Bump versions for v10.09

The report was still stuck on the loading spinner: an await in the publish body
never resolved, so this.ready() in the `finally` never ran and the subscription
never became ready (the report template only renders once ready). Two changes make
the publish always reach readiness:

- Call this.ready() UP FRONT, before any await, then stream the page rows with
  this.added — the table populates reactively. The spinner can no longer get stuck
  regardless of how slow/stuck the fetch is.
- Compute accessibleCardIds() by querying Boards / Cards directly with fetchAsync
  instead of through ReactiveCache, and fetch the attachments page from
  Attachments.collection directly — raw async fetches always resolve, avoiding the
  ostrio FilesCollection cursor / backward-compatibility fallback that can hang.

Thanks to xet7 !

.devcontainer/docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3.7'
-
 services:
 
   wekandb-dev:

.github/workflows/meteor-spk.yml

@@ -0,0 +1,107 @@
+name: Build meteor-spk bundle
+
+# Manually triggered. Assembles WeKan's modernized meteor-spk (the Sandstorm packaging
+# tool + its meteor-spk.deps: Node 24, FerretDB, the Mongo 3.x CLIs and the modern
+# sandstorm-http-bridge) and zips it as meteor-spk-YYYY-MM-DD_HH_MM_SS.zip — the same kind
+# of self-contained meteor-spk bundle that https://github.com/sandstorm-io/meteor-spk
+# releases, but with WeKan's Node 24 / FerretDB deps baked in. Download it to `meteor-spk
+# pack` WeKan (or any Meteor 3.x app) without re-running build-deps.sh each time.
+#
+#   gh workflow run meteor-spk.yml
+#
+# This only assembles + zips the tool; it does NOT pack or sign a WeKan .spk, so it needs
+# no SANDSTORM_KEYRING. The .spk itself is built by sandstorm.yml; the Sandstorm App
+# Market publish is done by sandstorm-store.yml.
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch, tag or SHA to build the meteor-spk deps from (default: main)'
+        required: false
+        default: 'main'
+
+permissions:
+  contents: write
+
+env:
+  NODE_VERSION: '24'
+
+jobs:
+  meteor-spk:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.ref || 'main' }}
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
+        # Same as sandstorm.yml: Ubuntu 24.04's AppArmor blocks the unprivileged user
+        # namespaces the Sandstorm install relies on; relax it so the install (whose
+        # sandstorm-http-bridge build-deps.sh copies in) can run on the runner.
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git zip
+
+      - name: Install Sandstorm (dev, unattended)
+        # build-deps.sh's [bridge] step copies the modern
+        # /opt/sandstorm/latest/bin/sandstorm-http-bridge into the deps, so Sandstorm
+        # must be installed first — same ordering as sandstorm.yml.
+        run: curl https://install.sandstorm.io | sudo bash -s -- -d
+
+      - name: Assemble modern meteor-spk.deps (Node 24 + FerretDB + Mongo 3.x CLIs)
+        # Base = upstream meteor-spk 0.6.0 from dl.sandstorm.io; build-deps.sh swaps in
+        # Node 24, FerretDB, the Mongo 3.x CLIs, the migration launcher/importer, keeps
+        # niscud, and swaps in the modern sandstorm-http-bridge. Produces
+        # $HOME/projects/meteor-spk/meteor-spk-0.6.0 (the meteor-spk tool + deps).
+        run: bash sandstorm-src/build-deps.sh
+
+      - name: Zip the meteor-spk bundle
+        id: zip
+        run: |
+          set -euo pipefail
+          STAMP="$(date +'%Y-%m-%d_%H_%M_%S')"
+          ZIP="meteor-spk-${STAMP}.zip"
+          BUNDLE_DIR="$HOME/projects/meteor-spk"
+          if [ ! -d "$BUNDLE_DIR/meteor-spk-0.6.0" ]; then
+            echo "::error::Expected meteor-spk bundle at $BUNDLE_DIR/meteor-spk-0.6.0 was not produced by build-deps.sh."
+            exit 1
+          fi
+          # Zip so it extracts to a top-level meteor-spk-0.6.0/ directory, like the
+          # upstream meteor-spk release archives. Exclude the base tarball build-deps.sh
+          # downloaded next to it.
+          ( cd "$BUNDLE_DIR" && zip -r -y -q "$GITHUB_WORKSPACE/$ZIP" meteor-spk-0.6.0 -x '*.tar.xz' )
+          ZIP_BYTES=$(stat -c%s "$GITHUB_WORKSPACE/$ZIP")
+          echo "Packed $ZIP: $((ZIP_BYTES/1024/1024)) MiB ($ZIP_BYTES bytes)"
+          ls -la "$GITHUB_WORKSPACE/$ZIP"
+          echo "zip=$ZIP" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: ${{ steps.zip.outputs.zip }}
+          path: ${{ steps.zip.outputs.zip }}
+          retention-days: 7
+
+      - name: Upload the meteor-spk bundle to the newest WeKan release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || true)"
+          if [ -z "${TAG:-}" ] || [ "$TAG" = "null" ]; then
+            echo "::warning::No existing GitHub Release found; the meteor-spk bundle is available only as a workflow artifact."
+            exit 0
+          fi
+          echo "Uploading ${{ steps.zip.outputs.zip }} to the newest release: $TAG"
+          gh release upload "$TAG" "${{ steps.zip.outputs.zip }}" --clobber

.github/workflows/sandstorm-store.yml

@@ -0,0 +1,145 @@
+name: Publish .spk to Sandstorm App Market
+
+# Manually triggered. Takes the Sandstorm .spk that sandstorm.yml already built and
+# attached to a WeKan GitHub Release, renames it to wekan-<VERSION>.spk (VERSION is the
+# WeKan release version, e.g. 9.88), and publishes it to the Sandstorm App Market with
+#   spk publish wekan-<VERSION>.spk
+# exactly like releases/release-sandstorm.sh does locally.
+#
+#   gh workflow run sandstorm-store.yml
+#   gh workflow run sandstorm-store.yml -f version=9.88
+#   gh workflow run sandstorm-store.yml -f version=9.88 -f tag=v9.88
+#
+# Needs SANDSTORM_KEYRING (base64 of ~/.sandstorm-keyring) — `spk publish` proves app
+# ownership with the WeKan Sandstorm app's private key from that keyring — and installs
+# Sandstorm + assembles meteor-spk the same way sandstorm.yml does, so `spk` is present.
+# It does NOT rebuild the .spk; it publishes the one already on the release.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'WeKan version for the store filename wekan-<VERSION>.spk (e.g. 9.88). Default: derived from the release tag.'
+        required: false
+        default: ''
+      tag:
+        description: 'Release tag whose .spk to publish (default: newest release).'
+        required: false
+        default: ''
+
+permissions:
+  contents: read
+
+env:
+  NODE_VERSION: '24'
+
+jobs:
+  sandstorm-store:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git
+
+      - name: Install Sandstorm (dev, unattended)
+        # Provides the `spk` command used to publish, and the sandstorm-http-bridge that
+        # build-deps.sh copies into the meteor-spk deps.
+        run: curl https://install.sandstorm.io | sudo bash -s -- -d
+
+      - name: Assemble modern meteor-spk.deps (same as sandstorm.yml)
+        run: |
+          bash sandstorm-src/build-deps.sh
+          echo "$HOME/projects/meteor-spk/meteor-spk-0.6.0" >> "$GITHUB_PATH"
+
+      - name: Restore the Sandstorm signing keyring
+        env:
+          SANDSTORM_KEYRING: ${{ secrets.SANDSTORM_KEYRING }}
+        run: |
+          if [ -n "${SANDSTORM_KEYRING:-}" ]; then
+            # spk publish reads the app signing key from ~/.sandstorm-keyring (a FILE in
+            # $HOME), same location meteor-spk pack uses.
+            printf '%s' "$SANDSTORM_KEYRING" | base64 -d > "$HOME/.sandstorm-keyring"
+            chmod 600 "$HOME/.sandstorm-keyring"
+            echo "Restored ~/.sandstorm-keyring ($(wc -c < "$HOME/.sandstorm-keyring") bytes)."
+          else
+            echo "::error::SANDSTORM_KEYRING secret is not set. 'spk publish' proves ownership of the WeKan Sandstorm app with the private key from this keyring, so publishing cannot proceed without it. Add the base64 of your ~/.sandstorm-keyring file as the SANDSTORM_KEYRING repository secret (e.g. 'base64 -w0 ~/.sandstorm-keyring')."
+            exit 1
+          fi
+
+      - name: Download the newest .spk from the WeKan release and name it wekan-<VERSION>.spk
+        id: fetch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          IN_TAG: ${{ github.event.inputs.tag }}
+          IN_VERSION: ${{ github.event.inputs.version }}
+        run: |
+          set -euo pipefail
+
+          # 1) Which release to publish from.
+          TAG="${IN_TAG:-}"
+          if [ -z "$TAG" ]; then
+            TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || true)"
+          fi
+          if [ -z "${TAG:-}" ] || [ "$TAG" = "null" ]; then
+            echo "::error::No release found to publish the .spk from."
+            exit 1
+          fi
+
+          # 2) VERSION for the store filename wekan-<VERSION>.spk. Use the input, else
+          #    derive it from the tag (strip a leading 'v', e.g. v9.88 -> 9.88).
+          VERSION="${IN_VERSION:-}"
+          if [ -z "$VERSION" ]; then
+            VERSION="${TAG#v}"
+          fi
+          echo "Release: $TAG  ->  store filename: wekan-${VERSION}.spk"
+
+          # 3) Download the newest .spk asset on that release. sandstorm.yml attaches it
+          #    as wekan-sandstorm-YYYY_MM_DD-HH_MM_SS.spk; if several exist, take the
+          #    lexicographically-newest (the timestamp sorts chronologically).
+          ASSET="$(gh release view "$TAG" --json assets \
+            --jq '[.assets[].name | select(endswith(".spk"))] | sort | last' 2>/dev/null || true)"
+          if [ -z "${ASSET:-}" ] || [ "$ASSET" = "null" ]; then
+            echo "::error::Release $TAG has no .spk asset. Run sandstorm.yml first to build and attach one."
+            exit 1
+          fi
+          echo "Downloading .spk asset: $ASSET"
+          gh release download "$TAG" --pattern "$ASSET" --dir . --clobber
+
+          SPK="wekan-${VERSION}.spk"
+          mv -f "$ASSET" "$SPK"
+          ls -la "$SPK"
+          echo "spk=$SPK" >> "$GITHUB_OUTPUT"
+
+      - name: Publish to the Sandstorm App Market
+        env:
+          SPK: ${{ steps.fetch.outputs.spk }}
+        run: |
+          set -euo pipefail
+          # Resolve the spk binary: prefer PATH, then the Sandstorm install location.
+          SPK_BIN="$(command -v spk || true)"
+          if [ -z "$SPK_BIN" ]; then
+            for c in /opt/sandstorm/latest/bin/spk /opt/sandstorm/spk /usr/local/bin/spk; do
+              [ -x "$c" ] && SPK_BIN="$c" && break
+            done
+          fi
+          if [ -z "$SPK_BIN" ]; then
+            echo "::error::Could not find the 'spk' command from the Sandstorm install."
+            exit 1
+          fi
+          echo "Publishing $SPK with $SPK_BIN ..."
+          # Same command as releases/release-sandstorm.sh: spk publish wekan-<VERSION>.spk
+          "$SPK_BIN" publish "$SPK"

.github/workflows/sandstorm.yml

@@ -0,0 +1,144 @@
+name: Build Sandstorm .spk
+
+# Manually triggered. Builds ONLY the Sandstorm .spk package (nothing else) and
+# uploads it as wekan-sandstorm-YYYY_MM_DD-HH_MM_SS.spk to the NEWEST WeKan GitHub
+# Release as an attachment, so you can download it, test whether the Sandstorm
+# build works, and see any errors — without running a full release.
+#
+#   gh workflow run sandstorm.yml
+#
+# EXPERIMENTAL in CI (same caveats as the build-sandstorm job in release-all.yml):
+#   * Sandstorm needs unprivileged user namespaces; GitHub's Ubuntu runners are VMs
+#     that allow them, but this is the fragile part.
+#   * meteor-spk SIGNS the .spk with the app private key from the Sandstorm keyring;
+#     provide it as the SANDSTORM_KEYRING secret (base64 of ~/.sandstorm keyring).
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch, tag or SHA to build the .spk from (default: main)'
+        required: false
+        default: 'main'
+
+permissions:
+  contents: write
+
+env:
+  NODE_VERSION: '24'
+
+jobs:
+  sandstorm:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # Build the dispatched ref so a fix branch can be tested before it is
+          # merged to main; defaults to main for a plain `gh workflow run`.
+          ref: ${{ github.event.inputs.ref || 'main' }}
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
+        # Ubuntu 24.04's AppArmor defaults kernel.apparmor_restrict_unprivileged_userns=1,
+        # which blocks the unprivileged user namespaces that the Sandstorm install and
+        # the spk supervisor rely on (the "fragile part" noted above). Relax it so
+        # `install.sandstorm.io` and meteor-spk can create sandboxes on the runner.
+        # `|| true`: on kernels/runners without these knobs, setting them is a no-op.
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
+
+      - name: Install system dependencies and Meteor
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git qemu-user-static
+          if [ ! -f "$HOME/.meteor/meteor" ]; then curl https://install.meteor.com/ | sh; fi
+          echo "$HOME/.meteor" >> "$GITHUB_PATH"
+
+      - name: Install Sandstorm (dev, unattended)
+        # Installed BEFORE assembling the deps: build-deps.sh's [bridge] step copies
+        # the modern /opt/sandstorm/latest/bin/sandstorm-http-bridge over the ancient
+        # bundled one, so the Sandstorm install must be in place first.
+        run: curl https://install.sandstorm.io | sudo bash -s -- -d
+
+      - name: Assemble modern meteor-spk.deps (Node 24 + FerretDB + Mongo 3.x CLIs)
+        # Base = upstream meteor-spk 0.6.0 from dl.sandstorm.io (has mongod 3.0 +
+        # niscud). build-deps.sh swaps in Node 24, adds FerretDB + the Mongo 3.x
+        # CLIs + the migration launcher/importer, keeps niscud, and swaps in the
+        # modern sandstorm-http-bridge from the Sandstorm install above. No dependency
+        # on the retired releases.wekan.team or the old projects.7z.
+        run: |
+          bash sandstorm-src/build-deps.sh
+          echo "$HOME/projects/meteor-spk/meteor-spk-0.6.0" >> "$GITHUB_PATH"
+
+      - name: Restore the Sandstorm signing keyring
+        env:
+          SANDSTORM_KEYRING: ${{ secrets.SANDSTORM_KEYRING }}
+        run: |
+          if [ -n "${SANDSTORM_KEYRING:-}" ]; then
+            # meteor-spk / spk read the app signing key from ~/.sandstorm-keyring —
+            # a FILE directly in $HOME (see the pack crash path
+            # "/home/runner/.sandstorm-keyring"). Write it exactly there, NOT to
+            # ~/.sandstorm/sandstorm-keyring, or `meteor-spk pack` aborts with
+            # "open(~/.sandstorm-keyring): No such file or directory".
+            printf '%s' "$SANDSTORM_KEYRING" | base64 -d > "$HOME/.sandstorm-keyring"
+            chmod 600 "$HOME/.sandstorm-keyring"
+            echo "Restored ~/.sandstorm-keyring ($(wc -c < "$HOME/.sandstorm-keyring") bytes)."
+          else
+            echo "::error::SANDSTORM_KEYRING secret is not set. meteor-spk pack signs the .spk with the WeKan Sandstorm app's private key, which lives in this keyring, so packing cannot proceed without it. Add the base64 of your ~/.sandstorm-keyring file as the SANDSTORM_KEYRING repository secret (e.g. 'base64 -w0 ~/.sandstorm-keyring')."
+            exit 1
+          fi
+
+      - name: Install Meteor npm dependencies
+        # PUPPETEER_SKIP_DOWNLOAD: puppeteer is a devDependency used only by tests,
+        # not by the server, so it never belongs in the packed .spk. Skipping its
+        # Chromium download (~150 MB) avoids any risk of it bloating the build and
+        # speeds up CI.
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: '1'
+        run: |
+          (meteor update --npm 2>/dev/null || true) && meteor npm install
+
+      - name: Build the Sandstorm .spk
+        id: build
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: '1'
+        run: |
+          set -euo pipefail
+          STAMP="$(date +'%Y_%m_%d-%H_%M_%S')"
+          SPK="wekan-sandstorm-${STAMP}.spk"
+          meteor-spk pack "$SPK"
+          # Report the packed size and warn if it exceeds Cloudflare's 100 MB upload
+          # cap (a proxied browser upload to a Cloudflare-fronted Sandstorm 413s above
+          # this; install via a DNS-only host / SSH tunnel, or trim further).
+          SPK_BYTES=$(stat -c%s "$SPK")
+          echo "Packed $SPK: $((SPK_BYTES/1024/1024)) MiB ($SPK_BYTES bytes)"
+          if [ "$SPK_BYTES" -gt $((100*1024*1024)) ]; then
+            echo "::warning::$SPK is $((SPK_BYTES/1024/1024)) MiB — over Cloudflare's 100 MB upload limit. Upload via a DNS-only host / SSH tunnel to Sandstorm, or trim the bundle further."
+          fi
+          ls -la "$SPK"
+          echo "spk=$SPK" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: ${{ steps.build.outputs.spk }}
+          path: ${{ steps.build.outputs.spk }}
+          retention-days: 7
+
+      - name: Upload the .spk to the newest WeKan release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || true)"
+          if [ -z "${TAG:-}" ] || [ "$TAG" = "null" ]; then
+            echo "::error::No existing GitHub Release found to attach the .spk to."
+            exit 1
+          fi
+          echo "Uploading ${{ steps.build.outputs.spk }} to the newest release: $TAG"
+          gh release upload "$TAG" "${{ steps.build.outputs.spk }}" --clobber

