lib/allBoardsSidebar';
+import { selectedStarTitleKey, selectedStarAction } from '/models/lib/selectedStars';
+
+// The All Boards right sidebar. Its shell mirrors the board sidebar's; what it
+// shows is this page's own. docs/Features/Page/Search.md,
+// docs/Features/Page/Multi-Selection.md
+
+Template.allBoardsSidebar.helpers({
+  isSidebarOpen() {
+    return isAllBoardsSidebarOpen();
+  },
+  // The theme the panel is painted with.
+  //
+  // `.sidebar .sidebar-content .sidebar-btn` is a light grey box whose text is
+  // WHITE; what makes that readable on a board is a `.board-color-*` ancestor
+  // replacing the grey with a themed colour. This page has no board, so without
+  // a class here every button was white on light grey - unreadable, which is
+  // exactly what it looked like.
+  //
+  // `board-color-belize` is the established default for a themed thing outside
+  // a board: client/components/main/globalSearch.js falls back to the same one.
+  themeClass() {
+    return 'board-color-belize';
+  },
+  sidebarViewTemplate() {
+    return sidebarViewTemplate(allBoardsSidebarView());
+  },
+  // Home has no title and no back arrow: there is nothing behind it.
+  sidebarViewTitle() {
+    const key = sidebarViewTitleKey(allBoardsSidebarView());
+    return key ? TAPi18n.__(key) : null;
+  },
+});
+
+Template.allBoardsSidebar.events({
+  'click .js-close-all-boards-sidebar'(evt) {
+    evt.preventDefault();
+    // Selection mode deliberately keeps this sidebar visible, so its X must
+    // turn the mode off before closeAllBoardsSidebar() will accept the close.
+    if (BoardMultiSelection.isActive()) BoardMultiSelection.disable();
+    closeAllBoardsSidebar();
+  },
+  'click .js-all-boards-sidebar-home'(evt) {
+    evt.preventDefault();
+    openAllBoardsSidebar(SIDEBAR_HOME);
+  },
+});
+
+Template.allBoardsHomeSidebar.helpers({
+  canMultiSelectBoards() {
+    const currentUser = ReactiveCache.getCurrentUser();
+    return currentUser && !currentUser.isCommentOnly();
+  },
+});
+
+Template.allBoardsHomeSidebar.events({
+  'click .js-all-boards-sidebar-search'(evt) {
+    evt.preventDefault();
+    openAllBoardsSidebar(SIDEBAR_SEARCH);
+  },
+  'click .js-all-boards-sidebar-multiselection'(evt) {
+    evt.preventDefault();
+    BoardMultiSelection.activate();
+    openAllBoardsSidebar(SIDEBAR_MULTISELECTION);
+  },
+  // Boards in Archive is a page. This row had no handler at all: the one it
+  // relied on lived in the header bar's events map and went when that map was
+  // rewritten, so the button did nothing.
+  'click .js-open-archived-board'(evt) {
+    evt.preventDefault();
+    closeAllBoardsSidebar();
+    // The SECTION of this page, not the full-width page it replaced.
+    // docs/Features/Page/Archive.md
+    FlowRouter.go(allBoardsPath(SECTION_ARCHIVE, []));
+  },
+});
+
+Template.allBoardsSearchSidebar.helpers({
+  boardSearch() {
+    return allBoardsSearchVar.get();
+  },
+});
+
+// The search term is the page's, not this template's: the board list behind the
+// sidebar filters as you type, which is what the header bar's search field did
+// before it became a sidebar view.
+Template.allBoardsSearchSidebar.events({
+  'input .js-board-search-input'(evt) {
+    allBoardsSearchVar.set(evt.currentTarget.value);
+  },
+  'keydown .js-board-search-input'(evt) {
+    if (evt.key === 'Escape') {
+      // Clear first, close second: Escape on a search box that has text in it
+      // means "undo the search", and only an already-empty box falls through to
+      // the sidebar's own Escape.
+      if (allBoardsSearchVar.get()) {
+        evt.preventDefault();
+        evt.stopPropagation();
+        allBoardsSearchVar.set('');
+        evt.currentTarget.value = '';
+      }
+    }
+  },
+  'click .js-board-search-clear'(evt, tpl) {
+    evt.preventDefault();
+    allBoardsSearchVar.set('');
+    const input = tpl.find('.js-board-search-input');
+    if (input) {
+      input.value = '';
+      input.focus();
+    }
+  },
+});
+
+// What the "Selected: ★" row would do if clicked right now, and to which
+// boards. The same function the header bar used - see models/lib/selectedStars.
+function currentSelectedStarAction() {
+  const user = ReactiveCache.getCurrentUser();
+  return selectedStarAction(BoardMultiSelection.getSelectedBoardIds(), id =>
+    Boolean(user && user.hasStarred(id)),
+  );
+}
+
+Template.allBoardsMultiSelectionSidebar.helpers({
+  selectedStarTitle() {
+    return TAPi18n.__(selectedStarTitleKey(currentSelectedStarAction().action));
+  },
+  isArchiveSelection() {
+    return allBoardsMenuVar.get() === SECTION_ARCHIVE;
+  },
+  isHomeSelection() {
+    return allBoardsMenuVar.get() === SECTION_HOME;
+  },
+  canPermanentlyDeleteArchivedBoards() {
+    const user = ReactiveCache.getCurrentUser();
+    const setting = ReactiveCache.getCurrentSetting();
+    return allBoardsMenuVar.get() === SECTION_ARCHIVE
+      && user?.isAdmin === true
+      && !!(setting && setting.enablePermanentDelete);
+  },
+});
+
+function selectedBoardIdsOrWarn() {
+  const ids = BoardMultiSelection.getSelectedBoardIds();
+  if (!ids.length) {
+    alert(TAPi18n.__('no-boards-selected'));
+    return null;
+  }
+  return ids;
+}
+
+function selectedHomeBoardIdOrWarn() {
+  const ids = BoardMultiSelection.getSelectedBoardIds();
+  if (ids.length !== 1) {
+    alert(TAPi18n.__('select-only-one-board'));
+    return null;
+  }
+  return ids[0];
+}
+
+Template.allBoardsMultiSelectionSidebar.events({
+  'click .js-delete-selected-boards'(evt) {
+    evt.preventDefault();
+    const ids = selectedBoardIdsOrWarn();
+    if (!ids || !confirm(TAPi18n.__('delete-board-confirm-popup'))) return;
+    Meteor.call('permanentlyDeleteArchivedBoards', ids, (err) => {
+      if (err) {
+        alert(err.reason || err.message || 'Failed to permanently delete boards');
+        return;
+      }
+      BoardMultiSelection.reset();
+    });
+  },
+  // Only the boards that must CHANGE are toggled: toggleBoardStar flips one
+  // board, so calling it for an already-starred one in the mixed case would
+  // un-star it.
+  'click .js-star-selected'(evt) {
+    evt.preventDefault();
+    const ids = selectedBoardIdsOrWarn();
+    if (!ids) return;
+    currentSelectedStarAction().boardIds.forEach((id) => {
+      Meteor.call('toggleBoardStar', id);
+    });
+  },
+  'click .js-home-selected'(evt) {
+    evt.preventDefault();
+    const boardId = selectedHomeBoardIdOrWarn();
+    if (!boardId) return;
+    Meteor.call('toggleDefaultBoard', boardId);
+  },
+  'click .js-archive-selected-boards'(evt) {
+    evt.preventDefault();
+    const selectedBoards = selectedBoardIdsOrWarn();
+    if (!selectedBoards) return;
+    if (
+      confirm(TAPi18n.__('archive-board-confirm'))
+    ) {
+      selectedBoards.forEach((boardId) => {
+        Meteor.call('archiveBoard', boardId, (err) => {
+          if (err) alert(err?.reason || err?.message || 'Failed to archive board');
+        });
+      });
+      BoardMultiSelection.reset();
+    }
+  },
+  'click .js-duplicate-selected-boards'(evt) {
+    evt.preventDefault();
+    const selectedBoards = selectedBoardIdsOrWarn();
+    if (!selectedBoards) return;
+    if (
+      confirm(TAPi18n.__('duplicate-board-confirm'))
+    ) {
+      selectedBoards.forEach((boardId) => {
+        const board = ReactiveCache.getBoard(boardId);
+        if (board) {
+          Meteor.call(
+            'copyBoard',
+            boardId,
+            {
+              sort: ReactiveCache.getBoards({ archived: false }).length,
+              type: 'board',
+              title: board.title,
+            },
+            (err) => {
+              if (err) console.error(err);
+            },
+          );
+        }
+      });
+      BoardMultiSelection.reset();
+    }
+  },
+  'click .js-multiselection-reset'(evt) {
+    evt.preventDefault();
+    BoardMultiSelection.disable();
+    closeAllBoardsSidebar();
+  },
+});

client/components/boards/boardArchive.jade

@@ -1,24 +1,20 @@
 template(name="archivedBoards")
-  h2
-    span(title="{{_ 'archived-boards'}}")
-      i.fa.fa-archive
-    | {{_ 'archived-boards'}}
-
+  .table-page-controls
+    input.js-archived-boards-search(type="search" placeholder="{{_ 'search'}}")
+    .table-page-pagination
+      button.js-archived-boards-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
+        | <
+      span.table-page-page-info {{currentPage}} / {{totalPages}}
+      button.js-archived-boards-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
+        | >
   ul.archived-lists
     each archivedBoards
       li.archived-lists-item
         div.board-header-btns
-          button.board-header-btn.js-delete-board
-            i.fa.fa-trash
-            | {{_ 'delete-board'}}
-          button.board-header-btn.js-restore-board
+          button.primary.board-header-btn.js-restore-board(type="submit")
             i.fa.fa-undo
             | {{_ 'restore-board'}}
           = title
         span {{ displayDate archivedAt 'LLL' }}
     else
       li.no-items-message {{_ 'no-archived-boards'}}
-
-template(name="boardDeletePopup")
-  p {{_ 'delete-board-confirm-popup'}}
-  button.js-confirm.negate.full(type="submit") {{_ 'delete'}}

client/components/boards/boardArchive.js

@@ -1,29 +1,70 @@
 import { ReactiveCache } from '/imports/reactiveCache';
-import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import Boards from '/models/boards';
 import { Utils } from '/client/lib/utils';
+import { TABLE_PAGE_ROWS_PER_PAGE } from '/models/lib/tablePage';
+
+// The app's one rows-per-page (docs/Features/Page/Table.md): the archive pages
+// like every other paginated page, whatever pager it draws.
+const ARCHIVED_BOARDS_PER_PAGE = TABLE_PAGE_ROWS_PER_PAGE;
 
 Template.archivedBoards.onCreated(function () {
-  this.subscribe('archivedBoards');
+  // Server-side pagination: only the current page of archived boards is ever
+  // published/loaded, so a long-lived instance's archive stays fast.
+  this.page = new ReactiveVar(1);
+  this.total = new ReactiveVar(0);
+  this.searchQuery = new ReactiveVar('');
+  this.autorun(() => {
+    const searchTerm = this.searchQuery.get();
+    const skip = (this.page.get() - 1) * ARCHIVED_BOARDS_PER_PAGE;
+    this.subscribe('archivedBoards', searchTerm, ARCHIVED_BOARDS_PER_PAGE, skip);
+    Meteor.call('getArchivedBoardsCount', searchTerm, (err, count) => {
+      if (!err) this.total.set(count || 0);
+    });
+  });
 });
 
 Template.archivedBoards.helpers({
   isBoardAdmin() {
-    return ReactiveCache.getCurrentUser().isBoardAdmin();
+    return ReactiveCache.getCurrentUser()?.isBoardAdmin();
   },
 
   archivedBoards() {
-    const ret = ReactiveCache.getBoards(
+    // Only the current page is in minimongo (the publication is limited).
+    return ReactiveCache.getBoards(
       { archived: true },
-      {
-        sort: { archivedAt: -1, modifiedAt: -1 },
-      },
+      { sort: { archivedAt: -1, modifiedAt: -1 } },
     );
-    return ret;
+  },
+
+  currentPage() { return Template.instance().page.get(); },
+  totalPages() { return Math.max(1, Math.ceil((Template.instance().total.get() || 0) / ARCHIVED_BOARDS_PER_PAGE)); },
+  hasPrevPage() { return Template.instance().page.get() > 1; },
+  hasNextPage() {
+    const tpl = Template.instance();
+    return tpl.page.get() < Math.max(1, Math.ceil((tpl.total.get() || 0) / ARCHIVED_BOARDS_PER_PAGE));
   },
 });
 
 Template.archivedBoards.events({
+  'keydown .js-archived-boards-search'(event, tpl) {
+    if (event.keyCode === 13) {
+      event.preventDefault();
+      tpl.searchQuery.set(tpl.$('.js-archived-boards-search').val() || '');
+      tpl.page.set(1);
+    }
+  },
+  'click .js-archived-boards-prev-page'(event, tpl) {
+    event.preventDefault();
+    const current = tpl.page.get();
+    if (current > 1) tpl.page.set(current - 1);
+  },
+  'click .js-archived-boards-next-page'(event, tpl) {
+    event.preventDefault();
+    const total = tpl.total.get() || 0;
+    const totalPages = Math.max(1, Math.ceil(total / ARCHIVED_BOARDS_PER_PAGE));
+    const current = tpl.page.get();
+    if (current < totalPages) tpl.page.set(current + 1);
+  },
   async 'click .js-restore-board'() {
     // TODO : Make isSandstorm variable global
     const isSandstorm =
@@ -38,17 +79,4 @@ Template.archivedBoards.events({
     await board.restore();
     Utils.goBoardId(board._id);
   },
-  'click .js-delete-board': Popup.afterConfirm('boardDelete', async function() {
-    Popup.back();
-    const isSandstorm =
-      Meteor.settings &&
-      Meteor.settings.public &&
-      Meteor.settings.public.sandstorm;
-    if (isSandstorm && Utils.getCurrentBoardId()) {
-      const currentBoard = Utils.getCurrentBoard();
-      await Boards.removeAsync(currentBoard._id);
-    }
-    await Boards.removeAsync(this._id);
-    FlowRouter.go('home');
-  }),
 });

client/components/boards/boardBody.css

@@ -1,7 +1,7 @@
 .board-wrapper {
   position: absolute;
-  left: 0;
-  right: 0;
+  inset-inline-start: 0;
+  inset-inline-end: 0;
   top: 0;
   bottom: 0;
   overflow-x: hidden;
@@ -30,8 +30,8 @@
 }
 .board-wrapper .board-canvas {
   position: absolute;
-  left: 0;
-  right: 0;
+  inset-inline-start: 0;
+  inset-inline-end: 0;
   top: 0;
   bottom: 0;
   transition: margin 0.1s;
@@ -107,17 +107,17 @@
       overflow-y: scroll !important;
     }
 
-    /* Mobile - make all text 2x bigger inside #content by default (icons stay same size) */
+    /* Mobile - keep #content text at normal size (reverted #6426 oversizing) */
     @media screen and (max-width: 800px),
            screen and (max-device-width: 800px),
            screen and (-webkit-min-device-pixel-ratio: 2) and (max-width: 800px),
            screen and (max-width: 800px) and (orientation: portrait),
            screen and (max-width: 800px) and (orientation: landscape) {
       #content {
-        font-size: 2em !important; /* 2x bigger base font size for content area */
+        font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
       }
 
-      /* Make all text elements 2x bigger */
+      /* Keep all text elements at normal size */
       #content h1, #content h2, #content h3, #content h4, #content h5, #content h6,
       #content p, #content span, #content div, #content a, #content button,
       #content .minicard, #content .list-header-name, #content .board-header-btn,
@@ -186,7 +186,7 @@
 
     /* Fallback for iPhone devices using JavaScript detection */
     .iphone-device #content {
-      font-size: 2em !important; /* 2x bigger base font size for content area */
+      font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
     }
 
     .iphone-device #content h1, .iphone-device #content h2, .iphone-device #content h3, .iphone-device #content h4, .iphone-device #content h5, .iphone-device #content h6,
@@ -231,9 +231,9 @@
       font-size: 1em !important; /* Keep original icon size */
     }
 
-/* Mobile iPhone: scale card details text and icons to 2x */
+/* Mobile iPhone: keep card details text/icons at normal size (reverted #6426 oversizing) */
 body.mobile-mode.iphone-device .card-details {
-  font-size: 2em !important;
+  font-size: 1em !important;
 }
 body.mobile-mode.iphone-device .card-details .fa,
 body.mobile-mode.iphone-device .card-details .icon,
@@ -276,12 +276,12 @@ body.mobile-mode.iphone-device .card-details .card-details-item-title {
 }
 .board-wrapper .board-canvas .board-overlay {
   position: fixed;
-  left: 0;
-  right: 0;
+  inset-inline-start: 0;
+  inset-inline-end: 0;
   top: 0;
   bottom: 0;
   top: -100px;
-  right: -400px;
+  inset-inline-end: -400px;
   background: #000;
   opacity: 0.33;
   animation: fadeIn 0.2s;
@@ -316,27 +316,39 @@ body.desktop-mode .board-wrapper .board-canvas .board-overlay {
   display: none !important;
   pointer-events: none !important;
 }
-.board-wrapper .board-canvas.is-dragging-active .open-minicard-composer,
+/* #2877 "Wekan swimlane jumps when moving card": while a card is dragged the
+   "+ Add Card" composer link is hidden, but hiding it with `display: none`
+   collapsed the bottom row of EVERY list at drag start (and restored it on
+   drop). With auto-height swimlanes the whole swimlane shrank/grew by the
+   composer's height, so all swimlanes below visibly jumped up and back down.
+   `visibility: hidden` hides the link just the same but keeps its box in the
+   layout, so nothing moves when a drag starts or ends. */
+.board-wrapper .board-canvas.is-dragging-active .open-minicard-composer {
+  visibility: hidden;
+}
+/* Checked cards of a multi-selection ARE the payload being dragged, so
+   removing them from the flow (showing the list as it will look after the
+   drop) is intentional — keep display: none here. */
 .board-wrapper .board-canvas.is-dragging-active .minicard-wrapper.is-checked {
   display: none;
 }
 /* Mobile view styles - applied when isMiniScreen is true (iPhone, etc.) */
 .board-wrapper.mobile-view {
-  width: 100vw !important;
-  max-width: 100vw !important;
-  min-width: 100vw !important;
-  left: 0 !important;
-  right: 0 !important;
+  width: 100% !important;
+  max-width: 100% !important;
+  min-width: 100% !important;
+  inset-inline-start: 0 !important;
+  inset-inline-end: 0 !important;
   overflow-x: hidden !important;
   overflow-y: auto !important;
 }
 
 .board-wrapper.mobile-view .board-canvas {
-  width: 100vw !important;
-  max-width: 100vw !important;
-  min-width: 100vw !important;
-  left: 0 !important;
-  right: 0 !important;
+  width: 100% !important;
+  max-width: 100% !important;
+  min-width: 100% !important;
+  inset-inline-start: 0 !important;
+  inset-inline-end: 0 !important;
   overflow-x: hidden !important;
   overflow-y: auto !important;
 }
@@ -349,34 +361,41 @@ body.desktop-mode .board-wrapper .board-canvas .board-overlay {
   padding: 0;
   overflow-x: hidden !important;
   overflow-y: auto;
-  width: 100vw !important;
-  max-width: 100vw !important;
-  min-width: 100vw !important;
+  width: 100% !important;
+  max-width: 100% !important;
+  min-width: 100% !important;
 }
 
+/* MOBILE MODE, not a narrow window. A swimlane laid out as a BLOCK with
+   `overflow-x: hidden` is the phone board: every list becomes a full-width row,
+   one under the other, and the "add list" form lands under the last list rather
+   than beside it. A phone whose user chose DESKTOP mode asked for the desktop
+   board - lists side by side, scrolled sideways - and was getting the phone one.
+   `.board-wrapper.mobile-view` above says the same thing for the mini-screen
+   class; this says it for the mode the user picked. */
 @media screen and (max-width: 800px),
        screen and (max-device-width: 932px) and (-webkit-min-device-pixel-ratio: 3) {
-  .board-wrapper {
-    width: 100vw !important;
-    max-width: 100vw !important;
-    min-width: 100vw !important;
-    left: 0 !important;
-    right: 0 !important;
+  body.mobile-mode .board-wrapper {
+    width: 100% !important;
+    max-width: 100% !important;
+    min-width: 100% !important;
+    inset-inline-start: 0 !important;
+    inset-inline-end: 0 !important;
     overflow-x: hidden !important;
     overflow-y: auto !important;
   }
 
-  .board-wrapper .board-canvas {
-    width: 100vw !important;
-    max-width: 100vw !important;
-    min-width: 100vw !important;
-    left: 0 !important;
-    right: 0 !important;
+  body.mobile-mode .board-wrapper .board-canvas {
+    width: 100% !important;
+    max-width: 100% !important;
+    min-width: 100% !important;
+    inset-inline-start: 0 !important;
+    inset-inline-end: 0 !important;
     overflow-x: hidden !important;
     overflow-y: auto !important;
   }
 
-  .board-wrapper .board-canvas .swimlane {
+  body.mobile-mode .board-wrapper .board-canvas .swimlane {
     border-bottom: 1px solid #ccc;
     display: block !important;
     flex-direction: column;
@@ -384,9 +403,23 @@ body.desktop-mode .board-wrapper .board-canvas .board-overlay {
     padding: 0;
     overflow-x: hidden !important;
     overflow-y: auto;
-    width: 100vw !important;
-    max-width: 100vw !important;
-    min-width: 100vw !important;
+    width: 100% !important;
+    max-width: 100% !important;
+    min-width: 100% !important;
+  }
+
+  /* Desktop mode on a narrow window: the board scrolls SIDEWAYS, like a desktop
+     board. Without this the canvas would keep the `overflow-x: hidden` it has
+     from elsewhere and the lists past the right edge would be unreachable. */
+  body:not(.mobile-mode) .board-wrapper,
+  body:not(.mobile-mode) .board-wrapper .board-canvas {
+    overflow-x: auto !important;
+  }
+
+  body:not(.mobile-mode) .board-wrapper .board-canvas .swimlane {
+    display: flex !important;
+    flex-direction: row !important;
+    overflow-x: auto !important;
   }
 }
 .calendar-event-green {
@@ -545,7 +578,7 @@ body.desktop-mode .board-wrapper .board-canvas .board-overlay {
   justify-content: center;
   align-items: center;
   margin: 0;
-  font-size: 18px;
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1));
 }
 .modal-footer {
   display: flex;
@@ -560,8 +593,8 @@ body.desktop-mode .board-wrapper .board-canvas .board-overlay {
   align-items: center;
   position: absolute;
   top: 5px;
-  right: 5px;
-  font-size: 25px;
+  inset-inline-end: 5px;
+  font-size: calc(25px * var(--wekan-ui-font-scale, 1));
   cursor: pointer;
 }
 

client/components/boards/boardBody.jade

@@ -21,16 +21,17 @@ template(name="boardBody")
   else
     // Debug information (remove in production)
     if debugBoardState
-      .debug-info(style="position: fixed; top: 0; left: 0; background: rgba(0,0,0,0.8); color: white; padding: 10px; z-index: 9999; font-size: 12px;")
+      .debug-info(style="position: fixed; top: 0; inset-inline-start: 0; background: rgba(0,0,0,0.8); color: white; padding: 10px; z-index: 9999; font-size: 12px;")
         | {{_ 'board'}}: {{currentBoard.title}} | {{_ 'view'}}: {{boardView}} | {{_ 'has-swimlanes'}}: {{hasSwimlanes}} | {{_ 'swimlanes'}}: {{currentBoard.swimlanes.length}}
-    .board-wrapper(class=currentBoard.colorClass class="{{#if isMiniScreen}}mobile-view{{/if}}")
-      .board-canvas.js-swimlanes(
-        class="{{#if hasSwimlanes}}dragscroll{{/if}}"
+    .board-wrapper(class="{{themeColorClass}}" class="{{#if isMiniScreen}}mobile-view{{/if}}")
+      .board-canvas.js-swimlanes.dragscroll(
         class="{{#if Sidebar.isOpen}}is-sibling-sidebar-open{{/if}}"
         class="{{#if MultiSelection.isActive}}is-multiselection-active{{/if}}"
         class="{{#if draggingActive}}is-dragging-active{{/if}}"
         class="{{#unless isVerticalScrollbars}}no-scrollbars{{/unless}}"
         class="{{#if isMiniScreen}}mobile-view{{/if}}")
+        if currentBoard.showDependencies
+          +dependencyOverlay
         if showOverlay
           .board-overlay
         if currentBoard.isTemplatesBoard
@@ -49,6 +50,10 @@ template(name="boardBody")
           +calendarView
         else if isViewGantt
           +ganttView
+        else if isViewTable
+          +tableView
+        else if isViewStats
+          +statsView
         else
           // Default view - show swimlanes if they exist, otherwise show lists
           if hasSwimlanes
@@ -64,7 +69,7 @@ template(name="boardBody")
 
 template(name="calendarView")
   if isViewCalendar
-    .calendar-view.swimlane
+    .calendar-view.swimlane.dragscroll
       if currentCard
         +cardDetails(currentCard)
       +fullcalendar(calendarOptions)

client/components/boards/boardBody.js

@@ -1,14 +1,26 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import { TAPi18n } from '/imports/i18n';
-import dragscroll from '@wekanteam/dragscroll';
+import {
+  suspendBoardDragscroll,
+  resumeBoardDragscroll,
+  resetBoardDragscroll,
+} from '/client/lib/boardDragscroll';
+import '/client/lib/dragscrollTouch';
+import '/client/lib/dragDropTouch';
 import { boardConverter } from '/client/lib/boardConverter';
+// Bring the swimlane or list a link named into view, once it has rendered.
+import { watchBoardItemReveals } from '/client/lib/revealBoardItem';
 import { formatDateByUserPreference } from '/imports/lib/dateUtils';
+import { toFullCalendarFirstDay } from '/client/lib/calendarFirstDay';
+import { weekNumberByFirstDay } from '/models/lib/weekStart';
 import Swimlanes from '/models/swimlanes';
 import Lists from '/models/lists';
 import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { Utils } from '/client/lib/utils';
+import { Filter } from '/client/lib/filter';
+import { migrationProgressManager } from '/client/components/settings/migrationProgress';
 
 // SubsManager removed for Meteor 3 migration
 const { calculateIndex } = Utils;
@@ -19,23 +31,68 @@ let BoardBody = null;
 
 Template.board.onCreated(function () {
   this.isBoardReady = new ReactiveVar(false);
+  // Kept for the template/jade which still references it; conversion is a no-op.
   this.isConverting = new ReactiveVar(false);
-  this._swimlaneCreated = new Set(); // Track boards where we've created swimlanes
-  this._boardProcessed = false; // Track if board has been processed
-  this._lastProcessedBoardId = null; // Track last processed board ID
+  this._swimlaneCreated = new Set(); // boards where a default swimlane was ensured
+  this._listRepairChecked = new Set(); // boards whose data-repair was checked
 
+  // When a board opens, detect whether it needs the shared data-repairs (the same
+  // set run during the MongoDB <-> SQLite migration): #6484 lists wrongly bound to
+  // a swimlane (a list DISAPPEARS from the other swimlanes), cards with no
+  // swimlane, and orphaned cards whose swimlane was deleted (invisible cards). If
+  // anything needs fixing and the viewer is a board admin, repair it — showing the
+  // shared blue, Product-name-branded migration-progress dashboard. Checked once
+  // per board, fire-and-forget so it never blocks rendering.
+  this.maybeRepairBoard = (boardId) => {
+    if (!boardId || this._listRepairChecked.has(boardId)) {
+      return;
+    }
+    this._listRepairChecked.add(boardId);
+    Meteor.call('boardRepairNeeded', boardId, (err, res) => {
+      if (err || !res || !res.total || !res.canRepair) {
+        return; // nothing to fix, or the viewer is not a board admin
+      }
+      migrationProgressManager.startMigration();
+      migrationProgressManager.updateProgress({
+        overallProgress: 20,
+        currentStep: 1,
+        totalSteps: 1,
+        stepName: 'repair_board_data',
+        stepProgress: 20,
+        stepStatus: 'running',
+        stepDetails: {
+          lists: res.listsUnbound,
+          cards: res.cardsAssigned + res.cardsRescued,
+        },
+        boardId,
+      });
+      Meteor.call('repairBoardData', boardId, (err2) => {
+        if (err2) {
+          this._listRepairChecked.delete(boardId); // allow a retry
+          migrationProgressManager.failMigration(err2);
+          return;
+        }
+        migrationProgressManager.completeMigration();
+      });
+    });
+  };
+
+  // Ensure a board has at least one swimlane. Guarded to run once per board and
+  // fire-and-forget so it never blocks rendering. The board is marked
+  // immediately to avoid duplicate concurrent calls, and the mark is rolled
+  // back on failure so a later attempt can retry.
   this.ensureDefaultSwimlane = async (boardId) => {
-    // Only create swimlane once per board
     if (this._swimlaneCreated.has(boardId)) {
       return;
     }
-
+    this._swimlaneCreated.add(boardId);
     try {
       const board = ReactiveCache.getBoard(boardId);
-      if (!board) return;
-
-      const swimlanes = board.swimlanes();
-      if (swimlanes.length === 0) {
+      if (!board) {
+        this._swimlaneCreated.delete(boardId);
+        return;
+      }
+      if (board.swimlanes().length === 0) {
         const swimlaneId = await Meteor.callAsync('ensureDefaultSwimlane', boardId);
         if (process.env.DEBUG === 'true' && swimlaneId) {
           console.log(
@@ -43,67 +100,46 @@ Template.board.onCreated(function () {
           );
         }
       }
-      this._swimlaneCreated.add(boardId);
     } catch (error) {
+      this._swimlaneCreated.delete(boardId); // allow a later retry
       console.error('Error creating default swimlane:', error);
     }
   };
 
-  this.checkAndConvertBoard = async (boardId) => {
-    try {
-      const board = ReactiveCache.getBoard(boardId);
-      if (!board) {
-        this.isBoardReady.set(true);
-        return;
-      }
-
-      this.isBoardReady.set(true);
-    } catch (error) {
-      console.error('Error during board conversion check:', error);
-      this.isConverting.set(false);
-      this.isBoardReady.set(true); // Show board even if conversion check failed
-    }
-  };
-
-  // The pattern we use to manually handle data loading is described here:
-  // https://kadira.io/academy/meteor-routing-guide/content/subscriptions-and-data-management/using-subs-manager
-  // XXX The boardId should be readed from some sort the component "props",
-  // unfortunatly, Blaze doesn't have this notion.
+  // Single reactive computation that subscribes to the current board and tracks
+  // its ready state in one place. Previously a Tracker.autorun was created
+  // *inside* this autorun on every re-run without being stopped, leaking
+  // computations that raced on shared ready-state flags. When navigating
+  // between boards — e.g. opening a freshly created board — that race could
+  // leave swimlanes/lists unrendered until the board was re-selected. A single
+  // self-managed autorun (auto-stopped by Blaze on destroy) avoids both the
+  // leak and the race.
+  // Pattern: https://kadira.io/academy/meteor-routing-guide/content/subscriptions-and-data-management/using-subs-manager
   this.autorun(() => {
     const currentBoardId = Session.get('currentBoard');
-    if (!currentBoardId) return;
+    if (!currentBoardId) {
+      this.isBoardReady.set(false);
+      return;
+    }
 
     const handle = Meteor.subscribe('board', currentBoardId, false);
+    // Learn this board's card-loading mode (lazy vs eager) so 'auto' can decide
+    // per board by size; the flag drives isLazyCards(boardId). #6480.
+    Meteor.subscribe('boardCardsLoadingMode', currentBoardId);
+    const ready = handle.ready();
+    this.isBoardReady.set(ready);
 
-    // Use a separate autorun for subscription ready state to avoid reactive loops
-    this.subscriptionReadyAutorun = Tracker.autorun(() => {
-      if (handle.ready()) {
-        if (
-          !this._boardProcessed ||
-          this._lastProcessedBoardId !== currentBoardId
-        ) {
-          this._boardProcessed = true;
-          this._lastProcessedBoardId = currentBoardId;
-
-          // Ensure default swimlane exists (only once per board)
-          this.ensureDefaultSwimlane(currentBoardId);
-          // Check if board needs conversion
-          this.checkAndConvertBoard(currentBoardId);
-        }
-      } else {
-        this.isBoardReady.set(false);
-      }
-    });
+    if (ready) {
+      // Run outside the computation so this autorun depends only on the board
+      // id and the subscription's ready state — not on the swimlane data that
+      // ensureDefaultSwimlane reads — which would otherwise cause extra re-runs.
+      Tracker.nonreactive(() => this.ensureDefaultSwimlane(currentBoardId));
+      // Also detect + run the shared board data-repairs once the board is ready.
+      Tracker.nonreactive(() => this.maybeRepairBoard(currentBoardId));
+    }
   });
 });
 
-Template.board.onDestroyed(function () {
-  // Clean up the subscription ready autorun to prevent memory leaks
-  if (this.subscriptionReadyAutorun) {
-    this.subscriptionReadyAutorun.stop();
-  }
-});
-
 Template.board.helpers({
   onlyShowCurrentCard() {
     const isMiniScreen = Utils.isMiniScreen();
@@ -142,6 +178,7 @@ Template.board.helpers({
 
 Template.boardBody.onCreated(function () {
   Meteor.subscribe('tableVisibilityModeSettings');
+  Meteor.subscribe('inviteToBoardRolesSettings');
   this.showOverlay = new ReactiveVar(false);
   this.draggingActive = new ReactiveVar(false);
   this._isDragging = false;
@@ -254,6 +291,11 @@ Template.boardBody.onRendered(function () {
   // Initialize user settings (zoom and mobile mode)
   Utils.initializeUserSettings();
 
+  // A link to a swimlane or a list has to end with that thing on screen. The
+  // route can only NAME it - it runs before this has rendered - so the reveal
+  // waits here for the element to exist. client/lib/revealBoardItem.js
+  this.boardItemReveals = watchBoardItemReveals();
+
   // Detect iPhone devices and add class for better CSS targeting
   const isIPhone = /iPhone|iPod/.test(navigator.userAgent);
   if (isIPhone) {
@@ -374,8 +416,10 @@ Template.boardBody.onRendered(function () {
     el.setAttribute('tabindex', '0');
     el.setAttribute('role', 'button');
   });
-  // Set the language attribute on the <html> element for accessibility
+  // Set the language and direction attributes on the <html> element for
+  // accessibility and RTL layout.
   document.documentElement.lang = TAPi18n.getLanguage();
+  document.documentElement.dir = TAPi18n.getLanguageDirection();
 
   // Ensure the accessible name for the board view switcher matches the visible label "Swimlanes"
   // This fixes WCAG 2.5.3: Label in Name
@@ -410,8 +454,9 @@ Template.boardBody.onRendered(function () {
       .js-add-card[tabindex] {
         outline: none;
       }
-      /* Sidebar hamburger menu button in header */
-      .js-toggle-sidebar .fa-bars {
+      /* Sidebar hamburger menu button in header. Renamed with the button when
+         it moved to the first top header bar: docs/Features/Page/Header.md */
+      .js-toggle-page-sidebar .fa-bars {
         color: #fff !important;
       }
       /* Grey icons in card detail header */
@@ -482,6 +527,7 @@ Template.boardBody.onRendered(function () {
       EscapeActions.executeUpTo('popup-close');
       listDom.addClass('moving-swimlane');
       tpl.setIsDragging(true);
+      suspendBoardDragscroll(); // #6558
 
       ui.placeholder.insertAfter(ui.placeholder.next());
       tpl.origPlaceholderIndex = ui.placeholder.index();
@@ -522,6 +568,7 @@ Template.boardBody.onRendered(function () {
       const nextSwimlaneDom = ui.item.nextAll('.js-swimlane').get(0);
       const sortIndex = calculateIndex(prevSwimlaneDom, nextSwimlaneDom, 1);
 
+      resumeBoardDragscroll(); // #6558
       $swimlanesDom.sortable('cancel');
       const swimlaneDomElement = ui.item.get(0);
       const swimlane = Blaze.getData(swimlaneDomElement);
@@ -572,8 +619,26 @@ Template.boardBody.onRendered(function () {
   });
 
   this.autorun(() => {
-    // Always reset dragscroll on view switch
-    dragscroll.reset();
+    // Re-attach mouse dragscroll whenever the set of rendered `.dragscroll`
+    // containers can change. The @wekanteam/dragscroll mouse handler is attached
+    // PER element inside reset(), so it must be re-run after the DOM changes;
+    // only dragscrollTouch (delegated on `document`) covers reactively-added
+    // nodes, and that is touch-only. Previously this autorun's only reactive deps
+    // were the touch/permission reads below, so mouse drag-scrolling stayed dead
+    // when swimlanes/lists rendered AFTER onRendered — adaptive lazy card loading
+    // (#6480), the on-open data-repair adding a default swimlane (#6484), or a
+    // board switch that reuses this template instance without re-firing onRendered
+    // (see the #4978 note below) — leaving lower swimlanes unreachable by drag on
+    // touchpad/mouse. Reading the board view + swimlanes + lists here establishes
+    // those dependencies so reset() re-runs when the containers change. None of
+    // these reads write to the DB, so there is no autorun write loop.
+    const dragscrollBoard = Utils.getCurrentBoard();
+    if (dragscrollBoard) {
+      Utils.boardView();
+      dragscrollBoard.swimlanes();
+      dragscrollBoard.draggableLists();
+    }
+    resetBoardDragscroll();
 
     if ($swimlanesDom.data('uiSortable') || $swimlanesDom.data('sortable')) {
       if (Utils.isTouchScreenOrShowDesktopDragHandles()) {
@@ -586,26 +651,58 @@ Template.boardBody.onRendered(function () {
         $swimlanesDom.sortable('option', 'handle', '.swimlane-header');
       }
 
-      // Disable drag-dropping if the current user is not a board member
+      // #6446: enable swimlane drag-drop — which also carries moving cards BETWEEN
+      // swimlanes — for any board member with write access, not only board admins.
+      // The old !isBoardAdmin() check disabled this sortable for every non-admin, so
+      // a normal member could still move a card WITHIN a swimlane but not BETWEEN
+      // swimlanes (a card crossing swimlanes is received across this sortable), and
+      // could not reorder swimlanes. canModifyCard() is the client write-access
+      // predicate (board member, not comment-only / worker / read-only), matching
+      // the server's allowIsBoardMemberWithWriteAccess.
       $swimlanesDom.sortable(
         'option',
         'disabled',
-        !ReactiveCache.getCurrentUser()?.isBoardAdmin(),
+        !Utils.canModifyCard(),
       );
     }
   });
 
-  dragscroll.reset();
-  Utils.setBackgroundImage();
+  resetBoardDragscroll();
+  // #4978: apply the board background inside a reactive autorun instead of a
+  // one-shot call. Switching directly between boards (e.g. the favorites bar)
+  // reuses this template instance and never re-fires onRendered, so the
+  // background used to stay on the previously shown board. Reading the current
+  // board inside setBackgroundImage() tracks both board switches and background
+  // edits; it performs no DB writes, so there is no autorun write loop.
+  this.autorun(() => {
+    Utils.setBackgroundImage();
+  });
 });
 
 Template.boardBody.onDestroyed(function () {
+  // The reveal watcher owns a Tracker computation and a retry interval, and
+  // neither stops on its own when this template goes.
+  if (this.boardItemReveals) {
+    this.boardItemReveals.stop();
+    this.boardItemReveals = null;
+  }
   if (BoardBody === this) {
     BoardBody = null;
   }
 });
 
 Template.boardBody.helpers({
+  openCards() {
+    const isMobile = Utils.getMobileMode();
+    if (!isMobile) {
+      const openCardIds = Session.get('openCards') || [];
+      return openCardIds
+        .map((id) => ReactiveCache.getCard(id))
+        .filter((card) => card);
+    }
+    return [];
+  },
+
   draggingActive() {
     return Template.instance().draggingActive.get();
   },
@@ -682,6 +779,32 @@ Template.boardBody.helpers({
     return boardView === 'board-view-gantt';
   },
 
+  isViewTable() {
+    const currentUser = ReactiveCache.getCurrentUser();
+    let boardView;
+
+    if (currentUser) {
+      boardView = (currentUser.profile || {}).boardView;
+    } else {
+      boardView = window.localStorage.getItem('boardView');
+    }
+
+    return boardView === 'board-view-table';
+  },
+
+  isViewStats() {
+    const currentUser = ReactiveCache.getCurrentUser();
+    let boardView;
+
+    if (currentUser) {
+      boardView = (currentUser.profile || {}).boardView;
+    } else {
+      boardView = window.localStorage.getItem('boardView');
+    }
+
+    return boardView === 'board-view-stats';
+  },
+
   hasSwimlanes() {
     const currentBoard = Utils.getCurrentBoard();
     if (!currentBoard) {
@@ -917,10 +1040,17 @@ document.addEventListener('keydown', function (e) {
 });
 
 Template.calendarView.onRendered(function () {
-  // Set the language attribute on the <html> element for accessibility
+  // Set the language and direction attributes on the <html> element for
+  // accessibility and RTL layout.
   document.documentElement.lang = TAPi18n.getLanguage();
+  document.documentElement.dir = TAPi18n.getLanguageDirection();
 
   this.autorun(function () {
+    // #5656: refetch calendar events whenever the active board Filter changes
+    // so the Calendar view stays in sync with the other views. Reading the
+    // Filter's reactive state here establishes the dependency; the events()
+    // callback below applies the actual selector.
+    Filter.isActive();
     const calendarEl = document.getElementById('calendar-view');
     if (calendarEl && calendarEl._wekanCalendar) {
       calendarEl._wekanCalendar.refetchEvents();
@@ -935,12 +1065,28 @@ Template.calendarView.helpers({
       return translated && translated !== key ? translated : fallback;
     };
 
+    // #5521: respect the user's "start day of week" setting instead of the
+    // FullCalendar locale default. getStartDayOfWeek() returns a zero-based day
+    // index (0=Sunday..6=Saturday), the same convention FullCalendar's firstDay
+    // uses; toFullCalendarFirstDay() validates it and falls back to Monday (1).
+    const currentUser = ReactiveCache.getCurrentUser();
+    const firstDay = toFullCalendarFirstDay(
+      currentUser ? currentUser.getStartDayOfWeek() : 1,
+    );
+
     return {
       id: 'calendar-view',
       initialView: 'dayGridMonth',
+      firstDay,
       editable: true,
       selectable: true,
       weekNumbers: true,
+      // #4946: FullCalendar's default weekNumberCalculation is locale-based
+      // (Sunday-anchored for many locales), so the week-number column ignored
+      // the user's start-day-of-week setting even though `firstDay` moved the
+      // grid. Compute the number from the SAME firstDay so the label matches the
+      // way the week is laid out.
+      weekNumberCalculation: date => weekNumberByFirstDay(date, firstDay),
       // Use non-localized AM/PM time format to avoid confusing notations like 上/下/中
       // Use full 'am'/'pm' instead of single-letter 'a'/'p' for clarity
       eventTimeFormat: {
@@ -981,8 +1127,15 @@ Template.calendarView.helpers({
         end: '18:00',
       },
       locale: TAPi18n.getLanguage(),
+      isRTL: TAPi18n.isRTL(),
       events(fetchInfo, callback) {
         const currentBoard = Utils.getCurrentBoard();
+        // #5656: apply the active board Filter (member / assignee / due-date /
+        // label / custom-field) so the Calendar view shows the same scoped set
+        // of cards as the Board / Lists / Swimlanes views.
+        const filterSelector = Filter.isActive()
+          ? Filter._getMongoSelector()
+          : undefined;
         const events = [];
         const pushEvent = function (card, title, start, end, extraCls) {
           start = start || card.startAt;
@@ -1007,12 +1160,12 @@ Template.calendarView.helpers({
           });
         };
         currentBoard
-          .cardsInInterval(fetchInfo.start, fetchInfo.end)
+          .cardsInInterval(fetchInfo.start, fetchInfo.end, filterSelector)
           .forEach(function (card) {
             pushEvent(card);
           });
         currentBoard
-          .cardsDueInBetween(fetchInfo.start, fetchInfo.end)
+          .cardsDueInBetween(fetchInfo.start, fetchInfo.end, filterSelector)
           .forEach(function (card) {
             pushEvent(
               card,

client/components/boards/boardHeader.css

@@ -1,5 +1,5 @@
 .integration-form {
-  padding: 0.7vh 0.7vw;
+  padding: 6px 10px;
   border-bottom: 1px solid #ccc;
 }
 .flex,
@@ -12,14 +12,14 @@
   display: flex;
 }
 .option {
-  -webkit-border-radius: 0.4vw;
-  border-radius: 0.4vw;
+  -webkit-border-radius: 6px;
+  border-radius: 6px;
   background: #fff;
   text-decoration: none;
-  -webkit-box-shadow: 0 0.2vh 0.3vh rgba(0,0,0,0.2);
-  box-shadow: 0 0.2vh 0.3vh rgba(0,0,0,0.2);
-  margin-top: 0.7vh;
-  padding: 0.7vh 0.7vw;
+  -webkit-box-shadow: 0 2px 3px rgba(0,0,0,0.2);
+  box-shadow: 0 2px 3px rgba(0,0,0,0.2);
+  margin-top: 6px;
+  padding: 6px 10px;
 }
 
 /* Zoom and Mobile Mode Controls */
@@ -30,75 +30,6 @@
   flex: 1;
 }
 
-.zoom-controls {
-  display: flex;
-  align-items: center;
-  gap: 0.5vw;
-  background: rgba(255, 255, 255, 0.9);
-  padding: 0.5vh 1vw;
-  border-radius: 0.5vw;
-  box-shadow: 0 0.2vh 0.5vh rgba(0,0,0,0.1);
-}
-
-.zoom-controls .board-header-btn {
-  padding: 0.5vh 0.8vw !important;
-  border-radius: 0.3vw !important;
-  background: #fff !important;
-  border: 1px solid #000 !important;
-  transition: all 0.2s ease !important;
-  color: #000 !important;
-  height: auto !important;
-  line-height: normal !important;
-  margin: 0 !important;
-  float: none !important;
-  overflow: visible !important;
-}
-
-.zoom-controls .board-header-btn i {
-  color: #000 !important;
-  float: none !important;
-  display: inline !important;
-  line-height: normal !important;
-  margin: 0 !important;
-}
-
-.zoom-controls .board-header-btn:hover {
-  background: #000 !important;
-  border-color: #000 !important;
-  color: #fff !important;
-}
-
-.zoom-controls .board-header-btn:hover i {
-  color: #fff !important;
-}
-
-.zoom-controls .board-header-btn.is-active {
-  background: #0079bf;
-  color: white;
-  border-color: #005a8a;
-}
-
-.zoom-controls .board-header-btn.is-active i {
-  color: white;
-}
-
-.zoom-level {
-  font-weight: bold;
-  color: #333;
-  min-width: 3vw;
-  text-align: center;
-  font-size: clamp(12px, 2vw, 14px);
-  cursor: pointer;
-  padding: 0.3vh 0.5vw;
-  border-radius: 0.3vw;
-  transition: all 0.2s ease;
-}
-
-.zoom-level:hover {
-  background: #f0f0f0;
-  color: #000;
-}
-
 /* Mobile Mode Styles */
 .mobile-mode .board-wrapper {
   width: 100%;
@@ -110,59 +41,18 @@
 }
 