.gitignore

@@ -70,3 +70,17 @@ test-results/
 _build-local-test
 */build-assets-local-test
 */build-chunks-local-test
+
+# Local-only working copies: other wekan repos cloned under this repo for editing,
+# and build inputs. These are separate git repos / large machine-specific dirs;
+# never commit them.
+#  - projects/    : unarchived meteor-spk fork (Node/Mongo/FerretDB binaries)
+#  - sandstorm/   : clone of sandstorm-io/sandstorm (platform source, for reference)
+#  - FerretDB/    : clone of wekan/FerretDB
+#  - mongo-tools/ : clone of wekan/mongo-tools
+#  - mongosh/     : clone of wekan/mongosh
+/projects/
+/sandstorm/
+/FerretDB/
+/mongo-tools/
+/mongosh/

.tx/config

@@ -1,6 +1,6 @@
 [main]
 host     = https://www.transifex.com
-lang_map = te_IN: te-IN, es_AR: es-AR, es_419: es-LA, es_TX: es-TX, he_IL: he-IL, zh_CN: zh-CN, ar_EG: ar-EG, cs_CZ: cs-CZ, fa_IR: fa-IR, ms_MY: ms-MY, nl_NL: nl-NL, de_CH: de-CH, en_IT: en-IT, uz_UZ: uz-UZ, fr_CH: fr-CH, hi_IN: hi-IN, et_EE: et-EE, es_PE: es-PE, es_MX: es-MX, gl_ES: gl-ES, mn_MN: mn, zh_TW: zh-TW, ast_ES: ast-ES, es_CL: es-CL, ja_JP: ja, lv_LV: lv, ro_RO: ro-RO, az_AZ: az-AZ, cy_GB: cy-GB, gu_IN: gu-IN, pl_PL: pl-PL, vep: ve-PP, en_BR: en-BR, en@ysv: en-YS, hu_HU: hu, ko_KR: ko-KR, pt_BR: pt-BR, zh_HK: zh-HK, zu_ZA: zu-ZA, en_MY: en-MY, ja-Hira: ja-HI, fi_FI: fi, vec: ve-CC, vi_VN: vi-VN, fr_FR: fr-FR, id_ID: id, zh_Hans: zh-Hans, en_DE: en-DE, en_GB: en-GB, el_GR: el-GR, uk_UA: uk-UA, az@latin: az-LA, de_AT: de-AT, uz@Latn: uz-LA, vls: vl-SS, ar_DZ: ar-DZ, bg_BG: bg, es_PY: es-PY, fy_NL: fy-NL, uz@Arab: uz-AR, ru_UA: ru-UA, war: wa-RR, zh_CN.GB2312: zh-GB
+lang_map = te_IN: te-IN, es_AR: es-AR, es_419: es-LA, es_TX: es-TX, he_IL: he-IL, zh_CN: zh-CN, ar_EG: ar-EG, cs_CZ: cs-CZ, fa_IR: fa-IR, ms_MY: ms-MY, nl_NL: nl-NL, de_CH: de-CH, en_IT: en-IT, uz_UZ: uz-UZ, fr_CH: fr-CH, hi_IN: hi-IN, et_EE: et-EE, es_PE: es-PE, es_MX: es-MX, gl_ES: gl-ES, mn_MN: mn, zh_TW: zh-TW, ast_ES: ast-ES, es_CL: es-CL, ja_JP: ja-JP, lv_LV: lv, ro_RO: ro-RO, az_AZ: az-AZ, cy_GB: cy-GB, gu_IN: gu-IN, pl_PL: pl-PL, vep: ve-PP, en_BR: en-BR, en@ysv: en-YS, hu_HU: hu, ko_KR: ko-KR, pt_BR: pt-BR, zh_HK: zh-HK, zu_ZA: zu-ZA, en_MY: en-MY, ja-Hira: ja-HI, fi_FI: fi, vec: ve-CC, vi_VN: vi-VN, fr_FR: fr-FR, id_ID: id, zh_Hans: zh-Hans, en_DE: en-DE, en_GB: en-GB, el_GR: el-GR, uk_UA: uk-UA, az@latin: az-LA, de_AT: de-AT, uz@Latn: uz-LA, vls: vl-SS, ar_DZ: ar-DZ, bg_BG: bg, es_PY: es-PY, fy_NL: fy-NL, uz@Arab: uz-AR, ru_UA: ru-UA, war: wa-RR, zh_CN.GB2312: zh-GB
 
 [o:wekan:p:wekan:r:application]
 file_filter = imports/i18n/data/<lang>.i18n.json

CODE_OF_CONDUCT.md

@@ -2,10 +2,10 @@
 
 For all code at WeKan GitHub Organization https://github.com/wekan
 
+- For pull requests, mention only those participants that are **human**.
 - All code in pull requests need to have permission already to add it to WeKan with MIT license, and will become MIT license.
 - For any dependencies, permissive licenses like https://copyfree.org are preferred
 - For anything currently that is non-permissive (like GPL, AGPL, SSPL), those will be replaced with permissive-licensed alternatives
-- Any intelligence allowed: Human, AI or any other. No discrimination, please have world peace. Mentioning participants optional.
 - All code is checked and validated by xet7 and many different security AI. If code is real working fix or feature, it usually will be merged.
 - All known vulnerabilities have been fixed at newest WeKan, please upgrade https://wekan.fi/upgrade/
 - There is no known backdoors. If WeKan is installed by someone else, first registered user is Admin and has Admin Panel access.

Dockerfile

@@ -7,7 +7,7 @@ LABEL org.opencontainers.image.source="https://github.com/wekan/wekan"
 # TARGETARCH and TARGETVARIANT are automatically provided by Docker Buildx
 ARG TARGETARCH
 ARG TARGETVARIANT
-ARG VERSION=9.74
+ARG VERSION=10.09
 ARG DEBIAN_FRONTEND=noninteractive
 
 ENV BUILD_DEPS="apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip"
@@ -185,24 +185,35 @@ apt-get update --assume-yes
 apt-get upgrade --assume-yes
 apt-get install --assume-yes --no-install-recommends ${BUILD_DEPS}
 
-# Multi-arch mapping: Docker TARGETARCH -> Node.js arch name + WeKan bundle name
-# arm/v7 uses TARGETARCH=arm; armhf has no MongoDB Community -> uses FerretDB
+# Multi-arch mapping: Docker TARGETARCH -> Node.js arch name + WeKan bundle name.
+# amd64/arm64 have MongoDB Community; ppc64le/s390x/riscv64 have no MongoDB server
+# and ship FerretDB v1 instead (the ferretdb binary is baked into their .zip and
+# started by wekan-entrypoint.sh). riscv64's Node.js 24 comes from
+# unofficial-builds.nodejs.org (nodejs.org ships no riscv64). armv7l is excluded:
+# there is no Node.js 24 build for it anywhere.
+NODE_BASE="official"
 case "${TARGETARCH}" in
     "amd64")   NODE_ARCH="x64"     WEKAN_ARCH="amd64"   ;;
     "arm64")   NODE_ARCH="arm64"   WEKAN_ARCH="arm64"   ;;
-    "arm")     NODE_ARCH="armv7l"  WEKAN_ARCH="armhf"   ;;
     "ppc64le") NODE_ARCH="ppc64le" WEKAN_ARCH="ppc64le" ;;
     "s390x")   NODE_ARCH="s390x"   WEKAN_ARCH="s390x"   ;;
+    "riscv64") NODE_ARCH="riscv64" WEKAN_ARCH="riscv64" NODE_BASE="unofficial" ;;
     *) echo "Unsupported architecture: ${TARGETARCH}"; exit 1 ;;
 esac
 
-# Node.js Installation (official nodejs.org builds for Node 22)
+# Node.js installation. Official nodejs.org builds for amd64/arm64/ppc64le/s390x;
+# unofficial-builds.nodejs.org for riscv64 (nodejs.org ships no riscv64 binary).
 cd /tmp
-wget "https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz"
-wget "https://nodejs.org/dist/${NODE_VERSION}/SHASUMS256.txt.asc"
-grep "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt.asc | shasum -a 256 -c -
+if [ "${NODE_BASE}" = "unofficial" ]; then
+    NODE_DIST="https://unofficial-builds.nodejs.org/download/release/${NODE_VERSION}"
+else
+    NODE_DIST="https://nodejs.org/dist/${NODE_VERSION}"
+fi
+wget "${NODE_DIST}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz"
+wget "${NODE_DIST}/SHASUMS256.txt"
+grep " node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz\$" SHASUMS256.txt | shasum -a 256 -c -
 tar xzf "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" -C /usr/local --strip-components=1 --no-same-owner
-rm -f "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt.asc
+rm -f "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt
 ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs"
 
 # NPM configuration
@@ -229,6 +240,14 @@ rm "wekan-${VERSION}-${WEKAN_ARCH}.zip"
 npm install --prefix ./bundle/programs/server
 mv /home/wekan/app/bundle /build
 
+# The .zip bundle now ships a self-contained launcher + its own Node.js for the
+# offline downloads; the Docker image installs its own Node and uses
+# wekan-entrypoint.sh, so drop the redundant bundled node + launchers. Keeps
+# /build/ferretdb (used by the entrypoint) and the per-arch MongoDB Database Tools
+# (bsondump, mongodump, mongorestore, … from wekan/mongo-tools, embedded in the
+# bundle) for backup/restore inside the container. Saves ~80 MB per arch.
+rm -f /build/node /build/start-wekan.sh /build/start-wekan.bat
+
 # Restore original tar
 mv $(which tar)~ $(which tar)
 
@@ -247,10 +266,17 @@ mkdir -p /data
 chown wekan:wekan --recursive /data
 EOR
 
+# Database-backend selector entrypoint. Every arch's bundle now ships a FerretDB
+# binary (baked into the .zip and moved to /build/ferretdb above); this script
+# starts FerretDB v1 (SQLite) or leaves the DB external based on WEKAN_DB and the
+# /build/.ferretdb-default marker (present only on MongoDB-less arches). See
+# releases/ferretdb/wekan-entrypoint.sh.
+COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh
+
 USER wekan
 ENV PORT=8080
 EXPOSE $PORT
 STOPSIGNAL SIGKILL
 WORKDIR /build
 
-CMD ["bash", "-c", "ulimit -s 65500; exec node main.js"]
+CMD ["bash", "/build/wekan-entrypoint.sh"]

README.md

@@ -67,7 +67,7 @@ that by providing one-click installation on various platforms.
 
 - WeKan ® is used in [most countries of the world](https://snapcraft.io/wekan).
 - WeKan ® largest user has 30k users using WeKan ® in their company.
-- WeKan ® has been [translated](https://app.transifex.com/wekan/) to about 105 languages.
+- WeKan ® has been [translated](https://app.transifex.com/wekan/) to 154 languages.
 - [Features][features]: WeKan ® has real-time user interface.
 - [Platforms](https://wekan.fi/install/): WeKan ® supports many platforms.
   WeKan ® is critical part of new platforms Wekan is currently being integrated to.
@@ -103,10 +103,10 @@ By working directly with WeKan ® you get the benefit of active maintenance and
 
 ## Getting Started with Development
 
-The default branch uses Meteor 3.5-rc.2 with Node.js 24.x.
+The main branch uses Meteor 3.5 with Node.js 24.x.
 See [CHANGELOG.md](https://github.com/wekan/wekan/blob/main/CHANGELOG.md) for the latest runtime updates.
 
-To contribute, [create a fork](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#2-create-fork-of-httpsgithubcomwekanwekan-at-github-web-page) and run `./rebuild-wekan.sh` (or `./rebuild-wekan.bat` on Windows) as detailed [here](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#3-select-option-1-to-install-dependencies-and-then-enter). Once you're ready, please test your code and [submit a pull request (PR)](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#7-test).
+To contribute, [create a fork](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#2-create-fork-of-httpsgithubcomwekanwekan-at-github-web-page) and run `./rebuild-wekan.sh` (or `./rebuild-wekan.bat` on Windows) as detailed [here](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#3-install-dependencies-build-wekan-and-run-the-dev-server). Once you're ready, please test your code and [submit a pull request (PR)](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#7-test).
 
 Please refer to the [developer documentation](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Developer-Documentation.md) for more information.
 
@@ -138,11 +138,17 @@ curl https://install.meteor.com/ | sh
 
 ### Building WeKan
 
-The `rebuild-wekan.sh` script guides you through a three-stage process:
+The `rebuild-wekan.sh` script shows a two-level menu. The top level groups options into categories:
 
-1. **Install dependencies (Option 1)** - Downloads all required Meteor packages and npm modules
-2. **Build WeKan (Option 2)** - Compiles the application
-3. **Run WeKan (Option 3)** - Starts the development server at http://localhost:4000
+```
+1) Setup   2) Dev server   3) Tests   4) Docker   5) Tools   6) Quit
+```
+
+You pick a category number, then the item number inside it (each submenu also has a `Back` entry). Building from source is a three-stage process:
+
+1. **Setup -> Install dependencies** - Downloads all required Meteor packages and npm modules
+2. **Setup -> Build WeKan** - Compiles the application
+3. **Dev server -> localhost:3000** - Starts the development server at http://localhost:3000
 
 ```bash
 # Clone your fork
@@ -152,25 +158,27 @@ cd wekan
 # Make the script executable
 chmod +x rebuild-wekan.sh
 
-# Step 1: Install dependencies
+# Step 1: Install dependencies (Setup -> Install dependencies)
 ./rebuild-wekan.sh
-# Press 1 and Enter
+# Press 1 (Setup) and Enter, then 1 (Install dependencies) and Enter
 
-# Step 2: Build WeKan (after dependencies complete)
+# Step 2: Build WeKan (Setup -> Build WeKan, after dependencies complete)
 ./rebuild-wekan.sh
-# Press 2 and Enter
+# Press 1 (Setup) and Enter, then 2 (Build WeKan) and Enter
 
-# Step 3: Run WeKan in development mode
+# Step 3: Run WeKan in development mode (Dev server -> localhost:3000)
 ./rebuild-wekan.sh
-# Press 3 and Enter
+# Press 2 (Dev server) and Enter, then 1 (localhost:3000) and Enter
 ```
+
+If a dev server is already running on that port, the **Dev server** options stop it automatically and start a fresh server on the same port.
  
 
 ### WSL Users
 
 WSL users can use Snap Candidate. See [install docs](https://wekan.fi/install/).
 
-The development server will start at http://localhost:4000. Any changes you make to the source code will automatically trigger a rebuild and refresh your browser.
+The development server will start at http://localhost:3000. Any changes you make to the source code will automatically trigger a rebuild and refresh your browser.
 
 ## Screenshot
 

SECURITY.md

@@ -10,8 +10,19 @@ because WeKan is NOT Big Tech. WeKan is FLOSS.
 - **Report**: Click "New draft security advisory" at [WeKan Security Advisories](https://github.com/wekan/wekan/security/advisories).
   More info at [GitHub Docs about reporting privately](https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-privately).
 - **Proof of Concept (PoC)**: If possible, include a fix or a reproduction script/code.
-- **If GitHub does not work**: Please send report to **security@wekan.fi**
-- **Optional Email Encryption**: An optional PGP key is available at [security-at-wekan.fi.asc](security-at-wekan.fi.asc).
+- DO NOT EMAIL [security@wekan.fi](security-at-wekan.fi.asc), because:
+  - Email is NOT secure or private.
+  - Using GitHub directly verifies that:
+    - You are:
+      - Saving my time by filling all details at GitHub, so that I can easily click request CVE at GitHub
+      - A correct GitHub user
+      - Really reading this SECURITY.md
+      - Knowing what you are doing
+    - You are not:
+      - Someone that tries to waste my time
+      - Trying to impersonate as some other GitHub user
+      - Spammer
+      - Bot
 
 ### 2. WeKan Security Team:
 
@@ -23,30 +34,26 @@ because WeKan is NOT Big Tech. WeKan is FLOSS.
 
 ### 3. Post-Release and Public Disclosure:
 
-- Publicity: If you publish blog posts, give talks, or write articles about the
-  reported vulnerabilities, please send the links to us. We will link them
-  to your entry in the [Hall of Fame](https://wekan.fi/hall-of-fame/) for additional context.
 - Advisories reported at GitHub are listed at [WeKan Security Advisories](https://github.com/wekan/wekan/security/advisories).
-
-## How Should Reports Be Formatted?
-
-```
-Name: %name
-Twitter: %twitter
-Bug type: %bugtype
-Domain: %domain
-Severity: %severity
-URL: %url
-PoC: %poc
-CVSS (optional): %cvss
-CWSS (optional): %cwss
-```
+- DO NOT EMAIL [security@wekan.fi](security-at-wekan.fi.asc), because:
+  - Email is NOT secure or private.
+  - Using GitHub directly verifies that:
+    - You are:
+      - Saving my time by filling all details at GitHub, so that I can easily click request CVE at GitHub
+      - A correct GitHub user
+      - Really reading this SECURITY.md
+      - Knowing what you are doing
+    - You are not:
+      - Someone that tries to waste my time
+      - Trying to impersonate as some other GitHub user
+      - Spammer
+      - Bot
 
 ## Who can participate in the program
 
 Anyone who reports a unique security issue in scope and does not disclose it to
-a third party before we have patched and updated may be upon their approval
-added to the WeKan Hall of Fame https://wekan.fi/hall-of-fame/
+a third party before we have patched, and is able to add
+"New draft security advisory" at [WeKan Security Advisories](https://github.com/wekan/wekan/security/advisories).
 
 ## Which domains are in scope?
 

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v9.74.0"
+appVersion: "v10.09.0"
 files:
   userUploads:
     - README.md

api.py

@@ -37,6 +37,8 @@ If *nix:  chmod +x api.py => ./api.py users
     python3 api.py lists BOARDID        # Lists of BOARDID
     python3 api.py list BOARDID LISTID  # Info of LISTID
     python3 api.py createlist BOARDID LISTTITLE # Create list
+    python3 api.py editlist BOARDID LISTID NEWLISTTITLE # Edit list title
+    python3 api.py editlistcolor BOARDID LISTID COLOR (Color available: `white`, `green`, `yellow`, `orange`, `red`, `purple`, `blue`, `sky`, `lime`, `pink`, `black`, `silver`, `peachpuff`, `crimson`, `plum`, `darkgreen`, `slateblue`, `magenta`, `gold`, `navy`, `gray`, `saddlebrown`, `paleturquoise`, `mistyrose`, `indigo`) # Edit list color
     python3 api.py addcard AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION
     python3 api.py editcard BOARDID LISTID CARDID NEWCARDTITLE NEWCARDDESCRIPTION
         python3 api.py getcard BOARDID LISTID CARDID # Get card info
@@ -130,6 +132,16 @@ If *nix:  chmod +x api.py => ./api.py users
     python3 api.py getcardsettings BOARDID # Get board-level card settings (allows* toggles, cardAging, cardAgingDays1/2/3)
     python3 api.py setcardsetting BOARDID KEY VALUE # Set one board card setting, e.g. allowsDueDate true, cardAging true, cardAgingDays1 5
 
+        Board Automation Rules API (IFTTT, Issue #2674):
+    python3 api.py listrules BOARDID # List automation rules of a board
+    python3 api.py getrule BOARDID RULEID # Get one rule with its trigger and action
+    python3 api.py addrule BOARDID TITLE TRIGGER_JSON ACTION_JSON # Add rule. Missing trigger matching fields default to the '*' wildcard
+    python3 api.py editrule BOARDID RULEID PATCH_JSON # Edit rule: {"title":..,"trigger":{..},"action":{..}}
+    python3 api.py removerule BOARDID RULEID # Remove rule (and its trigger + action)
+    # Example (Issue #2674) - add member when card moved TO list, remove member when moved AWAY FROM list:
+    #   python3 api.py addrule BOARDID 'Add on move to Doing' '{"activityType":"moveCard","listName":"Doing"}' '{"actionType":"addMember","username":"someuser"}'
+    #   python3 api.py addrule BOARDID 'Remove on move from Doing' '{"activityType":"moveCard","oldListName":"Doing"}' '{"actionType":"removeMember","username":"someuser"}'
+
   Admin API:
     python3 api.py newuser USERNAME EMAIL PASSWORD
 
@@ -432,6 +444,49 @@ if arguments == 5:
 
 if arguments >= 4:
 
+    if sys.argv[1] == 'editlist':
+
+        # ------- EDIT LIST START -----------
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        newlisttitle = sys.argv[4]
+        edlist = wekanurl + apiboards + boardid + s + l + s + listid
+        print(edlist)
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        put_data = {'title': '{}'.format(newlisttitle)}
+        body = requests.put(edlist, data=put_data, headers=headers)
+        print("=== EDIT LIST ===\n")
+        body = requests.get(edlist, headers=headers)
+        data2 = body.text.replace('}', "}\n")
+        print(data2)
+        # ------- EDIT LIST END -----------
+
+    if sys.argv[1] == 'editlistcolor':
+
+        # ------- EDIT LIST COLOR START -----------
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        newcolor = sys.argv[4]
+
+        valid_colors = ['white', 'green', 'yellow', 'orange', 'red', 'purple', 'blue', 'sky', 'lime', 'pink', 'black',
+                    'silver', 'peachpuff', 'crimson', 'plum', 'darkgreen', 'slateblue', 'magenta', 'gold', 'navy',
+                    'gray', 'saddlebrown', 'paleturquoise', 'mistyrose', 'indigo']
+
+        if newcolor not in valid_colors:
+            print("Invalid color. Choose a color from the list.")
+            sys.exit(1)
+
+        edlist = wekanurl + apiboards + boardid + s + l + s + listid
+        print(edlist)
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        put_data = {'color': '{}'.format(newcolor)}
+        body = requests.put(edlist, data=put_data, headers=headers)
+        print("=== EDIT LIST COLOR ===\n")
+        body = requests.get(edlist, headers=headers)
+        data2 = body.text.replace('}', "}\n")
+        print(data2)
+        # ------- EDIT LIST COLOR END -----------
+
     if sys.argv[1] == 'newuser':
 
         # ------- CREATE NEW USER START -----------
@@ -1728,6 +1783,18 @@ if arguments >= 1:
 #   python3 api.py addrule BOARDID 'Archive after 90 days' \
 #     '{"activityType":"scheduledTrigger","scheduleKind":"aging","listName":"Completed","days":90,"atTime":"03:00"}' \
 #     '{"actionType":"archive"}'
+#
+# Example (Issue #2674 - add a user to the card when it is moved TO a list, and
+# remove the user again when the card is moved AWAY FROM that list). Trigger
+# matching fields that are omitted (userId, swimlaneName, cardTitle, and the
+# unused one of listName/oldListName) are stored as the '*' wildcard by the
+# server, so the rules fire for any user/swimlane/card title:
+#   python3 api.py addrule BOARDID 'Add member on move to Doing' \
+#     '{"activityType":"moveCard","listName":"Doing"}' \
+#     '{"actionType":"addMember","username":"someuser"}'
+#   python3 api.py addrule BOARDID 'Remove member on move from Doing' \
+#     '{"activityType":"moveCard","oldListName":"Doing"}' \
+#     '{"actionType":"removeMember","username":"someuser"}'
 
 if arguments >= 2 and sys.argv[1] == 'listrules':
     boardid = sys.argv[2]

client/00-startup.js

@@ -1,7 +1,13 @@
 // Fix dynamic-import chunk loading when Wekan runs under a sub-path (ROOT_URL includes a pathname,
-// e.g. https://example.com/wekan). Rspack uses __webpack_public_path__ to prefix chunk URLs; by
-// default it is set to /build-chunks/ (no context path). We update it here, at module evaluation
-// time, before any import() expression runs (those are deferred to Meteor.startup callbacks).
+// e.g. https://example.com/wekan). Rspack's runtime builds every chunk URL as
+// __webpack_public_path__ + chunkName, and the chunk name ALREADY includes the "build-chunks/"
+// prefix (its runtime does `u = e => "build-chunks/" + e + "." + hash + ".js"`). The default
+// public path is "/", so at the site root chunks correctly resolve to "/build-chunks/<chunk>".
+// Under a sub-path we must prefix that sub-path — but must NOT re-add "build-chunks/" ourselves,
+// or the URL becomes "/wekan/build-chunks/build-chunks/<chunk>" and 404s (issue #6445, which broke
+// the lazy-loaded language chunks). So set the public path to "<sub-path>/" and let rspack append
+// "build-chunks/" itself. Done here at module evaluation time, before any import() expression runs
+// (those are deferred to Meteor.startup callbacks).
 /* global __webpack_public_path__:writable */
 try {
   const _cfg = typeof window !== 'undefined' && window.__meteor_runtime_config__;
@@ -9,7 +15,7 @@ try {
   if (_rootUrl) {
     const _rootPath = new URL(_rootUrl).pathname.replace(/\/+$/, '');
     if (_rootPath && _rootPath !== '/') {
-      __webpack_public_path__ = _rootPath + '/build-chunks/';
+      __webpack_public_path__ = _rootPath + '/';
     }
   }
 } catch (_) {}

client/components/activities/activities.css

@@ -15,6 +15,20 @@
 .reactions-popup .add-comment-reaction:hover {
   background-color: #b0c4de;
 }
+/* Eye / eye-slash icon toggle for showing/hiding activities. Open eye
+   (.eye-icon) = activities shown; crossed eye (.eye-slash-icon) = hidden.
+   Matches the password-visibility toggle used on the login/register pages. */
+.activities-eye-toggle {
+  cursor: pointer;
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4em;
+  text-decoration: none;
+}
+.activities-eye-toggle .eye-icon,
+.activities-eye-toggle .eye-slash-icon {
+  line-height: 1;
+}
 .activities {
   clear: both;
 }

client/components/activities/activities.jade

@@ -106,10 +106,10 @@ template(name="activity")
 
       //- comment activity ----------------------------------------------------
       if($eq activity.activityType 'deleteComment')
-        | {{{_ 'activity-deleteComment' activity.commentId}}}.
+        | {{{_ 'activity-deleteComment' (sanitize activity.commentDisplayText)}}}.
 
       if($eq activity.activityType 'editComment')
-        | {{{_ 'activity-editComment' activity.commentId}}}.
+        | {{{_ 'activity-editComment' (sanitize activity.commentDisplayText)}}}.
 
       if($eq activity.activityType 'addComment')
         | {{{_ 'activity-on' cardLink}}}
@@ -133,6 +133,9 @@ template(name="activity")
       if($eq activity.activityType 'a-changedTitle')
         | {{{_ 'activity-changedTitle' (sanitize activity.value) cardLink}}}.
 
+      if($eq activity.activityType 'a-changedDescription')
+        | {{{_ 'activity-changedDescription' cardLink}}}.
+
       //- customField activity ------------------------------------------------
       if($eq activity.activityType 'createCustomField')
         | {{_ 'activity-customfield-created' customField}}.

client/components/activities/activities.js

@@ -7,7 +7,12 @@ import { TAPi18n } from '/imports/i18n';
 import { Utils } from '/client/lib/utils';
 import { getSidebarInstance } from '/client/features/sidebar/service';
 
-const activitiesPerPage = 500;
+// #6480/#6481: 500 was far more than the sidebar/card activity feed ever shows
+// at once, and with FerretDB (no oplog) every live cursor is re-run on a timer —
+// so a 500-row activities cursor was re-fetched and re-diffed on every poll for
+// each open board/card. 50 covers the visible feed; infinite scroll still pulls
+// the next page on demand (the server cursor is index-bounded either way).
+const activitiesPerPage = 50;
 
 Template.activities.onCreated(function () {
   // Register with sidebar so it can call loadNextPage on us
@@ -234,7 +239,13 @@ Template.activity.helpers({
   sourceLink() {
     const source = this.activity.source;
     if (source) {
-      if (source.url) {
+      // XSS fix (reported by meifukun): source.url is imported from an external
+      // board (e.g. a Trello board's `url`) and was rendered as an <a href> with
+      // no scheme check, so a `javascript:` (or data:/vbscript:) URL executed in
+      // the board admin's session on click and could exfiltrate Meteor.loginToken.
+      // Only render a link for an http(s) URL; otherwise show the plain (sanitized)
+      // source name with no href.
+      if (source.url && /^https?:\/\//i.test(String(source.url))) {
         return Blaze.toHTML(
           HTML.A(
             {
@@ -243,9 +254,8 @@ Template.activity.helpers({
             sanitizeHTML(source.system),
           ),
         );
-      } else {
-        return sanitizeHTML(source.system);
       }
+      return sanitizeHTML(source.system);
     }
     return null;
   },

client/components/activities/comments.js

@@ -10,7 +10,61 @@ const commentFormIsOpen = new ReactiveVar(false);
 // Empty string means a new top-level comment.
 const replyToCommentId = new ReactiveVar('');
 
+// #5547: persist the comment draft (debounced) into UnsavedEdits while the user
+// types, so a comment in progress survives closing the card, clicking outside
+// it, or navigating away — the form prefills from {{getUnsavedValue
+// 'cardComment' ...}} on the next open. Historical note: the click-open flag
+// that armed the old escape-time draft save was removed in 2019 (3b3950369)
+// because the escape handler CLEARED the visible text; since then nothing saved
+// the draft at all, so any close of the card discarded the comment.
+let commentDraftTimer = null;
+let commentDraftPending = null; // { cardId, value }
+
+function commentDraftWrite({ cardId, value }) {
+  if (!cardId) return;
+  const draftKey = { fieldName: 'cardComment', docId: cardId };
+  if ((value || '').trim()) {
+    UnsavedEdits.set(draftKey, value);
+  } else {
+    UnsavedEdits.reset(draftKey);
+  }
+}
+
+function scheduleCommentDraftSave(cardId, value) {
+  commentDraftPending = { cardId, value };
+  if (commentDraftTimer) clearTimeout(commentDraftTimer);
+  commentDraftTimer = setTimeout(() => {
+    commentDraftTimer = null;
+    const pending = commentDraftPending;
+    commentDraftPending = null;
+    if (pending) commentDraftWrite(pending);
+  }, 300);
+}
+
+// Run a pending (debounced) save immediately — e.g. the card is closing.
+function flushCommentDraftSave() {
+  if (commentDraftTimer) {
+    clearTimeout(commentDraftTimer);
+    commentDraftTimer = null;
+  }
+  const pending = commentDraftPending;
+  commentDraftPending = null;
+  if (pending) commentDraftWrite(pending);
+}
+
+// Drop any pending save — the comment was submitted, so there is no draft.
+function cancelCommentDraftSave() {
+  if (commentDraftTimer) {
+    clearTimeout(commentDraftTimer);
+    commentDraftTimer = null;
+  }
+  commentDraftPending = null;
+}
+
 Template.commentForm.onDestroyed(function () {
+  // #5547: the card can close without the escape handler ever running (the X
+  // button, a route change); make sure the last keystrokes reach the draft.
+  flushCommentDraftSave();
   commentFormIsOpen.set(false);
   $('.note-popover').hide();
 });
@@ -28,6 +82,15 @@ Template.commentForm.helpers({
 });
 
 Template.commentForm.events({
+  // #5547: arm the escape handler below (it saves the draft and closes the
+  // form); this flag had no setter since 2019, so the handler never ran.
+  'focus .js-new-comment-input'() {
+    commentFormIsOpen.set(true);
+  },
+  // #5547: keep the draft continuously saved (debounced) while typing.
+  'input .js-new-comment-input'(evt) {
+    scheduleCommentDraftSave(Utils.getCurrentCardId(), evt.currentTarget.value);
+  },
   'submit .js-new-comment-form'(evt, tpl) {
     const input = tpl.$('.js-new-comment-input');
     const text = input.val().trim();
@@ -48,6 +111,13 @@ Template.commentForm.events({
         cardId,
         parentId: parentId || '',
       });
+      // #5547: the comment is saved — cancel any debounced draft save still in
+      // flight and remove the stored draft so it does not resurface next open.
+      cancelCommentDraftSave();
+      UnsavedEdits.reset({
+        fieldName: 'cardComment',
+        docId: Utils.getCurrentCardId(),
+      });
       replyToCommentId.set('');
       resetCommentInput(input);
       Tracker.flush();
@@ -159,13 +229,20 @@ EscapeActions.register(
       docId: Utils.getCurrentCardId(),
     };
     const commentInput = $('.js-new-comment-input');
-    const draft = commentInput.val().trim();
+    const draft = (commentInput.val() || '').trim();
+    cancelCommentDraftSave();
     if (draft) {
       UnsavedEdits.set(draftKey, draft);
     } else {
       UnsavedEdits.reset(draftKey);
     }
-    resetCommentInput(commentInput);
+    // #5547: do NOT clear the input — clearing it on every click outside the
+    // comment box is exactly the "comment text disappearing" bug that got this
+    // handler disarmed in 2019 (3b3950369). The draft is saved above; if the
+    // card stays open, the text stays visible; if the card closes, the next
+    // open prefills the form from the draft.
+    commentInput.blur();
+    commentFormIsOpen.set(false);
   },
   () => {
     return commentFormIsOpen.get();

client/components/boards/boardArchive.jade

@@ -4,14 +4,22 @@ template(name="archivedBoards")
       i.fa.fa-archive
     | {{_ 'archived-boards'}}
 
+  .admin-report-controls
+    input.js-archived-boards-search(type="search" placeholder="{{_ 'search'}}")
+    .admin-report-pagination
+      button.js-archived-boards-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
+        | <
+      span.admin-report-page-info {{currentPage}} / {{totalPages}}
+      button.js-archived-boards-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
+        | >
   ul.archived-lists
     each archivedBoards
       li.archived-lists-item
         div.board-header-btns
-          button.primary.board-header-btn.js-delete-board
+          button.primary.board-header-btn.js-delete-board(type="submit")
             i.fa.fa-trash
             | {{_ 'delete-board'}}
-          button.primary.board-header-btn.js-restore-board
+          button.primary.board-header-btn.js-restore-board(type="submit")
             i.fa.fa-undo
             | {{_ 'restore-board'}}
           = title

client/components/boards/boardArchive.js

@@ -3,8 +3,22 @@ import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import Boards from '/models/boards';
 import { Utils } from '/client/lib/utils';
 
+const ARCHIVED_BOARDS_PER_PAGE = 30;
+
 Template.archivedBoards.onCreated(function () {
-  this.subscribe('archivedBoards');
+  // Server-side pagination: only the current page of archived boards is ever
+  // published/loaded, so a long-lived instance's archive stays fast.
+  this.page = new ReactiveVar(1);
+  this.total = new ReactiveVar(0);
+  this.searchQuery = new ReactiveVar('');
+  this.autorun(() => {
+    const searchTerm = this.searchQuery.get();
+    const skip = (this.page.get() - 1) * ARCHIVED_BOARDS_PER_PAGE;
+    this.subscribe('archivedBoards', searchTerm, ARCHIVED_BOARDS_PER_PAGE, skip);
+    Meteor.call('getArchivedBoardsCount', searchTerm, (err, count) => {
+      if (!err) this.total.set(count || 0);
+    });
+  });
 });
 
 Template.archivedBoards.helpers({
@@ -13,17 +27,42 @@ Template.archivedBoards.helpers({
   },
 
   archivedBoards() {
-    const ret = ReactiveCache.getBoards(
+    // Only the current page is in minimongo (the publication is limited).
+    return ReactiveCache.getBoards(
       { archived: true },
-      {
-        sort: { archivedAt: -1, modifiedAt: -1 },
-      },
+      { sort: { archivedAt: -1, modifiedAt: -1 } },
     );
-    return ret;
+  },
+
+  currentPage() { return Template.instance().page.get(); },
+  totalPages() { return Math.max(1, Math.ceil((Template.instance().total.get() || 0) / ARCHIVED_BOARDS_PER_PAGE)); },
+  hasPrevPage() { return Template.instance().page.get() > 1; },
+  hasNextPage() {
+    const tpl = Template.instance();
+    return tpl.page.get() < Math.max(1, Math.ceil((tpl.total.get() || 0) / ARCHIVED_BOARDS_PER_PAGE));
   },
 });
 