 .mobile-mode .minicard {
-  font-size: clamp(16px, 4vw, 20px);
-  padding: 1.2vh 1.5vw 0.5vh;
-  min-height: 3vh;
+  font-size: calc(16px * var(--wekan-ui-font-scale, 1));
+  padding: 11px 21px 5px;
+  min-height: 24px;
 }
 
 .mobile-mode .list-header-name {
-  font-size: clamp(18px, 4.5vw, 24px);
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1));
 }
 
 .mobile-mode .board-header-btn {
-  padding: 1vh 1.5vw;
-  font-size: clamp(14px, 3.5vw, 18px);
-}
-
-.mobile-mode .zoom-controls {
-  padding: 1vh 1.5vw;
-  gap: 1vw;
-}
-
-.mobile-mode .zoom-controls .board-header-btn {
-  padding: 1vh 1.5vw !important;
-  font-size: clamp(14px, 3.5vw, 18px) !important;
-  background: #fff !important;
-  border: 1px solid #000 !important;
-  color: #000 !important;
-  height: auto !important;
-  line-height: normal !important;
-  margin: 0 !important;
-  float: none !important;
-  overflow: visible !important;
-}
-
-.mobile-mode .zoom-controls .board-header-btn i {
-  color: #000 !important;
-  float: none !important;
-  display: inline !important;
-  line-height: normal !important;
-  margin: 0 !important;
-}
-
-.mobile-mode .zoom-controls .board-header-btn:hover {
-  background: #000 !important;
-  border-color: #000 !important;
-  color: #fff !important;
-}
-
-.mobile-mode .zoom-controls .board-header-btn:hover i {
-  color: #fff !important;
-}
-
-.mobile-mode .zoom-level {
-  font-size: clamp(14px, 3.5vw, 18px);
-  min-width: 4vw;
+  padding: 9px 21px;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1));
 }
 
 /* Comprehensive Mobile Mode Styles - Works on all screen sizes */
@@ -186,19 +76,57 @@
   width: 100% !important;
   min-width: 100% !important;
   max-width: 100% !important;
-  margin-bottom: 2rem !important;
+  /* No 2rem band of grey between swimlanes. On a phone every swimlane already begins
+     with its own darker header bar, which separates them perfectly well, and the
+     margin only ever showed up as dead space: below the blue resize bar before the
+     next swimlane's header, and - since this selector matches the header wrapper too -
+     between a swimlane's own header and its lists. */
+  margin-bottom: 0 !important;
   display: block !important;
   float: none !important;
 }
 
+/* The header wrapper is exactly as tall as the header bar inside it. It is a
+   `.swimlane` as well, so it picks up that element's sizing, and anything left over
+   renders as the lighter grey of `.swimlane` around the darker bar. */
+.mobile-mode .swimlane.nodragscroll {
+  height: auto !important;
+  min-height: 0 !important;
+  padding: 0 !important;
+}
+
+/* The lists container is exactly the height it was resized to - no floor under it and
+   no margin after it, so the blue resize bar sits flush between the last list and the
+   next swimlane's header.
+   `min-height: 150px` (from .swimlane.js-lists.js-swimlane) held a short swimlane open
+   below the height that was chosen for it, and that leftover was the grey band above
+   the bar. Removing the floor is enough; the inline `height` from the stored swimlane
+   height is deliberately NOT overridden, because that is the height being dragged - an
+   `height: auto !important` here would make the resize bar do nothing at all. */
+.mobile-mode .swimlane.js-lists {
+  min-height: 0 !important;
+}
+
 .mobile-mode .swimlane-header {
   width: 100% !important;
   min-width: 100% !important;
   max-width: 100% !important;
-  font-size: clamp(18px, 2.5vw, 32px) !important;
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1)) !important;
   padding: 1rem !important;
-  margin-bottom: 1rem !important;
-  display: block !important;
+  /* No margin under the header bar: it is a fixed band of the swimlane's lighter
+     grey between the bar and the first list, with nothing in it. */
+  margin-bottom: 0 !important;
+  /* Flex, not block: the title is a bare text node / .viewer, and as a block it sat
+     at the TOP of a band whose height comes from the padding and the menu icons
+     beside it. Centred on its line instead. */
+  display: flex !important;
+  align-items: center !important;
+}
+
+/* ...and the band itself centres what sits in it, so the title and the icon row
+   share one centre line. */
+.mobile-mode .swimlane-header-wrap {
+  align-items: center !important;
 }
 
 .mobile-mode .list {
@@ -207,8 +135,12 @@
   max-width: 100% !important;
   display: block !important;
   float: none !important;
-  margin-bottom: 2rem !important;
-  border-left: none !important;
+  /* No margin under a list either. Lists are separated by the 2px border below, and
+     on the LAST list this margin was a fixed band of empty grey between it and the
+     swimlane resize bar - the band that travelled with the bar when the swimlane was
+     resized. */
+  margin-bottom: 0 !important;
+  border-inline-start: none !important;
   border-bottom: 2px solid #ccc !important;
   clear: both !important;
 }
@@ -218,30 +150,45 @@
   min-width: 100% !important;
   max-width: 100% !important;
   padding: 1rem !important;
-  font-size: clamp(18px, 2.5vw, 32px) !important;
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1)) !important;
   display: grid !important;
-  grid-template-columns: 30px 1fr auto auto !important;
+  /* title | caret | add-list + | drag handle. The grid follows the INLINE axis, so
+     under dir="rtl" column 1 is on the right and the whole row mirrors by itself. */
+  grid-template-columns: 30px 1fr auto auto auto !important;
   gap: 10px !important;
   align-items: center !important;
   position: relative !important;
 }
 
+/* The list title must be visible in mobile mode whichever markup rendered it.
+   listHeader.jade has TWO shapes: on a mini screen the `h2.list-header-name` is a
+   direct child of `.list-header`, and otherwise it is wrapped in a `div` (the one
+   that rotates when a list is collapsed). The rules below place the title by grid
+   row/column, which only works on a direct grid ITEM - inside the wrapper the title
+   was not one, so the placement was ignored and the wrapper landed in the 30px first
+   column, squeezing the title to nothing. `display: contents` drops the wrapper from
+   the layout so its children become grid items in both shapes.
+   Not when collapsed: `.list-rotated` needs the wrapper to be a real box to rotate. */
+.mobile-mode .list-header > div:not(.list-rotated):not(.list-move-buttons) {
+  display: contents;
+}
+
 .mobile-mode .list-header .list-header-name {
-  font-size: clamp(18px, 2.5vw, 32px) !important;
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1)) !important;
   font-weight: bold !important;
   grid-row: 1 !important;
   grid-column: 2 !important;
-  align-self: end !important;
+  align-self: center !important;
   display: block !important;
   visibility: visible !important;
   opacity: 1 !important;
 }
 
 .mobile-mode .list-header .cardCount {
-  font-size: clamp(14px, 2vw, 24px) !important;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1)) !important;
   grid-row: 2 !important;
   grid-column: 2 !important;
-  align-self: start !important;
+  align-self: center !important;
   display: block !important;
   visibility: visible !important;
   opacity: 1 !important;
@@ -249,28 +196,39 @@
 
 .mobile-mode .list-header .list-header-menu-icon {
   position: static !important;
-  right: auto !important;
+  inset-inline-end: auto !important;
   top: auto !important;
   transform: none !important;
   grid-row: 1/3 !important;
   grid-column: 3 !important;
   padding: 14px !important;
-  font-size: clamp(24px, 3vw, 48px) !important;
+  font-size: calc(24px * var(--wekan-ui-font-scale, 1)) !important;
   text-align: center !important;
   display: block !important;
   visibility: visible !important;
   opacity: 1 !important;
 }
 
-.mobile-mode .list-header .list-header-handle {
+/* The add-list + between the caret (column 3) and the drag handle (column 5). */
+.mobile-mode .list-header .list-header-add-list {
   position: static !important;
-  right: auto !important;
-  top: auto !important;
-  transform: none !important;
   grid-row: 1/3 !important;
   grid-column: 4 !important;
   padding: 14px !important;
-  font-size: clamp(28px, 3.5vw, 56px) !important;
+  font-size: calc(24px * var(--wekan-ui-font-scale, 1)) !important;
+  text-align: center !important;
+  display: block !important;
+}
+
+.mobile-mode .list-header .list-header-handle {
+  position: static !important;
+  inset-inline-end: auto !important;
+  top: auto !important;
+  transform: none !important;
+  grid-row: 1/3 !important;
+  grid-column: 5 !important;
+  padding: 14px !important;
+  font-size: calc(28px * var(--wekan-ui-font-scale, 1)) !important;
   text-align: center !important;
   display: block !important;
   visibility: visible !important;
@@ -289,25 +247,25 @@
   width: 100% !important;
   min-width: 100% !important;
   max-width: 100% !important;
-  font-size: clamp(16px, 2vw, 24px) !important;
-  padding: 1.2vh 1.5vw 0.5vh !important;
-  min-height: 3vh !important;
+  font-size: calc(16px * var(--wekan-ui-font-scale, 1)) !important;
+  padding: 11px 21px 5px !important;
+  min-height: 24px !important;
   margin-bottom: 0.5rem !important;
   display: block !important;
   float: none !important;
 }
 
 .mobile-mode .minicard .minicard-title {
-  font-size: clamp(16px, 2vw, 24px) !important;
+  font-size: calc(16px * var(--wekan-ui-font-scale, 1)) !important;
   font-weight: bold !important;
 }
 
 .mobile-mode .minicard .minicard-members {
-  font-size: clamp(12px, 1.5vw, 18px) !important;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 .mobile-mode .minicard .minicard-lists {
-  font-size: clamp(12px, 1.5vw, 18px) !important;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 /* Desktop Mode Styles */
@@ -325,22 +283,22 @@
   width: auto !important;
   min-width: auto !important;
   display: flex !important;
-  float: left !important;
+  float: inline-start !important;
   margin-bottom: 0 !important;
-  border-left: 1px solid #ccc !important;
+  border-inline-start: 1px solid #ccc !important;
   border-bottom: none !important;
 }
 
 .desktop-mode .list-header {
   width: auto !important;
   min-width: auto !important;
-  padding: 2.5vh 1.5vw 0.5vh !important;
-  font-size: clamp(14px, 3vw, 18px) !important;
+  padding: 23px 21px 5px !important;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1)) !important;
   display: block !important;
 }
 
 .desktop-mode .list-header .list-header-name {
-  font-size: clamp(14px, 3vw, 18px) !important;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1)) !important;
   display: inline !important;
   grid-row: auto !important;
   grid-column: auto !important;
@@ -348,7 +306,7 @@
 }
 
 .desktop-mode .list-header .cardCount {
-  font-size: 12px !important;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1)) !important;
   grid-row: auto !important;
   grid-column: auto !important;
   align-self: auto !important;
@@ -356,24 +314,24 @@
 
 .desktop-mode .list-header .list-header-menu-icon {
   position: absolute !important;
-  right: 60px !important;
+  inset-inline-end: 60px !important;
   top: 50% !important;
   transform: translateY(-50%) !important;
   grid-row: auto !important;
   grid-column: auto !important;
   padding: 14px !important;
-  font-size: 40px !important;
+  font-size: calc(40px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 .desktop-mode .list-header .list-header-handle {
   position: absolute !important;
-  right: 10px !important;
+  inset-inline-end: 10px !important;
   top: 50% !important;
   transform: translateY(-50%) !important;
   grid-row: auto !important;
   grid-column: auto !important;
   padding: 7px !important;
-  font-size: clamp(16px, 3vw, 20px) !important;
+  font-size: calc(16px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 .desktop-mode .list-body {
@@ -385,27 +343,27 @@
 .desktop-mode .minicard {
   width: auto !important;
   min-width: auto !important;
-  font-size: clamp(12px, 2.5vw, 16px) !important;
-  padding: 0.5vh 0.8vw !important;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1)) !important;
+  padding: 5px 11px !important;
   min-height: auto !important;
   margin-bottom: 9px !important;
 }
 
 .desktop-mode .minicard .minicard-title {
-  font-size: clamp(12px, 2.5vw, 16px) !important;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 .desktop-mode .minicard .minicard-members {
-  font-size: 10px !important;
+  font-size: calc(10px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 .desktop-mode .minicard .minicard-lists {
-  font-size: 10px !important;
+  font-size: calc(10px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 /* Additional Mobile Mode Styles for Other Elements - Works on all screen sizes */
 .mobile-mode .swimlane-header .swimlane-title {
-  font-size: clamp(18px, 2.5vw, 32px) !important;
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1)) !important;
   font-weight: bold !important;
   display: block !important;
   visibility: visible !important;
@@ -413,21 +371,21 @@
 }
 
 .mobile-mode .swimlane-header .swimlane-description {
-  font-size: clamp(14px, 2vw, 24px) !important;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1)) !important;
   display: block !important;
   visibility: visible !important;
   opacity: 1 !important;
 }
 
 .mobile-mode .board-header {
-  font-size: clamp(18px, 2.5vw, 32px) !important;
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1)) !important;
   padding: 1rem !important;
   width: 100% !important;
   max-width: 100% !important;
 }
 
 .mobile-mode .board-header .board-header-title {
-  font-size: clamp(18px, 2.5vw, 32px) !important;
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1)) !important;
   font-weight: bold !important;
   display: block !important;
   visibility: visible !important;
@@ -435,22 +393,22 @@
 }
 
 .mobile-mode .board-header .board-header-description {
-  font-size: clamp(14px, 2vw, 24px) !important;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1)) !important;
   display: block !important;
   visibility: visible !important;
   opacity: 1 !important;
 }
 
 .mobile-mode .board-header .board-header-btn {
-  font-size: clamp(14px, 2vw, 24px) !important;
-  padding: 1vh 1.5vw !important;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1)) !important;
+  padding: 9px 21px !important;
   display: inline-block !important;
   visibility: visible !important;
   opacity: 1 !important;
 }
 
 .mobile-mode .board-header .board-header-btn i {
-  font-size: clamp(14px, 2vw, 24px) !important;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1)) !important;
   display: inline !important;
   visibility: visible !important;
   opacity: 1 !important;
@@ -463,7 +421,7 @@
   visibility: visible !important;
   opacity: 1 !important;
   position: static !important;
-  right: auto !important;
+  inset-inline-end: auto !important;
   top: auto !important;
   transform: none !important;
 }
@@ -472,7 +430,7 @@
   grid-row: 1/3 !important;
   grid-column: 3 !important;
   padding: 14px !important;
-  font-size: clamp(24px, 3vw, 48px) !important;
+  font-size: calc(24px * var(--wekan-ui-font-scale, 1)) !important;
   text-align: center !important;
 }
 
@@ -480,7 +438,7 @@
   grid-row: 1/3 !important;
   grid-column: 4 !important;
   padding: 14px !important;
-  font-size: clamp(28px, 3.5vw, 56px) !important;
+  font-size: calc(28px * var(--wekan-ui-font-scale, 1)) !important;
   text-align: center !important;
 }
 
@@ -498,26 +456,51 @@
   min-width: 100% !important;
 }
 
-/* Force mobile mode list styling on all screen sizes - override desktop CSS */
+/* Every full-width box on a mobile board measures its padding INSIDE its width.
+   `* { box-sizing: unset }` (layouts.css) makes content-box the default, so a rule
+   that sets `width: 100%` AND `padding: 1rem` - which the swimlane header, the list
+   header, the list body and the minicard all do below - comes out 32px wider than its
+   parent. Stacked over four nesting levels that is what put a horizontal scrollbar
+   under the lists, with a small amount to scroll right and nothing there to see. */
+.mobile-mode .board-canvas,
+.mobile-mode .swimlane,
+.mobile-mode .swimlane-header,
+.mobile-mode .swimlane .lists,
+.mobile-mode .list,
+.mobile-mode .list-header,
+.mobile-mode .list-body,
+.mobile-mode .minicard {
+  box-sizing: border-box !important;
+}
+
+/* Force mobile mode list styling on all screen sizes - override desktop CSS.
+
+   These are `100%`, NOT `100vw`. `100vw` is the width of the viewport INCLUDING the
+   vertical scrollbar, and the board canvas scrolls vertically - so every element
+   forced to 100vw was about a scrollbar's width wider than the box it sat in, at each
+   nesting level (canvas > swimlane > lists > list). The result was a board that
+   always overflowed sideways by a sliver and, with `min-width` pinned to the same
+   value, could not reflow narrower. `100%` resolves against the parent's content box,
+   which already excludes the scrollbar. */
 .mobile-mode .board-canvas {
   display: block !important;
   flex-direction: column !important;
   flex-wrap: nowrap !important;
   align-items: stretch !important;
   justify-content: flex-start !important;
-  width: 100vw !important;
-  max-width: 100vw !important;
-  min-width: 100vw !important;
+  width: 100% !important;
+  max-width: 100% !important;
+  min-width: 100% !important;
   overflow-x: hidden !important;
   overflow-y: auto !important;
 }
 
   .mobile-mode .swimlane {
     display: block !important;
-    width: 100vw !important;
-    max-width: 100vw !important;
-    min-width: 100vw !important;
-    margin: 0 0 2rem 0 !important;
+    width: 100% !important;
+    max-width: 100% !important;
+    min-width: 100% !important;
+    margin: 0 !important;
     padding: 0 !important;
     float: none !important;
     clear: both !important;
@@ -525,21 +508,21 @@
 
   .mobile-mode .swimlane .swimlane-header {
     display: block !important;
-    width: 100vw !important;
-    max-width: 100vw !important;
-    min-width: 100vw !important;
-    margin: 0 0 1rem 0 !important;
+    width: 100% !important;
+    max-width: 100% !important;
+    min-width: 100% !important;
+    margin: 0 !important;
     padding: 1rem !important;
-    font-size: clamp(18px, 2.5vw, 32px) !important;
+    font-size: calc(18px * var(--wekan-ui-font-scale, 1)) !important;
     font-weight: bold !important;
     border-bottom: 2px solid #ccc !important;
   }
 
   .mobile-mode .swimlane .lists {
     display: block !important;
-    width: 100vw !important;
-    max-width: 100vw !important;
-    min-width: 100vw !important;
+    width: 100% !important;
+    max-width: 100% !important;
+    min-width: 100% !important;
     margin: 0 !important;
     padding: 0 !important;
     flex-direction: column !important;
@@ -550,15 +533,15 @@
 
   .mobile-mode .list {
     display: block !important;
-    width: 100vw !important;
-    max-width: 100vw !important;
-    min-width: 100vw !important;
-    margin: 0 0 2rem 0 !important;
+    width: 100% !important;
+    max-width: 100% !important;
+    min-width: 100% !important;
+    margin: 0 !important;
     padding: 0 !important;
     float: none !important;
     clear: both !important;
-    border-left: none !important;
-    border-right: none !important;
+    border-inline-start: none !important;
+    border-inline-end: none !important;
     border-top: none !important;
     border-bottom: 2px solid #ccc !important;
     flex: none !important;
@@ -566,20 +549,20 @@
     flex-grow: 0 !important;
     flex-shrink: 0 !important;
     position: static !important;
-    left: auto !important;
-    right: auto !important;
+    inset-inline-start: auto !important;
+    inset-inline-end: auto !important;
     top: auto !important;
     bottom: auto !important;
     transform: none !important;
   }
 
 .mobile-mode .list:first-child {
-  margin-left: 0 !important;
+  margin-inline-start: 0 !important;
   margin-top: 0 !important;
 }
 
 .mobile-mode .list:last-child {
-  margin-right: 0 !important;
+  margin-inline-end: 0 !important;
   margin-bottom: 0 !important;
 }
 
@@ -590,12 +573,12 @@
   min-width: 100% !important;
   height: auto !important;
   min-height: 60px !important;
-  margin: 0 0 2rem 0 !important;
+  margin: 0 !important;
   padding: 0 !important;
   float: none !important;
   clear: both !important;
-  border-left: none !important;
-  border-right: none !important;
+  border-inline-start: none !important;
+  border-inline-end: none !important;
   border-top: none !important;
   border-bottom: 2px solid #ccc !important;
   flex: none !important;
@@ -608,12 +591,12 @@
   min-width: 100% !important;
   height: auto !important;
   min-height: 60px !important;
-  margin: 0 0 2rem 0 !important;
+  margin: 0 !important;
   padding: 0 !important;
   float: none !important;
   clear: both !important;
-  border-left: none !important;
-  border-right: none !important;
+  border-inline-start: none !important;
+  border-inline-end: none !important;
   border-top: none !important;
   border-bottom: 2px solid #ccc !important;
   flex: none !important;
@@ -639,12 +622,12 @@
   width: 100% !important;
   max-width: 100% !important;
   min-width: 100% !important;
-  margin: 0 0 2rem 0 !important;
+  margin: 0 !important;
   padding: 0 !important;
   float: none !important;
   clear: both !important;
-  border-left: none !important;
-  border-right: none !important;
+  border-inline-start: none !important;
+  border-inline-end: none !important;
   border-top: none !important;
   border-bottom: 2px solid #ccc !important;
   flex: none !important;
@@ -652,8 +635,8 @@
   flex-grow: 0 !important;
   flex-shrink: 0 !important;
   position: static !important;
-  left: auto !important;
-  right: auto !important;
+  inset-inline-start: auto !important;
+  inset-inline-end: auto !important;
   top: auto !important;
   bottom: auto !important;
   transform: none !important;
@@ -667,9 +650,9 @@
     flex-wrap: nowrap !important;
     align-items: stretch !important;
     justify-content: flex-start !important;
-    width: 100vw !important;
-    max-width: 100vw !important;
-    min-width: 100vw !important;
+    width: 100% !important;
+    max-width: 100% !important;
+    min-width: 100% !important;
     overflow-x: hidden !important;
     overflow-y: auto !important;
   }
@@ -679,7 +662,7 @@
     width: 100% !important;
     max-width: 100% !important;
     min-width: 100% !important;
-    margin: 0 0 2rem 0 !important;
+    margin: 0 !important;
     padding: 0 !important;
     float: none !important;
     clear: both !important;
@@ -703,12 +686,12 @@
     width: 100% !important;
     max-width: 100% !important;
     min-width: 100% !important;
-    margin: 0 0 2rem 0 !important;
+    margin: 0 !important;
     padding: 0 !important;
     float: none !important;
     clear: both !important;
-    border-left: none !important;
-    border-right: none !important;
+    border-inline-start: none !important;
+    border-inline-end: none !important;
     border-top: none !important;
     border-bottom: 2px solid #ccc !important;
     flex: none !important;
@@ -716,8 +699,8 @@
     flex-grow: 0 !important;
     flex-shrink: 0 !important;
     position: static !important;
-    left: auto !important;
-    right: auto !important;
+    inset-inline-start: auto !important;
+    inset-inline-end: auto !important;
     top: auto !important;
     bottom: auto !important;
     transform: none !important;
@@ -768,10 +751,15 @@
   display: none !important;
 }
 
-/* Hide desktop-specific board header buttons in mobile mode */
-.mobile-mode .board-header-btns.left {
-  display: none !important;
-}
+/* The left group is NOT hidden in mobile mode.
+   It holds edit title / visibility / watch / star / sort, and boardHeader.jade renders
+   them in EXACTLY ONE of the two groups: the left one `unless isMiniScreen`, the right
+   one `if isMiniScreen`. So in mobile mode the left group is already empty and hiding
+   it changes nothing - EXCEPT when the two mobile switches disagree, and then it
+   deletes those five buttons from the bar with no replacement. That is what made the
+   second header bar on a phone hold fewer buttons than the same bar in mobile mode on
+   a desktop window. They now agree (see Utils.isMiniScreen), and this rule is gone so
+   that if they ever drift again the buttons survive instead of vanishing. */
 
 .mobile-mode .board-header-btns.center {
   display: none !important;
@@ -831,12 +819,12 @@
 
 .mobile-mode .board-header .board-header-btn {
   height: 32px !important;
-  line-height: 32px !important;
-  font-size: 15px !important;
+  line-height: calc(32px * var(--wekan-ui-font-scale, 1)) !important;
+  font-size: calc(15px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 .mobile-mode .board-header .board-header-btn i.fa {
-  line-height: 32px !important;
+  line-height: calc(32px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 /* Copy mobile media query styles to mobile mode for consistent appearance */
@@ -856,8 +844,8 @@
 
 .mobile-mode .board-header .board-header-btn {
   height: 32px !important;
-  line-height: 32px !important;
-  font-size: 15px !important;
+  line-height: calc(32px * var(--wekan-ui-font-scale, 1)) !important;
+  font-size: calc(15px * var(--wekan-ui-font-scale, 1)) !important;
   margin: 0 2px !important;
   padding: 4px 8px !important;
   border-radius: 4px !important;
@@ -878,8 +866,8 @@
 }
 
 .mobile-mode .board-header .board-header-btn i.fa {
-  line-height: 32px !important;
-  font-size: 15px !important;
+  line-height: calc(32px * var(--wekan-ui-font-scale, 1)) !important;
+  font-size: calc(15px * var(--wekan-ui-font-scale, 1)) !important;
   margin: 0 !important;
   padding: 0 !important;
 }
@@ -892,9 +880,115 @@
   display: none !important;
 }
 
-/* Hide the board title in mobile mode to match mobile view */
+/* The second header bar on a phone: board title at the left, buttons flowing from
+   the right of the title, sidebar hamburger pinned in the top right corner with its
+   divider to its left.
+   The title used to be hidden here to save a row, which left the bar with nothing but
+   icons - you could not tell which board you were on. A board name is how you know
+   where you are, so it is shown, and it wraps rather than truncating. */
 .mobile-mode .header-board-menu {
-  display: none !important;
+  /* Only as wide as the title needs, so the buttons can start beside it; it may
+     shrink and wrap when the title is long. */
+  flex: 0 1 auto;
+  min-width: 0;
+  overflow-wrap: break-word;
+}
+
+/* The buttons take the space left between the title and the hamburger, and drop to
+   the second row as a block once that space runs out - they are one flex item (see
+   boardHeader.jade), so they never split across the two rows. */
+.mobile-mode #header #header-main-bar .board-header-btns-group {
+  flex: 1 1 auto;
+}
+
+/* The hamburger is taken OUT of the flow and pinned to the top right corner, so it
+   stays there whether the buttons fit on the first row or wrap below. Leaving it in
+   the flow it would follow the buttons down to the second row, since a flex line
+   breaks in order. The bar reserves its width as end padding so a long title or a
+   full row of buttons never runs underneath it. Only on a board: the same bar on All
+   Boards / My Cards / ... has no hamburger, and would just gain empty end padding. */
+body.board-view.mobile-mode #header #header-main-bar {
+  position: relative;
+  /* separator (1px + 8px margins) + button (~20px) + the 8px edge gap. */
+  padding-inline-end: 44px;
+}
+
+body.board-view.mobile-mode #header #header-main-bar .board-header-sidebar-toggle {
+  position: absolute;
+  top: 7px;
+  inset-inline-end: 8px;
+  margin: 0;
+}
+
+/* The same rules by WIDTH, not by mobile mode - and NOT scoped to
+   `body.board-view`, which nothing in the app ever sets: that class is written in
+   67 CSS rules and added by no code, so every one of them, including the
+   mobile-mode pinning above, has never applied. The hamburger only exists on a
+   board page anyway (boardHeaderBar renders it), so `:has()` asks whether it is
+   there instead of asking a class that is never there. A browser without `:has()`
+   simply keeps the old wrapping, which is what it had before.
+
+   On a phone the bar is one row of title + as many buttons as fit, wrapping:
+
+   * the button GROUPS are `display: contents`, so each button is a flex item of
+     the bar itself. As one group they were a single unbreakable item, so the
+     whole set dropped below the title even when there was room beside it for
+     several; now they start immediately to the right of the title and wrap only
+     when they run out of row;
+   * the hamburger leaves the flow and sits in the TOP RIGHT corner, and the bar
+     reserves its width as end padding so a long title or a full row of buttons
+     never runs underneath it. In the flow it followed the buttons down and ended
+     up on a row of its own, which is the empty band under the icons. */
+@media screen and (max-width: 800px) {
+  #header #header-main-bar h1 {
+    flex: 0 1 auto;
+    min-width: 0;
+    overflow-wrap: break-word;
+  }
+
+  /* Not the hamburger: it carries `.board-header-btns` too, and it is positioned
+     out of the flow below - `display: contents` would remove the box that is
+     being positioned. */
+  #header #header-main-bar .board-header-btns-group,
+  #header #header-main-bar .board-header-btns:not(.board-header-sidebar-toggle) {
+    display: contents;
+  }
+
+  /* The hamburger is the LAST button, at the right of the last row: it stays in
+     the flow (so it never covers a button) and its auto start margin pushes it to
+     the end of whichever row it lands on. `order: 1` from the desktop rule
+     already puts it after every other button. It was pinned to the top right
+     corner, which put it beside the title with the icons below it; at the end of
+     the row it reads as what it is - one more button, the last one. */
+  #header #header-main-bar .board-header-sidebar-toggle {
+    position: static;
+    margin-inline-start: auto;
+    margin-inline-end: 8px;
+  }
+
+  /* Eleven icons in TWO rows, not four. Each button was ~20px of icon inside
+     10px of icon margin inside 6px of button margin - 52px of bar for 20px of
+     icon - so five fitted a row and the set took three rows under the title.
+     A 44px touch target with 2px between buttons is 48px each: seven fit a
+     375px row, so the icons take two rows (and the first of them shares the
+     title's row, since the groups are `display: contents` above).
+     44px is the minimum comfortable touch target, so this is as tight as it
+     goes without making them harder to hit. */
+  #header #header-main-bar .board-header-btn {
+    margin: 0 2px;
+    min-width: 44px;
+    height: 44px;
+    line-height: calc(44px * var(--wekan-ui-font-scale, 1));
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+  }
+
+  #header #header-main-bar .board-header-btn i.fa {
+    margin: 0;
+    line-height: 1;
+    float: none;
+  }
 }
 
 /* Ensure the board header takes full width in mobile mode */
@@ -909,31 +1003,48 @@
 
 /* Additional Desktop Mode Styles for Other Elements */
 .desktop-mode .swimlane-header .swimlane-title {
-  font-size: clamp(14px, 3vw, 18px) !important;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 .desktop-mode .swimlane-header .swimlane-description {
-  font-size: 12px !important;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 .desktop-mode .board-header {
-  font-size: clamp(14px, 3vw, 18px) !important;
-  padding: 2.5vh 1.5vw 0.5vh !important;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1)) !important;
+  padding: 23px 21px 5px !important;
 }
 
 .desktop-mode .board-header .board-header-title {
-  font-size: clamp(14px, 3vw, 18px) !important;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 .desktop-mode .board-header .board-header-description {
-  font-size: 12px !important;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1)) !important;
 }
 
 .desktop-mode .board-header .board-header-btn {
-  font-size: clamp(12px, 2.5vw, 16px) !important;
-  padding: 0.5vh 0.8vw !important;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1)) !important;
+  padding: 5px 11px !important;
 }
 
 .desktop-mode .board-header .board-header-btn i {
-  font-size: clamp(12px, 2.5vw, 16px) !important;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1)) !important;
+}
+
+/* #6419: make the board-header action buttons touch-friendly by VIEWPORT WIDTH,
+   not only when the mobile-mode class is toggled. The measured default at a phone
+   width was 28px tall / 13px font (too small to tap reliably). Enlarge vertically
+   + bump the icon/font; width is left to flex so the existing horizontal layout
+   is unchanged. Applies on real phones whether or not mobile-mode auto-applied. */
+@media screen and (max-width: 800px) {
+  .board-header-btns .board-header-btn {
+    min-height: 40px;
+    padding-top: 8px;
+    padding-bottom: 8px;
+    font-size: calc(15px * var(--wekan-ui-font-scale, 1));
+  }
+  .board-header-btns .board-header-btn i.fa {
+    font-size: calc(16px * var(--wekan-ui-font-scale, 1));
+  }
 }

client/components/boards/boardHeader.jade

@@ -1,154 +1,105 @@
-template(name="boardHeaderBar")
-  h1.header-board-menu
-    with currentBoard
-      if $eq title 'Templates'
-        | {{_ 'templates'}}
-      else
-        +viewer
-          = title
-
-  .board-header-btns.left
-    unless isMiniScreen
-      if currentBoard
-        if currentUser
+//- There is no pencil beside the board's name any more: the NAME renames the
+//- board. It is one target instead of a word and an icon that did the same
+//- thing, and the icon was the smaller of the two. client/components/main/header.jade
+//-
+//- Everything else the board's second header bar held, as icons in the FIRST
+//- bar, to the left of the notification bell.
+//-
+//- ICON ONLY, each named by a tooltip. The bar is a single row shared with the
+//- logo, the starred boards, the view menu, the bell and the user menu, and
+//- these are ten more controls - labelled, they would not fit at any width.
+//-
+//- There is no desktop/mobile split any more either. The second bar wrote the
+//- whole set out TWICE, once for each, because a labelled row does not fit on a
+//- phone; icons do, so one set serves both. docs/Features/Page/Header.md
+template(name="boardHeaderButtons")
+  if currentBoard
+    if currentUser
+      .board-header-btns.board-header-controls
+        //- The board's controls fold into one caret at the leading edge of the
+          group - left of the lock in a left-to-right page, right of it in Arabic,
+          because the caret's direction comes from the same rule as every other
+          one. Folded, the seven controls after it are gone; open, they are back.
+          The buttons a board's own Rules put in this bar are NOT folded away with
+          them: somebody added those to this board on purpose.
+          client/lib/foldState.js
+        a.board-header-btn.js-toggle-fold(data-fold="board-controls"
+          title="{{#if isFoldOpen 'board-controls'}}{{_ 'collapse'}}{{else}}{{_ 'uncollapse'}}{{/if}}" role="button" tabindex="0")
+          i.fa(class="{{foldCaret 'board-controls'}}")
+        if isFoldOpen 'board-controls'
           with currentBoard
-            if currentUser.isBoardAdmin
-              a.board-header-btn(class="{{#if currentUser.isBoardAdmin}}js-edit-board-title{{else}}is-disabled{{/if}}" title="{{_ 'edit'}}" value=title)
-                i.fa.fa-pencil-square-o
-
             a.board-header-btn(
               class="{{#if currentUser.isBoardAdmin}}js-change-visibility{{else}}is-disabled{{/if}}"
               title="{{_ currentBoard.permission}}")
               i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
-              span {{_ currentBoard.permission}}
+              //- The SAME expression the tooltip uses, so the two cannot say
+                different things - and both follow the board from Private to
+                Public without a second list of words to keep in step.
+              span.board-header-btn-label {{_ currentBoard.permission}}
 
-            a.board-header-btn.js-watch-board(
-              title="{{_ watchLevel }}")
-              if $eq watchLevel "watching"
-                i.fa.fa-eye
-              if $eq watchLevel "tracking"
-                i.fa.fa-bell
-              if $eq watchLevel "muted"
-                i.fa.fa-bell-slash
-              span {{_ watchLevel}}
-            a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
-              title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}} {{_ 'starred-boards-description'}}")
-              i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
-              if showStarCounter
-                span.board-star-counter {{currentBoard.stars}}
-            a.board-header-btn(title="{{_ 'sort-cards'}}" class="{{#if isSortActive }}emphasis{{else}} js-sort-cards {{/if}}")
+            unless watchDisabled
+              a.board-header-btn.js-watch-board(title="{{_ watchLevel }}")
+                if $eq watchLevel "watching"
+                  i.fa.fa-eye
+                if $eq watchLevel "tracking"
+                  i.fa.fa-bell
+                if $eq watchLevel "muted"
+                  i.fa.fa-bell-slash
+                span.board-header-btn-label {{_ watchLevel }}
+
+            //- The name beside the icon where the bar has room for it, dropped
+              when it does not - one rule in header.css hides every label of this
+              bar below the width they stop fitting at.
+              docs/Features/Page/Header.md
+            a.board-header-btn(title="{{#if isSortActive}}{{_ 'sort-is-on'}}{{else}}{{_ 'sort-cards'}}{{/if}}" class="js-sort-cards {{#if isSortActive }}emphasis{{/if}}")
               i.fa.fa-sort
-              span {{#if isSortActive }}{{_ 'sort-is-on'}}{{else}}{{_ 'sort-cards'}}{{/if}}
+              span.board-header-btn-label {{#if isSortActive}}{{_ 'sort-is-on'}}{{else}}{{_ 'sort-cards'}}{{/if}}
             if isSortActive
               a.board-header-btn-close.js-sort-reset(title="{{_ 'remove-sort'}}")
                 i.fa.fa-times-thin
 
-        else
-          a.board-header-btn.js-log-in(
-            title="{{_ 'log-in'}}")
-            i.fa.fa-sign-in
-            span {{_ 'log-in'}}
+        +boardButtons
 
-  .board-header-btns.center
-
-  .board-header-btns.right
-    if currentBoard
-      if isMiniScreen
-        if currentUser
-          with currentBoard
-            a.board-header-btn(class="{{#if currentUser.isBoardAdmin}}js-edit-board-title{{else}}is-disabled{{/if}}" title="{{_ 'edit'}}" value=title)
-              i.fa.fa-pencil-square-o
-
-            a.board-header-btn(
-              class="{{#if currentUser.isBoardAdmin}}js-change-visibility{{else}}is-disabled{{/if}}"
-              title="{{_ currentBoard.permission}}")
-              i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
-
-            a.board-header-btn.js-watch-board(
-              title="{{_ watchLevel }}")
-              if $eq watchLevel "watching"
-                i.fa.fa-eye
-              if $eq watchLevel "tracking"
-                i.fa.fa-bell
-              if $eq watchLevel "muted"
-                i.fa.fa-bell-slash
-            a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
-              title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}} {{_ 'starred-boards-description'}}")
-              i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
-            a.board-header-btn(title="{{_ 'sort-cards'}}" class="{{#if isSortActive }}emphasis{{else}} js-sort-cards {{/if}}")
-              i.fa.fa-sort
-              span {{#if isSortActive }}{{_ 'sort-is-on'}}{{else}}{{_ 'sort-cards'}}{{/if}}
-            if isSortActive
-              a.board-header-btn-close.js-sort-reset(title="{{_ 'remove-sort'}}")
-                i.fa.fa-times-thin
-
-        else
-          a.board-header-btn.js-log-in(
-            title="{{_ 'log-in'}}")
-            i.fa.fa-sign-in
-
-      if isSandstorm
-        if currentUser
-          a.board-header-btn.js-open-archived-board
-            i.fa.fa-archive
-
-      //if showSort
-      //
-        a.board-header-btn.js-open-sort-view(title="{{_ 'sort-desc'}}")
-      //
-          i.fa(class="{{directionClass}}")
-      //
-          span {{_ 'sort'}}{{_ listSortShortDesc}}
-
-      a.board-header-btn.js-open-filter-view(
-          title="{{#if Filter.isActive}}{{_ 'filter-on-desc'}}{{else}}{{_ 'filter'}}{{/if}}"
-          class="{{#if Filter.isActive}}js-filter-active{{/if}}")
-        i.fa.fa-filter
-        span {{#if Filter.isActive}}{{_ 'filter-on-desc'}}{{else}}{{_ 'filter'}}{{/if}}
-        if Filter.isActive
-          a.board-header-btn-close.js-filter-reset(title="{{_ 'filter-clear'}}")
-            i.fa.fa-times-thin
-
-      a.board-header-btn.js-open-search-view(title="{{_ 'search'}}")
-        i.fa.fa-search
-        span {{_ 'search'}}
-
-      unless currentBoard.isTemplatesBoard
-        a.board-header-btn.js-toggle-board-view
-          i.fa.fa-caret-down
-          if $eq boardView 'board-view-swimlanes'
-            i.fa.fa-th-large
-          if $eq boardView 'board-view-lists'
-            i.fa.fa-trello
-          if $eq boardView 'board-view-cal'
-            i.fa.fa-calendar
-          if $eq boardView 'board-view-gantt'
-            i.fa.fa-bar-chart
-          span
-            if $eq boardView 'board-view-swimlanes'
-              | {{_ 'swimlanes'}}
-            if $eq boardView 'board-view-lists'
-              | {{_ 'lists'}}
-            if $eq boardView 'board-view-cal'
-              | {{_ 'calendar'}}
-            if $eq boardView 'board-view-gantt'
-              | {{_ 'gantt'}}
-      if canModifyBoard
-        a.board-header-btn.js-multiselection-activate(
-            title="{{#if MultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}"
-            class="{{#if MultiSelection.isActive}}emphasis{{/if}}")
-          i.fa.fa-check-square-o
-          span {{#if MultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}
-          if MultiSelection.isActive
-            a.board-header-btn-close.js-multiselection-reset(title="{{_ 'filter-clear'}}")
+        if isFoldOpen 'board-controls'
+          a.board-header-btn.js-open-filter-view(
+              title="{{#if Filter.isActive}}{{_ 'filter-on-desc'}}{{else}}{{_ 'filter'}}{{/if}}"
+              class="{{#if Filter.isActive}}js-filter-active{{/if}}")
+            i.fa.fa-filter
+            span.board-header-btn-label {{#if Filter.isActive}}{{_ 'filter-on-desc'}}{{else}}{{_ 'filter'}}{{/if}}
+          if Filter.isActive
+            a.board-header-btn-close.js-filter-reset(title="{{_ 'filter-clear'}}")
               i.fa.fa-times-thin
 
-      .separator
-      a.board-header-btn.js-toggle-sidebar(title="{{_ 'sidebar-open'}} {{_ 'or'}} {{_ 'sidebar-close'}}")
-        i.fa.fa-bars
+          a.board-header-btn.js-open-search-view(title="{{_ 'search'}}")
+            i.fa.fa-search
+            span.board-header-btn-label {{_ 'search'}}
 
+          a.board-header-btn.js-toggle-dependencies(
+              title="{{#if currentBoard.showDependencies}}{{_ 'hide-dependencies'}}{{else}}{{_ 'show-dependencies'}}{{/if}}"
+              class="{{#if currentBoard.showDependencies}}emphasis{{/if}}")
+            i.fa.fa-link
+            span.board-header-btn-label {{#if currentBoard.showDependencies}}{{_ 'hide-dependencies'}}{{else}}{{_ 'show-dependencies'}}{{/if}}
+
+          if canModifyBoard
+            a.board-header-btn.js-multiselection-activate(
+                title="{{#if MultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}"
+                class="{{#if MultiSelection.isActive}}emphasis{{/if}}")
+              i.fa.fa-check-square-o
+              //- Named, like the board's Multi-Selection on All Boards: a
+                check-box outline says nothing about what the button does.
+              span.board-header-btn-label {{_ 'multi-selection'}}
+            if MultiSelection.isActive
+              a.board-header-btn-close.js-multiselection-reset(title="{{_ 'multi-selection-off'}}")
+                i.fa.fa-times-thin
+    else
+      a.board-header-btn.js-log-in(title="{{_ 'log-in'}}")
+        i.fa.fa-sign-in
+
+//- `described-list`: every row is icon + name + description, and the three are laid
+//- out as three left-aligned columns (popup.css), so the descriptions of all the
+//- rows start at the same x whether or not a row carries the check mark.
 template(name="boardVisibilityList")
-  ul.pop-over-list
+  ul.pop-over-list.described-list
     li
       with "private"
         a.js-select-visibility
@@ -171,7 +122,7 @@ template(name="boardChangeVisibilityPopup")
   +boardVisibilityList
 
 template(name="boardChangeWatchPopup")
-  ul.pop-over-list
+  ul.pop-over-list.described-list
     li
       with "watching"
         a.js-select-watch
@@ -227,123 +178,71 @@ template(name="boardChangeViewPopup")
           | {{_ 'board-view-gantt'}}
           if $eq Utils.boardView "board-view-gantt"
             i.fa.fa-check
+    li
+      with "board-view-table"
+        a.js-open-table-view
+          i.fa.fa-table
+          | {{_ 'board-view-table'}}
+          if $eq Utils.boardView "board-view-table"
+            i.fa.fa-check
+    li
+      with "board-view-stats"
+        a.js-open-stats-view
+          i.fa.fa-pie-chart
+          | {{_ 'board-view-stats'}}
+          if $eq Utils.boardView "board-view-stats"
+            i.fa.fa-check
+
+//- The Create Board form: a title, what the board is visible to, and Create.
+  Four templates drew it letter for letter - the one on the All Boards page and
+  three popups, one of which creates a TEMPLATE board and says so with a Session
+  flag rather than with different markup.
+//-
+//- The two things it shows about visibility are passed IN. The state itself
+  (setupCreateBoardState) and the handlers stay with each of the four: an event
+  in here bubbles to whichever one included it, which is the one holding the
+  state, and that is what keeps `createTemplateContainerPopup` creating a
+  template board and the others an ordinary one.
+  client/components/boards/boardHeader.js
+template(name="createBoardForm")
+  form
+    label
+      | {{_ 'title'}}
+      input.js-new-board-title(type="text" placeholder="{{_ 'bucket-example'}}" autofocus required)
+    if visibilityMenuIsOpen
+      +boardVisibilityList
+    else
+      p.quiet
+        if $eq visibility 'public'
+          span.fa.fa-globe.colorful
+          = " "
+          | {{{_ 'board-public-info'}}}
+        else
+          span.fa.fa-lock.colorful
+          = " "
+          | {{{_ 'board-private-info'}}}
+        a.js-change-visibility {{_ 'change'}}.
+    input.primary.wide(type="submit" value="{{_ 'create'}}")
+    unless importDisabled
+      span.quiet
+        | {{_ 'or'}}
+        a.js-import-board {{_ 'import'}}
+    span.quiet
+      | /
+      a.js-board-template {{_ 'template'}}
 
 template(name="createBoard")
-  form
-    label
-      | {{_ 'title'}}
-      input.js-new-board-title(type="text" placeholder="{{_ 'bucket-example'}}" autofocus required)
-    if visibilityMenuIsOpen
-      +boardVisibilityList
-    else
-      p.quiet
-        if $eq visibility 'public'
-          span.fa.fa-globe.colorful
-          = " "
-          | {{{_ 'board-public-info'}}}
-        else
-          span.fa.fa-lock.colorful
-          = " "
-          | {{{_ 'board-private-info'}}}
-        a.js-change-visibility {{_ 'change'}}.
-    a.flex.js-toggle-add-template-container
-      .materialCheckBox#add-template-container
-      span {{_ 'add-template-container'}}
-    input.primary.wide(type="submit" value="{{_ 'create'}}")
-    span.quiet
-      | {{_ 'or'}}
-      a.js-import-board {{_ 'import'}}
-    span.quiet
-      | /
-      a.js-board-template {{_ 'template'}}
+  +createBoardForm(visibility=visibility visibilityMenuIsOpen=visibilityMenuIsOpen)
 
 template(name="createBoardPopup")
-  form
-    label
-      | {{_ 'title'}}
-      input.js-new-board-title(type="text" placeholder="{{_ 'bucket-example'}}" autofocus required)
-    if visibilityMenuIsOpen
-      +boardVisibilityList
-    else
-      p.quiet
-        if $eq visibility 'public'
-          span.fa.fa-globe.colorful
-          = " "
-          | {{{_ 'board-public-info'}}}
-        else
-          span.fa.fa-lock.colorful
-          = " "
-          | {{{_ 'board-private-info'}}}
-        a.js-change-visibility {{_ 'change'}}.
-    a.flex.js-toggle-add-template-container
-      .materialCheckBox#add-template-container
-      span {{_ 'add-template-container'}}
-    input.primary.wide(type="submit" value="{{_ 'create'}}")
-    span.quiet
-      | {{_ 'or'}}
-      a.js-import-board {{_ 'import'}}
-    span.quiet
-      | /
-      a.js-board-template {{_ 'template'}}
+  +createBoardForm(visibility=visibility visibilityMenuIsOpen=visibilityMenuIsOpen)
 
 template(name="headerBarCreateBoardPopup")
-  form
-    label
-      | {{_ 'title'}}
-      input.js-new-board-title(type="text" placeholder="{{_ 'bucket-example'}}" autofocus required)
-    if visibilityMenuIsOpen
-      +boardVisibilityList
-    else
-      p.quiet
-        if $eq visibility 'public'
-          span.fa.fa-globe.colorful
-          = " "
-          | {{{_ 'board-public-info'}}}
-        else
-          span.fa.fa-lock.colorful
-          = " "
-          | {{{_ 'board-private-info'}}}
-        a.js-change-visibility {{_ 'change'}}.
-    a.flex.js-toggle-add-template-container
-      .materialCheckBox#add-template-container
-      span {{_ 'add-template-container'}}
-    input.primary.wide(type="submit" value="{{_ 'create'}}")
-    span.quiet
-      | {{_ 'or'}}
-      a.js-import-board {{_ 'import'}}
-    span.quiet
-      | /
-      a.js-board-template {{_ 'template'}}
+  +createBoardForm(visibility=visibility visibilityMenuIsOpen=visibilityMenuIsOpen)
 