 Template.archivedBoards.events({
+  'keydown .js-archived-boards-search'(event, tpl) {
+    if (event.keyCode === 13) {
+      event.preventDefault();
+      tpl.searchQuery.set(tpl.$('.js-archived-boards-search').val() || '');
+      tpl.page.set(1);
+    }
+  },
+  'click .js-archived-boards-prev-page'(event, tpl) {
+    event.preventDefault();
+    const current = tpl.page.get();
+    if (current > 1) tpl.page.set(current - 1);
+  },
+  'click .js-archived-boards-next-page'(event, tpl) {
+    event.preventDefault();
+    const total = tpl.total.get() || 0;
+    const totalPages = Math.max(1, Math.ceil(total / ARCHIVED_BOARDS_PER_PAGE));
+    const current = tpl.page.get();
+    if (current < totalPages) tpl.page.set(current + 1);
+  },
   async 'click .js-restore-board'() {
     // TODO : Make isSandstorm variable global
     const isSandstorm =

client/components/boards/boardBody.css

@@ -316,7 +316,19 @@ body.desktop-mode .board-wrapper .board-canvas .board-overlay {
   display: none !important;
   pointer-events: none !important;
 }
-.board-wrapper .board-canvas.is-dragging-active .open-minicard-composer,
+/* #2877 "Wekan swimlane jumps when moving card": while a card is dragged the
+   "+ Add Card" composer link is hidden, but hiding it with `display: none`
+   collapsed the bottom row of EVERY list at drag start (and restored it on
+   drop). With auto-height swimlanes the whole swimlane shrank/grew by the
+   composer's height, so all swimlanes below visibly jumped up and back down.
+   `visibility: hidden` hides the link just the same but keeps its box in the
+   layout, so nothing moves when a drag starts or ends. */
+.board-wrapper .board-canvas.is-dragging-active .open-minicard-composer {
+  visibility: hidden;
+}
+/* Checked cards of a multi-selection ARE the payload being dragged, so
+   removing them from the flow (showing the list as it will look after the
+   drop) is intentional — keep display: none here. */
 .board-wrapper .board-canvas.is-dragging-active .minicard-wrapper.is-checked {
   display: none;
 }

client/components/boards/boardBody.jade

@@ -23,7 +23,7 @@ template(name="boardBody")
     if debugBoardState
       .debug-info(style="position: fixed; top: 0; inset-inline-start: 0; background: rgba(0,0,0,0.8); color: white; padding: 10px; z-index: 9999; font-size: 12px;")
         | {{_ 'board'}}: {{currentBoard.title}} | {{_ 'view'}}: {{boardView}} | {{_ 'has-swimlanes'}}: {{hasSwimlanes}} | {{_ 'swimlanes'}}: {{currentBoard.swimlanes.length}}
-    .board-wrapper(class=currentBoard.colorClass class="{{#if isMiniScreen}}mobile-view{{/if}}")
+    .board-wrapper(class="{{#if currentUser.globalThemeColorClass}}{{currentUser.globalThemeColorClass}}{{else}}{{currentBoard.colorClass}}{{/if}}" class="{{#if isMiniScreen}}mobile-view{{/if}}")
       .board-canvas.js-swimlanes.dragscroll(
         class="{{#if Sidebar.isOpen}}is-sibling-sidebar-open{{/if}}"
         class="{{#if MultiSelection.isActive}}is-multiselection-active{{/if}}"
@@ -52,6 +52,8 @@ template(name="boardBody")
           +ganttView
         else if isViewTable
           +tableView
+        else if isViewStats
+          +statsView
         else
           // Default view - show swimlanes if they exist, otherwise show lists
           if hasSwimlanes

client/components/boards/boardBody.js

@@ -6,11 +6,13 @@ import '/client/lib/dragscrollTouch';
 import { boardConverter } from '/client/lib/boardConverter';
 import { formatDateByUserPreference } from '/imports/lib/dateUtils';
 import { toFullCalendarFirstDay } from '/client/lib/calendarFirstDay';
+import { weekNumberByFirstDay } from '/models/lib/weekStart';
 import Swimlanes from '/models/swimlanes';
 import Lists from '/models/lists';
 import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { Utils } from '/client/lib/utils';
+import { Filter } from '/client/lib/filter';
 
 // SubsManager removed for Meteor 3 migration
 const { calculateIndex } = Utils;
@@ -71,6 +73,9 @@ Template.board.onCreated(function () {
     }
 
     const handle = Meteor.subscribe('board', currentBoardId, false);
+    // Learn this board's card-loading mode (lazy vs eager) so 'auto' can decide
+    // per board by size; the flag drives isLazyCards(boardId). #6480.
+    Meteor.subscribe('boardCardsLoadingMode', currentBoardId);
     const ready = handle.ready();
     this.isBoardReady.set(ready);
 
@@ -568,17 +573,32 @@ Template.boardBody.onRendered(function () {
         $swimlanesDom.sortable('option', 'handle', '.swimlane-header');
       }
 
-      // Disable drag-dropping if the current user is not a board member
+      // #6446: enable swimlane drag-drop — which also carries moving cards BETWEEN
+      // swimlanes — for any board member with write access, not only board admins.
+      // The old !isBoardAdmin() check disabled this sortable for every non-admin, so
+      // a normal member could still move a card WITHIN a swimlane but not BETWEEN
+      // swimlanes (a card crossing swimlanes is received across this sortable), and
+      // could not reorder swimlanes. canModifyCard() is the client write-access
+      // predicate (board member, not comment-only / worker / read-only), matching
+      // the server's allowIsBoardMemberWithWriteAccess.
       $swimlanesDom.sortable(
         'option',
         'disabled',
-        !ReactiveCache.getCurrentUser()?.isBoardAdmin(),
+        !Utils.canModifyCard(),
       );
     }
   });
 
   dragscroll.reset();
-  Utils.setBackgroundImage();
+  // #4978: apply the board background inside a reactive autorun instead of a
+  // one-shot call. Switching directly between boards (e.g. the favorites bar)
+  // reuses this template instance and never re-fires onRendered, so the
+  // background used to stay on the previously shown board. Reading the current
+  // board inside setBackgroundImage() tracks both board switches and background
+  // edits; it performs no DB writes, so there is no autorun write loop.
+  this.autorun(() => {
+    Utils.setBackgroundImage();
+  });
 });
 
 Template.boardBody.onDestroyed(function () {
@@ -688,6 +708,19 @@ Template.boardBody.helpers({
     return boardView === 'board-view-table';
   },
 
+  isViewStats() {
+    const currentUser = ReactiveCache.getCurrentUser();
+    let boardView;
+
+    if (currentUser) {
+      boardView = (currentUser.profile || {}).boardView;
+    } else {
+      boardView = window.localStorage.getItem('boardView');
+    }
+
+    return boardView === 'board-view-stats';
+  },
+
   hasSwimlanes() {
     const currentBoard = Utils.getCurrentBoard();
     if (!currentBoard) {
@@ -929,6 +962,11 @@ Template.calendarView.onRendered(function () {
   document.documentElement.dir = TAPi18n.getLanguageDirection();
 
   this.autorun(function () {
+    // #5656: refetch calendar events whenever the active board Filter changes
+    // so the Calendar view stays in sync with the other views. Reading the
+    // Filter's reactive state here establishes the dependency; the events()
+    // callback below applies the actual selector.
+    Filter.isActive();
     const calendarEl = document.getElementById('calendar-view');
     if (calendarEl && calendarEl._wekanCalendar) {
       calendarEl._wekanCalendar.refetchEvents();
@@ -959,6 +997,12 @@ Template.calendarView.helpers({
       editable: true,
       selectable: true,
       weekNumbers: true,
+      // #4946: FullCalendar's default weekNumberCalculation is locale-based
+      // (Sunday-anchored for many locales), so the week-number column ignored
+      // the user's start-day-of-week setting even though `firstDay` moved the
+      // grid. Compute the number from the SAME firstDay so the label matches the
+      // way the week is laid out.
+      weekNumberCalculation: date => weekNumberByFirstDay(date, firstDay),
       // Use non-localized AM/PM time format to avoid confusing notations like 上/下/中
       // Use full 'am'/'pm' instead of single-letter 'a'/'p' for clarity
       eventTimeFormat: {
@@ -1002,6 +1046,12 @@ Template.calendarView.helpers({
       isRTL: TAPi18n.isRTL(),
       events(fetchInfo, callback) {
         const currentBoard = Utils.getCurrentBoard();
+        // #5656: apply the active board Filter (member / assignee / due-date /
+        // label / custom-field) so the Calendar view shows the same scoped set
+        // of cards as the Board / Lists / Swimlanes views.
+        const filterSelector = Filter.isActive()
+          ? Filter._getMongoSelector()
+          : undefined;
         const events = [];
         const pushEvent = function (card, title, start, end, extraCls) {
           start = start || card.startAt;
@@ -1026,12 +1076,12 @@ Template.calendarView.helpers({
           });
         };
         currentBoard
-          .cardsInInterval(fetchInfo.start, fetchInfo.end)
+          .cardsInInterval(fetchInfo.start, fetchInfo.end, filterSelector)
           .forEach(function (card) {
             pushEvent(card);
           });
         currentBoard
-          .cardsDueInBetween(fetchInfo.start, fetchInfo.end)
+          .cardsDueInBetween(fetchInfo.start, fetchInfo.end, filterSelector)
           .forEach(function (card) {
             pushEvent(
               card,

client/components/boards/boardHeader.jade

@@ -23,15 +23,16 @@ template(name="boardHeaderBar")
                 i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
                 span {{_ currentBoard.permission}}
 
-              a.board-header-btn.js-watch-board(
-                title="{{_ watchLevel }}")
-                if $eq watchLevel "watching"
-                  i.fa.fa-eye
-                if $eq watchLevel "tracking"
-                  i.fa.fa-bell
-                if $eq watchLevel "muted"
-                  i.fa.fa-bell-slash
-                span {{_ watchLevel}}
+              unless watchDisabled
+                a.board-header-btn.js-watch-board(
+                  title="{{_ watchLevel }}")
+                  if $eq watchLevel "watching"
+                    i.fa.fa-eye
+                  if $eq watchLevel "tracking"
+                    i.fa.fa-bell
+                  if $eq watchLevel "muted"
+                    i.fa.fa-bell-slash
+                  span {{_ watchLevel}}
               a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
                 title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}} {{_ 'starred-boards-description'}}")
                 i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
@@ -67,14 +68,15 @@ template(name="boardHeaderBar")
                 title="{{_ currentBoard.permission}}")
                 i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
 
-              a.board-header-btn.js-watch-board(
-                title="{{_ watchLevel }}")
-                if $eq watchLevel "watching"
-                  i.fa.fa-eye
-                if $eq watchLevel "tracking"
-                  i.fa.fa-bell
-                if $eq watchLevel "muted"
-                  i.fa.fa-bell-slash
+              unless watchDisabled
+                a.board-header-btn.js-watch-board(
+                  title="{{_ watchLevel }}")
+                  if $eq watchLevel "watching"
+                    i.fa.fa-eye
+                  if $eq watchLevel "tracking"
+                    i.fa.fa-bell
+                  if $eq watchLevel "muted"
+                    i.fa.fa-bell-slash
               a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
                 title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}} {{_ 'starred-boards-description'}}")
                 i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
@@ -129,6 +131,8 @@ template(name="boardHeaderBar")
               i.fa.fa-bar-chart
             if $eq boardView 'board-view-table'
               i.fa.fa-table
+            if $eq boardView 'board-view-stats'
+              i.fa.fa-pie-chart
             span
               if $eq boardView 'board-view-swimlanes'
                 | {{_ 'swimlanes'}}
@@ -140,6 +144,8 @@ template(name="boardHeaderBar")
                 | {{_ 'gantt'}}
               if $eq boardView 'board-view-table'
                 | {{_ 'board-view-table'}}
+              if $eq boardView 'board-view-stats'
+                | {{_ 'board-view-stats'}}
         a.board-header-btn.js-toggle-dependencies(
             title="{{#if currentBoard.showDependencies}}{{_ 'hide-dependencies'}}{{else}}{{_ 'show-dependencies'}}{{/if}}"
             class="{{#if currentBoard.showDependencies}}emphasis{{/if}}")
@@ -157,6 +163,8 @@ template(name="boardHeaderBar")
                 i.fa.fa-times-thin
 
         .separator
+        //- Board Settings cog removed: Board Settings is available in the right
+        //- sidebar (the hamburger), so the header no longer duplicates it.
         a.board-header-btn.js-toggle-sidebar(title="{{_ 'sidebar-open'}} {{_ 'or'}} {{_ 'sidebar-close'}}")
           i.fa.fa-bars
 
@@ -247,6 +255,13 @@ template(name="boardChangeViewPopup")
           | {{_ 'board-view-table'}}
           if $eq Utils.boardView "board-view-table"
             i.fa.fa-check
+    li
+      with "board-view-stats"
+        a.js-open-stats-view
+          i.fa.fa-pie-chart
+          | {{_ 'board-view-stats'}}
+          if $eq Utils.boardView "board-view-stats"
+            i.fa.fa-check
 
 template(name="createBoard")
   form
@@ -267,9 +282,10 @@ template(name="createBoard")
           | {{{_ 'board-private-info'}}}
         a.js-change-visibility {{_ 'change'}}.
     input.primary.wide(type="submit" value="{{_ 'create'}}")
-    span.quiet
-      | {{_ 'or'}}
-      a.js-import-board {{_ 'import'}}
+    unless importDisabled
+      span.quiet
+        | {{_ 'or'}}
+        a.js-import-board {{_ 'import'}}
     span.quiet
       | /
       a.js-board-template {{_ 'template'}}
@@ -293,9 +309,10 @@ template(name="createBoardPopup")
           | {{{_ 'board-private-info'}}}
         a.js-change-visibility {{_ 'change'}}.
     input.primary.wide(type="submit" value="{{_ 'create'}}")
-    span.quiet
-      | {{_ 'or'}}
-      a.js-import-board {{_ 'import'}}
+    unless importDisabled
+      span.quiet
+        | {{_ 'or'}}
+        a.js-import-board {{_ 'import'}}
     span.quiet
       | /
       a.js-board-template {{_ 'template'}}
@@ -319,9 +336,10 @@ template(name="headerBarCreateBoardPopup")
           | {{{_ 'board-private-info'}}}
         a.js-change-visibility {{_ 'change'}}.
     input.primary.wide(type="submit" value="{{_ 'create'}}")
-    span.quiet
-      | {{_ 'or'}}
-      a.js-import-board {{_ 'import'}}
+    unless importDisabled
+      span.quiet
+        | {{_ 'or'}}
+        a.js-import-board {{_ 'import'}}
     span.quiet
       | /
       a.js-board-template {{_ 'template'}}
@@ -346,9 +364,10 @@ template(name="createTemplateContainerPopup")
           | {{{_ 'board-private-info'}}}
         a.js-change-visibility {{_ 'change'}}.
     input.primary.wide(type="submit" value="{{_ 'create'}}")
-    span.quiet
-      | {{_ 'or'}}
-      a.js-import-board {{_ 'import'}}
+    unless importDisabled
+      span.quiet
+        | {{_ 'or'}}
+        a.js-import-board {{_ 'import'}}
     span.quiet
       | /
       a.js-board-template {{_ 'template'}}

client/components/boards/boardHeader.js

@@ -130,7 +130,6 @@ Template.boardHeaderBar.events({
       Meteor.call('toggleBoardStar', boardId);
     }
   },
-  'click .js-open-board-menu': Popup.open('boardMenu'),
   'click .js-change-visibility': Popup.open('boardChangeVisibility'),
   'click .js-watch-board': Popup.open('boardChangeWatch'),
   'click .js-open-archived-board'() {
@@ -249,6 +248,10 @@ Template.boardChangeViewPopup.events({
     Utils.setBoardView('board-view-table');
     Popup.back();
   },
+  'click .js-open-stats-view'() {
+    Utils.setBoardView('board-view-stats');
+    Popup.back();
+  },
 });
 
 // Shared setup for all create board popups

client/components/boards/boardsList.css

@@ -1,13 +1,5 @@
 @import url("../../../public/css/reset.css") print, screen;
 
-/* Board List Header with Zoom Controls */
-.board-list-header {
-  display: flex;
-  justify-content: center;
-  margin: 1vh 0 2vh 0;
-  padding: 1vh 0;
-}
-
 /* Two-column layout for All Boards */
 .boards-layout {
   display: grid;
@@ -260,6 +252,9 @@
   align-items: center;
   justify-content: space-between;
   gap: 8px;
+  /* Wrap to a 2nd row on narrow windows so the search box and the Sort /
+     Multi-Selection / Clear buttons stay visible instead of overflowing. */
+  flex-wrap: wrap;
   padding: 12px 16px;
   margin-bottom: 16px;
   background: #f5f5f5;
@@ -273,6 +268,46 @@
   align-items: center;
   gap: 8px;
   flex: 1;
+  min-width: 0; /* allow shrinking so path-right can wrap below instead of overflowing */
+  flex-wrap: wrap; /* the multi-selection hint wraps under the title when tight */
+}
+
+/* Keep the folder icon and the menu title (e.g. "Remaining") on ONE line, the
+   title to the RIGHT of the icon — never let flex-wrap stack them vertically. */
+.boards-path-header .path-title {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  white-space: nowrap;
+}
+
+/* Multi-Selection button with its hint stacked underneath (own column). */
+.boards-path-header .multiselection-group {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 4px;
+}
+
+/* "Selected:" actions row (star / home) below the Multi-Selection button. */
+.boards-path-header .selected-actions {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+.boards-path-header .selected-label {
+  font-size: 13px;
+  color: #333;
+}
+.boards-path-header .selected-action {
+  cursor: pointer;
+  color: #333;
+  font-size: 16px;
+  line-height: 1;
+  padding: 2px 4px;
+}
+.boards-path-header .selected-action:hover {
+  color: #2980b9;
 }
 
 .boards-path-header .multiselection-hint {
@@ -295,6 +330,10 @@
   display: flex;
   align-items: center;
   gap: 8px;
+  /* Buttons (Sort / Multi-Selection / Clear) wrap among themselves too, so none
+     is ever cut off on a narrow window. */
+  flex-wrap: wrap;
+  justify-content: flex-end;
 }
 
 /* #5799: board-name search box in the All Boards header */
@@ -306,6 +345,9 @@
   background: #fff;
   border: 1px solid #ddd;
   border-radius: 4px;
+  /* Roughly half the previous width; the input flexes to fill what's left. */
+  width: 300px;
+  max-width: 100%;
 }
 
 .boards-path-header .board-search input {
@@ -313,7 +355,11 @@
   outline: none;
   background: transparent;
   font-size: 14px;
-  min-width: 140px;
+  flex: 1 1 auto;
+  min-width: 0;
+  /* Nudge the text down so it sits at the vertical middle of the field. */
+  position: relative;
+  top: 8px;
 }
 
 .boards-path-header .board-search .board-search-clear {
@@ -517,19 +563,33 @@
   overflow: hidden;
   background-color: inherit; /* Inherit board color from parent li.js-board */
   color: #f6f6f6;
-  min-height: 100px;
+  min-height: 72px; /* #6465: thinner tiles so more boards fit in the overview */
   font-size: 16px;
   line-height: 22px;
   border-radius: 0; /* No border-radius - parent .js-board has it */
   display: block;
   font-weight: 700;
-  padding: 36px 8px 32px 8px; /* Top padding for drag handle, bottom for checkbox */
+  padding: 24px 8px 18px 8px; /* #6465: trimmed; top leaves room for the drag handle, bottom for the checkbox */
   margin: 0; /* No margin - moved to parent .js-board */
   position: relative;
   text-decoration: none;
   word-wrap: break-word;
 }
 
+/* #2220: Home-board badge — a home icon centred at the top of the board tile. */
+.board-list .board-home-badge {
+  position: absolute;
+  top: 2px;
+  left: 50%;
+  transform: translateX(-50%);
+  z-index: 3;
+  color: #fff;
+  font-size: 14px;
+  line-height: 1;
+  text-shadow: 0 1px 2px rgba(0, 0, 0, 0.45);
+  pointer-events: none;
+}
+
 .board-list .board-list-item > .js-open-board {
   text-decoration: none;
   color: inherit;
@@ -561,16 +621,27 @@
 }
 .board-list .js-add-board .label {
   font-weight: normal;
-  line-height: 56px;
-  min-height: 100px;
+  /* Match the board tiles (#6465 thinner tiles) so the grey "+ Add Board" /
+     "+ Add Template Container" box is the same height as a board icon:
+     same min-height, padding and line-height as .board-list-item above. */
+  line-height: 22px;
+  min-height: 72px;
   display: flex;
   align-items: center;
   justify-content: center;
   background-color: #999; /* Darker background for better text contrast */
   border-radius: 3px;
-  padding: 36px 8px 32px 8px;
+  /* Same total vertical padding as .board-list-item (42px -> same tile height),
+     but shifted up (top 24->18, bottom 18->24) so the "+ Add Board" text sits
+     higher. */
+  padding: 18px 8px 24px 8px;
   color: #fff; /* White text */
 }
+/* "+ Add Template Container" text sits 2px lower than "+ Add Board" (same 42px
+   total vertical padding, so the tile height is unchanged). */
+.board-list .js-add-board .label.is-template-container {
+  padding: 20px 8px 22px 8px;
+}
 .board-list .js-add-board .label i {
   color: #fff; /* White icon */
 }
@@ -668,12 +739,14 @@
 .board-list .board-handle {
   position: absolute;
   padding: 4px 6px;
-  top: 4px;
-  left: 50%;
-  transform: translateX(-50%);
+  /* Right middle of the tile (matches the mobile/small-screen handle position). */
+  top: 50%;
+  inset-inline-end: 6px;
+  transform: translateY(-50%);
   font-size: 14px;
   color: #fff;
-  background: rgba(0,0,0,0.4);
+  /* Transparent background so only the drag-handle icon shows (not a box). */
+  background: transparent;
   border-radius: 4px;
   display: flex;
   align-items: center;
@@ -812,20 +885,25 @@ body.grey-icons-enabled .checkmark-no-grey {
 
 /* Mobile view styles - applied when isMiniScreen is true (iPhone, etc.) */
 .board-list.mobile-view {
+  /* #6488: a real 2-column grid — robust regardless of float support or how narrow
+     the boards column is (at least 2 board icons per row on phones). */
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 8px;
   height: calc(100vh - 120px);
-  overflow-y: scroll !important;
+  overflow-y: auto !important;
   overflow-x: hidden;
-  padding: 0 1rem;
+  padding: 0 0.5rem;
   margin: 0;
   scrollbar-width: auto !important;
   scrollbar-color: #888 #f1f1f1;
 }
 .board-list.mobile-view li {
-  width: 100%;
+  width: auto; /* the grid controls the column width */
   float: none;
   display: block;
-  margin-bottom: 1rem;
-  padding-inline-end: 50px; /* Space for drag handle */
+  margin-bottom: 0.5rem;
+  padding-inline-end: 32px; /* Space for drag handle */
 }
 .board-list.mobile-view .board-list-item {
   overflow: visible;
@@ -893,11 +971,6 @@ body.grey-icons-enabled .checkmark-no-grey {
   background: #555 !important;
 }
 
-/* Force mobile view to have scrollable content */
-.board-list.mobile-view {
-  min-height: 100vh; /* Force content to be tall enough to scroll */
-}
-
 /* Hide archive and clone board buttons in mobile view */
 .board-list.mobile-view .js-archive-board,
 .board-list.mobile-view .js-clone-board {
@@ -910,38 +983,41 @@ body.grey-icons-enabled .checkmark-no-grey {
   font-family: inherit !important;
 }
 
-.board-list.mobile-view::after {
-  content: '';
-  display: block;
-  height: 100px;
-}
-
 @media screen and (max-width: 800px),
        screen and (max-device-width: 800px),
        screen and (-webkit-min-device-pixel-ratio: 2) and (max-width: 800px),
        screen and (max-width: 800px) and (orientation: portrait),
        screen and (max-width: 800px) and (orientation: landscape),
        screen and (max-device-width: 932px) and (-webkit-min-device-pixel-ratio: 3) {
+  /* #6488 + mobile layout: keep the left menu on the left but narrow (so the boards
+     get room), and show the board icons on the right at least 2 per row. */
+  .boards-layout {
+    grid-template-columns: minmax(84px, 30%) 1fr;
+    gap: 8px;
+  }
   .board-list {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 8px;
     height: 100%;
     overflow-y: auto;
     overflow-x: hidden;
-    padding: 0 1rem;
+    padding: 0 0.25rem;
     margin: 0;
   }
   .board-list li {
-    width: 100%;
+    width: auto; /* the grid controls the column width */
     float: none;
     display: block;
-    margin-bottom: 1rem;
-    padding-inline-end: 50px; /* Space for drag handle */
+    margin-bottom: 0.5rem;
+    padding-inline-end: 32px; /* Space for drag handle */
   }
   .board-list .board-list-item {
     overflow: visible;
     height: 8rem;
     width: 100%;
     margin: 0;
-    padding-inline-end: 50px; /* Ensure content doesn't overlap with drag handle */
+    padding-inline-end: 40px; /* Ensure content doesn't overlap with drag handle */
   }
 
   .board-list .board-list-item .details {
@@ -977,10 +1053,15 @@ body.grey-icons-enabled .checkmark-no-grey {
     background: rgba(255, 255, 0, 0.8) !important; /* Yellow hover */
   }
 }
-/* Very small screens - ensure one board per row */
+/* Very small screens - still keep at least 2 board icons per row (#6488). */
 @media screen and (max-width: 360px) {
+  .board-list {
+    display: grid !important;
+    grid-template-columns: repeat(2, minmax(0, 1fr)) !important;
+    gap: 6px;
+  }
   .board-list li {
-    width: 100% !important;
+    width: auto !important;
     float: none !important;
     display: block !important;
   }
@@ -1009,20 +1090,16 @@ body.grey-icons-enabled .checkmark-no-grey {
        screen and (max-width: 800px) and (orientation: portrait),
        screen and (max-width: 800px) and (orientation: landscape),
        screen and (max-device-width: 932px) and (-webkit-min-device-pixel-ratio: 3) {
-  /* Stack the two-column All Boards layout on small screens. The fixed
-     "260px 1fr" grid had no mobile collapse, so on narrow non-iPhone browsers
-     (Fairphone Firefox ESR / Ubuntu Touch Morph, narrow desktop) it overflowed
-     and the left menu (Starred / Templates / Remaining / Workspaces / + Add
-     board) was clipped. Width-based, so it applies to every browser. */
+  /* #6488: KEEP the two-column layout (narrow left menu, board icons on the RIGHT)
+     on small touch screens — do NOT stack the boards below the menu. Stacking pushed
+     the board icons under the menu + search bar, and dragscroll does not work over
+     the menu / search area, so boards below the fold were unreachable (you could not
+     drag-scroll down to them). The narrow minmax() menu set in the block above
+     already prevents the old fixed-260px overflow that used to clip the left menu, so
+     collapsing to one column is no longer needed. The board list stays in its own
+     right-hand column with its own overflow-y:auto scroll. */
   .boards-layout {
-    grid-template-columns: 1fr !important;
-  }
-
-  .boards-left-menu {
-    border-inline-end: none !important;
-    border-bottom: 1px solid #e0e0e0;
-    padding-inline-end: 0 !important;
-    padding-bottom: 12px;
+    grid-template-columns: minmax(84px, 30%) 1fr !important;
   }
 }
 .AllBoardTeamsOrgs {
@@ -1078,6 +1155,13 @@ body.grey-icons-enabled .checkmark-no-grey {
   margin: 8px; /* Space between board items */
 }
 
+/* #6439: highlight the board a dragged board will be dropped before, when
+   reordering in the Custom (drag order) sort mode. */
+.js-board.board-reorder-over {
+  outline: 2px dashed #3498db;
+  outline-offset: 2px;
+}
+
 /* Reset background for add-board button */
 .js-add-board {
   background-color: transparent !important;
@@ -1139,13 +1223,31 @@ body.grey-icons-enabled .checkmark-no-grey {
     height: 100vh;
   }
 
+  /* The left menu (Starred / Templates / Remaining / Workspaces / Add board) is its
+     own vertical scroll area, so when it is taller than the screen you can drag-scroll
+     down to its lower items — the board icons already scroll in their own column on the
+     right. Both columns are reachable in LTR and RTL: the grid columns and the logical
+     inline borders mirror automatically, so in RTL the menu is on the right and the
+     boards on the left. */
+  .boards-left-menu {
+    overflow-y: auto;
+    overflow-x: hidden;
+    -webkit-overflow-scrolling: touch;
+    max-height: calc(100vh - 120px);
+  }
+
   .board-list {
-    overflow-y: scroll !important;
+    overflow-y: auto !important;
     overflow-x: hidden !important;
     -webkit-overflow-scrolling: touch;
     scrollbar-width: thin;
     scrollbar-color: #888 #f1f1f1;
-    height: calc(100vh - 120px); /* Ensure there's content to scroll */
+    /* #6488: a BOUNDED height so the boards overflow and scroll. The old rule set
+       min-height:100vh (plus a phantom ::after), which grew the list to fit all its
+       content — so nothing overflowed and, clipped by the overflow:hidden wrapper,
+       boards below the fold were unreachable. */
+    height: calc(100vh - 120px);
+    max-height: calc(100vh - 120px);
   }
 
   /* Force scrollbar to always be visible */
@@ -1182,14 +1284,8 @@ body.grey-icons-enabled .checkmark-no-grey {
   .board-list {
     scrollbar-gutter: stable;
     scrollbar-width: auto !important;
-    min-height: 100vh; /* Force content to be tall enough to scroll */
-  }
-
-  /* Ensure there's always content to scroll */
-  .board-list::after {
-    content: '';
-    display: block;
-    height: 100px;
+    /* NOTE: no min-height/::after here — the bounded height above is what makes the
+       list scroll; forcing it 100vh tall would defeat that (see #6488). */
   }
 
   /* Ensure only one scrollbar is visible */

client/components/boards/boardsList.jade

@@ -1,7 +1,5 @@
 template(name="boardList")
   .wrapper
-    .board-list-header
-
     .boards-layout
       // Left menu
       .boards-left-menu
@@ -77,26 +75,11 @@ template(name="boardList")
       .boards-right-grid
         .boards-path-header
           .path-left
-            span.path-icon.emoji-icon {{currentMenuPath.icon}}
-            span.path-text {{currentMenuPath.text}}
-            if BoardMultiSelection.isActive
-              span.multiselection-hint
-                span.emoji-icon
-                  i.fa.fa-thumb-tack
-                |  {{_ 'multi-selection-active'}}
+            span.path-title
+              span.path-icon.emoji-icon {{currentMenuPath.icon}}
+              span.path-text {{currentMenuPath.text}}
           .path-right
-            .board-search
-              span.emoji-icon
-                i.fa.fa-search
-              input.js-board-search-input(type="text" placeholder="{{_ 'search-boards'}}" value="{{boardSearch}}" autocomplete="off")
-              if boardSearch
-                a.board-search-clear.js-board-search-clear(title="{{_ 'filter-clear'}}")
-                  span.emoji-icon
-                    i.fa.fa-times
-            a.board-header-btn.js-open-boards-sort(title="{{_ 'sort-boards'}}" class="{{#unless isBoardsSort 'custom'}}emphasis{{/unless}}")
-              span.emoji-icon
-                i.fa.fa-sort-alpha-asc
-              span {{_ 'sort'}}
+            //- Order (left -> right): Multi-Selection, Sort, Search boards.
             if canModifyBoards
               if hasBoardsSelected
                 button.js-archive-selected-boards.board-header-btn
@@ -107,13 +90,41 @@ template(name="boardList")
                   span.emoji-icon
                     i.fa.fa-clipboard
                   span {{_ 'duplicate-board'}}
-              a.board-header-btn.js-multiselection-activate(
-                title="{{#if BoardMultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}"
-                class="{{#if BoardMultiSelection.isActive}}emphasis{{/if}}")
-                span.emoji-icon
+              //- Multi-Selection button, with the "click checkboxes" hint stacked
+                directly BELOW it (own column) instead of beside the path title.
+              .multiselection-group
+                a.board-header-btn.js-multiselection-activate(
+                  title="{{#if BoardMultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}"
+                  class="{{#if BoardMultiSelection.isActive}}emphasis{{/if}}")
                   i.fa.fa-check-square-o
-              if BoardMultiSelection.isActive
-                a.board-header-btn-close.js-multiselection-reset(title="{{_ 'filter-clear'}}")
+                  span {{#if BoardMultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}
+                  if BoardMultiSelection.isActive
+                    a.board-header-btn-close.js-multiselection-reset(title="{{_ 'filter-clear'}}")
+                      i.fa.fa-times-thin
+                if BoardMultiSelection.isActive
+                  span.multiselection-hint
+                    span.emoji-icon
+                      i.fa.fa-thumb-tack
+                    |  {{_ 'multi-selection-active'}}
+                  //- "Selected:" actions on the multi-selected boards: star them,
+                    or set one as the Home board (opened after login, #2220).
+                  .selected-actions
+                    span.selected-label {{_ 'selected-label'}}
+                    a.selected-action.js-star-selected(title="{{_ 'set-selected-starred'}}")
+                      i.fa.fa-star
+                    a.selected-action.js-home-selected(title="{{_ 'set-selected-home'}}")
+                      i.fa.fa-home
+            a.board-header-btn.js-open-boards-sort(title="{{_ 'sort-boards'}}" class="{{#unless isBoardsSort 'custom'}}emphasis{{/unless}}")
+              span.emoji-icon
+                i.fa.fa-sort-alpha-asc
+              span {{_ 'sort'}}
+            //- Search boards is placed to the RIGHT of the Multi-Selection button.
+            .board-search
+              span.emoji-icon
+                i.fa.fa-search
+              input.js-board-search-input(type="text" placeholder="{{_ 'search-boards'}}" value="{{boardSearch}}" autocomplete="off")
+              if boardSearch
+                a.board-search-clear.js-board-search-clear(title="{{_ 'filter-clear'}}")
                   span.emoji-icon
                     i.fa.fa-times
         if boardsPaginationActive
@@ -126,7 +137,7 @@ template(name="boardList")
         ul.board-list.clearfix.js-boards.dragscroll(class="{{#if isMiniScreen}}mobile-view{{/if}} {{#if BoardMultiSelection.isActive}}is-multiselection-active{{/if}}")
           li.js-add-board
             if isSelectedMenu 'templates'
-              a.board-list-item.label(title="{{_ 'add-template-container'}}")
+              a.board-list-item.label.is-template-container(title="{{_ 'add-template-container'}}")
                 span.emoji-icon
                   i.fa.fa-plus
                 |  {{_ 'add-template-container'}}
@@ -188,6 +199,11 @@ template(name="boardList")
                     if BoardMultiSelection.isActive
                       .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
                         class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
+                    //- #2220: the Home board (opened after login) is badged with a
+                      home icon at the top centre of its tile.
+                    if isDefaultBoard
+                      span.board-home-badge(title="{{_ 'home-board-badge'}}")
+                        i.fa.fa-home
                     span.board-handle.nodragscroll(title="{{boardWorkspaceDragHint}}")
                       span.emoji-icon
                         i.fa.fa-arrows
@@ -197,14 +213,19 @@ template(name="boardList")
                         span.board-list-item-name(title="{{boardOpenAndMoveHint}}")
                           +viewer
                             = title
+                        //- #5174 / #4825: the per-board allows* flags are
+                        //- resolved server-side into the one-shot tile data
+                        //- (the raw fields are not even published to this
+                        //- page), so the show* helpers below gate the whole
+                        //- block consistently for every board.
                         unless currentSetting.hideBoardMemberList
-                          if allowsBoardMemberList
+                          if showBoardMemberList _id
                             .minicard-members
                               each member in boardMembers _id
                                 a.name
                                   +userAvatar(userId=member noRemove=true)
                         unless currentSetting.hideCardCounterList
-                          if allowsCardCounterList
+                          if showCardCounterList _id
                             .minicard-lists.flex.flex-wrap
                               each list in boardLists _id
                                 .item
@@ -223,6 +244,8 @@ template(name="boardList")
                       title="{{_ 'star-board-title'}}")
                       span.emoji-icon
                         i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
+                    //- #2220 Home-board toggle is disabled: the icon and the
+                    //- set-default-board action are intentionally not rendered.
 
 template(name="boardsSortPopup")
   ul.pop-over-list

client/components/boards/boardsList.js

@@ -6,6 +6,10 @@ import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
 import { BoardMultiSelection } from '/client/lib/boardMultiSelection';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { Utils } from '/client/lib/utils';
+import {
+  isDragReorderEnabled,
+  computeReorderedSortIndex,
+} from '/models/lib/boardSortReorder';
 