 // New popup for Template Container creation; shares the same form content
 template(name="createTemplateContainerPopup")
-  form
-    label
-      | {{_ 'title'}}
-      input.js-new-board-title(type="text" placeholder="{{_ 'bucket-example'}}" autofocus required)
-    if visibilityMenuIsOpen
-      +boardVisibilityList
-    else
-      p.quiet
-        if $eq visibility 'public'
-          span.fa.fa-globe.colorful
-          = " "
-          | {{{_ 'board-public-info'}}}
-        else
-          span.fa.fa-lock.colorful
-          = " "
-          | {{{_ 'board-private-info'}}}
-        a.js-change-visibility {{_ 'change'}}.
-    a.flex.js-toggle-add-template-container
-      .materialCheckBox#add-template-container
-      span {{_ 'add-template-container'}}
-    input.primary.wide(type="submit" value="{{_ 'create'}}")
-    span.quiet
-      | {{_ 'or'}}
-      a.js-import-board {{_ 'import'}}
-    span.quiet
-      | /
-      a.js-board-template {{_ 'template'}}
+  +createBoardForm(visibility=visibility visibilityMenuIsOpen=visibilityMenuIsOpen)
 
 //template(name="listsortPopup")
 //
@@ -363,7 +262,7 @@ template(name="createTemplateContainerPopup")
 //
         if $eq sortby value.name
 //
-           | {{#if $eq Direction "fa-arrow-up"}}⬆️{{else}}⬇️{{/if}}
+           i.fa(class="{{#if $eq Direction 'fa-arrow-up'}}fa-arrow-up{{else}}fa-arrow-down{{/if}}")
 //
         | {{_ value.label }}{{_ value.shortLabel}}
 //
@@ -407,3 +306,50 @@ template(name="cardsSortPopup")
         i.fa.fa-arrow-up
         | {{_ 'created-at-oldest-first'}}
 
+
+//- The board's view menu, in the FIRST top header bar.
+//-
+//- It was a button in the board's second header bar. A view menu says what you
+//- are looking AT, so it belongs beside the page's name in the one bar that is
+//- always on screen - the same place the All Boards Lists/Table menu is.
+//-
+//- `unless currentBoard.isTemplatesBoard`: there is nothing to look at six
+//- ways on a templates board. docs/Features/Page/Header.md
+//- Whether THIS board is starred, and the button that changes it. Its own
+//- template because the first header bar places it beside the starred-boards
+//- dropdown rather than among the board's other controls: the two are one pair -
+//- how many boards you have starred, and whether this is one of them.
+//-
+//- The outline star means not starred and the solid one means starred, so the
+//- button shows its state rather than the action - the tooltip says the action.
+//- docs/Features/Page/Header.md
+template(name="boardStarButton")
+  if currentBoard
+    a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
+      title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}}")
+      i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
+      if showStarCounter
+        span.board-star-counter {{currentBoard.stars}}
+
+template(name="boardViewMenu")
+  unless currentBoard.isTemplatesBoard
+    //- The name is VISIBLE beside the icon, not only in the tooltip. Six view
+      icons are six glyphs to learn, and a tooltip is the one place a name
+      cannot be read without hovering - so the button says which view is on.
+      The bar wraps to a second row when it runs out of width, which is what
+      makes a word beside the icon affordable. docs/Features/Page/Header.md
+    a.board-header-btn.js-toggle-board-view(title="{{boardViewName}}")
+      i.fa.fa-caret-down
+      if $eq boardView 'board-view-swimlanes'
+        i.fa.fa-th-large
+      if $eq boardView 'board-view-lists'
+        i.fa.fa-trello
+      if $eq boardView 'board-view-cal'
+        i.fa.fa-calendar
+      if $eq boardView 'board-view-gantt'
+        i.fa.fa-bar-chart
+      if $eq boardView 'board-view-table'
+        i.fa.fa-table
+      if $eq boardView 'board-view-stats'
+        i.fa.fa-pie-chart
+      span.board-header-btn-label= boardViewName

client/components/boards/boardHeader.js

@@ -1,15 +1,23 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
+const { allBoardsPath, SECTION_ARCHIVE } = require('/models/lib/allBoardsUrls');
 import dragscroll from '@wekanteam/dragscroll';
 import getSlug from 'limax';
 import Boards from '/models/boards';
 import Swimlanes from '/models/swimlanes';
 import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
 import { Filter } from '/client/lib/filter';
+// Which way a button that opens a sidebar view goes on a click - one answer,
+// in one place, for both Filter and Search.
+import {
+  SIDEBAR_VIEW_CLOSE,
+  sidebarViewButtonAction,
+} from '/models/lib/sidebarViewButton';
 import { MultiSelection } from '/client/lib/multiSelection';
 import { getSidebarInstance } from '/client/features/sidebar/service';
 import { Utils } from '/client/lib/utils';
+import { toggleFold } from '/client/lib/foldState';
 
 /*
 const DOWNCLS = 'fa-sort-down';
@@ -17,6 +25,21 @@ const UPCLS = 'fa-sort-up';
 */
 const sortCardsBy = new ReactiveVar('');
 
+// Persist the card sort so it survives a page reload. Session is in-memory and
+// is reset on reload, which is why "sort by due date" kept reverting to the
+// default. See https://github.com/wekan/wekan/issues/5886
+const CARDS_SORT_BY_STORAGE_KEY = 'wekan-cards-sortBy';
+function setCardsSortBy(sortBy) {
+  Session.set('sortBy', sortBy);
+  try {
+    if (sortBy) {
+      window.localStorage.setItem(CARDS_SORT_BY_STORAGE_KEY, JSON.stringify(sortBy));
+    } else {
+      window.localStorage.removeItem(CARDS_SORT_BY_STORAGE_KEY);
+    }
+  } catch (e) {}
+}
+
 Template.boardChangeTitlePopup.events({
   async submit(event, templateInstance) {
     event.preventDefault();
@@ -29,7 +52,16 @@ Template.boardChangeTitlePopup.events({
       .val()
       .trim();
     if (newTitle) {
-      const board = Utils.getCurrentBoard();
+      // The board this popup was opened FOR, when it was opened for one: the
+      // All Boards Table view opens this same popup from a row whose data
+      // context is that row's board (docs/Features/Page/All-Boards.md), and on
+      // that page there is no "current board" at all. The board header opens it
+      // with the current board as its context, so that side is unchanged.
+      const context = Template.currentData();
+      const board =
+        context && context._id && typeof context.rename === 'function'
+          ? context
+          : Utils.getCurrentBoard();
       if (board) {
         await board.rename(newTitle);
         await board.setDescription(newDesc);
@@ -39,98 +71,140 @@ Template.boardChangeTitlePopup.events({
   },
 });
 
-Template.boardHeaderBar.helpers({
+Template.boardHeaderButtons.onCreated(function () {
+  Meteor.subscribe('tableVisibilityModeSettings');
+  // Restore the persisted card sort after a reload (Session is in-memory), so
+  // both the sorting and the sort icon are remembered. See #5886.
+  if (!Session.get('sortBy')) {
+    try {
+      const stored = window.localStorage.getItem(CARDS_SORT_BY_STORAGE_KEY);
+      if (stored) {
+        Session.set('sortBy', JSON.parse(stored));
+      }
+    } catch (e) {}
+  }
+});
+
+Template.boardHeaderButtons.helpers({
+  notDisplayThisBoard() {
+    const allowPrivateVisibilityOnly = TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly');
+    const currentBoard = Utils.getCurrentBoard();
+    return (
+      allowPrivateVisibilityOnly !== undefined &&
+      allowPrivateVisibilityOnly.booleanValue &&
+      currentBoard &&
+      currentBoard.permission === 'public'
+    );
+  },
+
   watchLevel() {
     const currentBoard = Utils.getCurrentBoard();
     return currentBoard && currentBoard.getWatchLevel(Meteor.userId());
   },
 
-  isStarred() {
-    const boardId = Session.get('currentBoard');
-    const user = ReactiveCache.getCurrentUser();
-    return user && user.hasStarred(boardId);
-  },
-
-  // Only show the star counter if the number of star is greater than 2
-  showStarCounter() {
-    const currentBoard = Utils.getCurrentBoard();
-    return currentBoard && currentBoard.stars >= 2;
-  },
-
   boardView() {
     return Utils.boardView();
   },
   isSortActive() {
     return Session.get('sortBy') ? true : false;
   },
+  // A Font Awesome class name for the active sort, not an emoji.
   sortCardsIcon() {
     const sortBy = Session.get('sortBy');
     if (!sortBy) {
-      return '🃏'; // Card icon when nothing is selected
+      return 'fa-sort'; // nothing chosen
     }
-
-    // Determine which sort option is active based on sortBy object
     if (sortBy.dueAt) {
-      return '📅'; // Due date icon
+      return 'fa-clock-o'; // due date
     } else if (sortBy.title) {
-      return '🔤'; // Alphabet icon
+      return 'fa-font'; // alphabetical
     } else if (sortBy.createdAt) {
-      return sortBy.createdAt === 1 ? '⬆️' : '⬇️'; // Up/down arrow based on direction
+      return sortBy.createdAt === 1 ? 'fa-arrow-up' : 'fa-arrow-down';
     }
-
-    return '🃏'; // Default card icon
+    return 'fa-sort';
   },
 });
 
-Template.boardHeaderBar.events({
-  'click .js-edit-board-title': Popup.open('boardChangeTitle'),
+// The board star, in its own template because the first header bar places it
+// beside the starred-boards dropdown. A Blaze event map only sees events inside
+// its own template, so its helpers and its click come with its markup.
+Template.boardStarButton.helpers({
+  isStarred() {
+    const boardId = Session.get('currentBoard');
+    const user = ReactiveCache.getCurrentUser();
+    return user && user.hasStarred(boardId);
+  },
+
+  // Only show the star counter if the number of stars is greater than 2.
+  showStarCounter() {
+    const currentBoard = Utils.getCurrentBoard();
+    return currentBoard && currentBoard.stars >= 2;
+  },
+
+  currentBoard() {
+    return Utils.getCurrentBoard();
+  },
+});
+
+Template.boardStarButton.events({
   'click .js-star-board'() {
     const boardId = Session.get('currentBoard');
     if (boardId) {
       Meteor.call('toggleBoardStar', boardId);
     }
   },
-  'click .js-open-board-menu': Popup.open('boardMenu'),
+});
+
+// Open the sidebar on `view`, or shut it when it is already showing that view.
+// `mustStayOpen` is Filter's exception: see models/lib/sidebarViewButton.js.
+function toggleSidebarView(view, mustStayOpen) {
+  const sidebar = getSidebarInstance();
+  if (!sidebar) {
+    console.warn('Sidebar not available for setView');
+    return;
+  }
+  // Open AND on this view: a sidebar open on Activities is showing neither, and
+  // clicking either button there has to switch to it rather than close.
+  const isShowingView = sidebar.isOpen() && sidebar.getView() === view;
+  if (sidebarViewButtonAction(isShowingView, mustStayOpen) === SIDEBAR_VIEW_CLOSE) {
+    sidebar.hide();
+    return;
+  }
+  sidebar.setView(view);
+}
+
+Template.boardHeaderButtons.events({
+  // The board's controls fold into the caret at the start of the group. Named
+  // by the words the app already has for it - Collapse and Uncollapse - rather
+  // than a key of its own in 147 language files. client/lib/foldState.js
+  'click .js-toggle-fold'(event) {
+    event.preventDefault();
+    toggleFold(event.currentTarget.dataset.fold);
+  },
+  'keydown .js-toggle-fold'(event) {
+    if (event.key !== 'Enter' && event.key !== ' ') return;
+    event.preventDefault();
+    toggleFold(event.currentTarget.dataset.fold);
+  },
   'click .js-change-visibility': Popup.open('boardChangeVisibility'),
   'click .js-watch-board': Popup.open('boardChangeWatch'),
+  // Boards in Archive is a SECTION of All Boards, not a page of its own: the
+  // row in its left menu. `/archive` is the full-width page that section
+  // replaced. docs/Features/Page/Archive.md
   'click .js-open-archived-board'() {
-    Modal.open('archivedBoards');
-  },
-  'click .js-toggle-board-view': Popup.open('boardChangeView'),
-  'click .js-toggle-sidebar'() {
-    if (process.env.DEBUG === 'true') {
-      console.log('Hamburger menu clicked');
-    }
-    // Use the same approach as keyboard shortcuts
-    const sidebar = getSidebarInstance();
-    if (sidebar && typeof sidebar.toggle === 'function') {
-      if (process.env.DEBUG === 'true') {
-        console.log('Using Sidebar.toggle()');
-      }
-      sidebar.toggle();
-    } else {
-      if (process.env.DEBUG === 'true') {
-        console.warn('Sidebar not available, trying alternative approach');
-      }
-      // Try to trigger the sidebar through the global Blaze helper
-      if (typeof Blaze !== 'undefined' && Blaze._globalHelpers && Blaze._globalHelpers.Sidebar) {
-        const blazeSidebar = Blaze._globalHelpers.Sidebar();
-        if (blazeSidebar && typeof blazeSidebar.toggle === 'function') {
-          if (process.env.DEBUG === 'true') {
-            console.log('Using Blaze helper Sidebar.toggle()');
-          }
-          blazeSidebar.toggle();
-        }
-      }
-    }
+    FlowRouter.go(allBoardsPath(SECTION_ARCHIVE, []));
   },
+  // The button that opens the filter sidebar also shuts it. It only ever
+  // opened, so a second click did nothing visible and the only way back was the
+  // sidebar's own X - somewhere else on screen from the thing you just clicked.
+  //
+  // Not while a filter is ON, though: the sidebar is then the one place that
+  // says what is being hidden from the board, and closing it would leave a
+  // board showing a subset of its cards with nothing on screen to say so. The X
+  // beside this button is what clears the filter.
+  // models/lib/sidebarViewButton.js
   'click .js-open-filter-view'() {
-    const sidebar = getSidebarInstance();
-    if (sidebar) {
-      sidebar.setView('filter');
-    } else {
-      console.warn('Sidebar not available for setView');
-    }
+    toggleSidebarView('filter', Filter.isActive());
   },
   'click .js-sort-cards': Popup.open('cardsSort'),
   /*
@@ -156,14 +230,18 @@ Template.boardHeaderBar.events({
     Filter.reset();
   },
   'click .js-sort-reset'() {
-    Session.set('sortBy', '');
+    setCardsSortBy('');
   },
+  // Search shuts what it opened too, with no exception: its results are inside
+  // the panel, so closing it hides nothing from the board the way closing an
+  // active filter's panel would. models/lib/sidebarViewButton.js
   'click .js-open-search-view'() {
-    const sidebar = getSidebarInstance();
-    if (sidebar) {
-      sidebar.setView('search');
-    } else {
-      console.warn('Sidebar not available for setView');
+    toggleSidebarView('search', false);
+  },
+  'click .js-toggle-dependencies'() {
+    const currentBoard = Utils.getCurrentBoard();
+    if (currentBoard) {
+      currentBoard.setShowDependencies(!currentBoard.showDependencies);
     }
   },
   'click .js-multiselection-activate'() {
@@ -199,6 +277,14 @@ Template.boardChangeViewPopup.events({
     Utils.setBoardView('board-view-gantt');
     Popup.back();
   },
+  'click .js-open-table-view'() {
+    Utils.setBoardView('board-view-table');
+    Popup.back();
+  },
+  'click .js-open-stats-view'() {
+    Utils.setBoardView('board-view-stats');
+    Popup.back();
+  },
 });
 
 // Shared setup for all create board popups
@@ -206,6 +292,9 @@ function setupCreateBoardState(tpl) {
   tpl.visibilityMenuIsOpen = new ReactiveVar(false);
   tpl.visibility = new ReactiveVar('private');
   tpl.boardId = new ReactiveVar('');
+  // #5850: default to creating a regular board; the dedicated
+  // createTemplateContainerPopup sets this true in its onRendered.
+  Session.set('createBoardAsTemplate', false);
   Meteor.subscribe('tableVisibilityModeSettings');
 }
 
@@ -218,7 +307,7 @@ function createBoardHelpers() {
       return Template.instance().visibility.get();
     },
     notAllowPrivateVisibilityOnly() {
-      return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly').booleanValue;
+      return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly')?.booleanValue;
     },
     visibilityCheck() {
       return Template.currentData() === Template.instance().visibility.get();
@@ -231,7 +320,11 @@ async function createBoardSubmit(tpl, event) {
   const title = tpl.find('.js-new-board-title').value;
   const slug = getSlug(title) || 'board';
 
-  const addTemplateContainer = $('#add-template-container.is-checked').length > 0;
+  // #5850: template boards are created via the dedicated "Add Template Board"
+  // flow (createTemplateContainerPopup), signalled by this Session flag, rather
+  // than a checkbox on the generic Create Board popup. Consume it immediately.
+  const addTemplateContainer = Session.get('createBoardAsTemplate') === true;
+  Session.set('createBoardAsTemplate', false);
   if (addTemplateContainer) {
     tpl.boardId.set(
       await Meteor.callAsync('createBoardWithInitialSwimlanes', {
@@ -241,9 +334,9 @@ async function createBoardSubmit(tpl, event) {
         type: 'template-container',
         migrationVersion: 1,
         swimlanes: [
-          { title: 'Card Templates', sort: 1, type: 'template-container' },
-          { title: 'List Templates', sort: 2, type: 'template-container' },
-          { title: 'Board Templates', sort: 3, type: 'template-container' },
+          { title: 'Card Templates', sort: 1, type: 'template-container', role: 'card' },
+          { title: 'List Templates', sort: 2, type: 'template-container', role: 'list' },
+          { title: 'Board Templates', sort: 3, type: 'template-container', role: 'board' },
         ],
       }),
     );
@@ -288,21 +381,17 @@ async function createBoardSubmit(tpl, event) {
 function createBoardEvents() {
   return {
     'click .js-select-visibility'(event, tpl) {
-      tpl.visibility.set(Template.currentData());
+      tpl.visibility.set(this);
       tpl.visibilityMenuIsOpen.set(false);
     },
     'click .js-change-visibility'(event, tpl) {
       tpl.visibilityMenuIsOpen.set(!tpl.visibilityMenuIsOpen.get());
     },
-    'click .js-import': Popup.open('boardImportBoard'),
     async 'submit'(event, tpl) {
       await createBoardSubmit(tpl, event);
     },
     'click .js-import-board': Popup.open('chooseBoardSource'),
     'click .js-board-template': Popup.open('searchElement'),
-    'click .js-toggle-add-template-container'() {
-      $('#add-template-container').toggleClass('is-checked');
-    },
   };
 }
 
@@ -330,8 +419,8 @@ Template.createTemplateContainerPopup.onCreated(function () {
 });
 
 Template.createTemplateContainerPopup.onRendered(function () {
-  // Always pre-check the template container checkbox for this popup
-  $('#add-template-container').addClass('is-checked');
+  // #5850: this dedicated popup always creates a template board.
+  Session.set('createBoardAsTemplate', true);
 });
 
 Template.createTemplateContainerPopup.helpers(createBoardHelpers());
@@ -347,13 +436,12 @@ Template.headerBarCreateBoardPopup.helpers(createBoardHelpers());
 
 Template.headerBarCreateBoardPopup.events({
   'click .js-select-visibility'(event, tpl) {
-    tpl.visibility.set(Template.currentData());
+    tpl.visibility.set(this);
     tpl.visibilityMenuIsOpen.set(false);
   },
   'click .js-change-visibility'(event, tpl) {
     tpl.visibilityMenuIsOpen.set(!tpl.visibilityMenuIsOpen.get());
   },
-  'click .js-import': Popup.open('boardImportBoard'),
   async submit(event, tpl) {
     await createBoardSubmit(tpl, event);
     // Immediately star boards created with the headerbar popup.
@@ -361,8 +449,11 @@ Template.headerBarCreateBoardPopup.events({
   },
   'click .js-import-board': Popup.open('chooseBoardSource'),
   'click .js-board-template': Popup.open('searchElement'),
-  'click .js-toggle-add-template-container'() {
-    $('#add-template-container').toggleClass('is-checked');
+});
+
+Template.boardVisibilityList.helpers({
+  notAllowPrivateVisibilityOnly() {
+    return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly')?.booleanValue;
   },
 });
 
@@ -372,7 +463,7 @@ Template.boardChangeVisibilityPopup.onCreated(function () {
 
 Template.boardChangeVisibilityPopup.helpers({
   notAllowPrivateVisibilityOnly(){
-    return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly').booleanValue;
+    return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly')?.booleanValue;
   },
   visibilityCheck() {
     const currentBoard = Utils.getCurrentBoard();
@@ -383,7 +474,7 @@ Template.boardChangeVisibilityPopup.helpers({
 Template.boardChangeVisibilityPopup.events({
   'click .js-select-visibility'() {
     const currentBoard = Utils.getCurrentBoard();
-    const visibility = Template.currentData();
+    const visibility = this;
     if (typeof visibility === 'string') {
       currentBoard.setVisibility(visibility);
       Popup.back();
@@ -405,18 +496,38 @@ Template.boardChangeWatchPopup.helpers({
 
 Template.boardChangeWatchPopup.events({
   'click .js-select-watch'() {
-    const level = Template.currentData();
-    if (typeof level === 'string') {
-      Meteor.call(
-        'watch',
-        'board',
-        Session.get('currentBoard'),
-        level,
-        (err, ret) => {
-          if (!err && ret) Popup.back();
-        },
-      );
-    }
+    // `this` is the data context of the clicked row - the string from the
+    // enclosing {{#with "watching"}}. Blaze can hand that back as a boxed
+    // String, so read it through String() rather than refusing anything that is
+    // not typeof 'string'.
+    const level = this === null || this === undefined ? '' : String(this);
+    if (!level) return;
+    Meteor.call(
+      'watch',
+      'board',
+      Session.get('currentBoard'),
+      level,
+      (err, ret) => {
+        if (!err && ret) {
+          Popup.back();
+          return;
+        }
+        // AN ERROR MUST NOT BE SILENT. It was: the callback closed the popup on
+        // success and did nothing at all otherwise, so a refusal looked exactly
+        // like a broken button - "Silent does not respond. If we try to change
+        // it does not change. Nothing happens." (email, 2026-08-13). The server
+        // refuses for two reasons an admin can act on: the watch feature is
+        // turned off in the Admin Panel, and the board is not visible to this
+        // user.
+        const reason = err && (err.error || err.reason || err.message);
+        const message = reason === 'error-watch-disabled'
+          ? TAPi18n.__('error-watch-disabled')
+          : TAPi18n.__('error-board-notAMember');
+        // eslint-disable-next-line no-alert
+        if (typeof window !== 'undefined' && window.alert) window.alert(message);
+        if (process.env.DEBUG === 'true') console.error('watch failed:', err);
+      },
+    );
   },
 });
 
@@ -499,7 +610,7 @@ Template.cardsSortPopup.events({
     const sortBy = {
       dueAt: 1,
     };
-    Session.set('sortBy', sortBy);
+    setCardsSortBy(sortBy);
     sortCardsBy.set(TAPi18n.__('due-date'));
     Popup.back();
   },
@@ -507,7 +618,7 @@ Template.cardsSortPopup.events({
     const sortBy = {
       title: 1,
     };
-    Session.set('sortBy', sortBy);
+    setCardsSortBy(sortBy);
     sortCardsBy.set(TAPi18n.__('title'));
     Popup.back();
   },
@@ -515,7 +626,7 @@ Template.cardsSortPopup.events({
     const sortBy = {
       createdAt: 1,
     };
-    Session.set('sortBy', sortBy);
+    setCardsSortBy(sortBy);
     sortCardsBy.set(TAPi18n.__('date-created-newest-first'));
     Popup.back();
   },
@@ -523,8 +634,38 @@ Template.cardsSortPopup.events({
     const sortBy = {
       createdAt: -1,
     };
-    Session.set('sortBy', sortBy);
+    setCardsSortBy(sortBy);
     sortCardsBy.set(TAPi18n.__('date-created-oldest-first'));
     Popup.back();
   },
 });
+
+// The board's view menu is its own template in the FIRST header bar now, so its
+// handler is here rather than on the second bar that used to draw it.
+// docs/Features/Page/Header.md
+Template.boardViewMenu.events({
+  'click .js-toggle-board-view': Popup.open('boardChangeView'),
+});
+
+Template.boardViewMenu.helpers({
+  boardView() {
+    return Utils.boardView();
+  },
+  // The tooltip: the name of the view that is ON. The button is icon only, so
+  // this is the only place the name appears. docs/Features/Page/Header.md
+  boardViewName() {
+    const names = {
+      'board-view-swimlanes': 'swimlanes',
+      'board-view-lists': 'lists',
+      'board-view-cal': 'calendar',
+      'board-view-gantt': 'gantt',
+      'board-view-table': 'board-view-table',
+      'board-view-stats': 'board-view-stats',
+    };
+    return TAPi18n.__(names[Utils.boardView()] || 'board-view');
+  },
+});
+
+// The board is renamed by clicking its NAME in the first header bar, which is
+// handled where that bar is: client/components/main/header.js. The pencil that
+// used to be here is gone with the template it lived in.

client/components/boards/boardLabelHelpers.js

@@ -0,0 +1,42 @@
+/**
+ * Pure helpers for building the option labels shown in board / list /
+ * swimlane selectors (e.g. the move-card and copy-card popups).
+ *
+ * Regression #6135 ("numbering boards, list, swim caused some issues"):
+ * a previous change prepended a sequential number to every option label
+ * (e.g. "3. My Board"). That broke two things:
+ *
+ *   1. Boards whose name itself starts with a digit became hard to read.
+ *   2. First-letter keyboard navigation in the native <select> dropdown
+ *      stopped working, because every option started with a number instead
+ *      of the board name.
+ *
+ * The fix: numbering is OPTIONAL and OFF by default. By default the label is
+ * exactly the entity name, so its first character is the name's first
+ * character and first-letter navigation works again. When numbering is
+ * explicitly enabled, the number is appended as a trailing visual suffix so
+ * the label still STARTS with the name.
+ */
+
+/**
+ * Build the label for a selectable board/list/swimlane option.
+ *
+ * @param {string} name   The entity (board/list/swimlane) name/title.
+ * @param {number} index  Zero-based position in the list.
+ * @param {Object} [opts]
+ * @param {boolean} [opts.numbered=false] When true, append the 1-based
+ *        number as a trailing suffix. When false (default), return the bare
+ *        name so first-letter keyboard navigation keeps working.
+ * @returns {string} The option label.
+ */
+export function boardOptionLabel(name, index, { numbered = false } = {}) {
+  const label = name == null ? '' : String(name);
+  if (!numbered) {
+    return label;
+  }
+  const position = Number(index);
+  const number = Number.isFinite(position) ? position + 1 : index;
+  return `${label} (${number})`;
+}
+
+export default boardOptionLabel;

client/components/boards/boardsList.jade

@@ -1,32 +1,62 @@
 template(name="boardList")
-  .wrapper
-    .board-list-header
-
-    .boards-layout
+  //- `sidebar-open` moves the boards LEFT while the right sidebar is open, so
+    every board icon stays visible between the left menu and the panel instead
+    of hiding under it. Desktop only - on a phone the sidebar is full width and
+    there is nothing to move aside. boardsList.css
+  .wrapper.all-boards-wrapper(class="{{#if isSidebarOpen}}sidebar-open{{/if}}")
+    +allBoardsSidebar
+    //- The folded state is marked on the GRID, not on the menu inside it: a
+      hidden grid ITEM still leaves its track behind, so the boards would keep
+      a 260px-wide nothing beside them. The grid drops to one column and hides
+      the menu in the same rule. The Admin Panel marks its menu instead, because
+      a flex row with a hidden item simply closes up.
+      docs/Features/Page/Left-Menu.md
+    .boards-layout(class="{{#if isLeftMenuCollapsed}}collapsed{{/if}}")
       // Left menu
       .boards-left-menu
+        //- The caret that folds it away - the Admin Panel's own, so the two
+          menus cannot end up with two different carets, and the same control a
+          list has on a board. Folded, the menu is not drawn at all and the
+          caret that brings it back rides on the pane title below.
+          docs/Features/Page/Left-Menu.md
+        +leftMenuCollapse
         ul.menu
-          li(class="menu-item {{#if isSelectedMenu 'starred'}}active{{/if}}")
-            a.js-select-menu(data-type="starred")
-              span.menu-label
-                span.emoji-icon
-                  i.fa.fa-star
-                |  {{_ 'allboards.starred'}}
-              span.menu-count {{menuItemCount 'starred'}}
-          li(class="menu-item {{#if isSelectedMenu 'templates'}}active{{/if}}")
-            a.js-select-menu(data-type="templates")
-              span.menu-label
-                span.emoji-icon
-                  i.fa.fa-clipboard
-                |  {{_ 'allboards.templates'}}
-              span.menu-count {{menuItemCount 'templates'}}
-          li(class="menu-item {{#if isSelectedMenu 'remaining'}}active{{/if}}")
-            a.js-select-menu(data-type="remaining")
-              span.menu-label
-                span.emoji-icon
-                  i.fa.fa-folder
-                |  {{_ 'allboards.remaining'}}
-              span.menu-count {{menuItemCount 'remaining'}}
+          //- ONE row, rendered four times, rather than four copies of the same
+            eight lines. Their ORDER depends on the user - Starred first if
+            anything is starred, Remaining first if not - and four copies could
+            not be reordered without moving markup about.
+            menuSections() asks models/lib/allBoardsUrls.js for the order.
+
+            "Archive", not "Boards in Archive": one word, like its neighbours,
+            and the menu already says what it lists. `archives` is an existing
+            key, translated in the same 135 languages, and the one already used
+            for the archive as a PLACE.
+          each menuSections
+            li(class="menu-item {{#if isSelectedMenu type}}active{{/if}}")
+              a.js-select-menu(class="{{extraClass}}" data-type="{{type}}")
+                span.menu-label
+                  span.emoji-icon
+                    i.fa(class="{{icon}}")
+                  |  {{_ labelKey}}
+                span.menu-count {{sectionCount type}}
+            //- The share targets belong to the TEMPLATES row, so they are drawn
+              inside the loop directly under it - not after the whole list,
+              where they would follow the Archive and read as its sub-list.
+            if $eq type 'templates'
+              if isSelectedMenu 'templates'
+                if shareTargets.length
+                  li.menu-section-title {{_ 'share-template-with'}}
+                  each shareTargets
+                    li.menu-item.js-share-target(data-share-type="{{type}}", data-share-id="{{id}}", data-share-name="{{name}}", title="{{_ 'drag-template-here-to-share'}}")
+                      span.menu-label
+                        span.emoji-icon
+                          i.fa.fa-share-alt
+                        |  {{name}}
+        //- Rules above and below the Workspaces section. The menu is three
+          kinds of thing in one column - the three board lists, the workspaces
+          tree, and the archive - and without them the tree ran into its
+          neighbours as if it were more of the same list.
+        hr.boards-menu-divider
         .workspaces-header
           span
             span.emoji-icon
@@ -35,6 +65,7 @@ template(name="boardList")
           a.js-add-workspace(title="{{_ 'allboards.add-workspace'}}") +
         // Workspaces tree
         +workspaceTree(nodes=workspacesTree selectedWorkspaceId=selectedWorkspaceId)
+        hr.boards-menu-divider
 
         // Existing filter by orgs/teams (kept)
         ul.AllBoardTeamsOrgs
@@ -64,138 +95,286 @@ template(name="boardList")
                       i.fa.fa-times-thin
                   span {{_ 'filter-clear'}}
 
-      // Right boards grid
-      .boards-right-grid
-        .boards-path-header
-          .path-left
-            span.path-icon.emoji-icon {{currentMenuPath.icon}}
-            span.path-text {{currentMenuPath.text}}
-            if BoardMultiSelection.isActive
-              span.multiselection-hint
-                span.emoji-icon
-                  i.fa.fa-thumb-tack
-                |  {{_ 'multi-selection-active'}}
-          .path-right
-            if canModifyBoards
-              if hasBoardsSelected
-                button.js-archive-selected-boards.board-header-btn
-                  span.emoji-icon
-                    i.fa.fa-archive
-                  span {{_ 'archive-board'}}
-                button.js-duplicate-selected-boards.board-header-btn
-                  span.emoji-icon
-                    i.fa.fa-clipboard
-                  span {{_ 'duplicate-board'}}
-              a.board-header-btn.js-multiselection-activate(
-                title="{{#if BoardMultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}"
-                class="{{#if BoardMultiSelection.isActive}}emphasis{{/if}}")
-                span.emoji-icon
-                  i.fa.fa-check-square-o
-              if BoardMultiSelection.isActive
-                a.board-header-btn-close.js-multiselection-reset(title="{{_ 'filter-clear'}}")
-                  span.emoji-icon
-                    i.fa.fa-times
-        ul.board-list.clearfix.js-boards(class="{{#if isMiniScreen}}mobile-view{{/if}} {{#if BoardMultiSelection.isActive}}is-multiselection-active{{/if}}")
-          li.js-add-board
-            if isSelectedMenu 'templates'
-              a.board-list-item.label(title="{{_ 'add-template-container'}}")
-                span.emoji-icon
-                  i.fa.fa-plus
-                |  {{_ 'add-template-container'}}
-            else
-              a.board-list-item.label(title="{{_ 'add-board'}}")
-                span.emoji-icon
-                  i.fa.fa-plus
-                |  {{_ 'add-board'}}
-          each boards
-            li.js-board(class="{{_id}} {{#if isStarred}}starred{{/if}} {{colorClass}} {{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}", draggable="true")
-              if isInvited
-                .board-list-item
-                  if BoardMultiSelection.isActive
-                    .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
-                      class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
-                  span.details
-                    span.board-list-item-name= title
-                    span.js-star-board(
-                      class="{{#if isStarred}}is-star-active{{else}}is-not-star-active{{/if}}"
-                      title="{{_ 'star-board-title'}}")
-                      span.emoji-icon
-                        | {{#if isStarred}}⭐{{else}}☆{{/if}}
-                    p.board-list-item-desc {{_ 'just-invited'}}
-                    button.js-accept-invite.primary {{_ 'accept'}}
-                    button.js-decline-invite {{_ 'decline'}}
-              else
-                if $eq type "template-container"
-                  .template-container.board-list-item
-                    if BoardMultiSelection.isActive
-                      .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
-                        class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
-                    span.board-handle(title="{{_ 'drag-board'}}")
-                      span.emoji-icon
-                        i.fa.fa-arrows
+      //- The grip that changes the menu's width, the Admin Panel's own. It is a
+        child of the GRID and not of the menu: it is positioned absolutely, so it
+        is no grid item and adds no track, and it does not scroll away with a
+        long list of workspaces the way a handle inside the menu would.
+        docs/Features/Page/Left-Menu.md
+      +leftMenuResize
 
-                    a.js-open-board(href="{{pathFor 'board' id=_id slug=slug}}")
-                      span.details
-                        span.board-list-item-name(title="{{_ 'template-container'}}")
-                          +viewer
-                            = title
-                        p.board-list-item-desc
-                          +viewer
-                            = description
-                        if hasSpentTimeCards
-                          span.js-has-spenttime-cards(
-                            class="{{#if hasOvertimeCards}}has-overtime-card-active{{else}}no-overtime-card-active{{/if}}"
-                            title="{{#if hasOvertimeCards}}{{_ 'has-overtime-cards'}}{{else}}{{_ 'has-spenttime-cards'}}{{/if}}")
-                            span.emoji-icon
-                              i.fa.fa-clock-o
-                    span.js-star-board(
-                      class="{{#if isStarred}}is-star-active{{else}}is-not-star-active{{/if}}"
-                      title="{{_ 'star-board-title'}}")
-                      span.emoji-icon
-                        i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
+      // Right boards grid
+      //- There is NO bar above the boards, and no second header bar either.
+        Every control of this page - Sort, Search, Multi-Selection, the view
+        menu and the actions on a selection - is in the right sidebar, and the
+        page is named by the FIRST header bar. docs/Features/Page/All-Boards.md
+      .boards-right-grid
+        //- The heading of the pane: which list of boards this is. It sits above
+          the view branch, so it is drawn ONCE whichever view is on - the board
+          icons and the Table are two ways of showing the same section, not two
+          sections.
+          The Admin Panel's own `paneTitle`, so the two pages have one heading
+          at one size and colour. docs/Features/Page/All-Boards.md
+        +paneTitle(allBoardsPaneTitle)
+        if showsBoardSelectionControls
+          .board-multiselection-controls
+            button.primary.js-board-select-all(type="button") {{_ 'select-all'}}
+            button.primary.js-board-select-none(type="button") {{_ 'select-none'}}
+        //- The Archive is a SECTION of this page, drawn here beside the left
+          menu, not a page of its own that replaces it - and drawn with the same
+          board ICONS every other section uses. It had a table of its own, which
+          meant the one place you go to bring a board back was the one place
+          multi-selection, dragging and the tile layout did not work.
+          docs/Features/Page/Archive.md
+        if isAllBoardsView 'table'
+          +tablePage(tablePageData)
+        else
+          if boardsPaginationActive
+            .boards-pagination
+              button.js-boards-prev-page(class="{{#if hasBoardsPrevPage}}{{else}}disabled{{/if}}")
+                | <
+              span.boards-page-info {{boardsCurrentPage}} / {{boardsTotalPages}}
+              button.js-boards-next-page(class="{{#if hasBoardsNextPage}}{{else}}disabled{{/if}}")
+                | >
+          ul.board-list.clearfix.js-boards.dragscroll(class="{{#if isMiniScreen}}mobile-view{{/if}} {{#if BoardMultiSelection.isActive}}is-multiselection-active{{/if}}")
+            //- The Remove bar, drawn only while a board from Home is actually
+              being dragged - the launcher's, which appears at the top of the
+              screen when an icon is picked up and is not there the rest of the
+              time. Dropping a board here takes it off Home; the board itself
+              stays where it lives, the way an app stays in the drawer.
+              docs/Features/Board/Home.md
+            if showsHomeRemoveTarget
+              li.home-remove-target.js-home-remove
+                i.fa.fa-trash
+                span {{_ 'home-board-remove'}}
+            //- Home is a mark on ONE board rather than a place boards are
+              kept, so an empty Home says what to drag instead of showing a
+              blank pane.
+            if isSelectedMenu 'home'
+              unless boards.length
+                li.board-list-item-empty {{_ 'home-board-empty'}}
+            //- No "Add Board" in the Archive - a board cannot be created
+              already archived - nor in Home, where a new board would not be
+              the board that opens after login: the tile would promise
+              something it cannot do. ONE helper rather than two nested
+              conditions, because nesting one moved the tile's own children out
+              from under it.
+            if showsAddBoardTile
+              li.js-add-board
+                if isSelectedMenu 'templates'
+                  a.board-list-item.label.is-template-container(title="{{_ 'add-template-container'}}")
+                    span.emoji-icon
+                      i.fa.fa-plus
+                    |  {{_ 'add-template-container'}}
                 else
+                  a.board-list-item.label(title="{{_ 'add-board'}}")
+                    span.emoji-icon
+                      i.fa.fa-plus
+                    |  {{_ 'add-board'}}
+            //- The BOOKMARKS, in the Starred section beside the starred
+              boards - because Starred is the list of places you keep, and a
+              bookmark is one of them. A tile rather than a row, so it sits in
+              the same grid as the boards; a white border, so it is legible as
+              a different KIND of thing without being a different shape; and
+              the theme's own colour behind it, so it belongs to this WeKan.
+              It carries the title AND the URL: the title says where it goes
+              and the URL says what it is, which is what a bookmark bar shows.
+              Dragging one past another reorders them, and that order is the
+              order of the header dropdown - the two are views of one array.
+              docs/Features/Board/Starred.md
+            if isSelectedMenu 'starred'
+              each starredPages
+                li.js-bookmark.nodragscroll.board-list-item-bookmark(data-url="{{url}}", draggable="true")
+                  a.board-list-item(href="{{url}}", title="{{title}}")
+                    span.bookmark-title
+                      i.fa.fa-star
+                      |  {{title}}
+                    span.bookmark-url {{url}}
+                  //- A SIBLING of the link, not a child of it: an `a` inside an
+                    `a` is invalid HTML, and browsers repair it by closing the
+                    outer one early - which would leave the URL line outside the
+                    link that is supposed to carry it.
+                  a.js-unstar-bookmark.bookmark-unstar(href="#", title="{{_ 'click-to-unstar-page'}}")
+                    i.fa.fa-times
+            each boards
+              li.js-board.nodragscroll(class="{{_id}} {{#if isStarred}}starred{{/if}} {{colorClass}} {{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}", draggable="true")
+                if isInvited
                   .board-list-item
                     if BoardMultiSelection.isActive
                       .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
                         class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
-                    span.board-handle(title="{{_ 'drag-board'}}")
-                      span.emoji-icon
-                        i.fa.fa-arrows
+                    span.details
+                      span.board-list-item-name= title
+                      span.js-star-board(
+                        class="{{#if isStarred}}is-star-active{{else}}is-not-star-active{{/if}}"
+                        title="{{_ 'star-board-title'}}")
+                        span.emoji-icon
+                          i.fa(class="{{#if isStarred}}fa-star{{else}}fa-star-o{{/if}}")
+                      p.board-list-item-desc {{_ 'just-invited'}}
+                      button.js-accept-invite.primary {{_ 'accept'}}
+                      button.js-decline-invite {{_ 'decline'}}
+                else
+                  if $eq type "template-container"
+                    .template-container.board-list-item
+                      if BoardMultiSelection.isActive
+                        .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
+                          class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
+                      //- The drag handle obeys the same "Show desktop drag handles"
+                        setting as swimlanes, lists and cards. With handles ON it is
+                        the only place a board drag may start, so the rest of the
+                        tile is free to dragscroll; with handles OFF there is no
+                        handle and the whole tile is the drag source.
+                      if isTouchScreenOrShowDesktopDragHandles
+                        span.board-handle.nodragscroll(title="{{boardWorkspaceDragHint}}")
+                          span.emoji-icon
+                            i.fa.fa-arrows
 
-                    a.js-open-board(href="{{pathFor 'board' id=_id slug=slug}}")
-                      span.details
-                        span.board-list-item-name(title="{{_ 'board-drag-drop-reorder-or-click-open'}}")
-                          +viewer
-                            = title
-                        unless currentSetting.hideBoardMemberList
-                          if allowsBoardMemberList
-                            .minicard-members
-                              each member in boardMembers _id
-                                a.name
-                                  +userAvatar(userId=member noRemove=true)
-                        unless currentSetting.hideCardCounterList
-                          if allowsCardCounterList
-                            .minicard-lists.flex.flex-wrap
-                              each list in boardLists _id
-                                .item
-                                  | {{ list }}
-                        p.board-list-item-desc
-                          +viewer
-                            = description
-                        if hasSpentTimeCards
-                          span.js-has-spenttime-cards(
-                            class="{{#if hasOvertimeCards}}has-overtime-card-active{{else}}no-overtime-card-active{{/if}}"
-                            title="{{#if hasOvertimeCards}}{{_ 'has-overtime-cards'}}{{else}}{{_ 'has-spenttime-cards'}}{{/if}}")
-                            span.emoji-icon
-                              i.fa.fa-clock-o
-                    a.js-star-board(
-                      class="{{#if isStarred}}is-star-active{{else}}is-not-star-active{{/if}}"
-                      title="{{_ 'star-board-title'}}")
-                      span.emoji-icon
-                        i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
+                      a.js-open-board(href="{{pathFor 'board' id=_id slug=slug}}" draggable="false")
+                        span.details
+                          span.board-list-item-name(title="{{_ 'template-container'}}")
+                            +viewer
+                              = title
+                          p.board-list-item-desc
+                            +viewer
+                              = description
+                          //- When you are looking at the Archive, when it was
+                            archived - that is what you sort an archive by, and
+                            what tells one old board from another.
+                            client/components/boards/boardsList.js
+                          if isSelectedMenu 'archive'
+                            p.board-list-item-archived-at
+                              | {{_ 'archived-at'}}
+                              = ' '
+                              = archivedAtText
+                          if hasSpentTimeCards
+                            span.js-has-spenttime-cards(
+                              class="{{#if hasOvertimeCards}}has-overtime-card-active{{else}}no-overtime-card-active{{/if}}"
+                              title="{{#if hasOvertimeCards}}{{_ 'has-overtime-cards'}}{{else}}{{_ 'has-spenttime-cards'}}{{/if}}")
+                              span.emoji-icon
+                                i.fa.fa-clock-o
+                      span.js-star-board(
+                        class="{{#if isStarred}}is-star-active{{else}}is-not-star-active{{/if}}"
+                        title="{{_ 'star-board-title'}}")
+                        span.emoji-icon
+                          i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
+                  else
+                    //- #5157: reuse the board's existing backgroundImageURL as the
+                    //- tile background on the board list page.
+                    .board-list-item(class="{{#if backgroundImageURL}}has-background-image{{/if}}" style="{{#if backgroundImageURL}}background-image:url('{{backgroundImageURL}}');{{/if}}")
+                      if BoardMultiSelection.isActive
+                        .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
+                          class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
+                      //- #2220: the Home board (opened after login) is badged with a
+                        home icon at the top centre of its tile.
+                      if isDefaultBoard
+                        span.board-home-badge(title="{{_ 'home-board-badge'}}")
+                          i.fa.fa-home
+                      //- The drag handle obeys the same "Show desktop drag handles"
+                        setting as swimlanes, lists and cards. With handles ON it is
+                        the only place a board drag may start, so the rest of the
+                        tile is free to dragscroll; with handles OFF there is no
+                        handle and the whole tile is the drag source.
+                      if isTouchScreenOrShowDesktopDragHandles
+                        span.board-handle.nodragscroll(title="{{boardWorkspaceDragHint}}")
+                          span.emoji-icon
+                            i.fa.fa-arrows
 