 // SubsManager removed for Meteor 3 migration
 
@@ -59,6 +63,15 @@ const DEFAULT_WORKSPACE_ICON = '📁';
 // Matches the Admin Panel > People page size.
 const BOARDS_PER_PAGE = 25;
 
+// #6439: the effective All Boards sort mode for the current user, defaulting to
+// 'custom' (manual drag order) when unknown. Used to gate board drag-reordering.
+function currentAllBoardsSortBy() {
+  const cu = ReactiveCache.getCurrentUser();
+  return cu && typeof cu.getAllBoardsSortBy === 'function'
+    ? cu.getAllBoardsSortBy()
+    : 'custom';
+}
+
 function getCurrentWorkspacesTree() {
   const currentUser = ReactiveCache.getCurrentUser();
   const tree =
@@ -119,16 +132,6 @@ function saveWorkspace(workspaceId, { name, icon }) {
 }
 
 Template.boardList.helpers({
-  hideCardCounterList() {
-    /* Bug Board icons random dance https://github.com/wekan/wekan/issues/4214
-       return Utils.isMiniScreen() && Session.get('currentBoard'); */
-    return true;
-  },
-  hideBoardMemberList() {
-    /* Bug Board icons random dance https://github.com/wekan/wekan/issues/4214
-       return Utils.isMiniScreen() && Session.get('currentBoard'); */
-    return true;
-  },
   BoardMultiSelection() {
     return BoardMultiSelection;
   },
@@ -180,6 +183,15 @@ Template.boardList.onCreated(function () {
   Meteor.call('getMyShareableGroups', (err, res) => {
     if (!err && res) this.shareableGroups.set(res);
   });
+  // #5174 / #4825: per-board tile data (per-list card counts + member ids) for
+  // the All Boards tiles, computed server-side and fetched exactly ONCE here —
+  // deliberately NOT inside an autorun and NOT from reactive getLists/getCards
+  // cursors, so the #4214 "icons random dance" (a reactive re-render loop on
+  // this page, which is why the old helpers were stubbed out) cannot return.
+  this.boardTileDataVar = new ReactiveVar({});
+  Meteor.call('getAllBoardsTileData', (err, res) => {
+    if (!err && res) this.boardTileDataVar.set(res);
+  });
   let currUser = ReactiveCache.getCurrentUser();
   let userLanguage;
   if (currUser && currUser.profile) {
@@ -530,6 +542,21 @@ Template.boardList.helpers({
     const boards = ReactiveCache.getBoards(query, {});
     const currentUser = ReactiveCache.getCurrentUser();
 
+    // #2220: the Home board (opened after login) always appears FIRST in the
+    // Starred view, even when it has not been explicitly starred.
+    const withHomeFirst = (arr) => {
+      if (tpl.selectedMenu.get() !== 'starred') return arr;
+      if ((tpl.boardSearchVar.get() || '').trim()) return arr;
+      const homeId =
+        currentUser && typeof currentUser.getDefaultBoardId === 'function'
+          ? currentUser.getDefaultBoardId()
+          : null;
+      if (!homeId) return arr;
+      const homeBoard = ReactiveCache.getBoard(homeId);
+      if (!homeBoard || homeBoard.archived) return arr;
+      return [homeBoard, ...arr.filter((b) => b && b._id !== homeId)];
+    };
+
     // #5799: in a sorted (non-custom) mode the server already computed the
     // current page (filtered by menu/search and sorted), so render exactly that
     // ordered page of board icons. Custom (manual drag order) falls through to
@@ -540,9 +567,11 @@ Template.boardList.helpers({
         : 'custom';
     if (sortMode !== 'custom') {
       const paged = tpl.pagedBoardsVar.get();
-      return (paged.ids || [])
-        .map((id) => ReactiveCache.getBoard(id))
-        .filter(Boolean);
+      return withHomeFirst(
+        (paged.ids || [])
+          .map((id) => ReactiveCache.getBoard(id))
+          .filter(Boolean),
+      );
     }
 
     let list = boards;
@@ -579,37 +608,49 @@ Template.boardList.helpers({
     }
 
     if (currentUser && typeof currentUser.sortBoardsForUser === 'function') {
-      return currentUser.sortBoardsForUser(list);
+      return withHomeFirst(currentUser.sortBoardsForUser(list));
     }
-    return list
-      .slice()
-      .sort((a, b) => (a.title || '').localeCompare(b.title || ''));
+    return withHomeFirst(
+      list.slice().sort((a, b) => (a.title || '').localeCompare(b.title || '')),
+    );
   },
+  // #5174 / #4825: the board tiles' per-list card-count line and member avatar
+  // row. Data comes from the one-shot getAllBoardsTileData method fetch in
+  // onCreated (see there) — NOT from reactive getLists/getCards cursors, which
+  // caused the #4214 "icons random dance" and got these helpers stubbed to []
+  // (hiding the counters/avatars for everyone). The show* helpers resolve the
+  // per-board opt-in flags (allowsCardCounterList / allowsBoardMemberList,
+  // board sidebar "Show at All Boards page"), strictly, server-side — so a
+  // board with the checkbox off (or never set) consistently shows nothing.
   boardLists(boardId) {
-    /* Bug Board icons random dance https://github.com/wekan/wekan/issues/4214
-    const lists = ReactiveCache.getLists({ 'boardId': boardId, 'archived': false },{sort: ['sort','asc']});
-    const ret = lists.map(list => {
-      let cardCount = ReactiveCache.getCards({ 'boardId': boardId, 'listId': list._id }).length;
-      return `${list.title}: ${cardCount}`;
-    });
-    return ret;
-    */
-    return [];
+    const tile = (Template.instance().boardTileDataVar.get() || {})[boardId];
+    return (tile && tile.showLists && tile.lists) || [];
   },
 
   boardMembers(boardId) {
-    /* Bug Board icons random dance https://github.com/wekan/wekan/issues/4214
-    const lists = ReactiveCache.getBoard(boardId)
-    const boardMembers = lists?.members.map(member => member.userId);
-    return boardMembers;
-    */
-    return [];
+    const tile = (Template.instance().boardTileDataVar.get() || {})[boardId];
+    return (tile && tile.showMembers && tile.memberIds) || [];
+  },
+
+  showCardCounterList(boardId) {
+    const tile = (Template.instance().boardTileDataVar.get() || {})[boardId];
+    return !!(tile && tile.showLists && tile.lists && tile.lists.length);
+  },
+
+  showBoardMemberList(boardId) {
+    const tile = (Template.instance().boardTileDataVar.get() || {})[boardId];
+    return !!(tile && tile.showMembers && tile.memberIds && tile.memberIds.length);
   },
 
   isStarred() {
     const user = ReactiveCache.getCurrentUser();
     return user && user.hasStarred(this._id);
   },
+  // #2220: is this the user's Home board (the one opened after login)?
+  isDefaultBoard() {
+    const user = ReactiveCache.getCurrentUser();
+    return user && user.isDefaultBoard(this._id);
+  },
   isAdministrable() {
     const user = ReactiveCache.getCurrentUser();
     return user && user.isBoardAdmin(this._id);
@@ -897,6 +938,29 @@ Template.boardList.events({
       Meteor.call('toggleBoardStar', boardId);
     }
   },
+  // "Selected:" star action: star every multi-selected board that isn't yet
+  // starred (so it becomes Starred, never toggled back off by this button).
+  'click .js-star-selected'(evt) {
+    evt.preventDefault();
+    evt.stopPropagation();
+    const user = ReactiveCache.getCurrentUser();
+    BoardMultiSelection.getSelectedBoardIds().forEach((id) => {
+      if (user && !user.hasStarred(id)) {
+        Meteor.call('toggleBoardStar', id);
+      }
+    });
+  },
+  // #2220 "Selected:" home action: set the first selected board as the Home
+  // board (opened after login). Clicking it again when it is already Home clears
+  // it (toggle), matching toggleDefaultBoard.
+  'click .js-home-selected'(evt) {
+    evt.preventDefault();
+    evt.stopPropagation();
+    const ids = BoardMultiSelection.getSelectedBoardIds();
+    if (ids.length) {
+      Meteor.call('toggleDefaultBoard', ids[0]);
+    }
+  },
   // HTML5 DnD from boards to spaces
   // #5850: drag a (template) board onto an Org/Team/Domain target to share it.
   'dragover .js-share-target'(evt) {
@@ -973,6 +1037,55 @@ Template.boardList.events({
     document.querySelectorAll('.workspace-node.board-drag-hint, .js-select-menu.board-drag-hint').forEach((el) => {
       el.classList.remove('board-drag-hint');
     });
+    document.querySelectorAll('.js-board.board-reorder-over').forEach((el) => {
+      el.classList.remove('board-reorder-over');
+    });
+  },
+  // #6439: reorder boards on the All Boards page by dropping one board onto
+  // another. Only active in the "custom" (manual drag order) sort mode — in the
+  // sorted modes the order comes from the title, so a board is not a valid drop
+  // target (which is why, before this, the browser showed the not-allowed cursor
+  // and nothing persisted). The reorder decision/index math lives in the pure,
+  // unit-tested models/lib/boardSortReorder.js.
+  'dragover .js-board'(evt, tpl) {
+    if (!isDragReorderEnabled(currentAllBoardsSortBy())) return;
+    // A multi-board drag is a share/assign gesture, not a reorder.
+    const dt = evt.originalEvent.dataTransfer;
+    if (dt && dt.getData('application/x-board-multi') === 'true') return;
+    evt.preventDefault();
+    evt.stopPropagation();
+    if (dt) dt.dropEffect = 'move';
+    evt.currentTarget.classList.add('board-reorder-over');
+  },
+  'dragleave .js-board'(evt) {
+    evt.currentTarget.classList.remove('board-reorder-over');
+  },
+  'drop .js-board'(evt, tpl) {
+    if (!isDragReorderEnabled(currentAllBoardsSortBy())) return;
+    const dt = evt.originalEvent.dataTransfer;
+    if (dt && dt.getData('application/x-board-multi') === 'true') return;
+    const draggedId = dt ? dt.getData('text/plain') : '';
+    if (!draggedId) return;
+    evt.preventDefault();
+    evt.stopPropagation();
+    evt.currentTarget.classList.remove('board-reorder-over');
+    const targetId = this._id;
+    // #6442: current display order of the board grid. Read each board's _id from
+    // its Blaze data context (the same source dragstart uses via `this._id`) —
+    // NOT el.classList[0]. On `li.js-board(class="{{_id}} …")` Jade emits the
+    // literal `js-board` class FIRST, so classList[0] is the string "js-board"
+    // for every board; the old code therefore produced ['js-board','js-board',…],
+    // computeReorderedSortIndex could not find the dragged/target ids among them,
+    // returned null, and the drop silently did nothing (board snapped back).
+    const orderedIds = Array.from(tpl.findAll('.js-board'))
+      .map((el) => Blaze.getData(el)?._id)
+      .filter(Boolean);
+    const mapping = computeReorderedSortIndex(orderedIds, draggedId, targetId);
+    if (!mapping) return;
+    const currentUser = ReactiveCache.getCurrentUser();
+    if (currentUser && typeof currentUser.setBoardSortIndexes === 'function') {
+      currentUser.setBoardSortIndexes(mapping);
+    }
   },
   'click .js-clone-board'(evt) {
     if (confirm(TAPi18n.__('duplicate-board-confirm'))) {
@@ -1035,6 +1148,10 @@ Template.boardList.events({
   },
   'click .js-multiselection-reset'(evt) {
     evt.preventDefault();
+    // The reset X is now nested inside the activate button (matching the Swimlanes
+    // view), so stop the click from bubbling to js-multiselection-activate — which
+    // would otherwise immediately re-activate what we just disabled.
+    evt.stopPropagation();
     BoardMultiSelection.disable();
   },
   'click .js-toggle-board-multi-selection'(evt) {

client/components/boards/statsView.css

@@ -0,0 +1,55 @@
+/* Board "Statistics" view — full width, like the other board views. Its text is
+   selectable so any value can be highlighted and copied. */
+.stats-view {
+  width: 100%;
+  height: 100%;
+  overflow: auto;
+  user-select: text;
+  -webkit-user-select: text;
+}
+
+.stats-view-content {
+  max-width: 900px;
+  margin: 0 auto;
+  padding: 24px;
+}
+
+.stats-view-title {
+  margin: 0 0 16px;
+  font-size: 22px;
+  font-weight: bold;
+}
+
+.stats-view-section {
+  margin-bottom: 28px;
+}
+
+.stats-view-heading {
+  margin: 0 0 8px;
+  font-size: 16px;
+  font-weight: bold;
+  border-bottom: 2px solid #dbdbdb;
+  padding-bottom: 4px;
+}
+
+.stats-view-table {
+  width: 100%;
+  border-collapse: collapse;
+}
+
+.stats-view-table td {
+  padding: 8px 4px;
+  border-bottom: 1px solid #eee;
+  user-select: text;
+  -webkit-user-select: text;
+}
+
+.stats-view-table .stats-view-label {
+  color: #666;
+  width: 60%;
+}
+
+.stats-view-table .stats-view-value {
+  font-weight: bold;
+  text-align: right;
+}

client/components/boards/statsView.jade

@@ -0,0 +1,45 @@
+template(name="statsView")
+  .stats-view
+    .stats-view-content
+      h1.stats-view-title {{ boardTitle }}
+      .stats-view-section
+        h2.stats-view-heading {{_ 'board-status'}}
+        table.stats-view-table
+          tbody
+            tr
+              td.stats-view-label {{_ 'board-status-loading-mode'}}
+              td.stats-view-value {{ loadingModeLabel }}
+            tr
+              td.stats-view-label {{_ 'swimlanes'}}
+              td.stats-view-value {{ swimlaneCount }}
+            tr
+              td.stats-view-label {{_ 'lists'}}
+              td.stats-view-value {{ listCount }}
+            tr
+              td.stats-view-label {{_ 'cards'}}
+              td.stats-view-value {{ cardCount }}
+            tr
+              td.stats-view-label {{_ 'card-archived'}}
+              td.stats-view-value {{ archivedCardCount }}
+            tr
+              td.stats-view-label {{_ 'labels'}}
+              td.stats-view-value {{ labelCount }}
+            tr
+              td.stats-view-label {{_ 'members'}}
+              td.stats-view-value {{ memberCount }}
+            tr
+              td.stats-view-label {{_ 'custom-fields'}}
+              td.stats-view-value {{ customFieldCount }}
+      .stats-view-section
+        h2.stats-view-heading {{_ 'board-status-time-summary'}}
+        table.stats-view-table
+          tbody
+            tr
+              td.stats-view-label {{_ 'board-status-time-spent-total'}}
+              td.stats-view-value {{ timeSpentTotal }}
+            tr
+              td.stats-view-label {{_ 'board-status-cards-with-time'}}
+              td.stats-view-value {{ cardsWithTimeSpent }}
+            tr
+              td.stats-view-label {{_ 'board-status-overtime-cards'}}
+              td.stats-view-value {{ overtimeCards }}

client/components/boards/statsView.js

@@ -0,0 +1,70 @@
+import { ReactiveCache } from '/imports/reactiveCache';
+import { TAPi18n } from '/imports/i18n';
+import { ReactiveVar } from 'meteor/reactive-var';
+import { Utils } from '/client/lib/utils';
+
+// Board view "Statistics" (Tilastot) — a full-width board view (like Swimlanes /
+// Lists / Calendar / Gantt / Table) showing the board's status: its card-loading
+// mode, counts (swimlanes, lists, cards, labels, members, custom fields) and a
+// time-spent summary. Counts come from the server `boardStatus` method so they are
+// accurate even in lazy mode, where the browser only holds the visible card window.
+Template.statsView.onCreated(function() {
+  this.status = new ReactiveVar(null);
+  this.autorun(() => {
+    const boardId = Session.get('currentBoard');
+    if (boardId) {
+      Meteor.call('boardStatus', boardId, (err, res) => {
+        if (!err && res) this.status.set(res);
+      });
+    }
+  });
+});
+
+// Read one numeric field from the resolved status, or a placeholder while loading.
+function statsNum(key) {
+  const s = Template.instance().status.get();
+  return s ? (s[key] || 0) : '…';
+}
+
+Template.statsView.events({
+  // The board canvas uses drag-to-scroll (the `dragscroll` class), which otherwise
+  // swallows pointer/touch drags and prevents selecting text. Stop these events from
+  // reaching it so the browser's native selection works — with the mouse (drag) and
+  // on touch (long-press) — and any value can be copied to the clipboard.
+  'mousedown .stats-view'(event) {
+    event.stopPropagation();
+  },
+  'touchstart .stats-view'(event) {
+    event.stopPropagation();
+  },
+});
+
+Template.statsView.helpers({
+  boardTitle() {
+    const board = Utils.getCurrentBoard();
+    return board ? board.title : '';
+  },
+  loadingModeLabel() {
+    const s = Template.instance().status.get();
+    if (!s) return '…';
+    const inEffect = s.lazy
+      ? TAPi18n.__('cards-loading-lazy')
+      : TAPi18n.__('cards-loading-all');
+    return s.mode === 'auto' ? `${inEffect} (${TAPi18n.__('cards-loading-auto')})` : inEffect;
+  },
+  swimlaneCount() { return statsNum('swimlanes'); },
+  listCount() { return statsNum('lists'); },
+  cardCount() { return statsNum('cards'); },
+  archivedCardCount() { return statsNum('archivedCards'); },
+  labelCount() { return statsNum('labels'); },
+  memberCount() { return statsNum('members'); },
+  customFieldCount() { return statsNum('customFields'); },
+  cardsWithTimeSpent() { return statsNum('cardsWithTimeSpent'); },
+  overtimeCards() { return statsNum('overtimeCards'); },
+  timeSpentTotal() {
+    const s = Template.instance().status.get();
+    if (!s) return '…';
+    const n = Number(s.timeSpentTotal) || 0;
+    return `${n} h`;
+  },
+});

client/components/boards/tableView.css

@@ -63,18 +63,6 @@
   color: #333;
 }
 
-/* Sortable column headers (Excel-like): clickable, with a sort-direction
-   arrow appended by the sortIndicator helper. */
-.my-cards-board-table th.js-table-view-sort {
-  cursor: pointer;
-  user-select: none;
-  white-space: nowrap;
-}
-
-.my-cards-board-table th.js-table-view-sort:hover {
-  color: #01628c;
-}
-
 /* Leftmost "Edit" cell: an Edit link (pencil icon + text) styled like the one
    on the Admin Panel / People page, opening the card when clicked. */
 .my-cards-board-table td.table-view-cell-edit {

client/components/boards/tableView.jade

@@ -18,21 +18,21 @@ template(name="tableView")
         thead
           tr
             th(scope="col")
-            th.js-table-view-sort(scope="col" data-sort="card") {{_ "card"}} {{sortIndicator 'card'}}
-            th.js-table-view-sort(scope="col" data-sort="list") {{_ "list"}} {{sortIndicator 'list'}}
-            th.js-table-view-sort(scope="col" data-sort="swimlane") {{_ "swimlane"}} {{sortIndicator 'swimlane'}}
+            th(scope="col") {{_ "card"}}
+            th(scope="col") {{_ "list"}}
+            th(scope="col") {{_ "swimlane"}}
             unless isMiniScreen
               th(scope="col") {{_ "assignees"}}
               th(scope="col") {{_ "members"}}
               th(scope="col") {{_ "labels"}}
               if showReceivedColumn
-                th.js-table-view-sort(scope="col" data-sort="received") {{_ "card-received"}} {{sortIndicator 'received'}}
+                th(scope="col") {{_ "card-received"}}
               if showStartColumn
-                th.js-table-view-sort(scope="col" data-sort="start") {{_ "card-start"}} {{sortIndicator 'start'}}
+                th(scope="col") {{_ "card-start"}}
               if showDueColumn
-                th.js-table-view-sort(scope="col" data-sort="due") {{_ "card-due"}} {{sortIndicator 'due'}}
+                th(scope="col") {{_ "card-due"}}
               if showEndColumn
-                th.js-table-view-sort(scope="col" data-sort="end") {{_ "card-end"}} {{sortIndicator 'end'}}
+                th(scope="col") {{_ "card-end"}}
         tbody
           each row in rows
             tr
@@ -66,7 +66,7 @@ template(name="tableView")
                 td.table-view-cell-labels
                   .div
                     each label in row.labels
-                      span.card-label(class="card-label-{{label.color}}" title="{{label.name}}")
+                      span.card-label(class="{{labelColorClass label.color}}" style="{{labelColorStyle label.color}}" title="{{label.name}}")
                         +viewer
                           = label.name
                 if showReceivedColumn

client/components/boards/tableView.js

@@ -14,8 +14,6 @@ const rowsPerPage = 25;
 
 Template.tableView.onCreated(function () {
   this.searchQuery = new ReactiveVar('');
-  this.sortField = new ReactiveVar('card'); // card | list | swimlane | due
-  this.sortDirection = new ReactiveVar(1); // 1 ascending, -1 descending
   this.page = new ReactiveVar(1);
   this.filteredRows = new ReactiveVar([]);
 
@@ -30,8 +28,6 @@ Template.tableView.onCreated(function () {
     }
 
     const query = this.searchQuery.get().trim().toLowerCase();
-    const field = this.sortField.get();
-    const direction = this.sortDirection.get();
 
     const rows = [];
     board.cards().forEach(card => {
@@ -75,39 +71,11 @@ Template.tableView.onCreated(function () {
       });
     }
 
-    // Map a date sort field to the matching row property.
-    const dateFieldProp = {
-      received: 'receivedAt',
-      start: 'startAt',
-      due: 'dueAt',
-      end: 'endAt',
-    };
-
-    filtered = filtered.slice().sort((a, b) => {
-      const dateProp = dateFieldProp[field];
-      if (dateProp) {
-        // Cards without the date sort last, regardless of direction.
-        const av = a[dateProp] ? new Date(a[dateProp]).getTime() : Infinity;
-        const bv = b[dateProp] ? new Date(b[dateProp]).getTime() : Infinity;
-        return (av - bv) * direction;
-      }
-      let av;
-      let bv;
-      if (field === 'list') {
-        av = a.listTitle;
-        bv = b.listTitle;
-      } else if (field === 'swimlane') {
-        av = a.swimlaneTitle;
-        bv = b.swimlaneTitle;
-      } else {
-        av = a.title;
-        bv = b.title;
-      }
-      return (
-        av.localeCompare(bv, undefined, { numeric: true, sensitivity: 'base' }) *
-        direction
-      );
-    });
+    // Fixed order: by card title, ascending. (Column-header click-to-sort was
+    // removed; the Table view now always shows this stable order.)
+    filtered = filtered.slice().sort((a, b) =>
+      a.title.localeCompare(b.title, undefined, { numeric: true, sensitivity: 'base' }),
+    );
 
     this.filteredRows.set(filtered);
   });
@@ -172,13 +140,6 @@ Template.tableView.helpers({
     const board = Utils.getCurrentBoard();
     return !!board && (board.allowsEndDate || board.allowsEndDateOnMinicard);
   },
-
-  // Excel-like sort arrow shown on the active sort column header.
-  sortIndicator(field) {
-    const tpl = Template.instance();
-    if (tpl.sortField.get() !== field) return '';
-    return tpl.sortDirection.get() === 1 ? '▲' : '▼';
-  },
 });
 
 Template.tableView.events({
@@ -212,19 +173,6 @@ Template.tableView.events({
     if (current < totalPages) tpl.page.set(current + 1);
   },
 
-  'click .js-table-view-sort'(event, tpl) {
-    event.preventDefault();
-    const field = event.currentTarget.dataset.sort;
-    if (!field) return;
-    if (tpl.sortField.get() === field) {
-      tpl.sortDirection.set(tpl.sortDirection.get() * -1);
-    } else {
-      tpl.sortField.set(field);
-      tpl.sortDirection.set(1);
-    }
-    tpl.page.set(1);
-  },
-
   // Clicking the leftmost "Edit" link opens the Card Details popup on top of the
   // Board Table view (same mechanism as opening a card from search results).
   'click .js-table-view-edit-card'(event) {

client/components/cards/attachments.jade

@@ -62,20 +62,20 @@ template(name="attachmentGallery")
         .attachment-thumbnail-container.open-preview(data-attachment-id="{{_id}}" data-card-id="{{ meta.cardId }}")
           if link
             if(isImage)
-              img.attachment-thumbnail(src="{{link}}" title="{{sanitize name}}")
+              img.attachment-thumbnail(src="{{link}}" title="{{cleanFilename name}}")
             else if($eq extension 'svg')
-              img.attachment-thumbnail(src="{{link}}" title="{{sanitize name}}" type="image/svg+xml")
+              img.attachment-thumbnail(src="{{link}}" title="{{cleanFilename name}}" type="image/svg+xml")
             else if($eq extension 'mp3')
-              video.attachment-thumbnail(title="{{sanitize name}}")
+              video.attachment-thumbnail(title="{{cleanFilename name}}")
                 source(src="{{link}}" type="audio/mpeg")
             else if($eq extension 'ogg')
-              video.attachment-thumbnail(title="{{sanitize name}}")
+              video.attachment-thumbnail(title="{{cleanFilename name}}")
                 source(src="{{link}}" type="video/ogg")
             else if($eq extension 'webm')
-              video.attachment-thumbnail(title="{{sanitize name}}")
+              video.attachment-thumbnail(title="{{cleanFilename name}}")
                 source(src="{{link}}" type="video/webm")
             else if($eq extension 'mp4')
-              video.attachment-thumbnail(title="{{sanitize name}}")
+              video.attachment-thumbnail(title="{{cleanFilename name}}")
                 source(src="{{link}}" type="video/mp4")
             else
               span.attachment-thumbnail-text= extension
@@ -83,15 +83,14 @@ template(name="attachmentGallery")
         .attachment-details-container
           .attachment-details
             div
-              b
-                = name
+              b {{ cleanFilename name }}
               span.file-size ({{fileSize size}})
             if uploaderName
               div.attachment-uploader {{uploaderName}}
             if uploadedAt
               div.attachment-uploaded-at {{uploadedAt}}
             .attachment-actions
-              a.js-download(href="{{link}}?download=true", download="{{name}}", title="{{_ 'download'}}")
+              a.js-download(href="{{link}}?download=true", download="{{downloadFilename name}}", title="{{_ 'download'}}")
                 i.fa.fa-arrow-down
               if currentUser.isBoardMember
                 unless currentUser.isCommentOnly

client/components/cards/attachments.js

@@ -6,6 +6,7 @@ import uploadProgressManager from '../../lib/uploadProgressManager';
 import { attachmentMigrationManager } from '/client/lib/attachmentMigrationManager';
 import Attachments from '/models/attachments';
 import { Utils } from '/client/lib/utils';
+const { cleanFileName } = require('/imports/lib/fileNameDisplay');
 import { formatDateTime } from '/imports/lib/dateUtils';
 import { EscapeActions } from '/client/lib/escapeActions';
 
@@ -49,7 +50,14 @@ Template.attachmentGallery.events({
       if (card && card.coverId === this._id) {
         await card.unsetCover();
       }
-      await Attachments.removeAsync(this._id);
+      // #5282 (same class as #3252 for comments/checklists): only remove if the
+      // doc is still in the local cache. Under publication churn the attachment
+      // can already be evicted from Minimongo, and removing a missing _id
+      // throws "Removed nonexistent document" even though the delete itself
+      // succeeded on the server.
+      if (this._id && ReactiveCache.getAttachment(this._id)) {
+        await Attachments.removeAsync(this._id);
+      }
       Popup.back();
   }),
 });
@@ -141,7 +149,9 @@ function openAttachmentViewer(attachmentId) {
       break;
   }
 
-  $('#attachment-name').text(attachment.name);
+  // Show the cleaned name: URL-decoded, homoglyphs folded, invisible characters
+  // and exploit markup removed (plain text; .text() escapes, so never HTML).
+  $('#attachment-name').text(cleanFileName(attachment.name));
   $('#viewer-overlay').removeClass('hidden');
 }
 
@@ -432,11 +442,16 @@ export async function handleFileUpload(card, files) {
       fileName: fileName,
       meta: Utils.getCommonAttachmentMetaFrom(card),
       chunkSize: 'dynamic',
-      // Use HTTP transport instead of DDP so file chunks go over a dedicated
-      // fetch POST rather than flooding the WebSocket/DDP channel.  DDP
-      // upload causes repeated DDP reconnects in Safari, showing the
-      // "Loading, please wait" offline banner and stalling progress at ~95%.
-      transport: 'http',
+      // Use HTTP transport (a dedicated fetch POST per chunk) rather than DDP,
+      // which floods the WebSocket channel and causes repeated reconnects in
+      // Safari (the "Loading, please wait" offline banner, stalling at ~95%).
+      // EXCEPT on Sandstorm: the grain's sandstorm-http-bridge strips Meteor-Files'
+      // custom upload headers — x-start/x-mtok/x-chunkid/x-fileid/x-eof are not on
+      // Sandstorm's request-header whitelist — so the server never sees x-start,
+      // treats every request as a chunk continuation, and fails with "Can't
+      // continue upload, session expired" [408]. DDP uploads go over method calls
+      // (no custom HTTP headers), so they work through the bridge.
+      transport: Meteor.settings?.public?.sandstorm ? 'ddp' : 'http',
     };
     config.meta.fileId = fileId;
 
@@ -528,7 +543,9 @@ Template.previewClipboardImagePopup.events({
         meta: Utils.getCommonAttachmentMetaFrom(card),
         fileName: file.name || file.type.replace('image/', 'clipboard.'),
         chunkSize: 'dynamic',
-        transport: 'http',
+        // DDP on Sandstorm (its bridge strips Meteor-Files' x-* upload headers),
+        // HTTP elsewhere — see the note in the other upload handler above.
+        transport: Meteor.settings?.public?.sandstorm ? 'ddp' : 'http',
       };
       config.meta.fileId = fileId;
       const uploader = await Attachments.insertAsync(

client/components/cards/cardDescription.js

@@ -1,3 +1,5 @@
+import { UnsavedEdits } from '/client/lib/unsavedEdits';
+
 const descriptionFormIsOpen = new ReactiveVar(false);
 
 Template.descriptionForm.onDestroyed(function () {
@@ -16,6 +18,10 @@ Template.descriptionForm.events({
     event.preventDefault();
     const description = tpl.currentComponent ? tpl.currentComponent().getValue() : tpl.$('textarea').val();
     await this.setDescription(description);
+    // #6455: a successful save means there is no unsaved draft anymore; clear
+    // any pre-existing draft record so the "You have an unsaved description"
+    // warning does not stick around after saving.
+    UnsavedEdits.reset({ fieldName: 'cardDescription', docId: this._id });
   },
   // Pressing Ctrl+Enter should submit the form
   'keydown form textarea'(evt, tpl) {

client/components/cards/cardDetails.css

@@ -129,50 +129,82 @@
   box-sizing: border-box;
 }
 
-/* Desktop mode: position card below board header */
+/* Desktop mode: position card below board header.
+   #6465: the floating window used to span nearly the whole board (insets
+   20px/20px from BOTH edges, top-left anchored) — right on top of the card it
+   belongs to, with big rounded borders. Dock it to the END edge (right in LTR)
+   like the classic 6.09 side panel instead: the board and the card stay
+   visible, and the drag handle still moves it anywhere. */
 body.desktop-mode .card-details:not(.card-details-popup) {
   position: fixed;
   width: auto;
-  max-width: 800px;
+  max-width: 520px; /* #6465: narrower dock (was 800px, ~1/4 screen) */
   flex-basis: auto;
-  border-radius: 8px;
+  border-radius: 3px;
   z-index: 2001;
 }
 
 /* Default position for first card or when dragged */
 body.desktop-mode .card-details:not(.card-details-popup):not([style*="left"]):not([style*="top"]) {
   top: 8px;
-  inset-inline-start: 20px;
-  inset-inline-end: 20px;
-  bottom: 20px;
+  inset-inline-start: auto;
+  inset-inline-end: 8px;
+  width: min(650px, 90vw);
+  bottom: 8px;
 }
 
-/* Stagger positions for multiple cards using nth-of-type */
+/* Stagger positions for multiple cards using nth-of-type (from the end edge) */
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(1) {
   top: 8px;
-  inset-inline-start: 20px;
+  inset-inline-end: 8px;
 }
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(2) {
   top: 38px;
-  inset-inline-start: 50px;
+  inset-inline-end: 38px;
 }
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(3) {
   top: 68px;
-  inset-inline-start: 80px;
+  inset-inline-end: 68px;
 }
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(4) {
   top: 98px;
-  inset-inline-start: 110px;
+  inset-inline-end: 98px;
 }
 body.desktop-mode .card-details:not(.card-details-popup):nth-of-type(5) {
   top: 128px;
-  inset-inline-start: 140px;
+  inset-inline-end: 128px;
 }
 
 /* For expanded cards, set dimensions */
 body.desktop-mode .card-details:not(.card-details-popup):not(.card-details-collapsed) {
-  inset-inline-end: 20px;
-  bottom: 20px;
+  bottom: 8px;
+}
+
+/* #4822: the MAXIMIZED card must be anchored to the VIEWPORT (position: fixed
+   with viewport insets), never laid out inside — or measured from — the
+   scrolled swimlane/board container. Historically the maximized pane was an
+   in-flow flex/float item of its swimlane, so after scrolling down in the
+   swimlanes view it rendered at the swimlane's position in the tall scrolled
+   canvas (off-screen) instead of over the viewport.
+   All four insets are !important for two reasons:
+   1. The floating-window rules above (top: 8px / inset-inline-end: 8px /
+      width: min(650px, 90vw), specificity up to 0,5,1) otherwise override the
+      lower-specificity .card-details-maximized geometry entirely, leaving the
+      Maximize button a no-op.
+   2. The drag handle writes inline left/top styles onto the card; a card that
+      was dragged and then maximized must not keep the stale dragged offsets
+      (an off-viewport inline top is exactly the "wrong place" of #4822).
+      Only !important declarations beat inline styles. */
+body.desktop-mode .card-details.card-details-maximized:not(.card-details-popup):not(.card-details-collapsed) {
+  position: fixed !important;
+  top: 8px !important;
+  inset-inline-start: 8px !important;
+  inset-inline-end: 8px !important;
+  bottom: 8px !important;
+  width: auto !important;
+  height: auto !important;
+  max-width: none !important;
+  resize: none;
 }
 
 /* Collapsed card state - hide content and set height to title row only */
@@ -192,7 +224,9 @@ body.desktop-mode .card-details.card-details-collapsed {
 }
 .card-details .card-details-canvas {
   width: auto;
-  padding: 0 2.5vw;
+  /* #6465: fixed 20px as in 6.09 — 2.5vw was ~48px of white border per side
+     on a FullHD screen. */
+  padding: 0 20px;
 }
 .card-details .card-details-header {
   margin: 0 -20px 5px;
@@ -300,25 +334,14 @@ body.desktop-mode .card-details.card-details-collapsed {
   float: inline-end;
 }
 