-template(name="boardListHeaderBar")
-  h1 {{_ title }}
+                      a.js-open-board(href="{{pathFor 'board' id=_id slug=slug}}" draggable="false")
+                        span.details
+                          span.board-list-item-name(title="{{boardOpenAndMoveHint}}")
+                            +viewer
+                              = title
+                          //- #5174 / #4825: the per-board allows* flags are
+                          //- resolved server-side into the one-shot tile data
+                          //- (the raw fields are not even published to this
+                          //- page), so the show* helpers below gate the whole
+                          //- block consistently for every board.
+                          unless currentSetting.hideBoardMemberList
+                            if showBoardMemberList _id
+                              .minicard-members
+                                each member in boardMembers _id
+                                  a.name
+                                    +userAvatar(userId=member noRemove=true)
+                          unless currentSetting.hideCardCounterList
+                            if showCardCounterList _id
+                              .minicard-lists.flex.flex-wrap
+                                each list in boardLists _id
+                                  .item
+                                    | {{ list }}
+                          p.board-list-item-desc
+                            +viewer
+                              = description
+                          //- When you are looking at the Archive, when it was
+                            archived - that is what you sort an archive by, and
+                            what tells one old board from another.
+                            client/components/boards/boardsList.js
+                          if isSelectedMenu 'archive'
+                            p.board-list-item-archived-at
+                              | {{_ 'archived-at'}}
+                              = ' '
+                              = archivedAtText
+                          if hasSpentTimeCards
+                            span.js-has-spenttime-cards(
+                              class="{{#if hasOvertimeCards}}has-overtime-card-active{{else}}no-overtime-card-active{{/if}}"
+                              title="{{#if hasOvertimeCards}}{{_ 'has-overtime-cards'}}{{else}}{{_ 'has-spenttime-cards'}}{{/if}}")
+                              span.emoji-icon
+                                i.fa.fa-clock-o
+                      a.js-star-board(
+                        class="{{#if isStarred}}is-star-active{{else}}is-not-star-active{{/if}}"
+                        title="{{_ 'star-board-title'}}")
+                        span.emoji-icon
+                          i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
+                      //- #2220 Home-board toggle is disabled: the icon and the
+                      //- set-default-board action are intentionally not rendered.
+
+template(name="boardsSortPopup")
+  ul.pop-over-list
+    li
+      a.js-boards-sort(data-sort="custom" class="{{#if isBoardsSort 'custom'}}active{{/if}}")
+        span.emoji-icon
+          i.fa.fa-arrows
+        |  {{_ 'sort-boards-custom'}}
+    li
+      a.js-boards-sort(data-sort="title-asc" class="{{#if isBoardsSort 'title-asc'}}active{{/if}}")
+        span.emoji-icon
+          i.fa.fa-sort-alpha-asc
+        |  {{_ 'sort-boards-title-asc'}}
+    li
+      a.js-boards-sort(data-sort="title-desc" class="{{#if isBoardsSort 'title-desc'}}active{{/if}}")
+        span.emoji-icon
+          i.fa.fa-sort-alpha-desc
+        |  {{_ 'sort-boards-title-desc'}}
+
+//- One row of the All Boards Table view. A rowTemplate, because the Edit cell is
+//- a control and the row carries its board's colours - neither of which a
+//- text-cell column spec can express. Cells must match the header, in order:
+//- Edit, Board title, Board description.
+template(name="allBoardsRow")
+  tr.all-boards-row(class="{{colorClass}}" data-board-id="{{_id}}")
+    td.all-boards-edit
+      a.js-edit-board-title-row(title="{{_ 'edit'}}")
+        i.fa.fa-pencil
+    td.all-boards-title
+      a.js-open-board-row(href="{{pathFor 'board' id=_id slug=slug}}")
+        +viewer
+          = title
+    td.all-boards-desc
+      +viewer
+        = description
+
+template(name="allBoardsViewPopup")
+  ul.pop-over-list
+    li
+      a.js-all-boards-view-lists
+        i.fa.fa-trello
+        | {{_ 'lists'}}
+        if isAllBoardsView 'lists'
+          i.fa.fa-check
+    li
+      a.js-all-boards-view-table
+        i.fa.fa-table
+        | {{_ 'board-view-table'}}
+        if isAllBoardsView 'table'
+          i.fa.fa-check
   //.board-header-btns.right
   //
     a.board-header-btn.js-open-archived-board
@@ -214,14 +393,63 @@ template(name="boardListHeaderBar")
 template(name="workspaceTree")
   if nodes
     ul.workspace-tree.js-workspace-tree
+      //- `../selectedWorkspaceId`, not the bare name. Inside `each` the data
+        context is the NODE, and this is a template argument rather than a
+        helper - so a bare lookup found nothing on the node, `$eq` compared an
+        id with undefined, and no workspace ever got the `active` class. The
+        theme highlight was styled for a class that was never applied.
       each nodes
-        li.workspace-node(class="{{#if $eq id selectedWorkspaceId}}active{{/if}}" data-workspace-id="{{id}}" draggable="true")
+        //- Which part of the row starts a reorder follows the "Show desktop drag
+          handles" toggle in the first header bar - the same setting swimlanes,
+          lists, cards and the board tiles obey:
+            handles ON  - the ✥ handle, and only the handle;
+            handles OFF - the workspace's icon AND its name, which is the whole
+                          `a.js-select-space`.
+          The anchor rather than the icon alone: a 16px glyph is a target that
+          has to be aimed at, and the name beside it is the part of the row a
+          reader is actually pointing at. Clicking it still opens the workspace -
+          a click and a drag are different gestures on the same element, exactly
+          as they are on a board tile with handles off.
+          NOT the whole row either: the row also holds the ⋯ menu and the board
+          count, and a drag started on those is a drag of something else.
+          `dragstart` bubbles, so the handler stays on the row in both cases.
+          docs/Features/Page/All-Boards.md
+        li.workspace-node(class="{{#if $eq id ../selectedWorkspaceId}}active{{/if}}" data-workspace-id="{{id}}")
           .workspace-node-content
-            span.workspace-drag-handle
-              span.emoji-icon
-                i.fa.fa-arrows
+            //- The caret that folds this workspace's own workspaces away, at
+              the START of the row - before the drag handle, so the carets of a
+              tree line up in one column whatever the handles toggle says. It is
+              the control a list has on a board and the one the left menu itself
+              has, down to the two words in its tooltip.
+              A workspace with no workspaces under it has nothing to fold, so it
+              gets a spacer of the same width instead: a row that shifted
+              sideways when it gained a child would be a moving target.
+              docs/Features/Page/Workspaces.md
+            if workspaceHasChildren
+              a.workspace-collapse-indicator.js-collapse-workspace(
+                title="{{workspaceCollapseLabel}}"
+                aria-label="{{workspaceCollapseLabel}}"
+                aria-expanded="{{#if isWorkspaceCollapsed}}false{{else}}true{{/if}}"
+                role="button"
+                tabindex="0")
+                if isWorkspaceCollapsed
+                  i.fa.fa-caret-right
+                else
+                  i.fa.fa-caret-down
+            else
+              span.workspace-collapse-spacer
+            if isTouchScreenOrShowDesktopDragHandles
+              span.workspace-drag-handle.nodragscroll(draggable="true")
+                span.emoji-icon
+                  i.fa.fa-arrows
 
-            a.js-select-workspace.js-select-space(data-id="{{id}}")
+            //- `nodragscroll` for the same reason the handle carries it: the
+              page-level dragscroll owns a mousedown it is not opted out of, and
+              a drag that never begins is what "reordering does not work" looks
+              like.
+            a.js-select-workspace.js-select-space.nodragscroll(
+              data-id="{{id}}"
+              draggable="{{#if isTouchScreenOrShowDesktopDragHandles}}false{{else}}true{{/if}}")
               span.workspace-icon
                 if icon
                   span.workspace-icon-value(style="{{#if iconColor}}color: {{iconColor}};{{/if}}")
@@ -235,8 +463,24 @@ template(name="workspaceTree")
               span.emoji-icon
                 i.fa.fa-bars
             span.workspace-count {{workspaceCount id}}
-          if children
-            +workspaceTree(nodes=children selectedWorkspaceId=selectedWorkspaceId)
+          //- ONE condition, not `if children` wrapped in an `unless collapsed`:
+            `..` counts block levels, and a second block between the `each` and
+            this inclusion is another level for `../selectedWorkspaceId` to
+            climb - which is how the highlight was lost once already.
+            docs/Features/Page/Workspaces.md
+          if workspaceShowsChildren
+            +workspaceTree(nodes=children selectedWorkspaceId=../selectedWorkspaceId)
+
+//- #6524: creating a workspace used window.prompt(), which a browser may refuse
+  to show at all - iOS Safari lets the user suppress further prompts for a page,
+  and then the "+" beside Workspaces did nothing visible. This is a normal popup
+  with a real input, like every other create flow in WeKan.
+template(name="addWorkspacePopup")
+  form.js-add-workspace-form
+    label
+      | {{_ 'allboards.add-workspace-prompt'}}
+      input.js-new-workspace-name(type="text" autocomplete="off" autofocus required)
+    input.primary.wide(type="submit" value="{{_ 'allboards.add-workspace'}}")
 
 template(name="workspaceActionsPopup")
   form.workspace-actions-form.js-workspace-actions-form(data-id="{{id}}")
@@ -257,3 +501,54 @@ template(name="workspaceActionsPopup")
   .workspace-delete-block
     span.js-workspace-delete-error(style="color: #c00; display: block; margin: 4px 0;")
     button.js-delete-workspace.negate.wide(type="button" data-id="{{id}}") {{_ 'delete'}}
+
+//- The All Boards view menu, in the FIRST top header bar, beside the board
+//- view menu's place - a view menu says what you are looking AT, so both of
+//- them sit next to the page's name rather than in a bar or a panel.
+//-
+//- It names the CURRENT view, not itself: the board header says "Swimlanes" or
+//- "Lists" rather than "Board View", and this matches it.
+//- docs/Features/Page/Header.md
+//- The page's controls, as icons, in the first top header bar - left of the
+//- bell, exactly where a board's own controls are. They were rows inside the
+//- right sidebar's home view, which meant two clicks and a panel covering the
+//- boards to reach the thing you came for; and the sidebar's home view was the
+//- ONLY reason All Boards offered a hamburger, so it does not any more. Search
+//- and Multi-Selection still open the sidebar, straight into their own view.
+//-
+//- Each names itself beside its icon where the bar has room, and the one rule
+//- in header.css drops every label below 1100px, leaving the tooltips.
+//- docs/Features/Page/All-Boards.md
+template(name="allBoardsHeaderButtons")
+  a.board-header-btn.js-open-boards-sort(title="{{_ 'sort-boards'}}" class="{{#unless isBoardsSort 'custom'}}emphasis{{/unless}}")
+    i.fa.fa-sort
+    span.board-header-btn-label {{_ 'sort-boards'}}
+  a.board-header-btn.js-all-boards-sidebar-search(title="{{_ 'search-boards'}}")
+    i.fa.fa-search
+    span.board-header-btn-label {{_ 'search-boards'}}
+  if canMultiSelectBoards
+    //- Says whether it is ON, and offers the way OFF - the same pair the
+      board's own Multi-Selection has. It looked identical whether or not a
+      selection was running, so the one control that changes what a click on a
+      board does gave no sign it had changed it, and the only way out was to
+      find the row inside the sidebar. docs/Features/Page/Multi-Selection.md
+    a.board-header-btn.js-all-boards-sidebar-multiselection(
+        title="{{#if BoardMultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}"
+        class="{{#if BoardMultiSelection.isActive}}emphasis{{/if}}")
+      i.fa.fa-check-square-o
+      span.board-header-btn-label {{#if BoardMultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}
+    if BoardMultiSelection.isActive
+      a.board-header-btn-close.js-multiselection-reset(title="{{_ 'multi-selection-off'}}")
+        i.fa.fa-times-thin
+
+template(name="allBoardsViewMenu")
+  //- The name is visible beside the icon, the same as the board's view menu:
+    a tooltip is the one place a name cannot be read without hovering.
+  a.board-header-btn.js-open-all-boards-view(title="{{#if isAllBoardsView 'table'}}{{_ 'board-view-table'}}{{else}}{{_ 'lists'}}{{/if}}")
+    i.fa.fa-caret-down
+    if isAllBoardsView 'table'
+      i.fa.fa-table
+      span.board-header-btn-label {{_ 'board-view-table'}}
+    else
+      i.fa.fa-trello
+      span.board-header-btn-label {{_ 'lists'}}

client/components/boards/dependencyOverlay.css

@@ -0,0 +1,140 @@
+.dependency-overlay {
+  position: absolute;
+  top: 0;
+  inset-inline-start: 0;
+  width: 100%;
+  height: 100%;
+  pointer-events: none;
+  z-index: 100;
+  overflow: visible;
+}
+
+/* #3392: the overlay SVG stays click-through, but each line is clickable (to
+   open the edit/delete popup) even though its container is pointer-events:none. */
+.dependency-line {
+  pointer-events: stroke;
+  cursor: pointer;
+}
+
+.dependency-temp-line {
+  pointer-events: none;
+}
+
+/* #3392: drag-to-connect handle on the minicard (no mode — cards stay
+   clickable). Shown on hover; drag it onto another card to create a link. */
+.minicard .dependency-connect-handle {
+  position: absolute;
+  top: 50%;
+  inset-inline-end: -7px;
+  transform: translateY(-50%);
+  width: 18px;
+  height: 18px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  color: #eb144c;
+  background: #fff;
+  border-radius: 50%;
+  box-shadow: 0 0 2px rgba(0, 0, 0, 0.4);
+  cursor: crosshair;
+  opacity: 0;
+  z-index: 101;
+}
+
+.minicard:hover .dependency-connect-handle {
+  opacity: 1;
+}
+
+.dependency-line-popup .dependency-field {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  margin-bottom: 6px;
+}
+
+.dependency-line-popup .card-dependency-icons li a.is-selected {
+  border-color: #eb144c;
+  border-width: 2px;
+}
+
+.dependency-line-delete {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  color: #eb144c;
+}
+
+/* #3392: card detail "Dependencies" rows */
+.card-details-dependencies-list .card-dependency {
+  display: flex;
+  /* The title WRAPS now, so the row can be two or three lines tall. Centring
+     the icon and the controls against that block would float them halfway down
+     it; they belong beside the first line. */
+  align-items: flex-start;
+  gap: 6px;
+  margin-bottom: 4px;
+}
+
+.card-details-dependencies-list .card-dependency-link {
+  flex: 1 1 auto;
+  /* A card's title is a sentence, and the card details pane is narrow. It used
+     to be one line with an ellipsis, so everything past the width of the pane -
+     which is most of a real title, sitting right of the coloured icon - could
+     not be read at all. There is no reason to hide it: the row can be tall.
+     `min-width: 0` is what makes that work. A flex item's default is
+     `min-width: auto`, which refuses to shrink below its content, so the text
+     overflowed the row instead of wrapping inside it - and no amount of
+     `white-space: normal` alone would have fixed that. */
+  min-width: 0;
+  white-space: normal;
+  /* A title can be a URL or an id with no spaces in it; break inside the word
+     rather than let one long token push the controls off the row. */
+  overflow-wrap: anywhere;
+}
+
+.card-details-dependencies-list .js-dependency-type {
+  flex: 0 0 auto;
+  max-width: 130px;
+}
+
+.card-details-dependencies-list .js-dependency-color {
+  flex: 0 0 auto;
+  width: 28px;
+  height: 24px;
+  padding: 0;
+  border: none;
+  background: none;
+  cursor: pointer;
+}
+
+.card-dependencies-popup .dependency-field {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  margin-bottom: 6px;
+}
+
+.card-dependency-icons {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+  list-style: none;
+  margin: 0;
+  padding: 4px;
+}
+
+.card-dependency-icons li a {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 32px;
+  height: 32px;
+  border: 1px solid #ddd;
+  border-radius: 4px;
+}
+
+.minicard .badge.minicard-dependencies .badge-icon {
+  font-weight: bold;
+}

client/components/boards/dependencyOverlay.jade

@@ -0,0 +1,35 @@
+template(name="dependencyOverlay")
+  svg.dependency-overlay.js-dependency-overlay(xmlns="http://www.w3.org/2000/svg")
+    defs
+      each dependencyMarkers
+        marker(id="{{markerId}}" markerWidth="8" markerHeight="8" refX="7" refY="3" orient="auto" markerUnits="userSpaceOnUse")
+          path(d="M0,0 L7,3 L0,6 Z" fill="{{color}}")
+    each dependencyLines
+      path.dependency-line(d="{{path}}" fill="none" stroke="{{color}}" stroke-width="2" marker-end="{{markerUrl}}")
+    if tempLine
+      path.dependency-temp-line(d="{{tempLine}}" fill="none" stroke="#eb144c" stroke-width="2" stroke-dasharray="6,4")
+
+template(name="dependencyLinePopup")
+  .dependency-line-popup
+    label.dependency-field
+      span {{_ 'dependency-type'}}
+      select.js-line-type
+        each typeOption
+          if selected
+            option(value="{{id}}" selected="selected") {{_ label}}
+          else
+            option(value="{{id}}") {{_ label}}
+    label.dependency-field
+      span {{_ 'dependency-color'}}
+      input.js-line-color(type="color" value="{{color}}")
+    .dependency-field
+      span {{_ 'dependency-icon'}}
+    ul.card-dependency-icons
+      each dependencyIcons
+        li
+          a.js-line-icon(data-icon="{{name}}" title="{{name}}" class="{{#if selected}}is-selected{{/if}}")
+            i.fa(class="fa-{{name}}")
+    hr
+    a.js-line-delete.dependency-line-delete
+      i.fa.fa-times
+      | {{_ 'remove-dependency'}}

client/components/boards/dependencyOverlay.js

@@ -0,0 +1,300 @@
+import { ReactiveCache } from '/imports/reactiveCache';
+import { ReactiveVar } from 'meteor/reactive-var';
+import { Utils } from '/client/lib/utils';
+import {
+  DEPENDENCY_ICON_CHOICES,
+  DEPENDENCY_TYPES,
+  dependencyTypeMeta,
+  normalizeDependencies,
+} from '/models/metadata/dependencies';
+
+// #3392: PI Program Board "Red Strings".
+// Draw colored, typed connection lines (SVG paths) between cards that declare
+// cardDependencies. The board stays fully usable (cards clickable) — drawing a
+// new link is initiated from a small connect handle on each minicard (drag it
+// onto another card, piplanning.io / Kendis / Miro style), and a link can be
+// edited/deleted by clicking its line. The overlay SVG itself stays
+// pointer-events:none; only the lines (and the minicard handles) capture events.
+//
+// Coordinates are computed from the live DOM (getBoundingClientRect of
+// [data-card-id] minicards) translated into the overlay SVG's own coordinate
+// space, so scrolling/resizing is handled by recomputing relative to the SVG's
+// current bounding rect.
+
+// Stable, css-safe marker id for an arrowhead of a given color.
+function markerIdForColor(color) {
+  return `dependency-arrowhead-${String(color).replace(/[^a-zA-Z0-9]/g, '')}`;
+}
+
+Template.dependencyOverlay.onCreated(function () {
+  this.lines = new ReactiveVar([]);
+  this.markers = new ReactiveVar([]);
+  this.tempLine = new ReactiveVar(null); // line being drawn while dragging
+  // Guard against deferred (rAF / setTimeout) callbacks touching the DOM after
+  // the overlay is destroyed ("Can't select in removed DomRange").
+  this._overlayDestroyed = false;
+
+  // Rect of a card relative to the overlay SVG, or null if not rendered.
+  this.rectOf = (cardId, svgRect) => {
+    const el = document.querySelector(`[data-card-id="${cardId}"]`);
+    if (!el) return null;
+    const r = el.getBoundingClientRect();
+    if (r.width === 0 && r.height === 0) return null;
+    return { x: r.left - svgRect.left, y: r.top - svgRect.top, w: r.width, h: r.height };
+  };
+
+  this.recompute = () => {
+    if (this._overlayDestroyed || !this.view || this.view.isDestroyed) {
+      return;
+    }
+    const svg = this.find('.js-dependency-overlay');
+    if (!svg) {
+      return;
+    }
+    const board = Utils.getCurrentBoard();
+    if (!board) {
+      this.lines.set([]);
+      return;
+    }
+
+    const svgRect = svg.getBoundingClientRect();
+    const centerOf = cardId => this.rectOf(cardId, svgRect);
+
+    const cards = ReactiveCache.getCards({
+      boardId: board._id,
+      archived: false,
+    });
+
+    const lines = [];
+    const markerColors = new Set();
+    cards.forEach(card => {
+      const deps = normalizeDependencies(card.cardDependencies);
+      if (deps.length === 0) {
+        return;
+      }
+      const sourceRect = centerOf(card._id);
+      if (!sourceRect) {
+        return;
+      }
+      deps.forEach(dep => {
+        const targetRect = centerOf(dep.cardId);
+        if (!targetRect) {
+          return;
+        }
+        const meta = dependencyTypeMeta(dep.type);
+        // Draw the arrow from the prerequisite card's right edge to the
+        // dependent card's left edge. For forward relations (blocks/fixes/
+        // related-to) the source card is the prerequisite; for the reverse
+        // relations (is-blocked-by/is-fixed-by) the target is.
+        const prereq = meta.forward ? sourceRect : targetRect;
+        const dependent = meta.forward ? targetRect : sourceRect;
+        const x1 = prereq.x + prereq.w;
+        const y1 = prereq.y + prereq.h / 2;
+        const x2 = dependent.x;
+        const y2 = dependent.y + dependent.h / 2;
+        const dx = Math.max(40, Math.abs(x2 - x1) / 2);
+        const path = `M ${x1} ${y1} C ${x1 + dx} ${y1}, ${x2 - dx} ${y2}, ${x2} ${y2}`;
+        const markerId = markerIdForColor(dep.color);
+        if (meta.directed) {
+          markerColors.add(dep.color);
+        }
+        lines.push({
+          path,
+          color: dep.color,
+          type: dep.type,
+          icon: dep.icon,
+          directed: meta.directed,
+          markerId: meta.directed ? markerId : '',
+          // Source card (owns the dependency) and target card.
+          fromId: card._id,
+          toId: dep.cardId,
+        });
+      });
+    });
+    this.lines.set(lines);
+    this.markers.set(
+      [...markerColors].map(color => ({
+        color,
+        markerId: markerIdForColor(color),
+      })),
+    );
+  };
+
+  this.scheduleRecompute = () => {
+    if (this._overlayDestroyed) return;
+    if (this._raf) {
+      window.cancelAnimationFrame(this._raf);
+    }
+    this._raf = window.requestAnimationFrame(() => {
+      this._raf = null;
+      this.recompute();
+    });
+  };
+});
+
+Template.dependencyOverlay.onRendered(function () {
+  const instance = this;
+  const svg = this.find('.js-dependency-overlay');
+  this.scrollEl = svg ? this.firstNode.closest('.board-canvas') : null;
+
+  this.autorun(() => {
+    const board = Utils.getCurrentBoard();
+    if (board) {
+      ReactiveCache.getCards({ boardId: board._id, archived: false });
+    }
+    instance.scheduleRecompute();
+  });
+
+  this.onScroll = () => instance.scheduleRecompute();
+  this.onResize = () => instance.scheduleRecompute();
+
+  if (this.scrollEl) {
+    this.scrollEl.addEventListener('scroll', this.onScroll, { passive: true });
+  }
+  window.addEventListener('scroll', this.onScroll, { passive: true });
+  window.addEventListener('resize', this.onResize);
+
+  // --- drag-to-connect (from a minicard's connect handle) -----------------
+  // Find the card under a viewport point. The overlay is pointer-events:none,
+  // so elementsFromPoint returns the minicards directly.
+  const cardIdAtPoint = (clientX, clientY) => {
+    const els = document.elementsFromPoint(clientX, clientY);
+    for (const el of els) {
+      if (svg && svg.contains(el)) continue;
+      const card = el.closest && el.closest('[data-card-id]');
+      if (card) return card.getAttribute('data-card-id');
+    }
+    return null;
+  };
+
+  this.onMouseDown = e => {
+    if (e.button !== 0) return;
+    const handle =
+      e.target.closest && e.target.closest('.js-dependency-connect-handle');
+    if (!handle) return;
+    const cardEl = handle.closest('[data-card-id]');
+    if (!cardEl) return;
+    // Beat the card drag-sort: capture-phase + stop propagation.
+    e.preventDefault();
+    e.stopPropagation();
+    instance.dragSourceId = cardEl.getAttribute('data-card-id');
+  };
+
+  this.onMouseMove = e => {
+    if (!instance.dragSourceId || !svg) return;
+    const svgRect = svg.getBoundingClientRect();
+    const from = instance.rectOf(instance.dragSourceId, svgRect);
+    if (!from) return;
+    const x1 = from.x + from.w;
+    const y1 = from.y + from.h / 2;
+    const x2 = e.clientX - svgRect.left;
+    const y2 = e.clientY - svgRect.top;
+    const dx = Math.max(40, Math.abs(x2 - x1) / 2);
+    instance.tempLine.set(
+      `M ${x1} ${y1} C ${x1 + dx} ${y1}, ${x2 - dx} ${y2}, ${x2} ${y2}`,
+    );
+  };
+
+  this.onMouseUp = e => {
+    if (!instance.dragSourceId) return;
+    const sourceId = instance.dragSourceId;
+    instance.dragSourceId = null;
+    instance.tempLine.set(null);
+    const targetId = cardIdAtPoint(e.clientX, e.clientY);
+    if (targetId && targetId !== sourceId) {
+      const card = ReactiveCache.getCard(sourceId);
+      if (card && typeof card.addDependency === 'function') {
+        card.addDependency(targetId);
+      }
+    }
+  };
+
+  // Capture phase so the connect drag starts before the sortable grabs the card.
+  document.addEventListener('mousedown', this.onMouseDown, true);
+  document.addEventListener('mousemove', this.onMouseMove);
+  document.addEventListener('mouseup', this.onMouseUp);
+
+  this._initTimeout = Meteor.setTimeout(() => instance.scheduleRecompute(), 300);
+});
+
+Template.dependencyOverlay.onDestroyed(function () {
+  this._overlayDestroyed = true;
+  if (this.scrollEl) {
+    this.scrollEl.removeEventListener('scroll', this.onScroll);
+  }
+  window.removeEventListener('scroll', this.onScroll);
+  window.removeEventListener('resize', this.onResize);
+  if (this.onMouseDown) document.removeEventListener('mousedown', this.onMouseDown, true);
+  if (this.onMouseMove) document.removeEventListener('mousemove', this.onMouseMove);
+  if (this.onMouseUp) document.removeEventListener('mouseup', this.onMouseUp);
+  if (this._raf) {
+    window.cancelAnimationFrame(this._raf);
+  }
+  if (this._initTimeout) {
+    Meteor.clearTimeout(this._initTimeout);
+  }
+});
+
+Template.dependencyOverlay.helpers({
+  dependencyLines() {
+    return Template.instance().lines.get();
+  },
+  dependencyMarkers() {
+    return Template.instance().markers.get();
+  },
+  tempLine() {
+    return Template.instance().tempLine.get();
+  },
+  markerUrl() {
+    return this.markerId ? `url(#${this.markerId})` : '';
+  },
+});
+
+Template.dependencyOverlay.events({
+  'click .dependency-line'(event) {
+    event.preventDefault();
+    event.stopPropagation();
+    // `this` is the line data object (fromId/toId/type/color/icon).
+    Popup.open('dependencyLine').call(this, event);
+  },
+});
+
+// #3392: popup to edit or delete an on-board dependency line. Data context is the
+// line object { fromId, toId, type, color, icon }.
+Template.dependencyLinePopup.helpers({
+  typeOption() {
+    const current = this.type;
+    return DEPENDENCY_TYPES.map(t => ({
+      id: t.id,
+      label: `dependency-type-${t.id}`,
+      selected: t.id === current,
+    }));
+  },
+  color() {
+    return this.color;
+  },
+  dependencyIcons() {
+    const current = this.icon;
+    return DEPENDENCY_ICON_CHOICES.map(name => ({ name, selected: name === current }));
+  },
+});
+
+Template.dependencyLinePopup.events({
+  'change .js-line-type'(event) {
+    const card = ReactiveCache.getCard(this.fromId);
+    if (card) card.setDependencyProps(this.toId, { type: event.currentTarget.value });
+  },
+  'change .js-line-color'(event) {
+    const card = ReactiveCache.getCard(this.fromId);
+    if (card) card.setDependencyProps(this.toId, { color: event.currentTarget.value });
+  },
+  'click .js-line-icon'(event) {
+    const card = ReactiveCache.getCard(this.fromId);
+    if (card) card.setDependencyProps(this.toId, { icon: event.currentTarget.dataset.icon });
+  },
+  'click .js-line-delete'() {
+    const card = ReactiveCache.getCard(this.fromId);
+    if (card) card.removeDependency(this.toId);
+    Popup.back();
+  },
+});

client/components/boards/exportScope.jade

@@ -0,0 +1,111 @@
+//- The checkbox list - WHAT an export includes, and what an import brings in.
+  Its own template so the board popup can borrow it into a pane of its own
+  layout while the swimlane, list and card popups get it inside the pane
+  exportScopeBody builds for them, with no copy of the markup in either place.
+  The helpers are registered on BOTH templates from one object (exportScope.js);
+  the click handlers stay on exportScopeBody, because an event from here bubbles
+  to the template that includes it.
+//- EACH ROW CARRIES ITS OWN CHECKBOX - `.materialCheckBox`, the one Admin
+  Panel / Settings / Announcement uses for "Active System-Wide Announcement",
+  and the one every checkbox in the Admin Panel uses. A reader has seen it
+  before, and it says "on" and "off" at a glance.
+  It used to be an unconditional `i.fa.fa-check` on a `li.active`, which is a
+  DIFFERENT convention: popup.css hides that tick and shows it only for an
+  active row - but its selector is `.pop-over-list .pop-over-list.checkable
+  .fa-check`, so it needs a NESTED list carrying `checkable`, and this list was
+  neither. The tick was therefore never hidden and `active` was never styled, so
+  every row looked ticked whatever it was and clicking one changed nothing on
+  screen. Reported as \#6586 comment 5308548585, "I can't select/deselect those
+  arrows here".
+  A checkbox that carries its own state needs no ancestor to be right, which is
+  why it is this rather than the missing class.
+template(name="exportScopeSelect")
+  p.quiet {{_ 'export-select-what-to-include'}}
+  ul.pop-over-list.export-scope-select
+    li
+      a.flex.js-export-card-details-toggle(href="#" role="checkbox" aria-checked="{{#if cardDetailsChecked}}true{{else}}false{{/if}}")
+        .materialCheckBox(class="{{#if cardDetailsChecked}}is-checked{{/if}}")
+        span {{_ 'export-card-details'}}
+    each exportFields
+      li
+        a.flex.js-export-field-toggle(data-field="{{field}}" href="#" role="checkbox" aria-checked="{{#if checked}}true{{else}}false{{/if}}")
+          .materialCheckBox(class="{{#if checked}}is-checked{{/if}}")
+          span {{_ label}}
+
+//- The body of an export popup - ALL of them (#1173). What to include in one
+  pane and what to export it to in the other, side by side when the window has
+  room and stacked when it does not.
+  It was two menus: the board popup wrote nineteen formats of its own in
+  sidebar.jade under four subheadings, and the swimlane, list and card popups
+  wrote five here in one narrow column - so "the export popup" looked like two
+  different features depending on which menu opened it, and a format added to
+  one was missing from the other. The formats are one table now
+  (EXPORT_FORMAT_GROUPS, exportScope.js); each entry says which scopes it
+  applies to and whether it is a link or an action, and this lays them out.
+template(name="exportScopeBody")
+  .export-board-panes
+    .export-board-pane.export-board-pane-select
+      +exportScopeSelect
+    .export-board-pane.export-board-pane-formats
+      if isImportMode
+        //- #1173: the same popup, the other direction. The checkboxes in the
+          other pane say what goes OUT of an export and what comes IN from an
+          import - one selection, so "no comments" means the same thing
+          whichever way the file is moving.
+          Asked HERE as well as on the menu row that opens it: the row is hidden
+          from a reader who may not write, and a popup that trusts its caller is
+          a popup that offers the file chooser the first time somebody reaches
+          it another way.
+        if canImport
+          p.quiet {{_ 'import-here-instruction'}}
+          ul.pop-over-list
+            li
+              label.js-import-file-label
+                i.fa.fa-download
+                | {{_ 'import'}} / JSON, .zip
+                input.js-import-file(type="file" accept=".json,application/json,.zip,application/zip" hidden)
+          if importBusy
+            p.quiet {{_ 'importing'}}
+          if importError
+            .warning {{_ importError}}
+          if importDone
+            p.quiet {{_ 'import-done'}} {{importDone}}
+      else
+        each formatGroups
+          if heading
+            hr
+            h4.pop-over-list-subheading {{heading}}
+          ul.pop-over-list
+            each entries
+              li
+                if action
+                  a(class="{{action}}")
+                    i.fa(class="{{icon}}")
+                    | {{label}}
+                else
+                  //- The server supplies the localized, scope-aware filename.
+                  a(href="{{url}}" download)
+                    i.fa(class="{{icon}}")
+                    | {{label}}
+
+template(name="exportSwimlanePopup")
+  +exportScopeBody(swimlaneId=_id title=title)
+
+template(name="exportListPopup")
+  +exportScopeBody(listId=_id title=title)
+
+template(name="exportChecklistPopup")
+  +exportScopeBody(checklistId=_id title=title)
+
+//- The IMPORT half of each menu. Same body, same table, same selection - the
+  mode decides whether the second pane offers the formats to write out or the
+  file to read in. A menu says what it is about, so its two rows are named
+  "Export" and "Import" and nothing more.
+template(name="importSwimlanePopup")
+  +exportScopeBody(swimlaneId=_id title=title mode="import")
+
+template(name="importListPopup")
+  +exportScopeBody(listId=_id title=title mode="import")
+
+template(name="importCardPopup")
+  +exportScopeBody(cardId=_id listId=listId title=title mode="import")

client/components/boards/exportScope.js

@@ -0,0 +1,457 @@
+// ITS OWN TEMPLATE FIRST. This module is imported by sidebar.js, by
+// cardDetails.js and by the import page, and any of them can be evaluated
+// before client/features/boards.js gets to the .jade - at which point
+// `Template.exportScopeBody` is undefined and `.helpers()` on it throws at
+// module scope. That does not break this popup, it breaks THE WHOLE BUNDLE:
+// evaluation stops, every template registered after it never registers, and
+// the sign-in page comes up with "no template passwordInput found".
+//
+// A component whose .js is imported by other components cannot rely on the
+// central import order in client/features/*.js. Importing the template here
+// makes the order a fact rather than a hope; the module cache means the second
+// import costs nothing.
+import './exportScope.jade';
+import { ReactiveDict } from 'meteor/reactive-dict';
+import { Template } from 'meteor/templating';
+import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
+import { Meteor } from 'meteor/meteor';
+import { Session } from 'meteor/session';
+import { ReactiveCache } from '/imports/reactiveCache';
+import { TAPi18n } from '/imports/i18n';
+import { Accounts } from 'meteor/accounts-base';
+import { BOARD_EXPORT_FIELDS } from '/models/lib/exportFields';
+import { exportLocaleParams } from '/client/lib/exportLocale';
+
+// The "what do you want in it" half of an export, for a board, a swimlane or a
+// list (#1173 "Add Feature: Print Board with Params").
+//
+// One body, used by three popups. A board export, a swimlane export and a list
+// export differ by ONE query parameter - which cards are in scope - so writing
+// the checkbox list and the two download links three times would be three places
+// for a section to go missing from. `exportScopeBody` is included by each popup
+// with its own scope, and everything else is shared.
+//
+// The SELECTION is shared too, and deliberately: it is module-level, so ticking
+// "no attachments, no comments" once applies to the next export as well, in the
+// same session. Somebody printing a board rarely wants a different shape for
+// each list of it.
+
+const selection = new ReactiveDict();
+BOARD_EXPORT_FIELDS.forEach(({ field }) => selection.set(field, true));
+
+// `card-details` is what makes an export the card layout rather than the
+// spreadsheet table; it starts on, like everything else.
+selection.set('card-details', true);
+
+function selectedFields() {
+  return ['card-details', ...BOARD_EXPORT_FIELDS.map(({ field }) => field)]
+    .filter((field, index, all) => all.indexOf(field) === index)
+    .filter(field => selection.get(field));
+}
+
+// The scope a popup was opened with: {} for a board, {swimlaneId} or {listId}
+// for the other two.
+function currentScope() {
+  const data = Template.currentData() || {};
+  const scope = {};
+  if (data.swimlaneId) scope.swimlaneId = data.swimlaneId;
+  if (data.listId) scope.listId = data.listId;
+  return scope;
+}
+
+// ONE url builder for every format and every scope. A second one would be a
+// second place for a query parameter to go missing from - which is how the card
+// popup's checkboxes ended up driving the Excel download and not the PDF.
+// A CARD has export routes of its own - /lists/:listId/cards/:cardId/exportPDF
+// and exportExcel - which produce the one card rather than a board document with
+// one card in it. They are the same renderers underneath, so the popup uses them
+// when it is a card being exported and the board routes otherwise, instead of
+// there being two ways to ask for the same file.
+function routeFor(path) {
+  const data = Template.currentData() || {};
+  if (!data.cardId || !data.listId) return path;
+  if (path.endsWith('exportPDF')) {
+    return '/api/boards/:boardId/lists/:listId/cards/:cardId/exportPDF';
+  }
+  if (path.endsWith('exportExcel')) {
+    return '/api/boards/:boardId/lists/:listId/cards/:cardId/exportExcel';
+  }
+  return path;
+}
+
+function exportUrl(path, extra = {}) {
+  const boardId = Session.get('currentBoard');
+  const data = Template.currentData() || {};
+  const route = routeFor(path);
+  const params = { boardId };
+  if (route.includes(':listId')) params.listId = data.listId;
+  if (route.includes(':cardId')) params.cardId = data.cardId;
+  return FlowRouter.path(route, params, {
+    authToken: Accounts._storedLoginToken(),
+    fields: selectedFields().join(','),
+    ...currentScope(),
+    ...exportLocaleParams(),
+    ...extra,
+  });
+}
+
+// The import half's state. Module-level like the selection, because the popup is
+// destroyed and recreated as it is reopened and a half-finished import should
+// still be able to say how it went.
+const importState = new ReactiveDict();
+importState.set('busy', false);
+importState.set('error', '');
+importState.set('done', '');
+
+// A WeKan export is either the document itself or a .zip with the document
+// inside it. Reading the .zip in the BROWSER is what keeps the server out of it:
+// the method takes the same object either way, so there is one import path and
+// not two.
+async function readExportFile(file) {
+  const name = String(file.name || '').toLowerCase();
+  if (!name.endsWith('.zip')) {
+    // A .json already carries its attachments as base64 under `file`, which is
+    // what the importer reads.
+    return JSON.parse(await file.text());
+  }
+
+  const JSZip = (await import('jszip')).default;
+  const zip = await JSZip.loadAsync(file);
+  const entry = zip.file('wekan.json') || zip.file(/wekan\.json$/)[0];
+  if (!entry) throw new Error('import-not-wekan-export');
+  const doc = JSON.parse(await entry.async('string'));
+
+  // The FILES beside the document. The export writes them as
+  // `attachments/<attachmentId>-<name>`, and the id is what ties a file back to
+  // its metadata row - two attachments called "photo.png" are two entries.
+  //
+  // They go onto the SAME `file` field a .json export uses, so the server has
+  // one import path rather than one per container. That is also the tradeoff to
+  // know about: the archive is unpacked in the browser and sent as base64, so a
+  // .zip full of large attachments costs memory on the way in. It is the shape
+  // the board import has always used, and the reason to reach for a .zip is
+  // still the same - the JSON of a board with many attachments may be too large
+  // for one string, while its archive is not.
+  const byId = new Map(
+    (Array.isArray(doc.attachments) ? doc.attachments : [])
+      .filter(attachment => attachment && attachment._id)
+      .map(attachment => [attachment._id, attachment]),
+  );
+  const files = zip.file(/^attachments\//);
+  for (const archived of files || []) {
+    const base = archived.name.slice('attachments/'.length);
+    const dash = base.indexOf('-');
+    const attachmentId = dash === -1 ? base : base.slice(0, dash);
+    const attachment = byId.get(attachmentId);
+    // A file whose row is not in the document is one the selection left out, or
+    // a hand-made archive: skipping it is better than inventing a row for it.
+    if (!attachment) continue;
+    attachment.file = await archived.async('base64');
+  }
+  return doc;
+}
+
+// A .json is small enough to travel as a document: it is parsed here and sent
+// over DDP, which is the path the per-menu import has always used.
+function importJsonDocument(doc, target) {
+  return new Promise((resolve, reject) => {
+    Meteor.call('importScoped', target, doc, selectedFields(),
+      (err, res) => (err ? reject(err) : resolve(res)));
+  });
+}
+
+// POST the archive itself to /api/import/zip. `fetch` streams a File body, so
+// the browser does not hold a copy either.
+async function uploadZipImport(file, target) {
+  const params = new URLSearchParams({
+    authToken: Accounts._storedLoginToken() || '',
+    boardId: target.boardId,
+    fields: selectedFields().join(','),
+  });
+  for (const key of ['swimlaneId', 'listId', 'cardId', 'checklistId']) {
+    if (target[key]) params.set(key, target[key]);
+  }
+  const response = await fetch(`/api/import/zip?${params.toString()}`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/zip' },
+    body: file,
+  });
+  const answer = await response.json().catch(() => ({}));
+  if (!response.ok || !answer.ok) {
+    throw new Error(answer.error || 'import-scoped-failed');
+  }
+  return answer.counts;
+}
+
+// EVERY format this popup offers, in one table, for every scope.
+//
+// It was two markups: the board popup wrote its own list of nineteen formats in
+// sidebar.jade under four subheadings, and the swimlane / list / card popups
+// wrote five in exportScope.jade - so "the export popup" meant two different
+// menus with two different looks, and a format added to one was missing from
+// the other. One table, rendered by one template, is the answer to both.
+//
+// `scopes: ['board']` marks a format that only makes sense for a whole board -
+// the HTML archive, the dependency graph, the CSV columns, and the exports
+// written for another tool. Everything else is offered wherever the popup is,
+// because `exportUrl` already carries the scope: a swimlane, a list and a card
+// each differ from a board by a query parameter, not by a route.
+//
+// An entry is either a LINK (`path`, downloaded straight from the API) or an
+// ACTION (`action`, a class an event handler is bound to). Nothing else varies.
+const BOARD_ONLY = ['board'];
+const EXPORT_FORMAT_GROUPS = [
+  {
+    key: 'files',
+    entries: [
+      { key: 'pdf', icon: 'fa-file-pdf-o', label: 'PDF', path: 'exportPDF', ext: 'pdf' },
+      { key: 'excel', icon: 'fa-file-excel-o', label: 'Excel', path: 'exportExcel', ext: 'xlsx' },
+      { key: 'html', icon: 'fa-archive', label: 'HTML', action: 'html-export-board', scopes: BOARD_ONLY },
+    ],
+  },
+  {
+    key: 'dependencies',
+    headingKey: 'card-dependencies',
+    scopes: BOARD_ONLY,
+    entries: [
+      { key: 'dep-json', icon: 'fa-link', label: 'JSON', action: 'js-export-dependencies-json' },
+      { key: 'dep-svg', icon: 'fa-link', label: 'SVG', action: 'js-export-dependencies-svg' },
+    ],
+  },
+  {
+    key: 'csv',
+    heading: 'CSV',
+    scopes: BOARD_ONLY,
+    entries: [
+      { key: 'csv', icon: 'fa-upload', label: '(,)', path: 'export/csv', ext: 'csv', query: { delimiter: ',' } },
+      { key: 'scsv', icon: 'fa-upload', label: '(;)', path: 'export/csv', ext: 'csv', query: { delimiter: ';' } },
+      { key: 'tsv', icon: 'fa-upload', label: 'TSV', path: 'export/csv', ext: 'tsv', query: { delimiter: '\t' } },
+    ],
+  },
+  {
+    key: 'json',
+    heading: 'JSON',
+    entries: [
+      { key: 'json', icon: 'fa-file-code-o', label: 'JSON', path: 'export', ext: 'json' },
+      {
+        key: 'json-no-attachments',
+        icon: 'fa-file-code-o',
+        labelKey: 'export-board-without-attachments',
+        labelPrefix: 'JSON',
+        path: 'export',
+        ext: 'json',
+        query: { attachments: 'false' },
+      },
+      {
+        key: 'zip',
+        icon: 'fa-file-archive-o',
+        labelKey: 'attachments',
+        labelPrefix: '.zip',
+        path: 'exportZip',
+        ext: 'zip',
+      },
+      { key: 'kanboard', icon: 'fa-upload', label: 'Kanboard', path: 'export/kanboard', ext: 'json', scopes: BOARD_ONLY },
+      ...[
+        ['trello', 'Trello'], ['jira', 'Jira'], ['deck', 'NextCloud Deck'],
+        ['openproject', 'OpenProject'], ['github', 'GitHub'], ['gitlab', 'GitLab'],
+        ['gitea', 'Gitea'], ['forgejo', 'Forgejo'], ['asana', 'Asana'],
+        ['zenkit', 'Zenkit'],
+      ].map(([format, label]) => ({
+        key: format,
+        icon: 'fa-upload',
+        label,
+        path: `export/${format}`,
+        ext: 'json',
+        scopes: BOARD_ONLY,
+      })),
+    ],
+  },
+];
+
+// Is this popup a whole board, or a swimlane / list / card inside one?
+function isBoardScope() {
+  const data = Template.currentData() || {};
+  // checklistId too: the checklist popup is a scope of its own, and a scope
+  // that is not named here would be read as "a whole board" and offered the
+  // HTML archive, the dependency graph and the CSV columns of one.
+  return !data.swimlaneId && !data.listId && !data.cardId && !data.checklistId;
+}
+
+function entryApplies(entry) {
+  return !entry.scopes || entry.scopes.includes('board') === isBoardScope();
+}
+
+// The table above, resolved for the scope this popup was opened with: each entry
+// carries its URL; the response supplies its localized, scope-aware filename.
+// A group whose every entry is out of scope is dropped, heading and all.
+function resolvedFormatGroups() {
+  return EXPORT_FORMAT_GROUPS
+    .filter(group => !group.scopes || group.scopes.includes('board') === isBoardScope())
+    .map(group => ({
+      key: group.key,
+      heading: group.headingKey ? TAPi18n.__(group.headingKey) : group.heading || '',
+      entries: group.entries.filter(entryApplies).map(entry => ({
+        ...entry,
+        label: entry.labelKey
+          ? `${entry.labelPrefix} (${TAPi18n.__(entry.labelKey)})`
+          : entry.label,
+        url: entry.path ? exportUrl(`/api/boards/:boardId/${entry.path}`, entry.query || {}) : '',
+      })),
+    }))
+    .filter(group => group.entries.length);
+}
+
+// Import writes to the board, so unlike export it is offered only to somebody
+// who may change it. A named function rather than a helper body, because the
+// menus that offer the Import row have to ask the same question - four copies of
+// four permission checks is how one of them ends up offering a row that then
+// refuses to do anything.
+function canImportIntoBoard() {
+  const user = ReactiveCache.getCurrentUser();
+  return Boolean(user && !user.isWorker && !user.isCommentOnly
+    && !user.isReadOnly && !user.isReadAssignedOnly);
+}
+Template.registerHelper('canImportIntoBoard', canImportIntoBoard);
+
+const scopeHelpers = {
+  canImport() {
+    return canImportIntoBoard();
+  },
+  // Which half of the popup this is. One body, two modes: EXPORT shows the
+  // formats to download, IMPORT shows the file to read - and both keep the
+  // "what to include" pane, because that selection means the same thing in
+  // both directions (#1173).
+  isImportMode() {
+    const data = Template.currentData() || {};
+    return data.mode === 'import';
+  },
+  importBusy() { return importState.get('busy'); },
+  importError() { return importState.get('error'); },
+  importDone() { return importState.get('done'); },
+  exportFields() {
+    return BOARD_EXPORT_FIELDS.map(({ field, label }) => ({
+      field,
+      label,
+      checked: selection.get(field),
+    }));
+  },
+  cardDetailsChecked() {
+    return selection.get('card-details');
+  },
+  // Every format, resolved for this popup's scope - see EXPORT_FORMAT_GROUPS.
+  // #5870's "JSON without the base64 attachment data" is one of them, offered
+  // wherever an export is offered rather than only on the board menu.
+  formatGroups() {
+    return resolvedFormatGroups();
+  },
+};
+
+// One helper object, registered on both halves: the checkbox list is its own
+// template so the layout can put it in a pane, and it asks the same questions.
+Template.exportScopeBody.helpers(scopeHelpers);
+Template.exportScopeSelect.helpers(scopeHelpers);
+
+// THE TOGGLES, BOUND ON THE DOCUMENT - and deliberately not as a template event
+// map.
+//
+// #6586 comment 5308548585: "I can't select/deselect those arrows here", and
+// then "clicking a checked option, like labels, does not uncheck it". The
+// handlers were a `Template.exportScopeBody.events({...})` map, and a click on a
+// row did nothing. Registering the same map on `exportScopeSelect` as well - the
+// template that actually draws the rows - did not help either: the fix was
+// built, shipped in both the release and the development bundle, and the list
+// still could not be changed.
+//
+// What IS known, from the built bundle: the templates are registered, their
+// helpers run (the rows render, with their labels and their state), and both
+// event maps are attached. The click simply never arrives. This list is drawn
+// inside five different popups, each rendered by Popup into its own Blaze view
+// tree, so rather than keep guessing which link in that chain drops the event,
+// the toggle is bound where nothing can: one delegated handler on the document,
+// the same mechanism client/lib/escapeActions.js uses to catch clicks inside
+// popups.
+//
+// ONE binding, not one per template - two would toggle twice and cancel out,
+// which is the same "nothing happens" from a different direction.
+//
+// The display stays reactive through `selection`, which is what draws the
+// checkbox, so nothing here touches the DOM by hand.
+function toggleSelection(field) {
+  if (!field) return;
+  selection.set(field, !selection.get(field));
+}
+
+// A NATIVE listener, in the CAPTURE phase, and no jQuery.
+//
+// Capture, because it runs on the way DOWN to the row: a `stopPropagation()`
+// anywhere between the row and the document - which is one of the things that
+// could have been eating this click - cannot prevent it. And native, because a
+// `window.jQuery` that turned out to be undefined would fail silently, which is
+// indistinguishable from the bug being fixed.
+Meteor.startup(() => {
+  if (typeof document === 'undefined') return;
+  document.addEventListener('click', event => {
+    const target = event.target && event.target.closest
+      ? event.target.closest('.js-export-field-toggle, .js-export-card-details-toggle')
+      : null;
+    if (!target) return;
+    // The popup stays open: choosing five sections should not be five reopens.
+    event.preventDefault();
+    toggleSelection(target.classList.contains('js-export-card-details-toggle')
+      ? 'card-details'
+      : (target.dataset && target.dataset.field));
+  }, true);
+});
+
+Template.exportScopeBody.events({
+  async 'change .js-import-file'(event) {
+    const file = event.currentTarget.files && event.currentTarget.files[0];
+    if (!file) return;
+    const data = Template.currentData() || {};
+    const target = {
+      boardId: Session.get('currentBoard'),
+      ...currentScope(),
+    };
+    // A card's menu imports below THAT card, so the target is the card the popup
+    // was opened on - the same id the export side uses as its scope.
+    if (data.cardId) target.cardId = data.cardId;
+
+    importState.set('error', '');
+    importState.set('done', '');
+    importState.set('busy', true);
+    try {
+      const counts = String(file.name || '').toLowerCase().endsWith('.zip')
+        // A .zip goes to the server AS A FILE. Unpacking it here and sending
+        // base64 over DDP is what made a large archive expensive: 2 GB of
+        // attachments became 2.7 GB in one message. The route streams it to
+        // disk, reads the archive's directory, and pipes one attachment at a
+        // time into storage.
+        ? await uploadZipImport(file, target)
+        : await importJsonDocument(await readExportFile(file), target);
+      importState.set('done', Object.entries(counts || {})
+        .filter(([, n]) => n > 0)
+        .map(([what, n]) => `${n} ${what}`)
+        .join(', ') || '0');
+    } catch (error) {
+      const message = error && error.message === 'import-not-wekan-export'
+        ? 'import-not-wekan-export'
+        : 'import-scoped-failed';
+      importState.set('error', message);
+      // The reason, for somebody reading the console - the popup has room for a
+      // sentence, not for a stack.
+      console.error('scoped import failed', error);
+    } finally {
+      importState.set('busy', false);
+      event.currentTarget.value = '';
+    }
+  },
+});
+
+// `exportUrlFor` is what the board popup uses to build the same URLs with the
+// same selection - one query string, built in one place, whichever popup asks.
+export {
+  selectedFields,
+  selection,
+  readExportFile,
+  exportUrl as exportUrlFor,
+};

client/components/boards/originalPositionsView.css

@@ -35,7 +35,7 @@
 }
 
 .original-positions-loading i {
-  margin-right: 8px;
+  margin-inline-end: 8px;
 }
 
 .original-positions-filters {
@@ -100,7 +100,7 @@
   color: white;
   padding: 2px 6px;
   border-radius: 3px;
-  font-size: 11px;
+  font-size: calc(11px * var(--wekan-ui-font-scale, 1));
   font-weight: 500;
   text-transform: uppercase;
 }
@@ -112,23 +112,23 @@
 
 .entity-id {
   color: #6c757d;
-  font-size: 11px;
+  font-size: calc(11px * var(--wekan-ui-font-scale, 1));
   font-family: monospace;
 }
 
 .original-position-item-details {
-  margin-left: 24px;
+  margin-inline-start: 24px;
 }
 
 .original-position-description {
   color: #495057;
   margin-bottom: 6px;
-  font-size: 13px;
+  font-size: calc(13px * var(--wekan-ui-font-scale, 1));
 }
 
 .original-title {
   color: #6c757d;
-  font-size: 12px;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1));
   margin-bottom: 6px;
   padding: 4px 6px;
   background-color: #e9ecef;
@@ -141,7 +141,7 @@
 
 .original-position-date {
   color: #6c757d;
-  font-size: 11px;
+  font-size: calc(11px * var(--wekan-ui-font-scale, 1));
 }
 
 .no-original-positions {
@@ -152,7 +152,7 @@
 }
 
 .no-original-positions i {
-  font-size: 24px;
+  font-size: calc(24px * var(--wekan-ui-font-scale, 1));
   margin-bottom: 10px;
   display: block;
   color: #adb5bd;
@@ -191,7 +191,7 @@
   }
 
   .original-position-item-details {
-    margin-left: 0;
+    margin-inline-start: 0;
     margin-top: 8px;
   }
 }

client/components/boards/publicBoards.css

@@ -0,0 +1,60 @@
+/* /public — the Public Boards table.
+ * Design: docs/Features/Page/Public.md, which is docs/Features/Page/Table.md.
+ *
+ * ONLY the row's board colouring lives here. The table itself — its width, its
+ * columns, its cells, its controls row and its stacking below 800px — is
+ * tablePage.css, shared with every other table page, and this file must not
+ * restate any of it.
+ */
+
+.public-boards {
+  padding: 12px;
+}
+
+/* A board is recognised by its colour before its title is read, and it is the
+ * same board here as on All Boards, so a row carries its colour.
+ *
+ * The colour itself comes from boardColors.css, where `.public-board-row` was
+ * added to each board colour's existing selector list — the same declaration,
+ * one more selector — so these rows follow the board colours and the theme
+ * without a single hex value being repeated here.
+ *
+ * THE DEFAULT MATTERS MOST. A board with no colour matches none of those rules,
+ * so the row keeps the table's white background: with the light text below that
+ * is white on white, and only the row's emoji was visible. The All Boards tile
+ * has the same problem and solves it the same way — `.board-list-item` falls
+ * back to a grey (#999) so its white text always has something to sit on. */
+.public-board-row {
+  background-color: #999;
+  background-size: cover;
+  background-position: center;
+  cursor: pointer;
+}
+
+/* Light text, like the tile's own (.board-list-item is #f6f6f6), which is
+ * readable because the rule above guarantees a background to sit on. */
+.public-board-row td {
+  color: #f6f6f6;
+}
+.public-board-row .public-board-title a {
+  color: inherit;
+  font-weight: 700;
+  text-decoration: none;
+}
+.public-board-row .public-board-title a:hover {
+  text-decoration: underline;
+}
+
+/* A description is secondary to the title it explains, and it can be long: it may
+ * wrap, and it is dimmed a little against the board's own background — the same
+ * treatment .board-list-item-sub-name gets on the tile. */
+.public-board-row .public-board-desc {
+  color: rgba(255, 255, 255, 0.85);
+  white-space: normal;
+  word-break: break-word;
+}
+
+/* The whole row opens the board, so it has to look like it does. */
+.public-board-row:hover {
+  filter: brightness(1.08);
+}

client/components/boards/publicBoards.jade

@@ -0,0 +1,32 @@
+//- /public — the boards anybody may open.
+//- Design: docs/Features/Page/Public.md, which is the Table page design
+//- (docs/Features/Page/Table.md).
+//-
+//- The whole page is the shared table. It used to render `boardList`, the All
+//- Boards page, with its query swapped for `{ permission: 'public' }` — which
+//- brought the Starred/Templates/Remaining menu, the workspaces tree, the org and
+//- team filters, Multi-Selection with its archive and duplicate actions, board
+//- dragging and an "Add board" tile along with it, none of which means anything
+//- for a list of somebody else's public boards.
+template(name="publicBoards")
+  .wrapper.public-boards
+    +tablePage(tablePageData)
+
+//- One row. It supplies a rowTemplate — rather than a text-cell column spec —
+//- because a row is a LINK and carries its board's colours, neither of which a
+//- text cell can express. It is still read-only: one anchor, no control, and
+//- nothing on it changes anything.
+//-
+//- The cells must match the header, in order: Board, Description.
+template(name="publicBoardRow")
+  tr.public-board-row.js-open-public-board(
+    class="{{colorClass}}"
+    data-board-id="{{_id}}"
+    style="{{backgroundStyle}}")
+    td.public-board-title
+      a.js-open-public-board-link(href="{{pathFor 'board' id=_id slug=slug}}")
+        +viewer
+          = title
+    td.public-board-desc
+      +viewer
+        = description

client/components/boards/publicBoards.js

@@ -0,0 +1,137 @@
+import { ReactiveVar } from 'meteor/reactive-var';
+import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
+import Boards from '/models/boards';
+import { ReportPages } from '/client/lib/reportPages';
+import {
+  buildHeader,
+  docsByIds,
+  pageInfo,
+  TABLE_PAGE_ROWS_PER_PAGE,
+} from '/models/lib/tablePage';
+
+// /public — the boards anybody may open, as a table page.
+// Design: docs/Features/Page/Public.md (which is docs/Features/Page/Table.md).
+//
+// The page is ONLY the table. It used to render `boardList`, the All Boards page,
+// with its query swapped for `{ permission: 'public' }` — which brought the
+// Starred/Templates/Remaining menu, the workspaces tree, the org and team
+// filters, Multi-Selection with its archive and duplicate actions, board dragging
+// and an "Add board" tile with it. None of that means anything for a list of
+// somebody else's public boards, and some of it offered actions the visitor has
+// no rights to.
+
+// The server names its page under this id (publishReportPage in the publication).
+const PAGE_ID = 'public-boards';
+
+// The columns, in the order a board tile shows them. Header labels only: the rows
+// are a template, because a row is a LINK and carries its board's colours, and a
+// text cell can express neither.
+// Two columns, deliberately. The All Boards tile also shows member avatars, each
+// list with its card count and a spent-time clock; what a visitor needs of a board
+// they do not belong to is what it is called and what it is for. Each of the rest
+// also costs a query this page would otherwise not make - see the design doc.
+const COLUMNS = [
+  { labelKey: 'board' },
+  { labelKey: 'description' },
+];
+
+Template.publicBoards.onCreated(function () {
+  this.page = new ReactiveVar(1);
+  this.searchTerm = new ReactiveVar('');
+  this.total = new ReactiveVar(0);
+
+  this.autorun(() => {
+    const page = this.page.get();
+    const term = this.searchTerm.get();
+    this.subscribe('publicBoards', term, TABLE_PAGE_ROWS_PER_PAGE,
+      (page - 1) * TABLE_PAGE_ROWS_PER_PAGE);
+    // The total is a method, not a published count: the page needs one number and
+    // a live count cursor over every public board on the instance is not worth it.
+    Meteor.call('getPublicBoardsCount', term, (err, res) => {
+      if (!err && typeof res === 'number') this.total.set(res);
+    });
+  });
+});
+
+Template.publicBoards.helpers({
+  tablePageData() {
+    const tpl = Template.instance();
+    const info = pageInfo(tpl.total.get(), tpl.page.get());
+
+    // The boards of the page the SERVER named, in the order it sorted them. Not
+    // a plain find(): every board this user has opened is also in minimongo, and
+    // reading the collection would draw those too — the pager would say "1 / 3"
+    // beside rows from all three pages.
+    const index = ReportPages.findOne(PAGE_ID);
+    const ids = (index && index.ids) || [];
+    const boards = ids.length
+      ? docsByIds(ids, Boards.find({ _id: { $in: ids } }).fetch())
+      : [];
+
+    const docs = boards.map(board => {
+      return {
+        _id: board._id,
+        slug: board.slug,
+        title: board.title,
+        description: board.description,
+        colorClass: board.colorClass ? board.colorClass() : '',
+        // #5157: the board's own background image, the same one the All Boards
+        // tile uses, so a board is recognised here the way it is there.
+        backgroundStyle: board.backgroundImageURL
+          ? `background-image:url('${board.backgroundImageURL}');`
+          : '',
+      };
+    });
+
+    return {
+      // NO titleKey. The page already has a heading: the route renders
+      // `boardListHeaderBar`, whose `h1` says "Public". The shared table page
+      // prints a title only when one is supplied, precisely so a page that
+      // already has a heading does not show two - the same reason the Admin
+      // Panel panes supply none (docs/Features/Page/Table.md).
+      header: buildHeader(COLUMNS),
+      // A row template, not `rows`: see COLUMNS above.
+      rowTemplate: 'publicBoardRow',
+      docs,
+      rowCount: docs.length,
+      total: tpl.total.get(),
+      searchTerm: tpl.searchTerm.get(),
+      page: info.page,
+      totalPages: info.totalPages,
+      hasPrev: info.hasPrev,
+      hasNext: info.hasNext,
+      emptyKey: 'no-results',
+    };
+  },
+});
+
+Template.publicBoards.events({
+  // The shared controls row: search on Enter, and the pager. There is nothing
+  // else — no filter, no action button — because nothing on this page changes
+  // anything.
+  'keydown .js-table-page-search'(event, tpl) {
+    if (event.key !== 'Enter') return;
+    event.preventDefault();
+    tpl.searchTerm.set(event.currentTarget.value || '');
+    tpl.page.set(1);
+  },
+  'click .js-table-page-prev'(event, tpl) {
+    event.preventDefault();
+    tpl.page.set(Math.max(1, tpl.page.get() - 1));
+  },
+  'click .js-table-page-next'(event, tpl) {
+    event.preventDefault();
+    tpl.page.set(tpl.page.get() + 1);
+  },
+
+  // The whole row opens its board. The title is already an anchor, so a click on
+  // it is left alone — following it twice would push the same route twice.
+  'click .js-open-public-board'(event) {
+    if ($(event.target).closest('a').length > 0) return;
+    const boardId = event.currentTarget.getAttribute('data-board-id');
+    if (!boardId) return;
+    const board = Boards.findOne(boardId);
+    if (!board) return;
+    FlowRouter.go('board', { id: boardId, slug: board.slug });
+  },
+});

client/components/boards/statsView.css

@@ -0,0 +1,56 @@
+/* Board "Statistics" view — full width, like the other board views. Its text is
+   selectable so any value can be highlighted and copied. */
+.stats-view {
+  width: 100%;
+  height: 100%;
+  overflow: auto;
+  user-select: text;
+  -webkit-user-select: text;
+}
+
+.stats-view-content {
+  max-width: 900px;
+  margin: 0 auto;
+  padding: 24px;
+}
+
+.stats-view-title {
+  margin: 0 0 16px;
+  font-size: calc(22px * var(--wekan-ui-font-scale, 1));
+  font-weight: bold;
+}
+
+.stats-view-section {
+  margin-bottom: 28px;
+}
+
+.stats-view-heading {
+  margin: 0 0 8px;
+  font-size: calc(16px * var(--wekan-ui-font-scale, 1));
+  font-weight: bold;
+  border-bottom: 2px solid #dbdbdb;
+  padding-bottom: 4px;
+}
+
+.stats-view-table {
+  width: 100%;
+  border-collapse: collapse;
+}
+
+.stats-view-table td {
+  padding: 8px 4px;
+  border-bottom: 1px solid #eee;
+  user-select: text;
+  -webkit-user-select: text;
+}
+
+.stats-view-table .stats-view-label {
+  color: #666;
+  width: 60%;
+}
+
+.stats-view-table .stats-view-value {
+  font-weight: bold;
+  /* A number is read from its END edge - the right in LTR, the left in RTL. */
+  text-align: end;
+}

client/components/boards/statsView.jade

@@ -0,0 +1,45 @@
+template(name="statsView")
+  .stats-view
+    .stats-view-content
+      h1.stats-view-title {{ boardTitle }}
+      .stats-view-section
+        h2.stats-view-heading {{_ 'board-status'}}
+        table.stats-view-table
+          tbody
+            tr
+              td.stats-view-label {{_ 'board-status-loading-mode'}}
+              td.stats-view-value {{ loadingModeLabel }}
+            tr
+              td.stats-view-label {{_ 'swimlanes'}}
+              td.stats-view-value {{ swimlaneCount }}
+            tr
+              td.stats-view-label {{_ 'lists'}}
+              td.stats-view-value {{ listCount }}
+            tr
+              td.stats-view-label {{_ 'cards'}}
+              td.stats-view-value {{ cardCount }}
+            tr
+              td.stats-view-label {{_ 'card-archived'}}
+              td.stats-view-value {{ archivedCardCount }}
+            tr
+              td.stats-view-label {{_ 'labels'}}
+              td.stats-view-value {{ labelCount }}
+            tr
+              td.stats-view-label {{_ 'members'}}
+              td.stats-view-value {{ memberCount }}
+            tr
+              td.stats-view-label {{_ 'custom-fields'}}
+              td.stats-view-value {{ customFieldCount }}
+      .stats-view-section
+        h2.stats-view-heading {{_ 'board-status-time-summary'}}
+        table.stats-view-table
+          tbody
+            tr
+              td.stats-view-label {{_ 'board-status-time-spent-total'}}
+              td.stats-view-value {{ timeSpentTotal }}
+            tr
+              td.stats-view-label {{_ 'board-status-cards-with-time'}}
+              td.stats-view-value {{ cardsWithTimeSpent }}
+            tr
+              td.stats-view-label {{_ 'board-status-overtime-cards'}}
+              td.stats-view-value {{ overtimeCards }}

client/components/boards/statsView.js

@@ -0,0 +1,70 @@
+import { ReactiveCache } from '/imports/reactiveCache';
+import { TAPi18n } from '/imports/i18n';
+import { ReactiveVar } from 'meteor/reactive-var';
+import { Utils } from '/client/lib/utils';
+
+// Board view "Statistics" (Tilastot) — a full-width board view (like Swimlanes /
+// Lists / Calendar / Gantt / Table) showing the board's status: its card-loading
+// mode, counts (swimlanes, lists, cards, labels, members, custom fields) and a
+// time-spent summary. Counts come from the server `boardStatus` method so they are
+// accurate even in lazy mode, where the browser only holds the visible card window.
+Template.statsView.onCreated(function() {
+  this.status = new ReactiveVar(null);
+  this.autorun(() => {
+    const boardId = Session.get('currentBoard');
+    if (boardId) {
+      Meteor.call('boardStatus', boardId, (err, res) => {
+        if (!err && res) this.status.set(res);
+      });
+    }
+  });
+});
+
+// Read one numeric field from the resolved status, or a placeholder while loading.
+function statsNum(key) {
+  const s = Template.instance().status.get();
+  return s ? (s[key] || 0) : '…';
+}
+
+Template.statsView.events({
+  // The board canvas uses drag-to-scroll (the `dragscroll` class), which otherwise
+  // swallows pointer/touch drags and prevents selecting text. Stop these events from
+  // reaching it so the browser's native selection works — with the mouse (drag) and
+  // on touch (long-press) — and any value can be copied to the clipboard.
+  'mousedown .stats-view'(event) {
+    event.stopPropagation();
+  },
+  'touchstart .stats-view'(event) {
+    event.stopPropagation();
+  },
+});
+
+Template.statsView.helpers({
+  boardTitle() {
+    const board = Utils.getCurrentBoard();
+    return board ? board.title : '';
+  },
+  loadingModeLabel() {
+    const s = Template.instance().status.get();
+    if (!s) return '…';
+    const inEffect = s.lazy
+      ? TAPi18n.__('cards-loading-lazy')
+      : TAPi18n.__('cards-loading-all');
+    return s.mode === 'auto' ? `${inEffect} (${TAPi18n.__('cards-loading-auto')})` : inEffect;
+  },
+  swimlaneCount() { return statsNum('swimlanes'); },
+  listCount() { return statsNum('lists'); },
+  cardCount() { return statsNum('cards'); },
+  archivedCardCount() { return statsNum('archivedCards'); },
+  labelCount() { return statsNum('labels'); },
+  memberCount() { return statsNum('members'); },
+  customFieldCount() { return statsNum('customFields'); },
+  cardsWithTimeSpent() { return statsNum('cardsWithTimeSpent'); },
+  overtimeCards() { return statsNum('overtimeCards'); },
+  timeSpentTotal() {
+    const s = Template.instance().status.get();
+    if (!s) return '…';
+    const n = Number(s.timeSpentTotal) || 0;
+    return `${n} h`;
+  },
+});

client/components/boards/tableView.css

@@ -0,0 +1,131 @@
+/* Board Table view: search + pagination controls, styled to match the
+   Admin Panel / People page (see client/components/settings/peopleBody.css).
+   The table itself reuses the My Cards table styling (.my-cards-board-table). */
+
+.table-view-controls {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 12px;
+  margin: 9px 0;
+}
+
+.table-view-search-box {
+  display: flex;
+  flex-direction: row;
+  height: 34px;
+}
+
+.table-view-search-box input {
+  border: 1px solid #ccc;
+  border-radius: 6px;
+  padding: 0 8px;
+}
+
+.table-view-search-box button {
+  min-width: 90px;
+  margin-inline-start: 6px;
+  background: #01628c;
+  color: #fff;
+  border: none;
+  border-radius: 6px;
+  cursor: pointer;
+  padding: 0 12px;
+}
+
+.table-view-search-box button:hover {
+  background: #005377;
+}
+
+.table-view-pagination {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+}
+
+.table-view-pagination button {
+  min-width: 32px;
+  height: 30px;
+  border: 1px solid #bbb;
+  background: #fff;
+  border-radius: 6px;
+  cursor: pointer;
+}
+
+.table-view-pagination button.disabled {
+  opacity: 0.5;
+  pointer-events: none;
+}
+
+.table-view-page-info {
+  min-width: 72px;
+  text-align: center;
+  color: #333;
+}
+
+/* Leftmost "Edit" cell: an Edit link (pencil icon + text) styled like the one
+   on the Admin Panel / People page, opening the card when clicked. */
+.my-cards-board-table td.table-view-cell-edit {
+  white-space: nowrap;
+}
+
+.my-cards-board-table td.table-view-cell-edit .edit-card {
+  cursor: pointer;
+}
+
+.my-cards-board-table td.table-view-cell-edit .edit-card i.fa {
+  margin-inline-end: 4px;
+}
+
+/* Word-wrap the Card / List / Swimlane cells so long text breaks onto the next
+   line instead of overflowing across the other columns. */
+.my-cards-board-table td.table-view-cell-wrap {
+  max-width: 250px;
+  white-space: normal;
+  overflow-wrap: break-word;
+  word-break: break-word;
+}
+
+/* The +viewer template wraps its markdown in a block-level .viewer div. Inside
+   a table cell it should not add extra vertical margins, and inside a label it
+   must stay inline so the label keeps its pill shape. */
+.my-cards-board-table .viewer {
+  margin: 0;
+}
+
+.my-cards-board-table .viewer p {
+  margin: 0;
+}
+
+.my-cards-board-table .card-label .viewer,
+.my-cards-board-table .card-label .viewer p {
+  display: inline;
+}
+
+/* Word-wrap the Labels cell so each label pill wraps onto the next line instead
+   of stretching the column or overflowing across the date columns. */
+.my-cards-board-table td.table-view-cell-labels {
+  max-width: 250px;
+}
+
+.my-cards-board-table td.table-view-cell-labels .div {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 4px;
+}
+
+.my-cards-board-table td.table-view-cell-labels .card-label {
+  white-space: normal;
+  overflow-wrap: break-word;
+  word-break: break-word;
+}
+
+/* Keep each date in a single column; the clickable badge already styles itself
+   like the card detail / Gantt date badges. */
+.my-cards-board-table td.table-view-cell-date {
+  white-space: nowrap;
+}
+
+.my-cards-board-table td.table-view-cell-date .card-date {
+  cursor: pointer;
+}

client/components/boards/tableView.jade

@@ -0,0 +1,107 @@
+template(name="tableView")
+  if currentBoard
+    .wrapper
+      .table-view-controls
+        .table-view-search-box
+          input.js-table-view-search(type="text" placeholder="{{_ 'search'}}" aria-label="{{_ 'search'}}")
+          button.js-table-view-search-button(type="button")
+            i.fa.fa-search
+            | {{_ 'search'}}
+        .table-view-pagination
+          button.js-table-view-prev-page(type="button" class="{{#unless hasPrevPage}}disabled{{/unless}}" aria-label="{{_ 'previous'}}")
+            i.fa.fa-chevron-left
+          span.table-view-page-info {{currentPage}} / {{totalPages}}
+          button.js-table-view-next-page(type="button" class="{{#unless hasNextPage}}disabled{{/unless}}" aria-label="{{_ 'next'}}")
+            i.fa.fa-chevron-right
+      table.my-cards-board-table
+        caption.sr-only {{currentBoard.title}}
+        thead
+          tr
+            th(scope="col")
+            th(scope="col") {{_ "card"}}
+            th(scope="col") {{_ "list"}}
+            th(scope="col") {{_ "swimlane"}}
+            unless isMiniScreen
+              th(scope="col") {{_ "assignees"}}
+              th(scope="col") {{_ "members"}}
+              th(scope="col") {{_ "labels"}}
+              if showReceivedColumn
+                th(scope="col") {{_ "card-received"}}
+              if showStartColumn
+                th(scope="col") {{_ "card-start"}}
+              if showDueColumn
+                th(scope="col") {{_ "card-due"}}
+              if showEndColumn
+                th(scope="col") {{_ "card-end"}}
+        tbody
+          each row in rows
+            tr
+              td.table-view-cell-edit
+                a.edit-card.js-table-view-edit-card(href=row.card.originRelativeUrl data-card-id=row.card._id title="{{_ 'edit'}}")
+                  i.fa.fa-pencil-square-o
+                  | {{_ 'edit'}}
+              td.table-view-cell-wrap
+                unless isMiniScreen
+                  .my-cards-board-badge(class=row.colorClass)
+                .my-cards-card-title-table
+                  +viewer
+                    = row.title
+              td.table-view-cell-wrap
+                +viewer
+                  = row.listTitle
+              td.table-view-cell-wrap
+                +viewer
+                  = row.swimlaneTitle
+              unless isMiniScreen
+                td
+                  .div
+                    each assignee in row.card.getAssignees
+                      a.name
+                        +userAvatar(userId=assignee noRemove=true)
+                td
+                  .div
+                    each member in row.card.getMembers
+                      a.name
+                        +userAvatar(userId=member noRemove=true)
+                td.table-view-cell-labels
+                  .div
+                    each label in row.labels
+                      span.card-label(class="{{labelColorClass label.color}}" style="{{labelColorStyle label.color}}" title="{{label.name}}")
+                        +viewer
+                          = label.name
+                if showReceivedColumn
+                  td.table-view-cell-date
+                    with row.card
+                      if getReceived
+                        +cardReceivedDate
+                      else
+                        if canModifyCard
+                          a.card-label.add-label.js-received-date(title="{{_ 'card-received'}}")
+                            i.fa.fa-plus
+                if showStartColumn
+                  td.table-view-cell-date
+                    with row.card
+                      if getStart
+                        +cardStartDate
+                      else
+                        if canModifyCard
+                          a.card-label.add-label.js-start-date(title="{{_ 'card-start'}}")
+                            i.fa.fa-plus
+                if showDueColumn
+                  td.table-view-cell-date
+                    with row.card
+                      if getDue
+                        +cardDueDate
+                      else
+                        if canModifyCard
+                          a.card-label.add-label.js-due-date(title="{{_ 'card-due'}}")
+                            i.fa.fa-plus
+                if showEndColumn
+                  td.table-view-cell-date
+                    with row.card
+                      if getEnd
+                        +cardEndDate
+                      else
+                        if canModifyCard
+                          a.card-label.add-label.js-end-date(title="{{_ 'card-end'}}")
+                            i.fa.fa-plus

client/components/boards/tableView.js

@@ -0,0 +1,202 @@
+import { ReactiveCache } from '/imports/reactiveCache';
+import { Utils } from '/client/lib/utils';
+
+// Board "Table" view: lists every card of the current board in a table that
+// reuses the My Cards table styling (the .my-cards-board-table CSS classes in
+// client/components/main/myCards.css). It is the per-board counterpart of the
+// My Cards table view, which spans all boards.
+//
+// Search, column sorting (Excel-like) and pagination all run client-side: the
+// board's cards are already loaded reactively via board.cards(), so there is no
+// need for the server-side limit/skip publication the Admin People page uses.
+
+const rowsPerPage = 25;
+
+Template.tableView.onCreated(function () {
+  this.searchQuery = new ReactiveVar('');
+  this.page = new ReactiveVar(1);
+  this.filteredRows = new ReactiveVar([]);
+
+  // Recompute the flat, filtered and sorted row list whenever the board cards,
+  // search query or sort order change. Pagination is applied separately in the
+  // rows() helper so paging does not rebuild the whole list.
+  this.autorun(() => {
+    const board = Utils.getCurrentBoard();
+    if (!board) {
+      this.filteredRows.set([]);
+      return;
+    }
+
+    const query = this.searchQuery.get().trim().toLowerCase();
+
+    const rows = [];
+    board.cards().forEach(card => {
+      const swimlane = card.getSwimlane();
+      const list = card.getList();
+      if (!swimlane || swimlane.archived || !list || list.archived) return;
+
+      const labels = (card.labelIds || [])
+        .map(labelId => {
+          const label = board.getLabelById(labelId);
+          return label ? { name: label.name || '', color: label.color } : null;
+        })
+        .filter(Boolean);
+
+      rows.push({
+        card,
+        title: card.title || '',
+        listTitle: list.title || '',
+        swimlaneTitle: swimlane.title || '',
+        colorClass: board.colorClass(),
+        receivedAt: card.getReceived() || null,
+        startAt: card.getStart() || null,
+        dueAt: card.getDue() || null,
+        endAt: card.getEnd() || null,
+        labels,
+      });
+    });
+
+    let filtered = rows;
+    if (query) {
+      filtered = rows.filter(row => {
+        const haystack = [
+          row.title,
+          row.listTitle,
+          row.swimlaneTitle,
+          ...row.labels.map(label => label.name),
+        ]
+          .join(' ')
+          .toLowerCase();
+        return haystack.indexOf(query) !== -1;
+      });
+    }
+
+    // Fixed order: by card title, ascending. (Column-header click-to-sort was
+    // removed; the Table view now always shows this stable order.)
+    filtered = filtered.slice().sort((a, b) =>
+      a.title.localeCompare(b.title, undefined, { numeric: true, sensitivity: 'base' }),
+    );
+
+    this.filteredRows.set(filtered);
+  });
+});
+
+Template.tableView.helpers({
+  currentBoard() {
+    return Utils.getCurrentBoard();
+  },
+
+  rows() {
+    const tpl = Template.instance();
+    const all = tpl.filteredRows.get();
+    const totalPages = Math.max(1, Math.ceil(all.length / rowsPerPage));
+    // Clamp on read so a shrinking list (deleted cards) never shows an empty
+    // page; no write here, to avoid a reactive loop.
+    const page = Math.min(tpl.page.get(), totalPages);
+    const start = (page - 1) * rowsPerPage;
+    return all.slice(start, start + rowsPerPage);
+  },
+
+  currentPage() {
+    return Template.instance().page.get();
+  },
+
+  totalPages() {
+    const count = Template.instance().filteredRows.get().length;
+    return Math.max(1, Math.ceil(count / rowsPerPage));
+  },
+
+  hasPrevPage() {
+    return Template.instance().page.get() > 1;
+  },
+
+  hasNextPage() {
+    const tpl = Template.instance();
+    const totalPages = Math.max(
+      1,
+      Math.ceil(tpl.filteredRows.get().length / rowsPerPage),
+    );
+    return tpl.page.get() < totalPages;
+  },
+
+  // A date column is shown unless BOTH its "Show at Card" (allowsXxxDate) and
+  // "Show at Minicard" (allowsXxxDateOnMinicard) board settings are unchecked.
+  showReceivedColumn() {
+    const board = Utils.getCurrentBoard();
+    return !!board && (board.allowsReceivedDate || board.allowsReceivedDateOnMinicard);
+  },
+
+  showStartColumn() {
+    const board = Utils.getCurrentBoard();
+    return !!board && (board.allowsStartDate || board.allowsStartDateOnMinicard);
+  },
+
+  showDueColumn() {
+    const board = Utils.getCurrentBoard();
+    return !!board && (board.allowsDueDate || board.allowsDueDateOnMinicard);
+  },
+
+  showEndColumn() {
+    const board = Utils.getCurrentBoard();
+    return !!board && (board.allowsEndDate || board.allowsEndDateOnMinicard);
+  },
+});
+
+Template.tableView.events({
+  'click .js-table-view-search-button'(event, tpl) {
+    event.preventDefault();
+    tpl.searchQuery.set(tpl.$('.js-table-view-search').val() || '');
+    tpl.page.set(1);
+  },
+
+  'keydown .js-table-view-search'(event, tpl) {
+    if (event.keyCode === 13) {
+      event.preventDefault();
+      tpl.searchQuery.set(tpl.$('.js-table-view-search').val() || '');
+      tpl.page.set(1);
+    }
+  },
+
+  'click .js-table-view-prev-page'(event, tpl) {
+    event.preventDefault();
+    const current = tpl.page.get();
+    if (current > 1) tpl.page.set(current - 1);
+  },
+
+  'click .js-table-view-next-page'(event, tpl) {
+    event.preventDefault();
+    const totalPages = Math.max(
+      1,
+      Math.ceil(tpl.filteredRows.get().length / rowsPerPage),
+    );
+    const current = tpl.page.get();
+    if (current < totalPages) tpl.page.set(current + 1);
+  },
+
+  // Clicking the leftmost "Edit" link opens the Card Details popup on top of the
+  // Board Table view (same mechanism as opening a card from search results).
+  'click .js-table-view-edit-card'(event) {
+    event.preventDefault();
+    const cardId = event.currentTarget.dataset.cardId;
+    if (!cardId) return;
+    const board = Utils.getCurrentBoard();
+    Meteor.subscribe('popupCardData', cardId, {
+      onReady() {
+        Session.set('popupCardId', cardId);
+        if (board) Session.set('popupCardBoardId', board._id);
+        if (!Popup.isOpen()) {
+          Popup.open('cardDetails')(event);
+        }
+      },
+    });
+  },
+
+  // Adding a date to a card that has none. The data context of each add button
+  // is the card (set with `with row.card` in the template), so the popup edits
+  // the right card. Editing an existing date is handled by the cardXxxDate
+  // badge templates themselves (their own .js-edit-date click handlers).
+  'click .js-received-date': Popup.open('editCardReceivedDate'),
+  'click .js-start-date': Popup.open('editCardStartDate'),
+  'click .js-due-date': Popup.open('editCardDueDate'),
+  'click .js-end-date': Popup.open('editCardEndDate'),
+});

client/components/cards/attachments.css

@@ -23,7 +23,7 @@
   width: 150px;
   min-width: 150px;
   max-height: 150px;
-  padding-right: 16px;
+  padding-inline-end: 16px;
 }
 .attachment-thumbnail {
   max-width: 150px;
@@ -48,7 +48,7 @@
 .attachment-details {
   display: flex;
   justify-content: space-between;
-  margin-right: 25px; /* Make sure the icons are not to far to the right */
+  margin-inline-end: 25px; /* Make sure the icons are not to far to the right */
 }
 .attachment-actions {
   display: flex;
@@ -56,10 +56,10 @@
   align-items: center;
 }
 .attachment-actions a {
-  margin-left: 16px;
+  margin-inline-start: 16px;
 }
 .attachment-actions a:first-child {
-  margin-left: 0;
+  margin-inline-start: 0;
 }
 .add-attachment {
   display: flex;
@@ -74,7 +74,7 @@
 .icon {
   font-size: 1.5em;
   cursor: pointer;
-  margin-left: 10px;
+  margin-inline-start: 10px;
 }
 .icon:hover {
   color: #666;
@@ -84,7 +84,7 @@
   height: 100vh;
   position: fixed;
   top: 0;
-  left: 0;
+  inset-inline-start: 0;
   z-index: 9999 !important;
   background: rgba(13, 13, 13, 0.95);
 }
@@ -113,7 +113,7 @@
   cursor: pointer;
   font-size: 4em;
   position: absolute;
-  right: 50px;
+  inset-inline-end: 50px;
   top: 16px;
 }
 
@@ -125,7 +125,7 @@
   border-radius: 4px;
   padding: 12px;
   margin: 8px 0;
-  font-size: 14px;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1));
 }
 
 .upload-progress-header {
@@ -137,7 +137,7 @@
 }
 
 .upload-progress-header i {
-  margin-right: 8px;
+  margin-inline-end: 8px;
   color: #007bff;
 }
 
@@ -187,7 +187,7 @@
 .upload-progress-success {
   display: flex;
   align-items: center;
-  font-size: 12px;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1));
   font-weight: 500;
 }
 
@@ -201,14 +201,14 @@
 
 .upload-progress-error i,
 .upload-progress-success i {
-  margin-right: 4px;
+  margin-inline-end: 4px;
 }
 
 /* Minicard specific styles */
 .minicard-upload-progress {
   margin: 4px 0;
   padding: 8px;
-  font-size: 12px;
+  font-size: calc(12px * var(--wekan-ui-font-scale, 1));
 }
 
 .minicard-upload-progress .upload-progress-item {
@@ -217,7 +217,7 @@
 }
 
 .minicard-upload-progress .upload-progress-filename {
-  font-size: 11px;
+  font-size: calc(11px * var(--wekan-ui-font-scale, 1));
 }
 
 /* Card details specific styles */
@@ -227,7 +227,7 @@
 }
 
 .card-details-upload-progress .upload-progress-header {
-  font-size: 16px;
+  font-size: calc(16px * var(--wekan-ui-font-scale, 1));
   margin-bottom: 12px;
 }
 
@@ -237,7 +237,7 @@
 }
 
 .card-details-upload-progress .upload-progress-filename {
-  font-size: 14px;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1));
 }
 
 /* Drag over state for minicards */
@@ -263,14 +263,14 @@
   color: white;
   cursor: pointer;
   align-self: center;
-  margin-left: 70px;
+  margin-inline-start: 70px;
 }
 #next-attachment {
   font-size: 4em;
   color: white;
   cursor: pointer;
   align-self: center;
-  margin-right: 70px;
+  margin-inline-end: 70px;
 }
 #viewer-content {
   display: flex;
@@ -293,16 +293,16 @@
   max-width: 100%;
 }
 #pdf-viewer {
-  width: 40vw;
+  width: 560px;
   height: 100%;
 }
 #txt-viewer {
   background-color: white;
-  width: 40vw;
+  width: 560px;
   height: 100%;
 }
 .pdf-preview-error {
-  margin-top: 20vh;
+  margin-top: 180px;
   display: block;
   font-size: 2em;
   color: white;
@@ -310,7 +310,7 @@
 
 @media screen and (max-width: 1600px) {
   #pdf-viewer {
-    width: 60vw;
+    width: 840px;
   }
 }
 
@@ -325,20 +325,20 @@
     padding: 16px;
   }
   #prev-attachment {
-    left: 0;
+    inset-inline-start: 0;
     position: absolute;
     bottom: 2.2em;
     font-size: 1.6em;
     padding: 16px;
-    margin-left: 0;
+    margin-inline-start: 0;
   }
   #next-attachment {
-    right: 0;
+    inset-inline-end: 0;
     position: absolute;
     bottom: 2.2em;
     font-size: 1.6em;
     padding: 16px;
-    margin-right: 0;
+    margin-inline-end: 0;
   }
   #pdf-viewer {
     width: 100%;
@@ -365,7 +365,7 @@
   }
   .attachment-details {
     flex-direction: column;
-    margin-right: 0px;
+    margin-inline-end: 0px;
   }
   .attachment-actions {
     flex-direction: row;

client/components/cards/attachments.jade

@@ -62,20 +62,20 @@ template(name="attachmentGallery")
         .attachment-thumbnail-container.open-preview(data-attachment-id="{{_id}}" data-card-id="{{ meta.cardId }}")
           if link
             if(isImage)
-              img.attachment-thumbnail(src="{{link}}" title="{{sanitize name}}")
+              img.attachment-thumbnail(src="{{link}}" title="{{cleanFilename name}}")
             else if($eq extension 'svg')
-              img.attachment-thumbnail(src="{{link}}" title="{{sanitize name}}" type="image/svg+xml")
+              img.attachment-thumbnail(src="{{link}}" title="{{cleanFilename name}}" type="image/svg+xml")
             else if($eq extension 'mp3')
-              video.attachment-thumbnail(title="{{sanitize name}}")
+              video.attachment-thumbnail(title="{{cleanFilename name}}")
                 source(src="{{link}}" type="audio/mpeg")
             else if($eq extension 'ogg')
-              video.attachment-thumbnail(title="{{sanitize name}}")
+              video.attachment-thumbnail(title="{{cleanFilename name}}")
                 source(src="{{link}}" type="video/ogg")
             else if($eq extension 'webm')
-              video.attachment-thumbnail(title="{{sanitize name}}")
+              video.attachment-thumbnail(title="{{cleanFilename name}}")
                 source(src="{{link}}" type="video/webm")
             else if($eq extension 'mp4')
-              video.attachment-thumbnail(title="{{sanitize name}}")
+              video.attachment-thumbnail(title="{{cleanFilename name}}")
                 source(src="{{link}}" type="video/mp4")
             else
               span.attachment-thumbnail-text= extension
@@ -83,15 +83,14 @@ template(name="attachmentGallery")
         .attachment-details-container
           .attachment-details
             div
-              b
-                = name
+              b {{ cleanFilename name }}
               span.file-size ({{fileSize size}})
             if uploaderName
               div.attachment-uploader {{uploaderName}}
             if uploadedAt
               div.attachment-uploaded-at {{uploadedAt}}
             .attachment-actions
-              a.js-download(href="{{link}}?download=true", download="{{name}}", title="{{_ 'download'}}")
+              a.js-download(href="{{link}}?download=true", download="{{downloadFilename name}}", title="{{_ 'download'}}")
                 i.fa.fa-arrow-down
               if currentUser.isBoardMember
                 unless currentUser.isCommentOnly
@@ -125,23 +124,6 @@ template(name="attachmentActionsPopup")
             else
               | {{_ 'add-background-image'}}
 
-        if $neq versions.original.storage "fs"
-          a.js-move-storage-fs
-            i.fa.fa-arrow-right
-            | {{_ 'attachment-move-storage-fs'}}
-
-        if $neq versions.original.storage "gridfs"
-          if versions.original.storage
-            a.js-move-storage-gridfs
-              i.fa.fa-arrow-right
-              | {{_ 'attachment-move-storage-gridfs'}}
-
-        if $neq versions.original.storage "s3"
-          if versions.original.storage
-            a.js-move-storage-s3
-              i.fa.fa-arrow-right
-              | {{_ 'attachment-move-storage-s3'}}
-
 template(name="attachmentRenamePopup")
   input.js-edit-attachment-name(type='text' autofocus value="{{getNameWithoutExtension}}" dir="auto")
   .edit-controls.clearfix

client/components/cards/attachments.js

@@ -1,4 +1,5 @@
 import { ReactiveCache } from '/imports/reactiveCache';
+import { attachmentKind } from '/models/lib/attachmentKind';
 import { ObjectId } from 'bson';
 import DOMPurify from 'dompurify';
 import { sanitizeHTML, sanitizeText } from '/imports/lib/secureDOMPurify';
@@ -6,7 +7,10 @@ import uploadProgressManager from '../../lib/uploadProgressManager';
 import { attachmentMigrationManager } from '/client/lib/attachmentMigrationManager';
 import Attachments from '/models/attachments';
 import { Utils } from '/client/lib/utils';
+import { buildAttachmentUploadConfig } from '/client/lib/attachmentUploadConfig';
+const { cleanFileName } = require('/imports/lib/fileNameDisplay');
 import { formatDateTime } from '/imports/lib/dateUtils';
+import { EscapeActions } from '/client/lib/escapeActions';
 
 const { filesize } = require('filesize');
 import prettyMilliseconds from 'pretty-ms';
@@ -44,7 +48,18 @@ Template.attachmentGallery.events({
   },
   'click .js-rename': Popup.open('attachmentRename'),
   'click .js-confirm-delete': Popup.afterConfirm('attachmentDelete', async function() {
-      await Attachments.removeAsync(this._id);
+      const card = this.meta && this.meta.cardId ? ReactiveCache.getCard(this.meta.cardId) : null;
+      if (card && card.coverId === this._id) {
+        await card.unsetCover();
+      }
+      // #5282 (same class as #3252 for comments/checklists): only remove if the
+      // doc is still in the local cache. Under publication churn the attachment
+      // can already be evicted from Minimongo, and removing a missing _id
+      // throws "Removed nonexistent document" even though the delete itself
+      // succeeded on the server.
+      if (this._id && ReactiveCache.getAttachment(this._id)) {
+        await Attachments.removeAsync(this._id);
+      }
       Popup.back();
   }),
 });
@@ -74,16 +89,25 @@ function getPrevAttachmentId(currentAttachmentId, offset = 0) {
 }
 
 function attachmentCanBeOpened(attachment) {
+  // #6532: a migrated attachment can arrive without these flags, so ask the
+  // shared helper - which derives them from the mime type or the file name -
+  // rather than the raw document. Otherwise an image that renders as a
+  // thumbnail still refuses to open in the viewer.
+  const kind = attachmentKind(attachment);
   return (
-    attachment.isImage ||
-    attachment.isPDF ||
-    attachment.isText ||
-    attachment.isJSON ||
-    attachment.isVideo ||
-    attachment.isAudio
+    kind.isImage ||
+    kind.isPDF ||
+    kind.isText ||
+    kind.isJSON ||
+    kind.isVideo ||
+    kind.isAudio
   );
 }
 
+function getAttachmentUrl(attachment) {
+  return attachment && typeof attachment.link === 'function' ? attachment.link() : '';
+}
+
 function openAttachmentViewer(attachmentId) {
   const attachment = ReactiveCache.getAttachment(attachmentId);
 
@@ -98,41 +122,44 @@ function openAttachmentViewer(attachmentId) {
     - implement cleanup in the closeAttachmentViewer() function, if necessary
     - mark attachment type as openable by adding a new condition to the attachmentCanBeOpened function
   */
+  const kind = attachmentKind(attachment);
   switch(true){
-    case (attachment.isImage):
-      $("#image-viewer").attr("src", attachment.link());
+    case (kind.isImage):
+      $("#image-viewer").attr("src", getAttachmentUrl(attachment));
       $("#image-viewer").removeClass("hidden");
       break;
-    case (attachment.isPDF):
-      $("#pdf-viewer").attr("data", attachment.link());
+    case (kind.isPDF):
+      $("#pdf-viewer").attr("data", getAttachmentUrl(attachment));
       $("#pdf-viewer").removeClass("hidden");
       break;
-    case (attachment.isVideo):
+    case (kind.isVideo):
       // We have to create a new <source> DOM element and append it to the video
       // element, otherwise the video won't load
       let videoSource = document.createElement('source');
-      videoSource.setAttribute('src', attachment.link());
+      videoSource.setAttribute('src', getAttachmentUrl(attachment));
       $("#video-viewer").append(videoSource);
 
       $("#video-viewer").removeClass("hidden");
       break;
-    case (attachment.isAudio):
+    case (kind.isAudio):
       // We have to create a new <source> DOM element and append it to the audio
       // element, otherwise the audio won't load
       let audioSource = document.createElement('source');
-      audioSource.setAttribute('src', attachment.link());
+      audioSource.setAttribute('src', getAttachmentUrl(attachment));
       $("#audio-viewer").append(audioSource);
 
       $("#audio-viewer").removeClass("hidden");
       break;
-    case (attachment.isText):
-    case (attachment.isJSON):
-      $("#txt-viewer").attr("data", attachment.link());
+    case (kind.isText):
+    case (kind.isJSON):
+      $("#txt-viewer").attr("data", getAttachmentUrl(attachment));
       $("#txt-viewer").removeClass("hidden");
       break;
   }
 
-  $('#attachment-name').text(attachment.name);
+  // Show the cleaned name: URL-decoded, homoglyphs folded, invisible characters
+  // and exploit markup removed (plain text; .text() escapes, so never HTML).
+  $('#attachment-name').text(cleanFileName(attachment.name));
   $('#viewer-overlay').removeClass('hidden');
 }
 
@@ -262,8 +289,26 @@ Template.attachmentViewer.events({
 });
 
 Template.attachmentGallery.helpers({
+  attachments() {
+    const card = Template.currentData();
+    if (!card) return [];
+    const cardId = typeof card.getRealId === 'function' ? card.getRealId() : card._id;
+    if (!cardId) return [];
+    const filesCursor = Attachments.find(
+      { 'meta.cardId': cardId },
+      { sort: { uploadedAt: -1 } },
+    );
+    // Call fetch() on the underlying Mongo cursor to establish a reactive
+    // dependency directly inside this Blaze computation. Without this,
+    // .each() (which calls cursor.map()) would not register reactivity and
+    // newly-uploaded attachments would not appear until a page reload.
+    if (filesCursor && filesCursor.cursor) {
+      filesCursor.cursor.fetch();
+    }
+    return filesCursor.each();
+  },
   isBoardAdmin() {
-    return ReactiveCache.getCurrentUser().isBoardAdmin();
+    return ReactiveCache.getCurrentUser()?.isBoardAdmin();
   },
   fileSize(size) {
     const ret = filesize(size);
@@ -281,6 +326,22 @@ Template.attachmentGallery.helpers({
       ? uploader.profile.fullname
       : uploader.username || '';
   },
+  // #6532: the template asks `if(isImage)` and prints `extension` - both of
+  // which a migrated attachment can be missing, which drew an empty white box
+  // where the picture should be. A helper wins over the data context in Blaze,
+  // so these answer for every attachment, derived when the document is silent.
+  isImage() {
+    return attachmentKind(this).isImage;
+  },
+  isVideo() {
+    return attachmentKind(this).isVideo;
+  },
+  isAudio() {
+    return attachmentKind(this).isAudio;
+  },
+  extension() {
+    return attachmentKind(this).extension;
+  },
   uploadedAt() {
     if (this.uploadedAtOstrio) {
       return formatDateTime(this.uploadedAtOstrio);
@@ -314,6 +375,7 @@ Template.cardAttachmentsPopup.helpers({
 
 Template.cardAttachmentsPopup.events({
   async 'change .js-attach-file'(event, templateInstance) {
+    event.stopPropagation();
     const card = this;
     const files = event.currentTarget.files;
     if (files) {
@@ -336,6 +398,10 @@ Template.cardAttachmentsPopup.events({
     }
   },
   'click .js-computer-upload'(event, templateInstance) {
+    // Prevent the click fired when the OS file-picker dialog closes from
+    // triggering EscapeActions and closing the popup before the upload starts.
+    // Same pattern as swimlanes.js after drag operations.
+    EscapeActions.preventNextClick();
     templateInstance.find('.js-attach-file').click();
     event.preventDefault();
   },
@@ -380,28 +446,16 @@ export async function handleFileUpload(card, files) {
       continue;
     }
 
-    const fileId = new ObjectId().toString();
-    let fileName = sanitizeText(file.name);
-
-    // If sanitized filename is not same as original filename,
-    // it could be XSS that is already fixed with sanitize,
-    // or just normal mistake, so it is not a problem.
-    // That is why here is no warning.
-    if (fileName !== file.name) {
-      // If filename is empty, only in that case add some filename
-      if (fileName.length === 0) {
-        fileName = 'Empty-filename-after-sanitize.txt';
-      }
-    }
-
-    const config = {
-      file: file,
-      fileId: fileId,
-      fileName: fileName,
+    // The id, the sanitized name, the chunk size and the transport all come
+    // from one builder - the file id has to be stamped into `meta` for
+    // Attachments' namingFunction to find it, and the transport has to be DDP
+    // on Sandstorm and HTTP everywhere else. Both are easy to leave out by hand
+    // and neither says so until an upload silently does not arrive.
+    // client/lib/attachmentUploadConfig.js
+    const config = buildAttachmentUploadConfig({
+      file,
       meta: Utils.getCommonAttachmentMetaFrom(card),
-      chunkSize: 'dynamic',
-    };
-    config.meta.fileId = fileId;
+    });
 
     try {
       const uploader = await Attachments.insertAsync(
@@ -484,15 +538,12 @@ Template.previewClipboardImagePopup.events({
     if (pastedResults && pastedResults.file) {
       const file = pastedResults.file;
       window.oPasted = pastedResults;
-      const fileId = new ObjectId().toString();
-      const config = {
+      // Same builder as the file-picker upload above; a pasted image has no
+      // name of its own, which the builder answers with the image's type.
+      const config = buildAttachmentUploadConfig({
         file,
-        fileId: fileId,
         meta: Utils.getCommonAttachmentMetaFrom(card),
-        fileName: file.name || file.type.replace('image/', 'clipboard.'),
-        chunkSize: 'dynamic',
-      };
-      config.meta.fileId = fileId;
+      });
       const uploader = await Attachments.insertAsync(
         config,
         false,
@@ -515,6 +566,11 @@ Template.previewClipboardImagePopup.events({
 });
 
 Template.attachmentActionsPopup.helpers({
+  // The "add cover" / "add background image" entries are shown `if isImage`
+  // too - same derivation, or a migrated image could not be made a cover.
+  isImage() {
+    return attachmentKind(this).isImage;
+  },
   isCover() {
     const ret = ReactiveCache.getCard(this.meta.cardId).coverId == this._id;
     return ret;
@@ -550,23 +606,11 @@ Template.attachmentActionsPopup.events({
     Utils.reload();
     event.preventDefault();
   },
-  'click .js-move-storage-fs'() {
-    Meteor.call('moveAttachmentToStorage', this._id, "fs");
-    Popup.back();
-  },
-  'click .js-move-storage-gridfs'() {
-    Meteor.call('moveAttachmentToStorage', this._id, "gridfs");
-    Popup.back();
-  },
-  'click .js-move-storage-s3'() {
-    Meteor.call('moveAttachmentToStorage', this._id, "s3");
-    Popup.back();
-  },
 });
 
 Template.attachmentRenamePopup.helpers({
   getNameWithoutExtension() {
-    const ret = this.name.replace(new RegExp("\." + this.extension + "$"), "");
+    const ret = this.name.replace(new RegExp("\\." + this.extension + "$"), "");
     return ret;
   },
 });

client/components/cards/cardCustomFields.jade

@@ -1,16 +1,28 @@
+//- The card's custom fields, from the hamburger at the end of the Custom Fields
+  heading: every field the BOARD has, with a tick when it is on this card, a
+  pencil to edit the field itself, and - under a rule - the one that makes a new
+  one. Everything about custom fields, in the place they are shown.
+//-
+//- Edit and Add open in this same pop-over, on top of this list, so the back
+  arrow returns to it. They are the board's own forms
+  (client/components/sidebar/sidebarCustomFields.jade), not second copies.
 template(name="cardCustomFieldsPopup")
     ul.pop-over-list
         each board.customFields
-            li.item(class="")
-                a.name.js-select-field(href="#")
+            li.item
+                a.name.js-select-field(href="#" title="{{_ 'show-field-on-card'}}")
+                    //- The same animated checkbox used by Admin Panel /
+                      Settings / Announcement: the square itself morphs into
+                      the green tick through forms.css.
+                    .materialCheckBox(class="{{#if hasCustomField}}is-checked{{/if}}")
                     span.full-name
                       = name
-                    if hasCustomField
-                      i.fa.fa-check
+                a.js-edit-custom-field(title="{{_ 'edit'}}")
+                    i.fa.fa-pencil
     hr
-    a.quiet-button.full.js-settings
-        i.fa.fa-cog
-        span {{_ 'settings'}}
+    a.quiet-button.full.js-open-create-custom-field
+        i.fa.fa-plus
+        span {{_ 'createCustomField'}}
 
 template(name="cardCustomField")
     +Template.dynamic(template=getTemplate)
@@ -44,22 +56,21 @@ template(name="cardCustomField-number")
                 a.js-close-inlined-form
         else
             a.js-open-inlined-form
-                if value
-                    = value
+                if formattedValue
+                    = formattedValue
                 else
                     | {{_ 'edit'}}
     else
-        if value
-            = value
+        if formattedValue
+            = formattedValue
 
 template(name="cardCustomField-checkbox")
   .js-checklist-item.checklist-item(class="{{#if data.value }}is-checked{{/if}}")
     if canModifyCard
-      span.check-box-unicode
-        i.fa(class="{{#if data.value}}fa-check-square{{else}}fa-square-o{{/if}}")
+      .check-box-container
+        .check-box.materialCheckBox(class="{{#if data.value}}is-checked{{/if}}")
     else
-      span.check-box-unicode
-        i.fa(class="{{#if data.value}}fa-check-square{{else}}fa-square-o{{/if}}")
+      .materialCheckBox(class="{{#if data.value}}is-checked{{/if}}")
 
 template(name="cardCustomField-currency")
     if canModifyCard
@@ -100,19 +111,7 @@ template(name="cardCustomField-date")
                 | {{showWeek}}
 
 template(name="cardCustomField-datePopup")
-  .datepicker-container
-    form.edit-date
-      .fields
-        .left
-          label(for="date") {{_ 'date'}}
-          input.js-date-field#date(type="date" name="date" value=showDate autofocus)
-        .right
-          label(for="time") {{_ 'time'}}
-          input.js-time-field#time(type="time" name="time" value=showTime)
-      if error.get
-        .warning {{_ error.get}}
-      button.primary.wide.left.js-submit-date(type="submit") {{_ 'save'}}
-      button.js-delete-date.negate.wide.right.js-delete-date {{_ 'delete'}}
+  +editDateForm(showDate=showDate showTime=showTime error=error datePicker=datePicker)
 
 template(name="cardCustomField-dropdown")
     if canModifyCard

client/components/cards/cardCustomFields.js

@@ -3,7 +3,6 @@ import {
   setupDatePicker,
   datePickerRendered,
   datePickerHelpers,
-  datePickerEvents,
 } from '/client/lib/datepicker';
 import { ReactiveCache } from '/imports/reactiveCache';
 import {
@@ -29,8 +28,7 @@ import {
 } from '/imports/lib/dateUtils';
 import { CustomFieldStringTemplate } from '/client/lib/customFields'
 import { getCurrentCardFromContext } from '/client/lib/currentCard';
-import { EscapeActions } from '/client/lib/escapeActions';
-import { getSidebarInstance } from '/client/features/sidebar/service';
+import { formatNumberValue } from '/imports/lib/customNumberFormat';
 
 Template.cardCustomFieldsPopup.helpers({
   hasCustomField() {
@@ -49,13 +47,19 @@ Template.cardCustomFieldsPopup.events({
     card.toggleCustomField(customFieldId);
     event.preventDefault();
   },
-  'click .js-settings'(event) {
-    EscapeActions.executeUpTo('detailsPane');
-    const sidebar = getSidebarInstance();
-    if (sidebar) {
-      sidebar.setView('customFields');
-    }
-    event.preventDefault();
+  // Editing a field, and making one, open in this same pop-over on top of the
+  // list, so the back arrow returns to it and the card stays open behind. They
+  // are the board's own forms - the same templates the sidebar list opens - so
+  // there is one create form and one edit form, not a second pair for cards.
+  // client/components/sidebar/sidebarCustomFields.jade
+  'click .js-edit-custom-field': Popup.open('editCustomField'),
+  // "Add custom field" sits OUTSIDE the list, so its data context is this
+  // popup's own - which is the CARD. The form reads its context as the field
+  // being edited, and a card has an `_id`, so it was read as an edit of a
+  // custom field that does not exist and the new field was never inserted.
+  // A new field is made from nothing, so it is handed nothing.
+  'click .js-open-create-custom-field'(event) {
+    Popup.open('createCustomField').call({}, event);
   },
 });
 
@@ -91,10 +95,21 @@ Template['cardCustomField-number'].onCreated(function () {
   this.customFieldId = Template.currentData()._id;
 });
 
+Template['cardCustomField-number'].helpers({
+  // Render blank / cleared / non-numeric values as empty instead of "NaN" (#2091).
+  formattedValue() {
+    return formatNumberValue(this.value);
+  },
+});
+
 Template['cardCustomField-number'].events({
   'submit .js-card-customfield-number'(event, tpl) {
     event.preventDefault();
-    const value = parseInt(tpl.find('input').value, 10);
+    const rawValue = tpl.find('input').value;
+    // A cleared/blank input parses to NaN; store '' instead so it renders empty
+    // rather than as "NaN" (#2091).
+    const parsed = parseInt(rawValue, 10);
+    const value = Number.isNaN(parsed) ? '' : parsed;
     tpl.card.setCustomField(tpl.customFieldId, value);
   },
 });
@@ -106,9 +121,6 @@ Template['cardCustomField-checkbox'].onCreated(function () {
 });
 
 Template['cardCustomField-checkbox'].events({
-  'click .js-checklist-item .check-box-unicode'(event, tpl) {
-    tpl.card.setCustomField(tpl.customFieldId, !Template.currentData().value);
-  },
   'click .js-checklist-item .check-box-container'(event, tpl) {
     tpl.card.setCustomField(tpl.customFieldId, !Template.currentData().value);
   },
@@ -170,7 +182,7 @@ Template['cardCustomField-date'].helpers({
   },
   showDate() {
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
   },
   showISODate() {
@@ -200,10 +212,11 @@ Template['cardCustomField-datePopup'].onCreated(function () {
   const data = Template.currentData();
   setupDatePicker(this, {
     initialDate: data.value ? data.value : undefined,
+    storeDate: (date, card) => card.setCustomField(data._id, date),
+    deleteDate: card => card.setCustomField(data._id, ''),
   });
-  // Override card and store customFieldId for store/delete callbacks
+  // A custom-field popup's data is the field definition, not the card.
   this.datePicker.card = getCurrentCardFromContext();
-  this.customFieldId = data._id;
 });
 
 Template['cardCustomField-datePopup'].onRendered(function () {
@@ -212,15 +225,6 @@ Template['cardCustomField-datePopup'].onRendered(function () {
 
 Template['cardCustomField-datePopup'].helpers(datePickerHelpers());
 
-Template['cardCustomField-datePopup'].events(datePickerEvents({
-  storeDate(date) {
-    this.datePicker.card.setCustomField(this.customFieldId, date);
-  },
-  deleteDate() {
-    this.datePicker.card.setCustomField(this.customFieldId, '');
-  },
-}));
-
 // cardCustomField-dropdown
 Template['cardCustomField-dropdown'].onCreated(function () {
   this.card = getCurrentCardFromContext();

client/components/cards/cardDate.css

@@ -8,23 +8,27 @@
 .card-date.is-active {
   background-color: #b3b3b3;
 }
-/* Date status colors - red = overdue, amber = due soon, no shade = not due */
+/* Date status colors - red = overdue, amber = due soon, no shade = not due.
+ * These status rules use !important so they override the date-type base
+ * colours below (e.g. .card-date.due-date yellow). Without this, an overdue
+ * due-date badge in the card detail showed yellow/amber instead of red, while
+ * the minicard (which already used !important) showed red - issue #5965. */
 .card-date.overdue {
-  background-color: #ff4444; /* Red for overdue */
-  color: #fff;
+  background-color: #ff4444 !important; /* Red for overdue */
+  color: #fff !important;
 }
 .card-date.overdue:hover,
 .card-date.overdue.is-active {
-  background-color: #cc3333;
+  background-color: #cc3333 !important;
 }
 
 .card-date.due-soon {
-  background-color: #ffaa00; /* Amber for due soon */
-  color: #000;
+  background-color: #ffaa00 !important; /* Amber for due soon */
+  color: #000 !important;
 }
 .card-date.due-soon:hover,
 .card-date.due-soon.is-active {
-  background-color: #e69900;
+  background-color: #e69900 !important;
 }
 
 .card-date.not-due {
@@ -32,48 +36,48 @@
 }
 
 .card-date.current {
-  background-color: #5ba639; /* Green for current/active */
-  color: #fff;
+  background-color: #5ba639 !important; /* Green for current/active */
+  color: #fff !important;
 }
 .card-date.current:hover,
 .card-date.current.is-active {
-  background-color: #46802c;
+  background-color: #46802c !important;
 }
 
 .card-date.completed {
-  background-color: #90ee90; /* Light green for completed */
-  color: #000;
+  background-color: #90ee90 !important; /* Light green for completed */
+  color: #000 !important;
 }
 .card-date.completed:hover,
 .card-date.completed.is-active {
-  background-color: #7dd87d;
+  background-color: #7dd87d !important;
 }
 
 .card-date.completed-early {
-  background-color: #4caf50; /* Green for completed early */
-  color: #fff;
+  background-color: #4caf50 !important; /* Green for completed early */
+  color: #fff !important;
 }
 .card-date.completed-early:hover,
 .card-date.completed-early.is-active {
-  background-color: #45a049;
+  background-color: #45a049 !important;
 }
 
 .card-date.completed-late {
-  background-color: #ff9800; /* Orange for completed late */
-  color: #fff;
+  background-color: #ff9800 !important; /* Orange for completed late */
+  color: #fff !important;
 }
 .card-date.completed-late:hover,
 .card-date.completed-late.is-active {
-  background-color: #f57c00;
+  background-color: #f57c00 !important;
 }
 
 .card-date.completed-on-time {
-  background-color: #2196f3; /* Blue for completed on time */
-  color: #fff;
+  background-color: #2196f3 !important; /* Blue for completed on time */
+  color: #fff !important;
 }
 .card-date.completed-on-time:hover,
 .card-date.completed-on-time.is-active {
-  background-color: #1976d2;
+  background-color: #1976d2 !important;
 }
 
 /* Date type specific colors */
@@ -115,26 +119,35 @@
 .card-date.end-date.is-active {
   background-color: #ff9999;
 }
+/* Font Awesome glyphs, not emoji: the emoji were the last of the 8.00-8.24
+   colourful-emoji icon set, they render differently on every platform, and the
+   "Grey Icons" setting existed only to grey them. `time` is not an `.fa`
+   element, so the font is named here. */
+.card-date time::before {
+  font-family: FontAwesome;
+  font-weight: normal;
+  font-style: normal;
+  text-decoration: inherit;
+}
 .card-date.end-date time::before {
-  content: "🏁"; /* Finish flag - represents end/completion */
+  content: "\f11e"; /* fa-flag-checkered - end/completion */
 }
 .card-date.due-date time::before {
-  content: "⏰"; /* Alarm clock - represents due/deadline */
+  content: "\f017"; /* fa-clock-o - due/deadline */
 }
 .card-date.start-date time::before {
-  content: "🚀"; /* Rocket - represents start/launch */
+  content: "\f135"; /* fa-rocket - start/launch */
 }
 .card-date.received-date time::before {
-  content: "📥"; /* Inbox tray - represents received/incoming */
+  content: "\f01c"; /* fa-inbox - received/incoming */
 }
 
-/* Generic date badge and custom field date */
-.card-date:not(.received-date):not(.start-date):not(.due-date):not(.end-date) time::before {
-  /*content: "📅"; // Calendar - represents generic date */
-}
+/* Generic date badge and custom field date: no glyph of its own. (It used to
+   carry a commented-out calendar emoji; the icon set is Font Awesome now, so if
+   one is ever wanted here it is a codepoint like the four above.) */
 .card-date time::before {
   font-size: inherit;
-  margin-right: 0.3em;
+  margin-inline-end: 0.3em;
   display: inline-block;
 }
 .customfield-date {

client/components/cards/cardDate.jade

@@ -1,289 +1,91 @@
-template(name="dateBadge")
+//- One date badge: the coloured date on a card or a minicard. Twelve templates
+  drew this, letter for letter - Received, Start, Due and End on the card and
+  again on the minicard, a vote's end, a poker's end and a custom field's date -
+  and each of them still has its own helpers and its own click, which is the
+  part that differs. The markup did not.
+//-
+//- It takes what it draws as ARGUMENTS: a helper is looked up on the template
+  it is written in, not on the one including it, so passing the values is what
+  lets one piece of markup serve twelve templates without moving any of their
+  state.
+//-
+//- `baseClass` is the class the caller's own markup carried - `card-date`, plus
+  `due-date` and friends on a minicard. A custom field's date passes NONE: it
+  was never a `.card-date` and must not become one now.
+//- `canModifyCard` decides whether the badge is a link that opens the date
+  editor; a custom field's date is never one, and passes nothing.
+template(name="dateBadgeBody")
   if canModifyCard
-    a.js-edit-date.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
+    a.js-edit-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{baseClass}} {{classes}}")
       time(datetime="{{showISODate}}")
         | {{showDate}}
         if showWeekOfYear
           b
             | {{showWeek}}
   else
-    a.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
+    a(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{baseClass}} {{classes}}")
       time(datetime="{{showISODate}}")
         | {{showDate}}
         if showWeekOfYear
           b
             | {{showWeek}}
 
+template(name="dateBadge")
+  +dateBadgeBody(canModifyCard=canModifyCard baseClass="card-date" showTitle=showTitle classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
+
 template(name="cardReceivedDate")
-  if canModifyCard
-    a.js-edit-date.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
-  else
-    a.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
+  +dateBadgeBody(canModifyCard=canModifyCard baseClass="card-date" showTitle=showTitle classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="cardStartDate")
-  if canModifyCard
-    a.js-edit-date.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
-  else
-    a.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
+  +dateBadgeBody(canModifyCard=canModifyCard baseClass="card-date" showTitle=showTitle classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="cardDueDate")
-  if canModifyCard
-    a.js-edit-date.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
-  else
-    a.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
+  +dateBadgeBody(canModifyCard=canModifyCard baseClass="card-date" showTitle=showTitle classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="cardEndDate")
-  if canModifyCard
-    a.js-edit-date.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
-  else
-    a.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
+  +dateBadgeBody(canModifyCard=canModifyCard baseClass="card-date" showTitle=showTitle classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="dateCustomField")
-  a(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-    time(datetime="{{showISODate}}")
-      | {{showDate}}
-      if showWeekOfYear
-        b
-          | {{showWeek}}
+  +dateBadgeBody(showTitle=showTitle classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="cardCustomFieldDate")
-  a(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-    time(datetime="{{showISODate}}")
-      | {{showDate}}
-      if showWeekOfYear
-        b
-          | {{showWeek}}
+  +dateBadgeBody(showTitle=showTitle classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="voteEndDate")
-  if canModifyCard
-    a.js-edit-date.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
-  else
-    a.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
+  +dateBadgeBody(canModifyCard=canModifyCard baseClass="card-date" showTitle=showTitle classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="pokerEndDate")
-  if canModifyCard
-    a.js-edit-date.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
-  else
-    a.card-date(title="{{showTitle}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
+  +dateBadgeBody(canModifyCard=canModifyCard baseClass="card-date" showTitle=showTitle classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="minicardReceivedDate")
-  if canModifyCard
-    a.js-edit-date.card-date.received-date(title="{{_ 'card-received'}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
-  else
-    a.card-date.received-date(title="{{_ 'card-received'}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
+  +dateBadgeBody(canModifyCard=canModifyCard showTitle="{{_ 'card-received'}}" baseClass="card-date received-date" classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="minicardStartDate")
-  if canModifyCard
-    a.js-edit-date.card-date.start-date(title="{{_ 'card-start'}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
-  else
-    a.card-date.start-date(title="{{_ 'card-start'}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
+  +dateBadgeBody(canModifyCard=canModifyCard showTitle="{{_ 'card-start'}}" baseClass="card-date start-date" classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="minicardDueDate")
-  if canModifyCard
-    a.js-edit-date.card-date.due-date(title="{{_ 'card-due'}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
-  else
-    a.card-date.due-date(title="{{_ 'card-due'}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
+  +dateBadgeBody(canModifyCard=canModifyCard showTitle="{{_ 'card-due'}}" baseClass="card-date due-date" classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="minicardEndDate")
-  if canModifyCard
-    a.js-edit-date.card-date.end-date(title="{{_ 'card-end'}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
-  else
-    a.card-date.end-date(title="{{_ 'card-end'}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-      time(datetime="{{showISODate}}")
-        | {{showDate}}
-        if showWeekOfYear
-          b
-            | {{showWeek}}
+  +dateBadgeBody(canModifyCard=canModifyCard showTitle="{{_ 'card-end'}}" baseClass="card-date end-date" classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="minicardCustomFieldDate")
-  a(title="{{_ 'date'}} {{_ 'predicate-week'}} {{#if showWeekOfYear}}{{showWeek}}{{/if}}" class="{{classes}}")
-    time(datetime="{{showISODate}}")
-      | {{showDate}}
-      if showWeekOfYear
-        b
-          | {{showWeek}}
+  +dateBadgeBody(showTitle="{{_ 'date'}}" classes=classes showISODate=showISODate showDate=showDate showWeekOfYear=showWeekOfYear showWeek=showWeek)
 
 template(name="editCardReceivedDatePopup")
-  .datepicker-container
-    form.edit-date
-      .fields
-        .left
-          label(for="date") {{_ 'date'}}
-          input.js-date-field#date(type="date" name="date" value=showDate autofocus)
-        .right
-          label(for="time") {{_ 'time'}}
-          input.js-time-field#time(type="time" name="time" value=showTime)
-      if error.get
-        .warning {{_ error.get}}
-      button.primary.wide.left.js-submit-date(type="submit") {{_ 'save'}}
-      button.js-delete-date.negate.wide.right.js-delete-date {{_ 'delete'}}
+  +editDateForm(showDate=showDate showTime=showTime error=error datePicker=datePicker)
 
 template(name="editCardStartDatePopup")
-  .datepicker-container
-    form.edit-date
-      .fields
-        .left
-          label(for="date") {{_ 'date'}}
-          input.js-date-field#date(type="date" name="date" value=showDate autofocus)
-        .right
-          label(for="time") {{_ 'time'}}
-          input.js-time-field#time(type="time" name="time" value=showTime)
-      if error.get
-        .warning {{_ error.get}}
-      button.primary.wide.left.js-submit-date(type="submit") {{_ 'save'}}
-      button.js-delete-date.negate.wide.right.js-delete-date {{_ 'delete'}}
+  +editDateForm(showDate=showDate showTime=showTime error=error datePicker=datePicker)
 
 template(name="editCardDueDatePopup")
-  .datepicker-container
-    form.edit-date
-      .fields
-        .left
-          label(for="date") {{_ 'date'}}
-          input.js-date-field#date(type="date" name="date" value=showDate autofocus)
-        .right
-          label(for="time") {{_ 'time'}}
-          input.js-time-field#time(type="time" name="time" value=showTime)
-      if error.get
-        .warning {{_ error.get}}
-      button.primary.wide.left.js-submit-date(type="submit") {{_ 'save'}}
-      button.js-delete-date.negate.wide.right.js-delete-date {{_ 'delete'}}
+  +editDateForm(showDate=showDate showTime=showTime error=error datePicker=datePicker)
 
 template(name="editCardEndDatePopup")
-  .datepicker-container
-    form.edit-date
-      .fields
-        .left
-          label(for="date") {{_ 'date'}}
-          input.js-date-field#date(type="date" name="date" value=showDate autofocus)
-        .right
-          label(for="time") {{_ 'time'}}
-          input.js-time-field#time(type="time" name="time" value=showTime)
-      if error.get
-        .warning {{_ error.get}}
-      button.primary.wide.left.js-submit-date(type="submit") {{_ 'save'}}
-      button.js-delete-date.negate.wide.right.js-delete-date {{_ 'delete'}}
+  +editDateForm(showDate=showDate showTime=showTime error=error datePicker=datePicker)
 
 template(name="editVoteEndDatePopup")
-  .datepicker-container
-    form.edit-date
-      .fields
-        .left
-          label(for="date") {{_ 'date'}}
-          input.js-date-field#date(type="date" name="date" value=showDate autofocus)
-        .right
-          label(for="time") {{_ 'time'}}
-          input.js-time-field#time(type="time" name="time" value=showTime)
-      if error.get
-        .warning {{_ error.get}}
-      button.primary.wide.left.js-submit-date(type="submit") {{_ 'save'}}
-      button.js-delete-date.negate.wide.right.js-delete-date {{_ 'delete'}}
+  +editDateForm(showDate=showDate showTime=showTime error=error datePicker=datePicker)
 
 template(name="editPokerEndDatePopup")
-  .datepicker-container
-    form.edit-date
-      .fields
-        .left
-          label(for="date") {{_ 'date'}}
-          input.js-date-field#date(type="date" name="date" value=showDate autofocus)
-        .right
-          label(for="time") {{_ 'time'}}
-          input.js-time-field#time(type="time" name="time" value=showTime)
-      if error.get
-        .warning {{_ error.get}}
-      button.primary.wide.left.js-submit-date(type="submit") {{_ 'save'}}
-      button.js-delete-date.negate.wide.right.js-delete-date {{_ 'delete'}}
+  +editDateForm(showDate=showDate showTime=showTime error=error datePicker=datePicker)

client/components/cards/cardDate.js

@@ -4,7 +4,6 @@ import {
   setupDatePicker,
   datePickerRendered,
   datePickerHelpers,
-  datePickerEvents,
 } from '/client/lib/datepicker';
 import {
   formatDateTime,
@@ -25,9 +24,9 @@ import {
   now,
   createDate,
   fromNow,
-  calendar,
-  diff
+  calendar
 } from '/imports/lib/dateUtils';
+import { dueDateClass } from '/client/lib/dueDateColor';
 
 // --- DatePicker popups (edit date forms) ---
 
@@ -37,6 +36,12 @@ Template.editCardReceivedDatePopup.onCreated(function () {
   setupDatePicker(this, {
     defaultTime: formatDateTime(now()),
     initialDate: card.getReceived() ? card.getReceived() : undefined,
+    storeDate(date, currentCard) {
+      currentCard.setReceived(date);
+    },
+    deleteDate(currentCard) {
+      currentCard.unsetReceived();
+    },
   });
 });
 
@@ -46,21 +51,18 @@ Template.editCardReceivedDatePopup.onRendered(function () {
 
 Template.editCardReceivedDatePopup.helpers(datePickerHelpers());
 
-Template.editCardReceivedDatePopup.events(datePickerEvents({
-  storeDate(date) {
-    this.datePicker.card.setReceived(date);
-  },
-  deleteDate() {
-    this.datePicker.card.unsetReceived();
-  },
-}));
-
 // editCardStartDatePopup
 Template.editCardStartDatePopup.onCreated(function () {
   const card = Template.currentData();
   setupDatePicker(this, {
     defaultTime: formatDateTime(now()),
     initialDate: card.getStart() ? card.getStart() : undefined,
+    storeDate(date, currentCard) {
+      currentCard.setStart(date);
+    },
+    deleteDate(currentCard) {
+      currentCard.unsetStart();
+    },
   });
 });
 
@@ -70,21 +72,18 @@ Template.editCardStartDatePopup.onRendered(function () {
 
 Template.editCardStartDatePopup.helpers(datePickerHelpers());
 
-Template.editCardStartDatePopup.events(datePickerEvents({
-  storeDate(date) {
-    this.datePicker.card.setStart(date);
-  },
-  deleteDate() {
-    this.datePicker.card.unsetStart();
-  },
-}));
-
 // editCardDueDatePopup
 Template.editCardDueDatePopup.onCreated(function () {
   const card = Template.currentData();
   setupDatePicker(this, {
     defaultTime: '1970-01-01 17:00:00',
     initialDate: card.getDue() ? card.getDue() : undefined,
+    storeDate(date, currentCard) {
+      currentCard.setDue(date);
+    },
+    deleteDate(currentCard) {
+      currentCard.unsetDue();
+    },
   });
 });
 
@@ -94,21 +93,18 @@ Template.editCardDueDatePopup.onRendered(function () {
 
 Template.editCardDueDatePopup.helpers(datePickerHelpers());
 
-Template.editCardDueDatePopup.events(datePickerEvents({
-  storeDate(date) {
-    this.datePicker.card.setDue(date);
-  },
-  deleteDate() {
-    this.datePicker.card.unsetDue();
-  },
-}));
-
 // editCardEndDatePopup
 Template.editCardEndDatePopup.onCreated(function () {
   const card = Template.currentData();
   setupDatePicker(this, {
     defaultTime: formatDateTime(now()),
     initialDate: card.getEnd() ? card.getEnd() : undefined,
+    storeDate(date, currentCard) {
+      currentCard.setEnd(date);
+    },
+    deleteDate(currentCard) {
+      currentCard.unsetEnd();
+    },
   });
 });
 
@@ -118,17 +114,21 @@ Template.editCardEndDatePopup.onRendered(function () {
 
 Template.editCardEndDatePopup.helpers(datePickerHelpers());
 
-Template.editCardEndDatePopup.events(datePickerEvents({
-  storeDate(date) {
-    this.datePicker.card.setEnd(date);
-  },
-  deleteDate() {
-    this.datePicker.card.unsetEnd();
-  },
-}));
-
 // --- Card date badge display helpers ---
 
+// dateBadgeBody is a child template whose data is only display arguments. An
+// event handled by the surrounding card/minicard date template therefore must
+// open the popup with THAT surrounding template's Card, not with the event's
+// `this`. The plus buttons do not need this because they already live directly
+// in cardDetails with the Card as their data context.
+function openDateEditor(name) {
+  return function (event, templateInstance) {
+    event.preventDefault();
+    event.stopPropagation();
+    Popup.open(name).call(templateInstance.data, event, templateInstance);
+  };
+}
+
 // Shared onCreated logic for card date badge templates
 function cardDateOnCreated(tpl) {
   tpl.date = new ReactiveVar();
@@ -146,14 +146,12 @@ function cardDateHelpers(extraHelpers) {
     },
     showWeekOfYear() {
       const user = ReactiveCache.getCurrentUser();
-      if (!user) {
-        return false;
-      }
+      if (!user) return window.localStorage.getItem('showWeekOfYear') === 'true';
       return user.isShowWeekOfYear();
     },
     showDate() {
       const currentUser = ReactiveCache.getCurrentUser();
-      const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+      const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
       return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
     },
     showISODate() {
@@ -196,14 +194,14 @@ Template.cardReceivedDate.helpers(cardDateHelpers({
   showTitle() {
     const tpl = Template.instance();
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
     return `${TAPi18n.__('card-received-on')} ${formattedDate}`;
   },
 }));
 
 Template.cardReceivedDate.events({
-  'click .js-edit-date': Popup.open('editCardReceivedDate'),
+  'click .js-edit-date': openDateEditor('editCardReceivedDate'),
 });
 
 // cardStartDate
@@ -237,14 +235,14 @@ Template.cardStartDate.helpers(cardDateHelpers({
   showTitle() {
     const tpl = Template.instance();
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
     return `${TAPi18n.__('card-start-on')} ${formattedDate}`;
   },
 }));
 
 Template.cardStartDate.events({
-  'click .js-edit-date': Popup.open('editCardStartDate'),
+  'click .js-edit-date': openDateEditor('editCardStartDate'),
 });
 
 // cardDueDate
@@ -259,41 +257,24 @@ Template.cardDueDate.onCreated(function () {
 Template.cardDueDate.helpers(cardDateHelpers({
   classes() {
     const tpl = Template.instance();
-    let classes = 'due-date ';
     const data = Template.currentData();
     const endAt = data.getEnd();
     const theDate = tpl.date.get();
     const nowVal = tpl.now.get();
 
-    if (endAt && isBefore(endAt, theDate)) {
-      classes += 'completed-early';
-    } else if (endAt) {
-      classes += 'completed';
-    } else {
-      const daysDiff = diff(theDate, nowVal, 'days');
-
-      if (daysDiff < 0) {
-        classes += 'overdue';
-      } else if (daysDiff <= 1) {
-        classes += 'due-soon';
-      } else {
-        classes += 'not-due';
-      }
-    }
-
-    return classes;
+    return `due-date ${dueDateClass(theDate, nowVal, endAt)}`;
   },
   showTitle() {
     const tpl = Template.instance();
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
     return `${TAPi18n.__('card-due-on')} ${formattedDate}`;
   },
 }));
 
 Template.cardDueDate.events({
-  'click .js-edit-date': Popup.open('editCardDueDate'),
+  'click .js-edit-date': openDateEditor('editCardDueDate'),
 });
 
 // cardEndDate
@@ -331,7 +312,7 @@ Template.cardEndDate.helpers(cardDateHelpers({
 }));
 
 Template.cardEndDate.events({
-  'click .js-edit-date': Popup.open('editCardEndDate'),
+  'click .js-edit-date': openDateEditor('editCardEndDate'),
 });
 
 // cardCustomFieldDate
@@ -356,7 +337,7 @@ Template.cardCustomFieldDate.helpers(cardDateHelpers({
   showTitle() {
     const tpl = Template.instance();
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
     return `${formattedDate}`;
   },
@@ -400,19 +381,19 @@ Template.minicardReceivedDate.helpers(cardDateHelpers({
   showTitle() {
     const tpl = Template.instance();
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
     return `${TAPi18n.__('card-received-on')} ${formattedDate}`;
   },
   showDate() {
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
   },
 }));
 
 Template.minicardReceivedDate.events({
-  'click .js-edit-date': Popup.open('editCardReceivedDate'),
+  'click .js-edit-date': openDateEditor('editCardReceivedDate'),
 });
 
 // minicardStartDate
@@ -446,19 +427,19 @@ Template.minicardStartDate.helpers(cardDateHelpers({
   showTitle() {
     const tpl = Template.instance();
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
     return `${TAPi18n.__('card-start-on')} ${formattedDate}`;
   },
   showDate() {
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
   },
 }));
 
 Template.minicardStartDate.events({
-  'click .js-edit-date': Popup.open('editCardStartDate'),
+  'click .js-edit-date': openDateEditor('editCardStartDate'),
 });
 
 // minicardDueDate
@@ -473,46 +454,29 @@ Template.minicardDueDate.onCreated(function () {
 Template.minicardDueDate.helpers(cardDateHelpers({
   classes() {
     const tpl = Template.instance();
-    let classes = 'due-date ';
     const data = Template.currentData();
     const endAt = data.getEnd();
     const theDate = tpl.date.get();
     const nowVal = tpl.now.get();
 
-    if (endAt && isBefore(endAt, theDate)) {
-      classes += 'completed-early';
-    } else if (endAt) {
-      classes += 'completed';
-    } else {
-      const daysDiff = diff(theDate, nowVal, 'days');
-
-      if (daysDiff < 0) {
-        classes += 'overdue';
-      } else if (daysDiff <= 1) {
-        classes += 'due-soon';
-      } else {
-        classes += 'not-due';
-      }
-    }
-
-    return classes;
+    return `due-date ${dueDateClass(theDate, nowVal, endAt)}`;
   },
   showTitle() {
     const tpl = Template.instance();
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
     return `${TAPi18n.__('card-due-on')} ${formattedDate}`;
   },
   showDate() {
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
   },
 }));
 
 Template.minicardDueDate.events({
-  'click .js-edit-date': Popup.open('editCardDueDate'),
+  'click .js-edit-date': openDateEditor('editCardDueDate'),
 });
 
 // minicardEndDate
@@ -549,13 +513,13 @@ Template.minicardEndDate.helpers(cardDateHelpers({
   },
   showDate() {
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
   },
 }));
 
 Template.minicardEndDate.events({
-  'click .js-edit-date': Popup.open('editCardEndDate'),
+  'click .js-edit-date': openDateEditor('editCardEndDate'),
 });
 
 // minicardCustomFieldDate
@@ -570,13 +534,13 @@ Template.minicardCustomFieldDate.onCreated(function () {
 Template.minicardCustomFieldDate.helpers(cardDateHelpers({
   showDate() {
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
   },
   showTitle() {
     const tpl = Template.instance();
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
     return `${formattedDate}`;
   },
@@ -602,7 +566,7 @@ Template.voteEndDate.helpers(cardDateHelpers({
   },
   showDate() {
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
   },
   showTitle() {
@@ -612,7 +576,7 @@ Template.voteEndDate.helpers(cardDateHelpers({
 }));
 
 Template.voteEndDate.events({
-  'click .js-edit-date': Popup.open('editVoteEndDate'),
+  'click .js-edit-date': openDateEditor('editVoteEndDate'),
 });
 
 // pokerEndDate
@@ -630,7 +594,7 @@ Template.pokerEndDate.helpers(cardDateHelpers({
   },
   showDate() {
     const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
     return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
   },
   showTitle() {
@@ -640,5 +604,5 @@ Template.pokerEndDate.helpers(cardDateHelpers({
 }));
 
 Template.pokerEndDate.events({
-  'click .js-edit-date': Popup.open('editPokerEndDate'),
+  'click .js-edit-date': openDateEditor('editPokerEndDate'),
 });

client/components/cards/cardDescription.js

@@ -1,3 +1,5 @@
+import { UnsavedEdits } from '/client/lib/unsavedEdits';
+
 const descriptionFormIsOpen = new ReactiveVar(false);
 
 Template.descriptionForm.onDestroyed(function () {
@@ -16,6 +18,10 @@ Template.descriptionForm.events({
     event.preventDefault();
     const description = tpl.currentComponent ? tpl.currentComponent().getValue() : tpl.$('textarea').val();
     await this.setDescription(description);
+    // #6455: a successful save means there is no unsaved draft anymore; clear
+    // any pre-existing draft record so the "You have an unsaved description"
+    // warning does not stick around after saving.
+    UnsavedEdits.reset({ fieldName: 'cardDescription', docId: this._id });
   },
   // Pressing Ctrl+Enter should submit the form
   'keydown form textarea'(evt, tpl) {

client/components/cards/cardDetails.css

@@ -4,7 +4,7 @@
 }
 
 .card-details-item-date-format .card-details-item-title {
-  font-size: 15px;
+  font-size: calc(15px * var(--wekan-ui-font-scale, 1));
   font-weight: bold;
   margin-bottom: 6px;
   color: #333;
@@ -17,7 +17,7 @@
   border: 1px solid #ddd;
   border-radius: 5px;
   background-color: #fff;
-  font-size: 15px;
+  font-size: calc(15px * var(--wekan-ui-font-scale, 1));
   cursor: pointer;
   transition: border-color 0.15s, box-shadow 0.15s;
 }
@@ -31,10 +31,10 @@
 .assignee {
   display: block;
   position: relative;
-  float: left;
-  height: clamp(24px, 3.5vw, 36px);
-  width: clamp(24px, 3.5vw, 36px);
-  margin: 0.3vh;
+  float: inline-start;
+  height: 24px;
+  width: 24px;
+  margin: 3px;
   cursor: pointer;
   user-select: none;
   z-index: 1;
@@ -73,7 +73,7 @@
   height: 7px;
   width: 7px;
   position: absolute;
-  right: -1px;
+  inset-inline-end: -1px;
   bottom: -1px;
   z-index: 15;
 }
@@ -106,10 +106,10 @@
 }
 .copied-tooltip {
   display: none;
-  padding: 0 1.3vw;
+  padding: 0 18px;
   background-color: rgba(0,0,0,0.875);
   color: #fff;
-  border-radius: 0.7vw;
+  border-radius: 10px;
   font-size: 0.98em;
 }
 
@@ -121,58 +121,109 @@
   overflow-y: auto;
   overflow-x: hidden;
   background: #f7f7f7;
-  border-radius: 0 0 0.4vw 0.4vw;
+  border-radius: 0 0 6px 6px;
   z-index: 30;
   animation: flexGrowIn 0.1s;
-  box-shadow: 0 0 0.9vh 0 #b3b3b3;
+  box-shadow: 0 0 8px 0 #b3b3b3;
   transition: flex-basis 0.1s, box-shadow 0.15s;
   box-sizing: border-box;
 }
 
-/* Desktop mode: position card below board header */
+/* Desktop mode: position card below board header.
+   #6465: the floating window used to span nearly the whole board (insets
+   20px/20px from BOTH edges, top-left anchored) — right on top of the card it
+   belongs to, with big rounded borders. Dock it to the END edge (right in LTR)
+   like the classic 6.09 side panel instead: the board and the card stay
+   visible, and the drag handle still moves it anywhere. */
 body.desktop-mode .card-details:not(.card-details-popup) {
   position: fixed;
   width: auto;
-  max-width: 800px;
+  max-width: 520px; /* #6465: narrower dock (was 800px, ~1/4 screen) */
   flex-basis: auto;
-  border-radius: 8px;
+  border-radius: 3px;
   z-index: 2001;
 }
 
 /* Default position for first card or when dragged */
 body.desktop-mode .card-details:not(.card-details-popup):not([style*="left"]):not([style*="top"]) {
   top: 8px;
-  left: 20px;
-  right: 20px;
-  bottom: 20px;
+  inset-inline-start: auto;
+  inset-inline-end: 8px;
+  width: min(650px, 90vw);
+  bottom: 8px;
 }
 
-/* Stagger positions for multiple cards using nth-of-type */
+/* #6465: the Y half of the rule above, kept when the window has been placed
+   horizontally.
+
+   The default-position rule is `:not([style*="left"]):not([style*="top"])`, so it
+   switches itself off the moment anything writes an inline `left` — and it
+   carried `top` as well as the width. cardDetails.js now writes an inline `left`
+   to dock the window beside its minicard (X only), which would leave a SIXTH open
+   window — past the five staggered rules below — with no `top` at all, i.e.
+   `top: auto`, which for a fixed element is wherever it happened to land.
+
+   Same specificity as the stagger rules and written BEFORE them, so cards 1-5
+   still take their staggered `top` from those and nothing about the vertical
+   position changes. `bottom` is unchanged too: it comes from the
+   `:not(.card-details-collapsed)` rule further down, which never depended on the
+   inline styles. */
+body.desktop-mode .card-details:not(.card-details-popup):not([style*="top"]) {
+  top: 8px;
+}
+
+/* Stagger positions for multiple cards using nth-of-type (from the end edge) */
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(1) {
   top: 8px;
-  left: 20px;
+  inset-inline-end: 8px;
 }
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(2) {
   top: 38px;
-  left: 50px;
+  inset-inline-end: 38px;
 }
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(3) {
   top: 68px;
-  left: 80px;
+  inset-inline-end: 68px;
 }
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(4) {
   top: 98px;
-  left: 110px;
+  inset-inline-end: 98px;
 }
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(5) {
   top: 128px;
-  left: 140px;
+  inset-inline-end: 128px;
 }
 
 /* For expanded cards, set dimensions */
 body.desktop-mode .card-details:not(.card-details-popup):not(.card-details-collapsed) {
-  right: 20px;
-  bottom: 20px;
+  bottom: 8px;
+}
+
+/* #4822: the MAXIMIZED card must be anchored to the VIEWPORT (position: fixed
+   with viewport insets), never laid out inside — or measured from — the
+   scrolled swimlane/board container. Historically the maximized pane was an
+   in-flow flex/float item of its swimlane, so after scrolling down in the
+   swimlanes view it rendered at the swimlane's position in the tall scrolled
+   canvas (off-screen) instead of over the viewport.
+   All four insets are !important for two reasons:
+   1. The floating-window rules above (top: 8px / inset-inline-end: 8px /
+      width: min(650px, 90vw), specificity up to 0,5,1) otherwise override the
+      lower-specificity .card-details-maximized geometry entirely, leaving the
+      Maximize button a no-op.
+   2. The drag handle writes inline left/top styles onto the card; a card that
+      was dragged and then maximized must not keep the stale dragged offsets
+      (an off-viewport inline top is exactly the "wrong place" of #4822).
+      Only !important declarations beat inline styles. */
+body.desktop-mode .card-details.card-details-maximized:not(.card-details-popup):not(.card-details-collapsed) {
+  position: fixed !important;
+  top: 8px !important;
+  inset-inline-start: 8px !important;
+  inset-inline-end: 8px !important;
+  bottom: 8px !important;
+  width: auto !important;
+  height: auto !important;
+  max-width: none !important;
+  resize: none;
 }
 
 /* Collapsed card state - hide content and set height to title row only */
@@ -188,11 +239,13 @@ body.desktop-mode .card-details.card-details-collapsed {
   bottom: auto !important;
 }
 .card-details .mCustomScrollBox {
-  padding-left: 0;
+  padding-inline-start: 0;
 }
 .card-details .card-details-canvas {
   width: auto;
-  padding: 0 2.5vw;
+  /* #6465: fixed 20px as in 6.09 — 35px was ~48px of white border per side
+     on a FullHD screen. */
+  padding: 0 20px;
 }
 .card-details .card-details-header {
   margin: 0 -20px 5px;
@@ -208,16 +261,16 @@ body.desktop-mode .card-details.card-details-collapsed {
 .card-details .card-details-header .card-number {
   color: #b3b3b3;
   display: inline-block;
-  margin-right: 6px;
+  margin-inline-end: 6px;
 }
 
 /* Collapse toggle triangle */
 .card-details .card-details-header .card-collapse-toggle {
-  float: left;
-  font-size: 20px;
+  float: inline-start;
+  font-size: calc(20px * var(--wekan-ui-font-scale, 1));
   padding: 7px 10px;
-  margin-left: -10px;
-  margin-right: 5px;
+  margin-inline-start: -10px;
+  margin-inline-end: 5px;
   cursor: pointer;
   user-select: none;
   color: #000;
@@ -226,13 +279,13 @@ body.desktop-mode .card-details.card-details-collapsed {
 }
 
 .card-details .card-details-header .card-drag-handle {
-  font-size: 20px;
+  font-size: calc(20px * var(--wekan-ui-font-scale, 1));
   padding: 8px 10px;
-  margin-right: 10px;
+  margin-inline-end: 10px;
   cursor: move;
   user-select: none;
   display: inline-block;
-  float: right;
+  float: inline-end;
   vertical-align: middle;
   line-height: 1.2;
 }
@@ -246,14 +299,14 @@ body.desktop-mode .card-details.card-details-collapsed {
 .card-details .card-details-header .close-card-details-mobile-web,
 .card-details .card-details-header .card-details-menu-mobile-web,
 .card-details .card-details-header .copied-tooltip {
-  float: right;
+  float: inline-end;
 }
 .card-details .card-details-header .close-card-details,
 .card-details .card-details-header .maximize-card-details,
 .card-details .card-details-header .minimize-card-details {
-  font-size: 24px;
+  font-size: calc(24px * var(--wekan-ui-font-scale, 1));
   padding: 5px 10px 5px 10px;
-  margin-right: -8px;
+  margin-inline-end: -8px;
   cursor: pointer;
   user-select: none;
   vertical-align: middle;
@@ -262,66 +315,55 @@ body.desktop-mode .card-details.card-details-collapsed {
 }
 .card-details .card-details-header .close-card-details-mobile-web,
 .card-details .card-details-header .card-mobile-desktop-toggle {
-  font-size: 24px;
+  font-size: calc(24px * var(--wekan-ui-font-scale, 1));
   padding: 5px;
-  margin-right: 5px;
+  margin-inline-end: 5px;
   cursor: pointer;
   user-select: none;
 }
 .card-details .card-details-header .card-copy-button {
-  font-size: 17px;
+  font-size: calc(17px * var(--wekan-ui-font-scale, 1));
   padding: 10px;
-  margin-right: 10px;
+  margin-inline-end: 10px;
 }
 .card-details .card-details-header .card-copy-mobile-button {
-  font-size: 17px;
+  font-size: calc(17px * var(--wekan-ui-font-scale, 1));
   padding: 10px;
-  margin-right: 10px;
+  margin-inline-end: 10px;
 }
 .card-details .card-details-header .card-details-menu {
-  font-size: 17px;
+  font-size: calc(17px * var(--wekan-ui-font-scale, 1));
   padding: 10px;
   vertical-align: middle;
   line-height: 1.2;
 }
 .card-details .card-details-header .card-details-menu-mobile-web {
-  font-size: 17px;
+  font-size: calc(17px * var(--wekan-ui-font-scale, 1));
   padding: 10px;
-  margin-right: 30px;
+  margin-inline-end: 30px;
 }
 .card-details .card-details-header .card-mobile-desktop-toggle,
 .card-details .card-details-header .card-zoom-in,
 .card-details .card-details-header .card-zoom-out {
-  font-size: 24px;
+  font-size: calc(24px * var(--wekan-ui-font-scale, 1));
   padding: 5px 10px 5px 10px;
-  margin-right: 5px;
+  margin-inline-end: 5px;
   cursor: pointer;
   user-select: none;
-  float: right;
+  float: inline-end;
 }
 
-/* Unify all card text to match title size */
+/* #6465: the "unify all card text to match title size" block (v8.18) forced
+   EVERY element in card details to the base font size with line-height 1.5,
+   flattening the 6.09 hierarchy where labels/metadata were smaller than body
+   text — a big part of the "card window is WAAAY too big" complaint. Removed:
+   components keep their own sizes again. */
 .card-details {
   font-size: 1em;
 }
-.card-details p,
-.card-details span,
-.card-details div,
-.card-details a,
-.card-details label,
-.card-details input,
-.card-details textarea,
-.card-details select,
-.card-details button,
-.card-details .card-details-item-title,
-.card-details .card-label,
-.card-details .viewer {
-  font-size: inherit;
-  line-height: 1.5;
-}
 .card-details .card-details-header .card-details-watch {
-  font-size: 17px;
-  padding-left: 7px;
+  font-size: calc(17px * var(--wekan-ui-font-scale, 1));
+  padding-inline-start: 7px;
   color: #a6a6a6;
 }
 .card-details .card-details-header .card-details-title {
@@ -333,6 +375,46 @@ body.desktop-mode .card-details.card-details-collapsed {
   vertical-align: middle;
   line-height: 1.3;
   letter-spacing: 0.01em;
+  position: relative;
+}
+
+/* The title is two things at once, split like a minicard's: the LEADING half
+   opens the editor, the trailing half drags the window. With drag handles OFF
+   there is no handle, so the title bar is what the window is moved by - and a
+   heading that is entirely an edit target leaves nothing to take hold of.
+
+   An overlay rather than a split of the text, because the text is a `.viewer`
+   and cutting it in two would cut the sentence in two. `inset-inline-start`, so
+   the edit half is the left in English and the right in Arabic from one rule.
+   The drag handler steps aside for this zone (cardDetails.js). */
+.card-details .card-details-header .card-details-title .card-details-title-edit-zone {
+  position: absolute;
+  top: 0;
+  bottom: 0;
+  inset-inline-start: 0;
+  /* Half of the heading - and the heading is stretched to the row below, so
+     this is half of the BAR however long the title happens to be. */
+  width: 50%;
+  cursor: text;
+  z-index: 1;
+}
+
+/* The heading fills the row rather than shrinking to its text, so "half the
+   title" and "half the bar" are the same half however long the title is. A
+   heading only as wide as its words leaves the empty space beside it belonging
+   to nothing - and that space is where anybody would grab to move the window.
+   It stays inline-block so the complete-toggle beside it keeps its place; the
+   buttons floating at the trailing edge take their room out of this width. */
+.card-details .card-details-header .card-details-title {
+  min-width: 60%;
+}
+
+/* With drag handles ON the handle is the only drag source, so the whole title
+   is the edit target - the same rule the minicard follows, from the same
+   question: `card-details-with-handle` is set by the template from
+   isTouchScreenOrShowDesktopDragHandles, which is Utils.showDragHandles(). */
+.card-details.card-details-with-handle .card-details-header .card-details-title .card-details-title-edit-zone {
+  width: 100%;
 }
 .card-details .card-details-header .linked-card-location {
   font-style: italic;
@@ -363,11 +445,11 @@ body.desktop-mode .card-details.card-details-collapsed {
   padding: 0 5px;
 }
 .card-details .card-details-header .copied-tooltip {
-  margin-right: 10px;
+  margin-inline-end: 10px;
   padding: 10px;
 }
 .card-details .card-description i.fa.fa-pencil-square-o {
-  float: right;
+  float: inline-end;
 }
 .card-details .card-description textarea {
   min-height: 100px;
@@ -380,11 +462,11 @@ body.desktop-mode .card-details.card-details-collapsed {
   gap: 0.5em;
 }
 .card-details .card-details-items .card-details-item {
-  margin-right: 0.5em;
+  margin-inline-end: 0.5em;
   flex-grow: 1;
 }
 .card-details .card-details-items .card-details-item:last-child {
-  margin-right: 0;
+  margin-inline-end: 0;
 }
 .card-details .card-details-items .card-details-item.card-details-item-labels {
   display: block;
@@ -409,21 +491,27 @@ body.desktop-mode .card-details.card-details-collapsed {
   max-width: 28%;
 }
 .card-details .card-details-items .card-details-item.custom-fields {
-  padding-left: 10px;
+  padding-inline-start: 10px;
 }
 .card-details .card-details-item-title {
-  font-size: 16px;
+  font-size: calc(16px * var(--wekan-ui-font-scale, 1));
   font-weight: bold;
   color: #4d4d4d;
 }
+.card-details .card-details-person-controls {
+  align-items: flex-start;
+  display: flex;
+  flex-direction: column;
+  gap: 0.25em;
+}
 .card-details .activities {
   padding-top: 10px;
 }
 @media screen and (min-width: 801px) {
   .card-details {
     top: 97px;
-    left: calc(50% - (600px / 2));
-    width: 600px;
+    inset-inline-start: calc(50% - (520px / 2)); /* #6465: narrower card (was 600px) */
+    width: 520px;
     bottom: 0;
     position: fixed;
     resize: both;
@@ -433,8 +521,8 @@ body.desktop-mode .card-details.card-details-collapsed {
   body.mobile-mode .card-details {
     width: 100vw !important;
     top: 0 !important;
-    left: 0 !important;
-    right: 0 !important;
+    inset-inline-start: 0 !important;
+    inset-inline-end: 0 !important;
     bottom: 0 !important;
     height: 100vh !important;
     max-height: 100vh !important;
@@ -446,6 +534,12 @@ body.desktop-mode .card-details.card-details-collapsed {
     flex-shrink: 0;
     flex-basis: calc(100% - 20px);
     will-change: flex-basis;
+    /* #4822: declare the position strategy explicitly. The maximized pane must
+       be fixed to the viewport in its own right — never an in-flow flex/float
+       item of the scrolled swimlane container, and never dependent on the
+       sibling .card-details rule (or the body.desktop-mode rules) happening to
+       supply position: fixed. */
+    position: fixed;
     overflow-y: auto;
     overflow-x: auto;
     background: #f7f7f7;
@@ -456,23 +550,23 @@ body.desktop-mode .card-details.card-details-collapsed {
     transition: flex-basis 0.1s;
     box-sizing: border-box;
     top: 97px;
-    left: 0px;
+    inset-inline-start: 0px;
     height: calc(100% - 100px);
     width: calc(100% - 20px);
-    float: left;
+    float: inline-start;
   }
   .card-details-maximized .card-details-left {
-    float: left;
+    float: inline-start;
     top: 60px;
-    left: 20px;
+    inset-inline-start: 20px;
     width: 47%;
-    border-right: solid 2px #dbdbdb;
-    padding-right: 10px;
+    border-inline-end: solid 2px #dbdbdb;
+    padding-inline-end: 10px;
   }
   .card-details-maximized .card-details-right {
     position: absolute;
-    float: right;
-    left: 50%;
+    float: inline-end;
+    inset-inline-start: 50%;
     margin: 15px 0;
   }
   .card-details-maximized .card-details-header {
@@ -480,12 +574,12 @@ body.desktop-mode .card-details.card-details-collapsed {
   }
 }
 input[type="text"].attachment-add-link-input {
-  float: left;
+  float: inline-start;
   margin: 0 0 8px;
   width: 80%;
 }
 input[type="submit"].attachment-add-link-submit {
-  float: left;
+  float: inline-start;
   margin: 0 0 8px 4px;
   padding: 6px 12px;
   width: 18%;
@@ -501,52 +595,57 @@ input[type="submit"].attachment-add-link-submit {
     -webkit-overflow-scrolling: touch;
     position: fixed !important;
     top: 0 !important;
-    left: 0 !important;
-    right: 0 !important;
+    inset-inline-start: 0 !important;
+    inset-inline-end: 0 !important;
     bottom: 0 !important;
-    z-index: 100 !important;
+    /* #6419: the open card is a full-screen takeover on mobile, so it must sit
+       ABOVE the app header bar (#header-main-bar is z-index 1000) — otherwise the
+       header overlaps the top of the card and hides the close (X) button, making
+       it impossible to close the card. Kept below popups (z-index 2000+) so card
+       menus / date pickers still open over the card. */
+    z-index: 1100 !important;
     height: 100vh !important;
     max-height: 100vh !important;
     border-radius: 0 !important;
     box-shadow: none !important;
   }
 
-  /* Ensure card details are above everything on mobile */
+  /* Ensure card details are above the app header on mobile (#6419) */
   body.mobile-mode .card-details {
-    z-index: 100 !important;
+    z-index: 1100 !important;
     width: 100vw !important;
-    left: 0 !important;
-    right: 0 !important;
+    inset-inline-start: 0 !important;
+    inset-inline-end: 0 !important;
   }
   .card-details .card-details-canvas {
     width: 100%;
-    padding-left: 0px;
+    padding-inline-start: 0px;
     padding: 0 15px;
   }
   .card-details .card-details-header .close-card-details {
-    margin-right: 0px;
+    margin-inline-end: 0px;
     display: block !important;
   }
   .card-details .card-details-header .close-card-details-mobile-web {
     display: block !important;
-    margin-right: 5px !important;
+    margin-inline-end: 5px !important;
   }
   .card-details .card-details-header .card-mobile-desktop-toggle {
     display: block !important;
-    margin-right: 5px !important;
+    margin-inline-end: 5px !important;
   }
   .card-details .card-details-header .card-mobile-desktop-toggle {
     display: block !important;
-    margin-right: 5px !important;
+    margin-inline-end: 5px !important;
   }
   .card-details .card-details-header .card-details-menu {
-    margin-right: 40px;
+    margin-inline-end: 40px;
   }
   .card-details .card-details-header .maximize-card-details {
-    margin-right: 40px;
+    margin-inline-end: 40px;
   }
   .card-details .card-details-header .minimize-card-details {
-    margin-right: 40px;
+    margin-inline-end: 40px;
   }
   .card-details-popup {
     padding: 0px 10px;
@@ -565,7 +664,7 @@ input[type="submit"].attachment-add-link-submit {
   }
   /* iPhone mobile: enlarge header buttons and increase spacing */
   body.mobile-mode.iphone-device .card-details .card-details-header {
-    padding-right: 16px;
+    padding-inline-end: 16px;
   }
   body.mobile-mode.iphone-device .card-details .card-details-header .close-card-details,
   body.mobile-mode.iphone-device .card-details .card-details-header .maximize-card-details,
@@ -577,12 +676,12 @@ input[type="submit"].attachment-add-link-submit {
   body.mobile-mode.iphone-device .card-details .card-details-header .card-zoom-out {
     font-size: 2em !important; /* 2x bigger */
     padding: 0.3em !important;
-    margin-right: 0.75em !important; /* 2x space compared to default */
-    margin-left: 0 !important;
+    margin-inline-end: 0.75em !important; /* 2x space compared to default */
+    margin-inline-start: 0 !important;
   }
   /* Avoid clipping of the close button on the right edge */
   body.mobile-mode.iphone-device .card-details .card-details-header .close-card-details {
-    margin-right: 0.75em !important;
+    margin-inline-end: 0.75em !important;
   }
   /* Enlarge the header title too */
   body.mobile-mode.iphone-device .card-details .card-details-header .card-details-title {
@@ -598,10 +697,11 @@ body.mobile-mode .card-details {
   margin: 0px !important;
   position: fixed !important;
   top: 0 !important;
-  left: 0 !important;
-  right: 0 !important;
+  inset-inline-start: 0 !important;
+  inset-inline-end: 0 !important;
   bottom: 0 !important;
-  z-index: 100 !important;
+  /* #6419: above the app header (#header-main-bar z-index 1000), below popups. */
+  z-index: 1100 !important;
   height: 100vh !important;
   max-height: 100vh !important;
   border-radius: 0 !important;
@@ -731,7 +831,7 @@ body.mobile-mode .card-details .card-details-header .close-card-details-mobile-w
 }
 .vote-title .js-edit-date {
   align-self: flex-start;
-  margin-left: 6px;
+  margin-inline-start: 6px;
 }
 .vote-result {
   display: flex;
@@ -750,7 +850,7 @@ body.mobile-mode .card-details .card-details-header .close-card-details-mobile-w
 }
 .poker-title .js-edit-date {
   align-self: flex-start;
-  margin-left: 6px;
+  margin-inline-start: 6px;
 }
 .poker-result {
   display: flex;
@@ -827,11 +927,11 @@ body.mobile-mode .card-details .card-details-header .close-card-details-mobile-w
   display: inline-block;
 }
 .poker-table-side-right {
-  padding-left: 10px;
+  padding-inline-start: 10px;
 }
 @media (max-width: 400px) {
   .poker-table-side-right {
-    padding-left: 0px;
+    padding-inline-start: 0px;
   }
 }
 .estimation-add {
@@ -842,16 +942,16 @@ body.mobile-mode .card-details .card-details-header .close-card-details-mobile-w
 }
 .estimation-add input {
   display: inline-block;
-  float: right;
+  float: inline-end;
   margin: auto;
-  margin-right: 10px;
+  margin-inline-end: 10px;
   width: 100px;
   border-radius: 2px;
   padding: 3px 6px;
 }
 .estimation-add button {
   display: inline-block;
-  float: right;
+  float: inline-end;
   margin: auto;
   border-radius: 2px;
   padding: 3px 10px;
@@ -859,14 +959,14 @@ body.mobile-mode .card-details .card-details-header .close-card-details-mobile-w
 .poker-card {
   width: 48px;
   height: 72px;
-  float: left;
+  float: inline-start;
   background: #fff;
   border-radius: 5px;
   display: table;
   box-sizing: border-box;
   padding: 5px;
   margin: 3px;
-  font-size: 20px;
+  font-size: calc(20px * var(--wekan-ui-font-scale, 1));
   font-weight: bold;
   text-shadow: #2d2d2d 1px 1px 0;
   box-shadow: 0 0 5px #aaa;
@@ -890,3 +990,288 @@ body.mobile-mode .card-details .card-details-header .close-card-details-mobile-w
   transform: scale(1.01);
   transition: all 0.2s ease;
 }
+
+/* Sticker picker + card-detail stickers + due-complete toggle */
+/* The picker fills the popup it is in rather than stopping at eight columns:
+   the popup is wide now (popup.css), and a fixed 320px there would have left
+   the extra width empty while the icons still ran off the bottom. A grid that
+   fits as many 40px cells as there is room for turns that width into rows the
+   reader does not have to scroll past. */
+.card-stickers-picker {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(40px, 1fr));
+  justify-items: center;
+}
+.card-sticker-select {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 36px;
+  height: 36px;
+  margin: 2px;
+  border-radius: 3px;
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1));
+  color: #4d4d4d;
+  cursor: pointer;
+  position: relative;
+}
+.card-sticker-select:hover {
+  background: #e0e0e0;
+}
+.card-sticker-select.active {
+  background: #d6ecd2;
+  color: #3cb500;
+}
+.card-sticker-select .card-sticker-check {
+  position: absolute;
+  bottom: 1px;
+  inset-inline-end: 2px;
+  font-size: calc(10px * var(--wekan-ui-font-scale, 1));
+  color: #3cb500;
+}
+.card-stickers .card-sticker {
+  display: inline-flex;
+  align-items: center;
+  margin: 0 8px 4px 0;
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1));
+}
+.card-sticker .card-sticker-remove {
+  margin-inline-start: 3px;
+  font-size: calc(11px * var(--wekan-ui-font-scale, 1));
+  color: #999;
+  cursor: pointer;
+}
+.card-sticker .card-sticker-remove:hover {
+  color: #eb4646;
+}
+.card-due-complete-toggle {
+  display: inline-flex;
+  align-items: center;
+  margin-inline-start: 8px;
+  vertical-align: middle;
+}
+
+/* Trello-style "mark complete" toggle, left of the card title */
+.card-details-complete-toggle {
+  float: inline-start;
+  display: flex;
+  align-items: center;
+  /* Title is 1.35em with 1.3 line-height (~28px box) and margin-top 7px; push
+     the 13px checkbox down so it lands at the vertical middle of the title. */
+  margin: 14px 10px 0 0;
+  cursor: pointer;
+}
+
+/* Card locations: multiple locations, each editable with a remove button */
+.card-details-item-location .card-locations {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  margin-bottom: 6px;
+}
+.card-details-item-location .card-location {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  background: #fff;
+  border: 1px solid #e3e3e3;
+  border-radius: 4px;
+  padding: 6px 8px;
+}
+.card-details-item-location .card-location-info {
+  flex: 1;
+}
+.card-details-item-location .js-edit-location {
+  cursor: pointer;
+}
+.card-details-item-location .card-location-name {
+  font-weight: bold;
+}
+.card-details-item-location .card-location-address {
+  color: #4d4d4d;
+}
+.card-details-item-location .card-location-remove {
+  margin-inline-start: 8px;
+  color: #8c8c8c;
+  cursor: pointer;
+}
+.card-details-item-location .card-location-remove:hover {
+  color: #eb4646;
+}
+
+/* Sticker icon highlight styles (used instead of colour): taco pack => underline,
+   pete pack => round (ring around the icon). Icon keeps its normal colour. */
+.card-sticker i.sticker-underline {
+  border-bottom: 2px solid currentColor;
+  padding-bottom: 1px;
+  line-height: 1;
+}
+.card-sticker i.sticker-round {
+  border: 1px solid currentColor;
+  border-radius: 50%;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.6em;
+  height: 1.6em;
+  line-height: 1;
+  box-sizing: border-box;
+}
+
+/* Opened card (card details popup) docks to the very top of the window and
+   overlays the global + board header bars instead of opening below them. The
+   base .pop-over is position:absolute with a small margin/top offset, which left
+   the card's top behind the fixed header bars; fix it to the viewport top with a
+   z-index above every header (headers top out around z-index 1000-2000). */
+/* The card details content (.card-details) is always position:fixed (see the
+   min-width:801px and max-width:800px media queries above), so it renders as its
+   own framed, viewport-positioned box and escapes this .pop-over wrapper. That
+   leaves the generic .pop-over chrome (white background, border, shadow, header
+   and ~380px width) visible as a redundant empty second popup at the top of the
+   page. Collapse the wrapper to nothing and make it invisible; the fixed card
+   descendant still renders normally on top of the page. Closing is handled by
+   the card's own close button (.js-close-card-details), clicking outside, or
+   pressing Escape. */
+.pop-over[data-popup="cardDetailsPopup"] {
+  position: fixed !important;
+  top: 0 !important;
+  inset-inline-start: 0 !important;
+  margin: 0 !important;
+  padding: 0 !important;
+  width: 0 !important;
+  height: 0 !important;
+  min-height: 0 !important;
+  background: none !important;
+  border: none !important;
+  box-shadow: none !important;
+  overflow: visible !important;
+  z-index: 100000 !important;
+}
+
+.pop-over[data-popup="cardDetailsPopup"] > .header {
+  display: none !important;
+}
+
+.pop-over[data-popup="cardDetailsPopup"] > .content-wrapper {
+  max-height: none !important;
+  overflow: visible !important;
+}
+
+/* Sticker highlight styles inside the sticker picker (mascot = underline,
+   computer = round), matching how they render on the card. */
+.card-sticker-select i.sticker-underline {
+  border-bottom: 2px solid currentColor;
+  padding-bottom: 1px;
+  line-height: 1;
+}
+.card-sticker-select i.sticker-round {
+  border: 1px solid currentColor;
+  border-radius: 50%;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.6em;
+  height: 1.6em;
+  line-height: 1;
+  box-sizing: border-box;
+}
+
+/* #6431 follow-up: cover image on the opened card (Card Settings > Cover image
+   on card, opt-in). Mirrors the minicard cover but taller. */
+.card-details-cover {
+  background-position: center;
+  background-repeat: no-repeat;
+  background-size: contain;
+  height: 200px;
+  user-select: none;
+  margin: 8px 0;
+}
+
+/* #1591 gave every FIELD of the opened card a caret of its own on its title,
+   and hid everything after that title when it was folded. The section carets
+   replaced it - one handle per section, on the heading - and the two ran at the
+   same time: clicking a section's caret also folded the field the heading was
+   drawn on, and with the field's own caret gone there was nothing left to open
+   it. That is where the Date Format select went. Both halves are gone from
+   here; client/components/cards/cardDetails.js says the same at the handler. */
+
+/* Collapsible card sections.
+   Every section of an opened card - Labels, Date Format, Members, Dependencies,
+   Sort, Custom Fields, Description, Checklists, Subtasks, Attachments, Comments
+   and Activities - has one rule above it and a caret in its heading that
+   collapses it. The rule comes from the same template as the caret, so eleven
+   sections cannot end up with ten separators.
+   The heading is a button: it says so to a screen reader (role/tabindex in the
+   template) and it looks like one to a mouse. */
+/* The GROUP is the full-width row of the card, and the fields inside it share
+   rows within it - which is what puts Assignee and Creator beside Members
+   rather than under it. The class that made an individual field full width is
+   gone with the grouping; a field that is its own section is a group of one. */
+.card-details .card-details-section-rule {
+  width: 100%;
+  margin: 14px 0 6px 0;
+}
+.card-details h3.card-details-item-title.js-toggle-card-section {
+  cursor: pointer;
+  user-select: none;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+}
+/* The hamburger that opens a section's settings, at the FAR end of its heading
+   - `margin-inline-start: auto` in a flex row, so it mirrors itself in a
+   right-to-left page. It is inside a heading that folds the section when
+   clicked, so its own handler stops the click there. */
+.card-details h3.card-details-item-title .card-details-section-menu {
+  margin-inline-start: auto;
+  padding: 0 4px;
+  color: #808080;
+  cursor: pointer;
+}
+
+.card-details h3.card-details-item-title .card-details-section-menu:hover {
+  color: #000;
+}
+
+/* The caret is the widest part of the heading that must not move as the label
+   changes length, so it gets a fixed box. `text-align: center` rather than a
+   side, because the glyph itself differs between the open and closed states
+   (down, and right or left) and a fixed side would make it jump. */
+.card-details h3.card-details-item-title.js-toggle-card-section > .fa:first-child {
+  width: 12px;
+  text-align: center;
+  flex: 0 0 auto;
+}
+.card-details h3.card-details-item-title.js-toggle-card-section:hover {
+  opacity: 0.85;
+}
+/* The checklist "3/7" line that used to be a second h3 under the Checklists
+   heading: a subtitle, so it is not read as another section. */
+.card-details .card-details-item-subtitle {
+  margin: 0 0 4px 0;
+  font-size: calc(13px * var(--wekan-ui-font-scale, 1));
+  font-weight: 400;
+  opacity: 0.8;
+}
+
+/* A GROUP of card fields - Labels with Stickers and Location, Date Format with
+   the four dates, Members with Assignee and Creator, and so on.
+   The group's own title carries the caret that folds it, and the fields inside
+   it do NOT: #1591 gives every .card-details-item a caret of its own, drawn on
+   the title by the rule further up this file, and inside a group that is a
+   second caret on every row saying the same thing in a smaller way. One handle
+   per group is what was asked for, and it is the group's.
+   The fields keep sharing rows inside the group, which is how they were laid
+   out - the group is a full-width row, the fields inside it wrap within it. */
+.card-details .card-details-items .card-details-group {
+  flex: 0 0 100%;
+  width: 100%;
+}
+.card-details .card-details-group-body {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5em;
+}
+.card-details .card-details-group-body .card-details-item {
+  flex-grow: 1;
+}

client/components/cards/cardStickers.jade

@@ -0,0 +1,7 @@
+template(name="cardStickersPopup")
+  .card-stickers-picker.clearfix
+    each stickerIcons
+      a.card-sticker-select.js-select-sticker(class="{{#if isSelected}}active{{/if}}" title="{{stickerTitle}}")
+        i.fa(class="fa-{{icon}} {{#if highlight}}sticker-{{highlight}}{{/if}}")
+        if isSelected
+          i.fa.fa-check.card-sticker-check

client/components/cards/cardStickers.js

@@ -0,0 +1,39 @@
+import { ReactiveCache } from '/imports/reactiveCache';
+import { STICKER_PICKER } from '/models/metadata/stickers';
+
+// Picker popup that lets a user add/remove stickers on a card. Each entry is
+// { icon, highlight?, name? }: the plain Font Awesome icons plus the mascot
+// (underlined) and computer (ringed) highlighted stickers. Opened from the card
+// details stickers section with the card as the data context.
+
+Template.cardStickersPopup.onCreated(function () {
+  const data = Template.currentData();
+  this.cardId = data && data._id;
+});
+
+function pickerCard(tpl) {
+  return ReactiveCache.getCard(tpl.cardId);
+}
+
+Template.cardStickersPopup.helpers({
+  stickerIcons() {
+    return STICKER_PICKER;
+  },
+  isSelected() {
+    const card = pickerCard(Template.instance());
+    return !!(card && card.hasSticker(this.icon, this.highlight));
+  },
+  stickerTitle() {
+    return this.name || this.icon;
+  },
+});
+
+Template.cardStickersPopup.events({
+  'click .js-select-sticker'(event) {
+    event.preventDefault();
+    const card = pickerCard(Template.instance());
+    if (card) {
+      card.toggleSticker(this.icon, this.highlight, this.name);
+    }
+  },
+});

client/components/cards/cardTime.css

@@ -14,5 +14,5 @@
   font-size: inherit;
   -webkit-font-smoothing: antialiased;
   content: "\f017";
-  margin-right: 0.3em;
+  margin-inline-end: 0.3em;
 }

client/components/cards/cardTime.jade

@@ -16,7 +16,9 @@ template(name="editCardSpentTimePopup")
 template(name="cardSpentTime")
   if canModifyCard
     a.js-edit-time.card-time(title="{{_ 'time'}}" class="{{#if getIsOvertime}}card-label-red{{else}}card-label-green{{/if}}")
-      | ⏱️ {{showTime}}
+      i.fa.fa-clock-o
+      |  {{showTime}}
   else
     a.card-time(title="{{_ 'time'}}" class="{{#if getIsOvertime}}card-label-red{{else}}card-label-green{{/if}}")
-      | ⏱️ {{showTime}}
+      i.fa.fa-clock-o
+      |  {{showTime}}

client/components/cards/checklists.css

@@ -14,7 +14,7 @@ textarea.js-edit-checklist-item {
   color: #8c8c8c;
   text-decoration: underline;
   word-wrap: break-word;
-  float: right;
+  float: inline-end;
   padding-top: 6px;
 }
 .delete-text:hover,
@@ -32,7 +32,7 @@ textarea.js-edit-checklist-item {
   align-items: center;
 }
 .checklist-progress-bar-container .checklist-progress-text {
-  margin-right: 10px;
+  margin-inline-end: 10px;
 }
 .checklist-progress-bar-container .checklist-progress-bar {
   width: 80%;
@@ -51,33 +51,33 @@ textarea.js-edit-checklist-item {
   padding: 10px;
 }
 .checklist-title .checkbox {
-  float: left;
+  float: inline-start;
   width: 30px;
   height: 30px;
-  font-size: 18px;
-  line-height: 30px;
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1));
+  line-height: calc(30px * var(--wekan-ui-font-scale, 1));
 }
 .checklist-title .title {
-  font-size: 18px;
-  line-height: 25px;
+  font-size: calc(18px * var(--wekan-ui-font-scale, 1));
+  line-height: calc(25px * var(--wekan-ui-font-scale, 1));
 }
 .checklist-title .checklist-stat {
   margin: 0 0.5em;
-  float: right;
+  float: inline-end;
   padding-top: 6px;
 }
 .checklist-title .checklist-stat.is-finished {
   color: #3cb500;
 }
 .checklist-title span.fa.checklist-handle {
-  padding-right: 20px;
+  padding-inline-end: 20px;
   padding-top: 3px;
-  float: left;
+  float: inline-start;
 }
 #card-details-overlay {
   top: 0;
   bottom: -600px;
-  right: 0;
+  inset-inline-end: 0;
 }
 .checklist {
   background: #f7f7f7;
@@ -93,7 +93,7 @@ textarea.js-edit-checklist-item {
 }
 .checklist-item {
   margin: 0 0 0 0.1em;
-  line-height: 18px;
+  line-height: calc(18px * var(--wekan-ui-font-scale, 1));
   font-size: 1.1em;
   margin-top: 3px;
   display: flex;
@@ -123,14 +123,14 @@ textarea.js-edit-checklist-item {
   background-color: #ebebeb;
 }
 .checklist-item .check-box-container {
-  padding-right: 10px;
+  padding-inline-end: 10px;
 }
 .checklist-item .check-box {
   margin: 0.1em 0 0 0;
 }
 .checklist-item .check-box.is-checked {
   border-bottom: 2px solid #3cb500;
-  border-right: 2px solid #3cb500;
+  border-inline-end: 2px solid #3cb500;
 }
 .checklist-item .item-title {
   flex: 1;
@@ -148,7 +148,7 @@ textarea.js-edit-checklist-item {
 }
 .checklist-item span.fa.checklistitem-handle {
   padding-top: 2px;
-  padding-right: 10px;
+  padding-inline-end: 10px;
 }
 .js-delete-checklist-item,
 .js-convert-checklist-item-to-card {
@@ -171,9 +171,9 @@ textarea.js-edit-checklist-item {
 }
 .add-checklist-top {
   /* more space to checklists title */
-  padding-left: 20px;
+  padding-inline-start: 20px;
   /* + is easier clickable */
-  padding-right: 20px;
+  padding-inline-end: 20px;
 }
 .add-checklist-top.js-open-inlined-form:hover {
   background: #dbdbdb;
@@ -185,9 +185,32 @@ textarea.js-edit-checklist-item {
   width: 100%;
 }
 .checklist-details-menu {
-  float: right;
+  float: inline-end;
   padding: 6px 10px 6px 10px;
 }
 .edit-controls label.toggle-label {
-  margin-left: 2px;
+  margin-inline-start: 2px;
+}
+
+/* #1591: the fold caret on a checklist title. Sized and coloured like the
+   actions menu beside it so the two read as one row of controls, and given a
+   real hit area - it is a single glyph, and a caret you have to aim at is worse
+   than no caret. */
+.checklist-title .checklist-collapse {
+  /* Logical, so the caret sits on the reading-start side under dir=rtl too
+     (tests/rtl.test.js enforces this across component CSS). */
+  float: inline-start;
+  margin-block-start: 2px;
+  margin-inline-end: 4px;
+  padding: 2px 4px;
+  color: #808080;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1));
+  line-height: calc(14px * var(--wekan-ui-font-scale, 1));
+  cursor: pointer;
+  text-decoration: none;
+}
+
+.checklist-title .checklist-collapse:hover,
+.checklist-title .checklist-collapse:focus-visible {
+  color: #2980b9;
 }

client/components/cards/checklists.jade

@@ -1,8 +1,9 @@
 template(name="checklists")
+  //- The NAME of this section is drawn by +cardSectionHeader in cardDetails.jade,
+    with the caret that collapses it and the rule above it. What stays here is
+    the control that belongs to the list itself: add a checklist.
   .checklists-title
     h3.card-details-item-title
-      i.fa.fa-check
-      | {{_ 'checklists'}}
       if canModifyCard
         +inlinedForm(autoclose=false classNames="js-add-checklist" cardId = cardId
           position="top")
@@ -34,10 +35,19 @@ template(name="checklists")
 template(name="checklistDetail")
   .js-checklist.checklist.nodragscroll
     +inlinedForm(classNames="js-edit-checklist-title" checklist = checklist)
-      +editChecklistItemForm(checklist = checklist)
+      +editChecklistForm(checklist = checklist)
     else
       .checklist-title
         span
+        //- #1591: fold a long checklist out of the way. A caret rather than
+          another entry in the actions menu, because the whole point is to do it
+          at a glance while reading the card - and it is a view preference of
+          this user, so it does not touch the card.
+        a.fa.checklist-collapse.js-collapse-checklist(
+          class="{{#if checklistCollapsed}}fa-caret-right{{else}}fa-caret-down{{/if}}"
+          title="{{#if checklistCollapsed}}{{_ 'expand-checklist'}}{{else}}{{_ 'collapse-checklist'}}{{/if}}"
+          role="button" tabindex="0"
+          aria-expanded="{{#if checklistCollapsed}}false{{else}}true{{/if}}")
         if canModifyCard
           a.fa.fa-navicon.checklist-details-menu.js-open-checklist-details-menu(title="{{_ 'checklistActionsPopup-title'}}")
 
@@ -52,12 +62,15 @@ template(name="checklistDetail")
             +viewer
                 = checklist.title
 
+    //- The progress bar stays visible when folded: it is the summary of what was
+      folded away, so hiding it too would leave a title that says nothing.
     if $gt finishedPercent 0
       .checklist-progress-bar-container
         .checklist-progress-text {{finishedPercent}}%
         .checklist-progress-bar
           .checklist-progress(style="width:{{finishedPercent}}%")
-    +checklistItems(checklist = checklist card = card)
+    unless checklistCollapsed
+      +checklistItems(checklist = checklist card = card)
 
 template(name="checklistDeletePopup")
   p {{_ 'confirm-checklist-delete-popup'}}
@@ -85,6 +98,19 @@ template(name="addChecklistItemForm")
           label.toggle-label(for="toggleNewlineBecomesNewChecklistItemOriginOrder")
           | {{_ 'originOrder'}}
 
+template(name="editChecklistForm")
+  a.fa.fa-copy(title="{{_ 'copy-text-to-clipboard'}}")
+  span.copied-tooltip {{_ 'copied'}}
+  textarea.js-edit-checklist-item(rows='1' autofocus dir="auto")
+    if $eq type 'item'
+      = item.title
+    else
+      = checklist.title
+  .edit-controls.clearfix
+    button.primary.confirm.js-submit-edit-checklist-item-form(type="submit") {{_ 'save'}}
+    a.fa.fa-times-thin.js-close-inlined-form(title="{{_ 'close-edit-checklist-item'}}")
+    span(title=createdAt) {{ displayDate createdAt }}
+
 template(name="editChecklistItemForm")
   a.fa.fa-copy(title="{{_ 'copy-text-to-clipboard'}}")
   span.copied-tooltip {{_ 'copied'}}
@@ -125,7 +151,7 @@ template(name="checklistItems")
           i.fa.fa-plus
 
 template(name='checklistItemDetail')
-  .js-checklist-item.checklist-item(class="{{#if item.isFinished }}is-checked{{#if checklist.hideCheckedChecklistItems}} invisible{{/if}}{{/if}}{{#if checklist.hideAllChecklistItems}} is-checked invisible{{/if}}"
+  .js-checklist-item.checklist-item(class="{{#if item.isFinished }}is-checked{{#if checklist.isItemHidden item.isFinished}} invisible{{/if}}{{/if}}{{#if checklist.hideAllChecklistItems}} is-checked invisible{{/if}}"
     role="checkbox" aria-checked="{{#if item.isFinished }}true{{else}}false{{/if}}" tabindex="0")
     if canModifyCard
       .check-box-container
@@ -142,6 +168,14 @@ template(name='checklistItemDetail')
           = item.title
 
 template(name="checklistActionsPopup")
+  //- #1173: a checklist exports like everything else - the same popup body, with
+    the checklist as its scope. Reading, so it is above the rows that change it.
+  ul.pop-over-list
+    li
+      a.js-export-checklist
+        i.fa.fa-exchange
+        | {{_ 'export'}} / {{_ 'import'}} ...
+  hr
   ul.pop-over-list
     li
       a.js-delete-checklist.delete-checklist
@@ -157,7 +191,7 @@ template(name="checklistActionsPopup")
         i.fa.fa-eye-slash
         | {{_ "hideCheckedChecklistItems"}} ...
         .material-toggle-switch(title="{{_ 'hide-checked-items'}}")
-          if checklist.hideCheckedChecklistItems
+          if checklist.hideCheckedState
             input.toggle-switch(type="checkbox" id="toggleHideCheckedChecklistItems_{{checklist._id}}" checked="checked")
           else
             input.toggle-switch(type="checkbox" id="toggleHideCheckedChecklistItems_{{checklist._id}}")
@@ -171,6 +205,19 @@ template(name="checklistActionsPopup")
           else
             input.toggle-switch(type="checkbox" id="toggleHideAllChecklistItems_{{checklist._id}}")
           label.toggle-label(for="toggleHideAllChecklistItems_{{checklist._id}}")
+      a.js-show-checklist-at-minicard
+        i.fa.fa-th-list
+        | {{_ "show-on-minicard"}} ...
+        .material-toggle-switch(title="{{_ 'show-on-minicard'}}")
+          //- The switch shows what is ON THE MINICARD, not the raw field. Drawn
+            from the field it read OFF beside a checklist that was plainly showing,
+            because the board default (allowsChecklistsOnMinicard, on out of the
+            box) put it there - reported by email.
+          if shownAtMinicard
+            input.toggle-switch(type="checkbox" id="toggleShowChecklistAtMinicard_{{checklist._id}}" checked="checked")
+          else
+            input.toggle-switch(type="checkbox" id="toggleShowChecklistAtMinicard_{{checklist._id}}")
+          label.toggle-label(for="toggleShowChecklistAtMinicard_{{checklist._id}}")
 
 template(name="copyChecklistPopup")
   +copyAndMoveChecklist

client/components/cards/checklists.js

@@ -8,6 +8,7 @@ import { BoardSwimlaneListCardDialog } from '/client/lib/dialogWithBoardSwimlane
 import { EscapeActions } from '/client/lib/escapeActions';
 import { Utils } from '/client/lib/utils';
 import autosize from 'autosize';
+import { isChecklistShownAtMinicard } from '/models/lib/minicardChecklistVisibility';
 
 // SubsManager removed for Meteor 3 migration
 const { calculateIndexData } = Utils;
@@ -82,6 +83,47 @@ Template.checklistDetail.helpers({
     const ret = this.checklist.finishedPercent();
     return ret;
   },
+  /** #1591: is this checklist folded for THIS user?
+   *
+   * Per-user, keyed by card and checklist, exactly like collapsed lists and
+   * swimlanes - not the checklist's own hideAllChecklistItems, which is a field
+   * on the checklist and so changes what everyone on the board sees. `null` from
+   * the getter means "never set", which is what makes the default (expanded)
+   * distinguishable from somebody having deliberately expanded it. */
+  checklistCollapsed() {
+    const checklist = this.checklist;
+    if (!checklist || !checklist._id) return false;
+    const user = ReactiveCache.getCurrentUser();
+    if (!user) return false;
+    const cardId = (this.card && this.card._id) || checklist.cardId;
+    const stored = user.getCollapsedCardSection(
+      cardId, user.checklistSectionKey(checklist._id));
+    return stored === true;
+  },
+});
+
+Template.checklistDetail.events({
+  'click .js-collapse-checklist'(event) {
+    // The caret sits inside the title, which opens the inline rename form when
+    // clicked - so this must not reach it.
+    event.preventDefault();
+    event.stopPropagation();
+    const checklist = this.checklist;
+    const user = ReactiveCache.getCurrentUser();
+    if (!checklist || !checklist._id || !user) return;
+    const cardId = (this.card && this.card._id) || checklist.cardId;
+    const key = user.checklistSectionKey(checklist._id);
+    const collapsed = user.getCollapsedCardSection(cardId, key) === true;
+    user.setCollapsedCardSection(cardId, key, !collapsed);
+  },
+  'keydown .js-collapse-checklist'(event) {
+    // It is a link acting as a button, so it has to answer the keys a button
+    // answers or it is unreachable without a mouse.
+    if (event.key !== 'Enter' && event.key !== ' ') return;
+    event.preventDefault();
+    event.stopPropagation();
+    $(event.currentTarget).trigger('click');
+  },
 });
 
 Template.checklists.helpers({
@@ -135,8 +177,11 @@ Template.checklists.events({
     event.preventDefault();
     const textarea = tpl.find('textarea.js-edit-checklist-item');
     const title = textarea.value.trim();
-    const checklist = Template.currentData().checklist;
-    checklist.setTitle(title);
+    const formData = Blaze.getData(event.currentTarget) || Blaze.getData(event.target);
+    const checklist = formData?.checklist;
+    if (checklist) {
+      checklist.setTitle(title);
+    }
   },
   'submit .js-add-checklist-item'(event, tpl) {
     event.preventDefault();
@@ -211,7 +256,9 @@ Template.checklists.events({
   'click .js-delete-checklist-item': Popup.afterConfirm('checklistItemDelete', function () {
     Popup.back();
     const item = this?.item || this;
-    if (item && item._id) {
+    // #3252: guard against removing a doc already evicted from Minimongo (heavy
+    // archive/delete churn), which throws "Removed nonexistent document".
+    if (item && item._id && ChecklistItems.findOne(item._id)) {
       ChecklistItems.remove(item._id);
     }
   }),
@@ -251,11 +298,31 @@ Template.addChecklistItemForm.events({
   },
 });
 
+// The board default this checklist's own setting overrides. Read here rather than
+// in the model helper, because the model runs on the server too, where looking a
+// board up is asynchronous - and a Blaze helper has to answer now.
+function boardAllowsChecklistsOnMinicard(checklist) {
+  if (!checklist) return false;
+  const board = ReactiveCache.getBoard(checklist.boardId);
+  return !!(board && board.allowsChecklistsOnMinicard);
+}
+
+Template.checklistActionsPopup.helpers({
+  // What the "Show on minicard" switch draws: whether the checklist is on the
+  // minicard right now, board default included.
+  shownAtMinicard() {
+    const checklist = this.checklist;
+    return isChecklistShownAtMinicard(checklist, boardAllowsChecklistsOnMinicard(checklist));
+  },
+});
+
 Template.checklistActionsPopup.events({
+  'click .js-export-checklist': Popup.open('exportChecklist'),
   'click .js-delete-checklist': Popup.afterConfirm('checklistDelete', function () {
     Popup.back(2);
     const checklist = this.checklist;
-    if (checklist && checklist._id) {
+    // #3252: see js-delete-checklist-item — avoid "Removed nonexistent document".
+    if (checklist && checklist._id && Checklists.findOne(checklist._id)) {
       Checklists.remove(checklist._id);
     }
   }),
@@ -271,6 +338,16 @@ Template.checklistActionsPopup.events({
     Template.currentData().checklist.toggleHideAllChecklistItems();
     Popup.back();
   },
+  'click .js-show-checklist-at-minicard'(event) {
+    event.preventDefault();
+    const checklist = Template.currentData().checklist;
+    // The board's setting is the default this one overrides, so the toggle has to
+    // flip what is ON SCREEN, not the raw field. Flipping the field is what made
+    // the first click do nothing while the board default was on (false -> true,
+    // still shown) - reported by email.
+    checklist.toggleShowChecklistAtMinicard(boardAllowsChecklistsOnMinicard(checklist));
+    Popup.back();
+  },
 });
 
 Template.editChecklistItemForm.onRendered(function () {

client/components/cards/labels.css

@@ -1,11 +1,89 @@
+/* #4759: Member Settings / Font popup — a button per installed font (each shown in
+   its own font) and a row of size buttons (smaller ... 100% ... larger). Clicking a
+   button applies immediately. */
+.ui-font-buttons,
+.ui-font-size-buttons {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 4px;
+  margin: 2px 0 10px 0;
+}
+.ui-font-btn,
+.ui-font-size-btn {
+  display: inline-block;
+  padding: 4px 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  background: #fff;
+  color: #333;
+  cursor: pointer;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1));
+  line-height: 1.4;
+  text-decoration: none;
+}
+.ui-font-btn:hover,
+.ui-font-size-btn:hover {
+  background: #f0f0f0;
+}
+.ui-font-btn.active,
+.ui-font-size-btn.active {
+  background: #2980b9;
+  border-color: #2980b9;
+  color: #fff;
+}
+/* The "Unset" colour reset links look like buttons. */
+.color-wheel-wrap .js-reset-text-color,
+.color-wheel-wrap .js-reset-bg-color {
+  display: inline-block;
+  padding: 4px 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  background: #fff;
+  color: #333;
+  cursor: pointer;
+  font-size: calc(14px * var(--wekan-ui-font-scale, 1));
+  line-height: 1.4;
+  text-decoration: none;
+}
+.color-wheel-wrap .js-reset-text-color:hover,
+.color-wheel-wrap .js-reset-bg-color:hover {
+  background: #f0f0f0;
+}
+.color-wheel-wrap .js-reset-text-color.disabled,
+.color-wheel-wrap .js-reset-bg-color.disabled {
+  opacity: 0.5;
+  pointer-events: none;
+}
+
+/* #5514: native color-wheel (custom RGB / hex) picker wrapper, shared by the
+   label / list / swimlane / card color popups. */
+.color-wheel-wrap {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin: 6px 0 10px 0;
+}
+.color-wheel-wrap label {
+  margin: 0;
+}
+.color-wheel-wrap input[type="color"] {
+  width: 44px;
+  height: 28px;
+  padding: 0;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  cursor: pointer;
+  background: none;
+}
+
 .card-label {
   border: 1px solid #000;
   border-radius: 4px;
   color: #fff;
   display: inline-block;
   font-weight: 700;
-  font-size: 13px;
-  margin-right: 4px;
+  font-size: calc(13px * var(--wekan-ui-font-scale, 1));
+  margin-inline-end: 4px;
   margin-bottom: 5px;
   padding: 3px 8px;
   max-width: 210px;
@@ -140,7 +218,7 @@
 }
 .edit-label .card-label,
 .create-label .card-label {
-  float: left;
+  float: inline-start;
   height: 25px;
   margin: 0px 3% 7px 0px;
   width: 10.5%;
@@ -153,18 +231,18 @@
 }
 .edit-labels .card-label {
   height: 30px;
-  left: 0;
+  inset-inline-start: 0;
   padding: 1px 5px;
   position: absolute;
   top: 0;
   width: 24px;
 }
 .edit-labels .labels-static .card-label {
-  line-height: 30px;
+  line-height: calc(30px * var(--wekan-ui-font-scale, 1));
   margin-bottom: 4px;
   position: relative;
   top: auto;
-  left: 0;
+  inset-inline-start: 0;
   width: 260px;
 }
 .edit-labels-pop-over {
@@ -185,24 +263,24 @@
   min-height: 18px;
   padding: 8px;
   position: relative;
-  transition: margin-right 0.1s;
+  transition: margin-inline-end 0.1s;
 }
 .card-label-selectable .card-label-selectable-icon {
   position: absolute;
   top: 8px;
-  right: -20px;
+  inset-inline-end: -20px;
 }
 .card-label-selectable.active:hover,
 .card-label-selectable.active,
 .card-label-selectable.active.selected:hover,
 .card-label-selectable.active.selected {
-  padding-right: 32px;
+  padding-inline-end: 32px;
 }
 .card-label-selectable.active:hover .card-label-selectable-icon,
 .card-label-selectable.active .card-label-selectable-icon,
 .card-label-selectable.active.selected:hover .card-label-selectable-icon,
 .card-label-selectable.active.selected .card-label-selectable-icon {
-  right: 6px;
+  inset-inline-end: 6px;
 }
 .card-label-selectable.selected,
 .card-label-selectable:hover {
@@ -210,21 +288,21 @@
 }
 .active .card-label-selectable,
 .active .card-label-selectable:hover {
-  margin-right: 0;
+  margin-inline-end: 0;
 }
 .active .card-label-selectable .card-label-selectable-icon {
-  right: 8px;
+  inset-inline-end: 8px;
 }
 .card-label-edit-button {
   border-radius: 3px;
-  float: right;
+  float: inline-end;
   padding: 8px;
 }
 .card-label-edit-button:hover {
   background: #dbdbdb;
 }
 ul.edit-labels-pop-over span.label-handle {
-  padding-right: 10px;
+  padding-inline-end: 10px;
   display: inline-block;
   width: 1.2em;
   text-align: center;

client/components/cards/labels.jade

@@ -4,9 +4,12 @@ template(name="formLabel")
 
   label {{_ "select-color"}}
   .palette-colors: each labels
-    span.card-label.palette-color.js-palette-color(class="card-label-{{color}}")
+    span.card-label.palette-color.js-palette-color(class="{{labelColorClass color}}" style="{{labelColorStyle color}}")
       if(isSelected color)
         i.fa.fa-check
+  .color-wheel-wrap
+    label(for="labelColorWheel") {{_ 'custom-color'}}
+    input.js-label-color-wheel#labelColorWheel(type="color" value=currentColorHex title="{{_ 'custom-color'}}")
 
 template(name="createLabelPopup")
   form.create-label
@@ -31,8 +34,8 @@ template(name="cardLabelsPopup")
         a.card-label-edit-button.fa.fa-pencil.js-edit-label
         if isTouchScreenOrShowDesktopDragHandles
           span.fa.label-handle(class="fa-arrows" title="{{_ 'dragLabel'}}")
-        span.card-label.card-label-selectable.js-select-label.card-label-wrapper(class="card-label-{{color}}"
-          class="{{# if isLabelSelected ../_id }}active{{/if}}")
+        span.card-label.card-label-selectable.js-select-label.card-label-wrapper(class="{{labelColorClass color}}"
+          class="{{# if isLabelSelected ../_id }}active{{/if}}" style="{{labelColorStyle color}}")
             +viewer
               = name
             if(isLabelSelected ../_id)

client/components/cards/labels.js

@@ -1,5 +1,6 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { LABEL_COLORS } from '/models/metadata/colors';
+import { isHexColor, toHex } from '/models/lib/contrastColor';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { Utils } from '/client/lib/utils';
 
@@ -28,6 +29,11 @@ Template.formLabel.helpers({
   isSelected(color) {
     return Template.instance().currentColor.get() === color;
   },
+  // #5514: current color as a '#rrggbb' hex for the color-wheel <input>, which
+  // only accepts hex. Named colors map to their palette hex; fall back to green.
+  currentColorHex() {
+    return toHex(Template.instance().currentColor.get()) || '#3cb500';
+  },
 });
 
 Template.formLabel.events({
@@ -36,6 +42,13 @@ Template.formLabel.events({
     const selectedColor = paletteData?.color || Template.currentData()?.color || getFallbackLabelColor();
     tpl.currentColor.set(selectedColor);
   },
+  // #5514: picking a color from the native color wheel stores a custom hex.
+  'input .js-label-color-wheel'(event, tpl) {
+    const value = event.currentTarget.value;
+    if (isHexColor(value)) {
+      tpl.currentColor.set(value);
+    }
+  },
 });
 
 Template.createLabelPopup.helpers({
@@ -131,7 +144,16 @@ Template.createLabelPopup.events({
       ? selectedColorIcon.closest('.js-palette-color')
       : null;
     const selectedColorData = selectedPaletteNode && Blaze.getData(selectedPaletteNode);
-    const color = selectedColorData?.color || getFallbackLabelColor();
+    // #5514: a named swatch (has the check icon) wins; otherwise fall back to
+    // the custom color-wheel hex, then to the default palette color.
+    let color = selectedColorData?.color;
+    if (!color) {
+      const wheel = templateInstance.find('.js-label-color-wheel');
+      if (wheel && isHexColor(wheel.value)) {
+        color = wheel.value;
+      }
+    }
+    color = color || getFallbackLabelColor();
     board.addLabel(name, color);
     Popup.back();
   },
@@ -158,7 +180,16 @@ Template.editLabelPopup.events({
       ? selectedColorIcon.closest('.js-palette-color')
       : null;
     const selectedColorData = selectedPaletteNode && Blaze.getData(selectedPaletteNode);
-    const color = selectedColorData?.color || getFallbackLabelColor();
+    // #5514: a named swatch (has the check icon) wins; otherwise fall back to
+    // the custom color-wheel hex, then to the default palette color.
+    let color = selectedColorData?.color;
+    if (!color) {
+      const wheel = templateInstance.find('.js-label-color-wheel');
+      if (wheel && isHexColor(wheel.value)) {
+        color = wheel.value;
+      }
+    }
+    color = color || getFallbackLabelColor();
     board.editLabel(this._id, name, color);
     Popup.back();
   },

client/components/cards/minicard.css

@@ -3,11 +3,11 @@
   position: relative;
   display: flex;
   align-items: center;
-  margin-bottom: 1.2vh;
+  margin-bottom: 8px;
 }
 .minicard-wrapper.placeholder {
   background: #ccc;
-  border-radius: 1.2vw;
+  border-radius: 17px;
 }
 .minicard-wrapper.ui-sortable-helper {
   cursor: grabbing;
@@ -16,44 +16,56 @@
 }
 .minicard-wrapper.ui-sortable-helper .and-n-other {
   width: 100%;
-  height: 2.5vh;
-  padding: 0.5vh;
+  height: 25px;
+  padding: 5px;
   background-color: #f2f2f2;
   text-align: center;
-  border-radius: 0.4vw;
+  border-radius: 6px;
 }
 .minicard-wrapper.ui-sortable-helper .multi-selection-checkbox {
   display: none;
 }
 .minicard-wrapper .multi-selection-checkbox + .minicard {
-  margin-left: 1vw;
+  margin-inline-start: 14px;
+}
+/* Enlarge the clickable area of the small selection checkbox so it can be
+   reliably clicked at the left side of the minicard. The visible 13px box (and
+   its rotated is-checked checkmark) keep their size; an invisible overlay only
+   extends the hit target. */
+.minicard-wrapper .multi-selection-checkbox::before {
+  content: "";
+  position: absolute;
+  top: -8px;
+  inset-inline-start: -8px;
+  inset-inline-end: -8px;
+  bottom: -8px;
 }
 @media only screen {
   .minicard {
-    padding: 0.8vh 1vw 0.3vh;
+    padding: 8px 14px 3px;
     position: relative;
     flex: 1;
     flex-wrap: wrap;
     background-color: #fff;
-    min-height: 2.5vh;
-    box-shadow: 0 0.2vh 0.3vh rgba(0,0,0,0.15);
-    border-radius: 0.3vw;
+    min-height: 25px;
+    box-shadow: 0 2px 3px rgba(0,0,0,0.15);
+    border-radius: 4px;
     color: #4d4d4d;
     overflow: hidden;
     transition: transform 0.2s, border-radius 0.2s;
   }
 }
 .minicard-details-menu-with-handle {
-  float: right;
-  padding-left: 0.7vw;
-  font-size: clamp(14px, 3vw, 18px);
+  float: inline-end;
+  padding-inline-start: 10px;
+  font-size: 0.875rem;
   padding: 0;
   z-index: 1;
 }
 .minicard-details-menu {
-  float: right;
-  font-size: clamp(14px, 3vw, 18px);
-  padding-left: 0.7vw;
+  float: inline-end;
+  font-size: 0.875rem;
+  padding-inline-start: 10px;
 }
 @media print {
   .minicard-details-menu,
@@ -64,7 +76,7 @@
 .minicard.linked-board .linked-icon,
 .minicard.linked-card .linked-icon {
   display: inline-block;
-  margin-right: 1.5vw;
+  margin-inline-end: 21px;
   vertical-align: baseline;
   font-size: 0.9em;
 }
@@ -73,11 +85,11 @@
   color: #937760;
 }
 .is-selected .minicard {
-  transform: translateX(1.5vw);
+  transform: translateX(21px);
   border-bottom-right-radius: 0;
   border-top-right-radius: 0;
   z-index: 25;
-  box-shadow: -0.3vw 0.2vh 0.3vh rgba(0,0,0,0.2);
+  box-shadow: -4px 2px 3px rgba(0,0,0,0.2);
 }
 .minicard:hover:not(.minicard-composer),
 .is-selected .minicard,
@@ -91,21 +103,37 @@
   background-position: center;
   background-repeat: no-repeat;
   background-size: contain;
-  height: 20vh;
+  height: 150px;
   user-select: none;
-  margin: 0.8vh -1vw 0.8vh -1vw;
-  border-radius: top 0.3vw;
+  margin: 8px -14px 8px -14px;
+  border-radius: top 4px;
 }
 .minicard .minicard-labels {
   float: none;
-  margin-right: 6vw;
+  margin-inline-end: 84px;
 }
 .minicard .minicard-labels .minicard-label {
-  width: clamp(12px, 1.5vw, 16px);
-  height: clamp(12px, 1.5vw, 16px);
-  border-radius: 0.3vw;
-  margin-right: 0.4vw;
-  margin-bottom: 0.4vh;
+  width: 12px;
+  height: 12px;
+  border-radius: 4px;
+  margin-inline-end: 6px;
+  margin-bottom: 4px;
+}
+/* Keep text labels on a single compact line. The label name is rendered
+   inside a `.viewer`, whose global `min-height: 2.5vh` otherwise forces every
+   label to roughly double height on the minicard. */
+.minicard .minicard-labels .card-label {
+  min-height: 0;
+  padding: 1px 6px;
+  line-height: 1.3;
+  white-space: nowrap;
+}
+.minicard .minicard-labels .card-label .viewer {
+  min-height: 0;
+  display: inline;
+}
+.minicard .minicard-labels .card-label .viewer p {
+  display: inline;
 }
 .minicard .minicard-labels-no-text {
   display: flex;
@@ -113,7 +141,7 @@
 }
 .minicard .minicard-custom-fields {
   display: block;
-  margin-right: 6vw;
+  margin-inline-end: 84px;
 }
 .minicard .minicard-custom-field {
   display: flex;
@@ -122,22 +150,23 @@
   flex-grow: 1;
   display: block;
   word-wrap: break-word;
-  max-width: 13vw;
-  margin-right: 0.5vw;
+  /* Fixed, not 13vw: a chip that grew with the window made the card reflow. */
+  max-width: 160px;
+  margin-inline-end: 7px;
 }
 .minicard .minicard-custom-field-item-fullwidth {
   flex-grow: 1;
   display: block;
   word-wrap: break-word;
   max-width: 100%;
-  margin-right: 0.5vw;
+  margin-inline-end: 7px;
 }
 .minicard .handle {
-  width: clamp(20px, 2.5vw, 28px);
-  height: clamp(20px, 2.5vw, 28px);
+  width: 20px;
+  height: 20px;
   position: absolute;
-  right: 0vw;
-  top: 4vh;
+  inset-inline-end: 1px;
+  top: 28px;
   display: none;
   z-index: 1;
 }
@@ -146,20 +175,145 @@
     display: block;
   }
 }
+/* #6521: on a touch device the handle is the ONLY way to drag a card - the rest
+   of the minicard deliberately pans the board instead - so it has to be a target
+   a finger can actually hit. A 20-28px icon in the corner is a mouse-sized
+   target; on a wall-mounted infoscreen it is close to unusable.
+
+   On a coarse pointer the card's two controls become one column down the
+   TRAILING (right in LTR) edge: the details menu on top, the drag handle
+   directly BELOW it. That is where the handle already is for a mouse - just
+   under the menu button - so both pointer kinds put it in the same place, and
+   the thumb-sized version does not move it somewhere else to be looked for.
+   (It was a full-height strip on the LEADING edge, which reached the size goal
+   but put the handle on the opposite side from every other card control.)
+
+   The handle runs from under the menu to the bottom of the card, so on a tall
+   card it is a large target, and a minimum height keeps it a real one on a card
+   with nothing but a title. Mouse users keep the compact corner handle, since
+   `pointer: coarse` does not match a mouse. */
+/* MOBILE MODE, not merely a coarse pointer: a phone whose user chose DESKTOP
+   mode asked for the desktop card, and there the handle is the compact one in the
+   top corner just under the menu button. The full-height thumb column below was
+   appearing there too, which is a handle sitting near the BOTTOM of a tall card -
+   far from the menu it belongs with. `body.mobile-mode` and `pointer: coarse`
+   together mean "a finger, and the user is in the finger layout". */
+@media (pointer: coarse) {
+  /* Pinned rather than floated: the card gets trailing padding below to keep its
+     text out of this column, and a float would be pushed inward by it. */
+  body.mobile-mode .minicard .minicard-details-menu-with-handle {
+    position: absolute;
+    float: none;
+    top: 0;
+    inset-inline-end: 0;
+    width: 44px;
+    height: 32px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 0;
+  }
+  body.mobile-mode .minicard .handle {
+    width: 44px;
+    /* From just below the menu button down to the bottom of the card. */
+    top: 32px;
+    bottom: 0;
+    height: auto;
+    min-height: 36px;
+    inset-inline-start: auto;
+    inset-inline-end: 0;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    /* Faint tint so the target is discoverable without shouting. */
+    background: rgba(127, 127, 127, 0.08);
+    border-end-end-radius: inherit;
+  }
+  /* The card's own content must not sit under the column, and the card must be
+     tall enough to hold menu + handle at their minimum sizes (32 + 36). */
+  body.mobile-mode .minicard.minicard-with-handle {
+    padding-inline-end: 44px;
+    min-height: 68px;
+  }
+  body.mobile-mode .minicard .handle .drag-handle,
+  body.mobile-mode .minicard .handle .fa {
+    font-size: 1.375rem;
+  }
+}
+
 .minicard .handle .drag-handle {
-  font-size: clamp(16px, 3vw, 20px);
+  font-size: 1rem;
   color: #ccc;
   display: inline-block;
   width: 1.4em;
   text-align: center;
 }
 .minicard .minicard-title {
-  margin-right: 1.5vw;
+  /* #6465: one step below the list heading above it (16px), and above the
+     "Add card" affordance below (13px). It used to inherit the 16px document
+     size, which made a card title exactly as loud as the heading of the column
+     holding it. See the note on .list-header-name in lists/list.css. */
+  font-size: 0.875rem;
+  margin-inline-end: 21px;
+  /* #6444: isolate each title's bidirectional context. The title is a
+     dir="auto" .viewer; under a global dir="rtl" document, non-isolated
+     dir="auto" runs share bidi state, so typing a strong RTL (e.g. Arabic)
+     character into another list's dir="auto" composer re-resolved the shared
+     context and visibly reflowed OTHER lists' minicard titles (no data change,
+     reverts on refresh). Isolation makes each title a self-contained run. */
+  unicode-bidi: isolate;
+}
+/* #4990: the title text is the edit target. It is a block so that the whole
+   line, not only the words, is that target: a click on the empty space after a
+   short title is still a click on the title. */
+.minicard .minicard-title .minicard-title-text {
+  display: block;
+  position: relative;
+}
+
+/* ...and with no drag handles, only HALF of it. The card is then dragged by its
+   own body, so a title that is entirely an edit target leaves nowhere on that
+   line to take hold of - a grab that moves a few pixels is a click, and the
+   editor opens instead of the card moving.
+
+   The zone is an overlay rather than a split of the text, because the text is a
+   `.viewer` and cutting it in two would cut the SENTENCE in two. It sits on the
+   LEADING half - `inset-inline-start`, so it is the left in English and the
+   right in Arabic without a second rule - and the trailing half is left for
+   dragging. Dragging still works over the zone too (jQuery UI sortable's handle
+   is the whole `.minicard`); what the zone decides is where a CLICK edits. */
+.minicard .minicard-title .minicard-title-edit-zone {
+  position: absolute;
+  top: 0;
+  bottom: 0;
+  inset-inline-start: 0;
+  width: 50%;
+  cursor: text;
+  /* Above the text, so the click lands here and not on the `.viewer`. */
+  z-index: 1;
+}
+
+/* With handles ON the handle is the only drag source, so nothing has to be
+   reserved and the whole title is the edit target again. */
+.minicard.minicard-with-handle .minicard-title .minicard-title-edit-zone {
+  width: 100%;
+}
+/* The editor replaces the title in place and is the width of the card. */
+.minicard .js-minicard-title-form textarea.minicard-title-editor {
+  font-size: 0.875rem;
+  width: 100%;
+  min-height: 40px;
+  max-height: 200px;
+  margin-bottom: 4px;
+  overflow-y: auto;
+  resize: none;
+  /* Same bidi isolation as the title it stands in for. */
+  unicode-bidi: isolate;
 }
 .minicard .minicard-title .card-number {
   color: #b3b3b3;
   display: inline-block;
-  margin-right: 0.7vw;
+  margin-inline-end: 10px;
 }
 @media only screen {
   .minicard .minicard-title p:last-child {
@@ -168,6 +322,12 @@
   .minicard .minicard-title .viewer {
     display: block;
     word-wrap: break-word;
+    /* #6465: the minicard title renders inside a .viewer, which inherits the
+       global `.viewer { min-height: 2.5vh }` (layouts.css). On tall screens that
+       reserves a big empty band under a one-line title, so half of every
+       minicard was white space. Collapse it to fit the text (same fix already
+       applied to the label .viewer above). */
+    min-height: 0;
   }
 }
 .minicard .dates {
@@ -176,30 +336,36 @@
   flex-wrap: wrap;
   position: relative;
   z-index: 5;
-  margin-right: 6vw;
+  margin-inline-end: 84px;
   clear: both;
 }
 .minicard .date {
-  margin-right: 0.4vw;
+  margin-inline-end: 6px;
 }
 
-/* Unicode icons for minicard dates - matching cardDate.css */
+/* Font Awesome glyphs for minicard dates - matching cardDate.css */
+.minicard .card-date time::before {
+  font-family: FontAwesome;
+  font-weight: normal;
+  font-style: normal;
+  text-decoration: inherit;
+}
 .minicard .card-date.end-date time::before {
-  content: "🏁"; /* Finish flag - represents end/completion */
+  content: "\f11e"; /* fa-flag-checkered - end/completion */
 }
 .minicard .card-date.due-date time::before {
-  content: "⏰"; /* Alarm clock - represents due/deadline */
+  content: "\f017"; /* fa-clock-o - due/deadline */
 }
 .minicard .card-date.start-date time::before {
-  content: "🚀"; /* Rocket - represents start/launch */
+  content: "\f135"; /* fa-rocket - start/launch */
 }
 .minicard .card-date.received-date time::before {
-  content: "📥"; /* Inbox tray - represents received/incoming */
+  content: "\f01c"; /* fa-inbox - received/incoming */
 }
 
 .minicard .card-date time::before {
   font-size: inherit;
-  margin-right: 0.3em;
+  margin-inline-end: 0.3em;
   display: inline-block;
 }
 
@@ -312,27 +478,27 @@
 }
 
 .minicard .badges {
-  float: left;
-  margin-top: 1vh;
+  float: inline-start;
+  margin-top: 8px;
   color: #808080;
 }
 .minicard .badges:empty {
   display: none;
 }
 .minicard .badges .badge {
-  float: left;
-  margin-right: 1.5vw;
-  margin-bottom: 0.4vh;
+  float: inline-start;
+  margin-inline-end: 21px;
+  margin-bottom: 4px;
   font-size: 0.9em;
 }
 .minicard .badges .badge.is-finished {
   background: #3cb500;
-  padding: 0 0.4vw;
-  border-radius: 0.4vw;
+  padding: 0 6px;
+  border-radius: 6px;
   color: #fff;
 }
 .minicard .badges .badge:last-of-type {
-  margin-right: 0;
+  margin-inline-end: 0;
 }
 .minicard .badges .badge .badge-icon,
 .minicard .badges .badge .badge-text {
@@ -344,41 +510,41 @@
 }
 .minicard .badges .badge .badge-text {
   font-size: 0.9em;
-  padding-left: 0.3vw;
+  padding-inline-start: 4px;
   line-height: 1.2;
 }
 .minicard .badges .badge .check-list-text {
-  padding-left: 0px;
+  padding-inline-start: 0px;
   line-height: 1.1;
 }
 .minicard .minicard-members,
 .minicard .minicard-assignees,
 .minicard .minicard-creator {
-  float: right;
-  margin-left: 0.7vw;
-  margin-bottom: 0.5vh;
+  float: inline-end;
+  margin-inline-start: 10px;
+  margin-bottom: 4px;
 }
 .minicard .minicard-members .member,
 .minicard .minicard-assignees .member,
 .minicard .minicard-creator .member {
-  float: right;
+  float: inline-end;
   border-radius: 50%;
-  height: clamp(24px, 3.5vw, 32px);
-  width: clamp(24px, 3.5vw, 32px);
-  margin-bottom: 0.5vh;
+  height: 24px;
+  width: 24px;
+  margin-bottom: 4px;
 }
 .minicard .minicard-members .assignee,
 .minicard .minicard-assignees .assignee,
 .minicard .minicard-creator .assignee {
-  float: right;
+  float: inline-end;
   border-radius: 50%;
-  height: clamp(24px, 3.5vw, 32px);
-  width: clamp(24px, 3.5vw, 32px);
+  height: 24px;
+  width: 24px;
 }
 .minicard .minicard-members + .badges,
 .minicard .minicard-assignees + .badges,
 .minicard .minicard-creator + .badges {
-  margin-top: 0.7vh;
+  margin-top: 6px;
 }
 .minicard .minicard-assignees {
   border-bottom: 1px solid #f00;
@@ -391,13 +557,13 @@
   display: none;
 }
 .minicard .minicard-description {
-  padding: 0.8vh 0 0 1vw;
+  padding: 8px 0 0 14px;
   color: #000;
   background-color: #eee;
   width: 100%;
-  margin-bottom: 0.3vh;
-  margin-left: -0.5vw;
-  border-radius: 0.4vw;
+  margin-bottom: 3px;
+  margin-inline-start: -7px;
+  border-radius: 6px;
   overflow: hidden;
   text-overflow: ellipsis;
   display: -webkit-box;
@@ -405,7 +571,7 @@
   -webkit-box-orient: vertical;
 }
 .minicard.minicard-composer {
-  margin-bottom: 1.3vh;
+  margin-bottom: 12px;
 }
 .minicard.minicard-composer textarea.minicard-composer-textarea,
 .minicard.minicard-composer textarea.minicard-composer-textarea:focus {
@@ -416,10 +582,14 @@
   height: auto;
   margin: 0;
   padding: 0;
-  max-height: 22vh;
-  min-height: 5vh;
-  margin-bottom: 2.5vh;
+  max-height: 200px;
+  min-height: 50px;
+  margin-bottom: 20px;
   overflow-y: auto;
+  /* #6444: isolate the composer's dir="auto" bidi run so typing a strong RTL
+     character here cannot perturb the rendering of the surrounding minicard
+     titles under a dir="rtl" document. */
+  unicode-bidi: isolate;
 }
 .parent-prefix {
   color: #b3b3b3;
@@ -732,24 +902,34 @@
   transition: all 0.2s ease;
 }
 
-/* List name display on minicard */
+/* The name of the LIST this card is in, under the badges - "Show on Minicard /
+   List title", for reading a card away from the column it lives in (a
+   swimlane, search results, My Cards).
+
+   `clear` is the whole rule: `.minicard .badges` is `float: inline-start`, so
+   without it this block shares the badges' line and reads as one more badge
+   rather than as the line it is. Logical `inline-start`, so it clears the
+   floats on whichever side the page starts. */
 .minicard-list-name {
+  clear: inline-start;
   font-size: 0.75em;
   color: #8c8c8c;
-  margin-top: 0.2vh;
+  margin-top: 2px;
   display: flex;
   align-items: center;
-  gap: 0.3vw;
+  gap: 4px;
 }
 
 /* Checklist display on minicard */
 .minicard-checklist {
   width: 100%;
-  margin-top: 0.5vh;
-  margin-bottom: 0.5vh;
-  padding: 0.3vh 0.5vw;
+  box-sizing: border-box;
+  clear: both;
+  margin-top: 2px;
+  margin-bottom: 5px;
+  padding: 3px 7px;
   background-color: rgba(255, 255, 255, 0.8);
-  border-radius: 0.3vw;
+  border-radius: 4px;
   border: 1px solid #e0e0e0;
 }
 
@@ -757,7 +937,7 @@
   display: flex;
   justify-content: space-between;
   align-items: center;
-  margin-bottom: 0.3vh;
+  margin-bottom: 3px;
 }
 
 .minicard-checklist .checklist-title {
@@ -765,14 +945,15 @@
   font-weight: bold;
   color: #4d4d4d;
   flex: 1;
+  margin: 0;
 }
 
 .minicard-checklist .checklist-menu {
   font-size: 1.2em;
   color: #666;
   cursor: pointer;
-  padding: 0 0.3vw;
-  border-radius: 0.2vw;
+  padding: 0 4px;
+  border-radius: 3px;
   transition: background-color 0.2s;
 }
 
@@ -783,14 +964,14 @@
 .minicard-checklist .checklist-item {
   font-size: 0.75em;
   color: #666;
-  margin-bottom: 0.2vh;
+  margin-bottom: 2px;
   display: flex;
   align-items: flex-start;
-  gap: 0.3vw;
+  gap: 4px;
   line-height: 1.2;
   cursor: pointer;
-  padding: 0.2vh 0;
-  border-radius: 0.2vw;
+  padding: 2px 0;
+  border-radius: 3px;
   transition: background-color 0.2s;
 }
 
@@ -806,7 +987,7 @@
 .minicard-checklist .checklist-item .check-box-unicode {
   flex-shrink: 0;
   font-size: 0.8em;
-  margin-top: 0.1vh;
+  margin-top: 1px;
   transition: transform 0.2s;
 }
 
@@ -819,3 +1000,52 @@
   word-wrap: break-word;
   overflow-wrap: break-word;
 }
+
+/* Trello-style "mark complete" toggle, left of the minicard title */
+.minicard-title .minicard-complete-toggle {
+  display: inline-flex;
+  align-items: center;
+  vertical-align: middle;
+  /* Nudge down so the checkmark sits at the vertical middle of the title text
+     (the checked materialCheckBox is shifted up 4px by its own positioning). */
+  position: relative;
+  top: 4px;
+  margin-inline-end: 6px;
+  cursor: pointer;
+}
+
+/* Sticker icon highlight styles (used instead of colour): taco pack => underline,
+   pete pack => round (ring around the icon). Icon keeps its normal colour. */
+.minicard-sticker i.sticker-underline {
+  border-bottom: 2px solid currentColor;
+  padding-bottom: 1px;
+  line-height: 1;
+}
+.minicard-sticker i.sticker-round {
+  border: 1px solid currentColor;
+  border-radius: 50%;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.6em;
+  height: 1.6em;
+  line-height: 1;
+  box-sizing: border-box;
+}
+
+/* #3984: Visual card aging — progressively fade cards that have not been
+ * touched recently, when card aging is enabled for the board. */
+.minicard.minicard-aging-1 {
+  opacity: 0.85;
+}
+.minicard.minicard-aging-2 {
+  opacity: 0.6;
+}
+.minicard.minicard-aging-3 {
+  opacity: 0.4;
+}
+.minicard.minicard-aging-1:hover,
+.minicard.minicard-aging-2:hover,
+.minicard.minicard-aging-3:hover {
+  opacity: 1;
+}

client/components/cards/minicard.jade

@@ -1,15 +1,34 @@
 template(name="minicard")
-  .minicard.nodragscroll(
+  //- `nodragscroll` ONLY when the minicard itself is the card's drag source, i.e.
+  //- when drag handles are OFF (list.js then sets the sortable handle to
+  //- `.minicard`). That is the whole point of drag handles: with handles ON the
+  //- card body is free, so a finger dragging across it PANS the board
+  //- (dragscroll) instead of doing nothing. It used to be unconditional, so with
+  //- handles on, a drag starting on a card neither panned nor moved the card.
+  //- The HANDLE itself is always `nodragscroll` (#6558): it is the drag source,
+  //- so a press on it must move the card, never pan the board underneath it.
+  .minicard(
+    class="{{#unless isTouchScreenOrShowDesktopDragHandles}}nodragscroll{{/unless}}"
+    class="{{#if showMinicardHandle}}minicard-with-handle{{/if}}"
     class="{{#if isLinkedCard}}linked-card{{/if}}"
     class="{{#if isLinkedBoard}}linked-board{{/if}}"
-    class="{{#if colorClass}}minicard-{{colorClass}}{{/if}}")
+    class="{{agingClass}}"
+    class="{{#if colorClass}}minicard-{{colorClass}}{{/if}}"
+    style="{{colorStyle}}")
     if canMoveCard
       if isTouchScreenOrShowDesktopDragHandles
-        .handle
+        .handle.nodragscroll
           i.fa.fa-arrows
+      //- #459: keyboard/screen-reader reordering (visually hidden, focusable).
+      .minicard-move-buttons.sr-only
+        a.js-card-move-up(href="#" role="button" aria-label="{{_ 'move-card-up'}}") {{_ 'move-card-up'}}
+        a.js-card-move-down(href="#" role="button" aria-label="{{_ 'move-card-down'}}") {{_ 'move-card-down'}}
     if canModifyCard
       a.minicard-details-menu-with-handle.js-open-minicard-details-menu(title="{{_ 'cardDetailsActionsPopup-title'}}")
         i.fa.fa-bars
+    if showDependencyConnectHandle
+      a.dependency-connect-handle.js-dependency-connect-handle(title="{{_ 'drag-to-connect'}}")
+        i.fa.fa-dot-circle-o
     .dates
       if showReceived
         if getReceived
@@ -21,7 +40,7 @@ template(name="minicard")
             +minicardStartDate
       if showDue
         if getDue
-          .date
+          .date(class="{{#if getDueComplete}}due-complete{{/if}}")
             +minicardDueDate
       if showEnd
         if getEnd
@@ -53,39 +72,65 @@ template(name="minicard")
                 i.fa.fa-check
                 span {{_ 'upload-completed'}}
 
-    .minicard-title
-      if $eq 'prefix-with-full-path' currentBoard.presentParentTask
-        .parent-prefix
-          | {{ parentString ' > ' }}
-      if $eq 'prefix-with-parent' currentBoard.presentParentTask
-        .parent-prefix
-          | {{ parentCardName }}
-      if isLinkedBoard
-        a.js-linked-link
-          span.linked-icon
-            i.fa.fa-folder
-      else if isLinkedCard
-        a.js-linked-link
-          span.linked-icon
-            i.fa.fa-id-card
-      if getArchived
-        span.linked-icon.linked-archived
-          i.fa.fa-archive
-      +viewer
-        if showCardNumber
-          span.card-number
-            | ##{getCardNumber}
-        = getTitle
+    //- #4990: the title is edited where it is read - on the board - exactly
+      like a list's title is. Clicking the title text opens this form in its
+      place; everything else on the card still opens the card.
+    +inlinedForm(classNames="js-minicard-title-form")
+      +editMinicardTitleForm
+    else
+      .minicard-title
+        if showDueComplete
+          if canModifyCard
+            a.minicard-complete-toggle.js-toggle-card-complete(title="{{#if getDueComplete}}{{_ 'card-mark-incomplete'}}{{else}}{{_ 'card-mark-complete'}}{{/if}}")
+              .materialCheckBox(class="{{#if getDueComplete}}is-checked{{/if}}")
+        if $eq 'prefix-with-full-path' currentBoard.presentParentTask
+          .parent-prefix
+            | {{ parentString ' > ' }}
+        if $eq 'prefix-with-parent' currentBoard.presentParentTask
+          .parent-prefix
+            | {{ parentCardName }}
+        if isLinkedBoard
+          a.js-linked-link
+            span.linked-icon
+              i.fa.fa-folder
+        else if isLinkedCard
+          a.js-linked-link
+            span.linked-icon
+              i.fa.fa-id-card
+        if getArchived
+          span.linked-icon.linked-archived
+            i.fa.fa-archive
+        //- Only the TEXT is the edit target, and only for somebody who may
+          write: the checkbox, the linked-card icons and the card number keep
+          doing what they did.
+        //-
+          And only HALF of the text, when there are no drag handles. With handles
+          off the card is dragged by its own body, so a title that is entirely an
+          edit target leaves nowhere on that line to take hold of: a grab that
+          moves a few pixels is a click, and the editor opens instead of the card
+          moving. The edit target is the LEADING half - left in English, right in
+          Arabic, because it is an inline edge - and the trailing half is there to
+          drag from. With handles ON the handle is the only drag source, so
+          nothing has to be reserved and the whole title edits.
+          client/components/cards/minicard.css
+        span.minicard-title-text(class="{{#if canModifyCard}}is-editable{{/if}}")
+          if canModifyCard
+            span.minicard-title-edit-zone.js-open-inlined-form(title="{{_ 'edit'}}")
+          +viewer
+            if showCardNumber
+              span.card-number
+                | ##{getCardNumber}  
+            = getTitle
     if showLabels
       if labels
         .minicard-labels(class="{{#if hiddenMinicardLabelText}}minicard-labels-no-text{{/if}}")
           each labels
             unless hiddenMinicardLabelText
-              span.js-card-label.card-label(class="card-label-{{color}}" title=name)
+              span.js-card-label.card-label(class="{{labelColorClass color}}" style="{{labelColorStyle color}}" title=name)
                 +viewer
                   = name
             if hiddenMinicardLabelText
-              .minicard-label(class="card-label-{{color}}" title="{{name}}")
+              .minicard-label(class="{{labelColorClass color}}" style="{{labelColorStyle color}}" title="{{name}}")
 
     .minicard-custom-fields
       each customFieldsWD
@@ -148,14 +193,26 @@ template(name="minicard")
       .minicard-creator
         +userAvatar(userId=this.userId noRemove=true)
 
+    if shouldShowChecklistAtMinicard
+      each shouldShowChecklistAtMinicard
+        +minicardChecklist(checklist=. card=..)
     .badges
-      if canModifyCard
-        if comments.length
-          .badge(title="{{_ 'card-comments-title' comments.length }}")
-            span.badge-icon.badge-comment.badge-text
-              i.fa.fa-comment-o
-              = ' '
-              = comments.length
+      if dependencyBadge
+        .badge.badge-state-image-only.minicard-dependencies(title="{{_ 'card-dependencies'}}")
+          span.badge-icon(style="color:{{dependencyBadge.color}}")
+            i.fa(class="fa-{{dependencyBadge.icon}}")
+          span.badge-text {{ dependencyBadge.count }}
+      if stickers.length
+        .badge.badge-state-image-only.minicard-stickers
+          each stickers
+            span.badge-icon.minicard-sticker(title="{{#if name}}{{name}}{{else}}{{icon}}{{/if}}")
+              i.fa(class="fa-{{icon}} {{#if highlight}}sticker-{{highlight}}{{/if}}")
+      if comments.length
+        .badge(title="{{_ 'card-comments-title' comments.length }}")
+          span.badge-icon.badge-comment.badge-text
+            i.fa.fa-comment-o
+            = ' '
+            = comments.length
             //span.badge-comment.badge-text
             //|
               {{_ 'comment'}}
@@ -191,15 +248,21 @@ template(name="minicard")
               i.fa.fa-globe
             span.badge-text.check-list-text {{subtasksFinishedCount}}/{{allSubtasksCount}}
             //{{subtasksFinishedCount}}/{{subtasksCount}} does not work because when a subtaks is archived, the count goes down
+      //- #6431: compact checklist item-count badge (finished/total). The outer
+        guard is a cheap boolean, so when the setting is off the checklist
+        counting below never runs.
+      if showChecklistCountBadge
+        if checklists.length
+          .badge(class="{{#if checklistFinished}}is-finished{{/if}}" title="{{_ 'checklists'}}")
+            span.badge-icon
+              i.fa.fa-check-square-o
+            span.badge-text.check-list-text {{checklistFinishedCount}}/{{checklistItemCount}}
       if currentBoard.allowsCardSortingByNumber
         if currentBoard.allowsCardSortingByNumberOnMinicard
           .badge
             span.badge-icon
               i.fa.fa-sort-numeric-asc
             span.badge-text.check-list-sort {{ sort }}
-    if shouldShowChecklistAtMinicard
-      each shouldShowChecklistAtMinicard
-        +minicardChecklist(checklist=. card=..)
     if currentBoard.allowsDescriptionTextOnMinicard
       if getDescription
         .minicard-description
@@ -216,6 +279,16 @@ template(name="minicard")
       .parent-subtext
         | {{ parentCardName }}
 
+//- The card's title editor on the board, the same shape as a list's: the text
+  as a textarea, Save, and an X that closes without saving.
+template(name="editMinicardTitleForm")
+  textarea.minicard-title-editor.js-edit-minicard-title(rows='1' autofocus dir="auto")
+    = getTitle
+  .edit-controls.clearfix
+    button.primary.confirm.js-submit-edit-minicard-title(type="submit") {{_ 'save'}}
+    a.js-close-inlined-form(title="{{_ 'close'}}")
+      i.fa.fa-times-thin
+
 template(name="editCardSortOrderPopup")
   input.js-edit-card-sort-popup(type='text' autofocus value=sort dir="auto")
   .edit-controls.clearfix
@@ -224,10 +297,34 @@ template(name="editCardSortOrderPopup")
 template(name="minicardChecklist")
   .minicard-checklist
     .checklist-header
-      .checklist-title= checklist.title
+      //- #1591: the same caret as on the opened card, and the same stored key,
+        so folding a checklist folds it in both places.
+      a.fa.checklist-collapse.js-collapse-checklist(
+        class="{{#if checklistCollapsed}}fa-caret-right{{else}}fa-caret-down{{/if}}"
+        title="{{#if checklistCollapsed}}{{_ 'expand-checklist'}}{{else}}{{_ 'collapse-checklist'}}{{/if}}"
+        role="button" tabindex="0"
+        aria-expanded="{{#if checklistCollapsed}}false{{else}}true{{/if}}")
+      if canModifyCard
+        +inlinedForm(classNames="js-edit-checklist-title" checklist=checklist)
+          +editChecklistForm(checklist=checklist)
+        else
+          h4.checklist-title.js-open-inlined-form.is-editable= checklist.title
+      else
+        h4.checklist-title= checklist.title
       if canModifyCard
         a.checklist-menu.js-open-checklist-menu(title="{{_ 'checklistActionsPopup-title'}}")
           i.fa.fa-bars
-    each visibleItems
-      +checklistItemDetail(item = . checklist = checklist card = card)
+    unless checklistCollapsed
+      .checklist-items.js-checklist-items
+        each visibleItems
+          +inlinedForm(classNames="js-edit-checklist-item" item=. checklist=checklist)
+            +editChecklistItemForm(type='item' item=. checklist=checklist)
+          else
+            +checklistItemDetail(item=. checklist=checklist card=card)
+      if canModifyCard
+        +inlinedForm(autoclose=false classNames="js-add-checklist-item" checklist=checklist)
+          +addChecklistItemForm(checklist=checklist showNewlineBecomesNewChecklistItem=false)
+        else
+          a.add-checklist-item.js-open-inlined-form(title="{{_ 'add-checklist-item'}}")
+            i.fa.fa-plus