-/* Unify all card text to match title size */
+/* #6465: the "unify all card text to match title size" block (v8.18) forced
+   EVERY element in card details to the base font size with line-height 1.5,
+   flattening the 6.09 hierarchy where labels/metadata were smaller than body
+   text — a big part of the "card window is WAAAY too big" complaint. Removed:
+   components keep their own sizes again. */
 .card-details {
   font-size: 1em;
 }
-.card-details p,
-.card-details span,
-.card-details div,
-.card-details a,
-.card-details label,
-.card-details input,
-.card-details textarea,
-.card-details select,
-.card-details button,
-.card-details .card-details-item-title,
-.card-details .card-label,
-.card-details .viewer {
-  font-size: inherit;
-  line-height: 1.5;
-}
 .card-details .card-details-header .card-details-watch {
   font-size: 17px;
   padding-inline-start: 7px;
@@ -422,8 +445,8 @@ body.desktop-mode .card-details.card-details-collapsed {
 @media screen and (min-width: 801px) {
   .card-details {
     top: 97px;
-    inset-inline-start: calc(50% - (600px / 2));
-    width: 600px;
+    inset-inline-start: calc(50% - (520px / 2)); /* #6465: narrower card (was 600px) */
+    width: 520px;
     bottom: 0;
     position: fixed;
     resize: both;
@@ -446,6 +469,12 @@ body.desktop-mode .card-details.card-details-collapsed {
     flex-shrink: 0;
     flex-basis: calc(100% - 20px);
     will-change: flex-basis;
+    /* #4822: declare the position strategy explicitly. The maximized pane must
+       be fixed to the viewport in its own right — never an in-flow flex/float
+       item of the scrolled swimlane container, and never dependent on the
+       sibling .card-details rule (or the body.desktop-mode rules) happening to
+       supply position: fixed. */
+    position: fixed;
     overflow-y: auto;
     overflow-x: auto;
     background: #f7f7f7;

client/components/cards/cardDetails.jade

@@ -6,7 +6,7 @@ template(name="cardDetails")
   +attachmentViewer
 
   section.card-details.js-card-details.nodragscroll(class='{{#if cardMaximized}}card-details-maximized{{/if}}' class='{{#if isPopup}}card-details-popup{{/if}}' class='{{#unless isVerticalScrollbars}}no-scrollbars{{/unless}}' class='{{#if cardCollapsed}}card-details-collapsed{{/if}}'): .card-details-canvas
-    .card-details-header(class='{{#if colorClass}}card-details-{{colorClass}}{{/if}}')
+    .card-details-header(class='{{#if colorClass}}card-details-{{colorClass}}{{/if}}' style='{{colorStyle}}')
       +inlinedForm(classNames="js-card-details-title")
         +editCardTitleForm
       else
@@ -127,7 +127,7 @@ template(name="cardDetails")
               | {{_ 'labels'}}
             a(class="{{#if canModifyCard}}js-add-labels{{else}}is-disabled{{/if}}" title="{{_ 'card-labels-title'}}")
               each labels
-                span.card-label(class="card-label-{{color}}" title=name)
+                span.card-label(class="{{labelColorClass color}}" style="{{labelColorStyle color}}" title=name)
                   +viewer
                     = name
             if canModifyCard
@@ -741,12 +741,12 @@ template(name="cardDetails")
             i.fa.fa-history
             | {{ _ 'activities'}}
           if currentUser.isBoardMember
-            .material-toggle-switch(title="{{_ 'show-activities'}}")
-              if showActivities
-                input.toggle-switch(type="checkbox" id="toggleShowActivitiesCard" checked="checked")
-              else
-                input.toggle-switch(type="checkbox" id="toggleShowActivitiesCard")
-              label.toggle-label(for="toggleShowActivitiesCard")
+            if showActivities
+              a.activities-eye-toggle.js-toggle-show-activities-card(title="{{_ 'hide-activities'}}" aria-label="{{_ 'hide-activities'}}")
+                i.fa.fa-eye.eye-icon
+            else
+              a.activities-eye-toggle.js-toggle-show-activities-card(title="{{_ 'show-activities'}}" aria-label="{{_ 'show-activities'}}")
+                i.fa.fa-eye-slash.eye-slash-icon
 
       if currentUser.isBoardAdmin
         if isLoaded.get
@@ -1199,6 +1199,10 @@ template(name="setCardColorPopup")
           span.card-label.palette-color.js-palette-color(class="card-details-{{color}}")
             if(isSelected color)
               i.fa.fa-check
+    // #5514: native color wheel for picking a custom RGB / hex color
+    .color-wheel-wrap
+      label(for="cardColorWheel") {{_ 'custom-color'}}
+      input.js-card-color-wheel#cardColorWheel(type="color" value=currentColorHex title="{{_ 'custom-color'}}")
   button.primary.confirm.js-submit {{_ 'save'}}
   button.js-remove-color.negate.wide.right {{_ 'unset-color'}}
 

client/components/cards/cardDetails.js

@@ -50,7 +50,10 @@ import Users from '/models/users';
 import Lists from '/models/lists';
 import CardComments from '/models/cardComments';
 import { ALLOWED_COLORS } from '/config/const';
+import { isHexColor, toHex } from '/models/lib/contrastColor';
 import { uniqBy } from '/imports/lib/collectionHelpers';
+import { memberTargetBoardId } from '/models/lib/linkedCardMembers';
+import { isSubmitKey } from '/models/lib/editorSubmitKey';
 import { UserAvatar } from '../users/userAvatar';
 import { Filter } from '/client/lib/filter';
 import { BoardSwimlaneListCardDialog } from '/client/lib/dialogWithBoardSwimlaneListCard';
@@ -60,6 +63,7 @@ import {
   getCurrentCardIdFromContext,
   getCurrentCardFromContext,
 } from '/client/lib/currentCard';
+import { isLazyCards } from '/client/lib/lazyCards';
 import uploadProgressManager from '../../lib/uploadProgressManager';
 import { CSSEvents } from '/client/lib/cssEvents';
 import { UnsavedEdits } from '/client/lib/unsavedEdits';
@@ -371,6 +375,19 @@ Template.cardDetails.onCreated(function () {
       Meteor.subscribe('legacyBoardAttachments', board._id);
     }
   });
+
+  // In lazy (windowed) card loading the board/window publications only ship the
+  // children of cards in the visible window, so an open card that scrolled out of
+  // — or was just added to — a window could miss its own comments/attachments/
+  // checklists. Subscribe to the open card's OWN live children so the card detail
+  // is always complete and reactive, independent of the window (#6480). No-op in
+  // 'all' mode, where the board publication already ships everything.
+  this.autorun(() => {
+    const cardId = Session.get('currentCard');
+    if (cardId && isLazyCards()) {
+      Meteor.subscribe('openCardData', cardId);
+    }
+  });
 });
 
 Template.cardDetails.onRendered(function () {
@@ -864,6 +881,12 @@ Template.cardDetails.events({
     // permission denial that otherwise vanished with no feedback.
     try {
       await card.setDescription(description);
+      // #6455: a successful save means there is no unsaved draft anymore.
+      // Clear the record explicitly instead of relying on the inlined form's
+      // close-time draft/description comparison, which can run before the
+      // updated description is visible and leave a stale "You have an unsaved
+      // description" warning behind.
+      UnsavedEdits.reset({ fieldName: 'cardDescription', docId: card._id });
     } catch (error) {
       alert(error?.reason || error?.message || 'Failed to save description');
     }
@@ -1045,7 +1068,7 @@ Template.cardDetails.events({
     const card = Template.currentData();
     await card.toggleHideCheckedChecklistItems();
   },
-  async 'change #toggleShowActivitiesCard'() {
+  async 'click .js-toggle-show-activities-card'() {
     const card = Template.currentData();
     await card.toggleShowActivities();
   },
@@ -1364,10 +1387,24 @@ Template.inlinedCardDescription.onCreated(function () {
 
   this._close = (isReset = false) => {
     if (this.isOpen.get() && !isReset) {
-      const draft = (this._getValue() || '').trim();
+      // #6455: normalize BOTH sides the same way before comparing. The textarea
+      // value has per-line trailing whitespace stripped (_getValue), while
+      // getDescription() returns the raw stored text — or null for an empty
+      // description. Comparing them raw made the comparison permanently unequal
+      // for descriptions containing Markdown "  \n" hard breaks (or after
+      // emptying the description), re-creating the phantom draft on every save.
+      const normalize = (s) => (s || '').replaceAll(/[ \f\r\t\v]+$/gm, '').trim();
+      const draft = normalize(this._getValue());
       const card = getCurrentCardFromContext();
-      if (card && draft !== card.getDescription()) {
+      if (card && draft !== normalize(card.getDescription())) {
         UnsavedEdits.set(this._getUnsavedEditKey(), this._getValue());
+      } else {
+        // #6455: closing with the draft equal to the saved description must
+        // REMOVE any pre-existing unsaved-edits record. Previously this branch
+        // did nothing, so once a draft record existed, pressing Save ("View it"
+        // -> Save) could never clear the "You have an unsaved description"
+        // warning — only Discard could.
+        UnsavedEdits.reset(this._getUnsavedEditKey());
       }
     }
     this.isOpen.set(false);
@@ -1395,7 +1432,10 @@ Template.inlinedCardDescription.events({
     tpl.isOpen.set(true);
   },
   'keydown form textarea'(evt, tpl) {
-    if (evt.keyCode === 13 && (evt.metaKey || evt.ctrlKey)) {
+    // Ctrl/Cmd+Enter submits by default; plain Enter when the user enabled
+    // "submit on Enter" in Member Settings (Shift+Enter then makes a newline).
+    const submitOnEnter = !!ReactiveCache.getCurrentUser()?.hasSubmitOnEnter?.();
+    if (isSubmitKey(evt, { submitOnEnter })) {
       tpl.find('button[type=submit]').click();
     }
   },
@@ -1464,6 +1504,15 @@ Template.cardDetailsActionsPopup.events({
     Popup.close();
     if (!card) return;
     await card.archive();
+    // #6465 follow-up: archiving must also CLOSE the card's details window.
+    // The card id stayed in the openCards session list, so the floating window
+    // kept rendering above the board — and, docked to the right edge, exactly
+    // over the archives sidebar someone restoring the card would open next,
+    // intercepting its Restore/Delete clicks.
+    Session.set('openCards', (Session.get('openCards') || []).filter((id) => id !== card._id));
+    if (Session.get('currentCard') === card._id) {
+      Session.set('currentCard', null);
+    }
     Utils.goBoardId(card.boardId);
   }),
   'click .js-more': Popup.open('cardMore'),
@@ -1497,9 +1546,12 @@ Template.editCardTitleForm.events({
     Utils.showCopied(promise, $tooltip);
   },
   'keydown .js-edit-card-title'(event) {
-    // If enter key was pressed, submit the data
-    // Unless the shift key is also being pressed
-    if (event.keyCode === 13 && !event.shiftKey) {
+    // #4236: by default Ctrl/Cmd+Enter saves; plain Enter (and Shift+Enter)
+    // insert a new line. A user who turns on "submit on Enter" in Member
+    // Settings gets plain Enter to save (Shift+Enter for a newline) instead —
+    // the pre-#4236 fast title-editing workflow (#6480 email feedback).
+    const submitOnEnter = !!ReactiveCache.getCurrentUser()?.hasSubmitOnEnter?.();
+    if (isSubmitKey(event, { submitOnEnter })) {
       $('.js-submit-edit-card-title-form').click();
     }
   },
@@ -1657,7 +1709,25 @@ Template.cardLocationsPopup.events({
 });
 
 const filterMembers = (filterTerm) => {
-  let currBoard = Utils.getCurrentBoard();
+  // #5676: for a linked card the members live on the REAL card it points at,
+  // which may be on another board (that is what getMembers()/toggleMember() act
+  // on). Offer that board's members instead of the viewing board's, so the
+  // picker is consistent with where membership is actually stored. Falls back to
+  // the current board for normal cards or when the real card isn't loaded yet.
+  const card = getCurrentCardFromContext();
+  let currBoard = null;
+  if (card) {
+    const boardId = memberTargetBoardId(card, id => ReactiveCache.getCard(id));
+    if (boardId) {
+      currBoard = ReactiveCache.getBoard(boardId);
+    }
+  }
+  if (!currBoard) {
+    currBoard = Utils.getCurrentBoard();
+  }
+  if (!currBoard) {
+    return [];
+  }
   let members = currBoard.activeMembers();
 
   if (filterTerm) {
@@ -2013,6 +2083,10 @@ Template.setCardColorPopup.helpers({
     }
     return tpl.currentColor.get() === color;
   },
+  // #5514: current color as a '#rrggbb' hex for the native color wheel <input>.
+  currentColorHex() {
+    return toHex(Template.instance().currentColor.get()) || '#0079bf';
+  },
 });
 
 Template.setCardColorPopup.events({
@@ -2020,6 +2094,13 @@ Template.setCardColorPopup.events({
     const paletteData = Blaze.getData(event.currentTarget);
     tpl.currentColor.set(paletteData?.color);
   },
+  // #5514: picking from the native color wheel stores a custom hex.
+  'input .js-card-color-wheel'(event, tpl) {
+    const value = event.currentTarget.value;
+    if (isHexColor(value)) {
+      tpl.currentColor.set(value);
+    }
+  },
   async 'click .js-submit'(event, tpl) {
     event.preventDefault();
     const card = Cards.findOne(getCardId());
@@ -2183,6 +2264,12 @@ Template.cardMorePopup.events({
     // verify that there are no linked cards
     if (ReactiveCache.getCards({ linkedId: card._id }).length === 0) {
       Cards.remove(card._id);
+      // #6465 follow-up: like archiving, deleting must close the card's
+      // details window (drop it from the openCards session list).
+      Session.set('openCards', (Session.get('openCards') || []).filter((id) => id !== card._id));
+      if (Session.get('currentCard') === card._id) {
+        Session.set('currentCard', null);
+      }
     } else {
       // TODO: Maybe later we can list where the linked cards are.
       // Now here is popup with a hint that the card cannot be deleted

client/components/cards/labels.css

@@ -1,3 +1,81 @@
+/* #4759: Member Settings / Font popup — a button per installed font (each shown in
+   its own font) and a row of size buttons (smaller ... 100% ... larger). Clicking a
+   button applies immediately. */
+.ui-font-buttons,
+.ui-font-size-buttons {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 4px;
+  margin: 2px 0 10px 0;
+}
+.ui-font-btn,
+.ui-font-size-btn {
+  display: inline-block;
+  padding: 4px 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  background: #fff;
+  color: #333;
+  cursor: pointer;
+  font-size: 14px;
+  line-height: 1.4;
+  text-decoration: none;
+}
+.ui-font-btn:hover,
+.ui-font-size-btn:hover {
+  background: #f0f0f0;
+}
+.ui-font-btn.active,
+.ui-font-size-btn.active {
+  background: #2980b9;
+  border-color: #2980b9;
+  color: #fff;
+}
+/* The "Unset" colour reset links look like buttons. */
+.color-wheel-wrap .js-reset-text-color,
+.color-wheel-wrap .js-reset-bg-color {
+  display: inline-block;
+  padding: 4px 10px;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  background: #fff;
+  color: #333;
+  cursor: pointer;
+  font-size: 14px;
+  line-height: 1.4;
+  text-decoration: none;
+}
+.color-wheel-wrap .js-reset-text-color:hover,
+.color-wheel-wrap .js-reset-bg-color:hover {
+  background: #f0f0f0;
+}
+.color-wheel-wrap .js-reset-text-color.disabled,
+.color-wheel-wrap .js-reset-bg-color.disabled {
+  opacity: 0.5;
+  pointer-events: none;
+}
+
+/* #5514: native color-wheel (custom RGB / hex) picker wrapper, shared by the
+   label / list / swimlane / card color popups. */
+.color-wheel-wrap {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin: 6px 0 10px 0;
+}
+.color-wheel-wrap label {
+  margin: 0;
+}
+.color-wheel-wrap input[type="color"] {
+  width: 44px;
+  height: 28px;
+  padding: 0;
+  border: 1px solid #ccc;
+  border-radius: 4px;
+  cursor: pointer;
+  background: none;
+}
+
 .card-label {
   border: 1px solid #000;
   border-radius: 4px;

client/components/cards/labels.jade

@@ -4,9 +4,12 @@ template(name="formLabel")
 
   label {{_ "select-color"}}
   .palette-colors: each labels
-    span.card-label.palette-color.js-palette-color(class="card-label-{{color}}")
+    span.card-label.palette-color.js-palette-color(class="{{labelColorClass color}}" style="{{labelColorStyle color}}")
       if(isSelected color)
         i.fa.fa-check
+  .color-wheel-wrap
+    label(for="labelColorWheel") {{_ 'custom-color'}}
+    input.js-label-color-wheel#labelColorWheel(type="color" value=currentColorHex title="{{_ 'custom-color'}}")
 
 template(name="createLabelPopup")
   form.create-label
@@ -31,8 +34,8 @@ template(name="cardLabelsPopup")
         a.card-label-edit-button.fa.fa-pencil.js-edit-label
         if isTouchScreenOrShowDesktopDragHandles
           span.fa.label-handle(class="fa-arrows" title="{{_ 'dragLabel'}}")
-        span.card-label.card-label-selectable.js-select-label.card-label-wrapper(class="card-label-{{color}}"
-          class="{{# if isLabelSelected ../_id }}active{{/if}}")
+        span.card-label.card-label-selectable.js-select-label.card-label-wrapper(class="{{labelColorClass color}}"
+          class="{{# if isLabelSelected ../_id }}active{{/if}}" style="{{labelColorStyle color}}")
             +viewer
               = name
             if(isLabelSelected ../_id)

client/components/cards/labels.js

@@ -1,5 +1,6 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { LABEL_COLORS } from '/models/metadata/colors';
+import { isHexColor, toHex } from '/models/lib/contrastColor';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { Utils } from '/client/lib/utils';
 
@@ -28,6 +29,11 @@ Template.formLabel.helpers({
   isSelected(color) {
     return Template.instance().currentColor.get() === color;
   },
+  // #5514: current color as a '#rrggbb' hex for the color-wheel <input>, which
+  // only accepts hex. Named colors map to their palette hex; fall back to green.
+  currentColorHex() {
+    return toHex(Template.instance().currentColor.get()) || '#3cb500';
+  },
 });
 
 Template.formLabel.events({
@@ -36,6 +42,13 @@ Template.formLabel.events({
     const selectedColor = paletteData?.color || Template.currentData()?.color || getFallbackLabelColor();
     tpl.currentColor.set(selectedColor);
   },
+  // #5514: picking a color from the native color wheel stores a custom hex.
+  'input .js-label-color-wheel'(event, tpl) {
+    const value = event.currentTarget.value;
+    if (isHexColor(value)) {
+      tpl.currentColor.set(value);
+    }
+  },
 });
 
 Template.createLabelPopup.helpers({
@@ -131,7 +144,16 @@ Template.createLabelPopup.events({
       ? selectedColorIcon.closest('.js-palette-color')
       : null;
     const selectedColorData = selectedPaletteNode && Blaze.getData(selectedPaletteNode);
-    const color = selectedColorData?.color || getFallbackLabelColor();
+    // #5514: a named swatch (has the check icon) wins; otherwise fall back to
+    // the custom color-wheel hex, then to the default palette color.
+    let color = selectedColorData?.color;
+    if (!color) {
+      const wheel = templateInstance.find('.js-label-color-wheel');
+      if (wheel && isHexColor(wheel.value)) {
+        color = wheel.value;
+      }
+    }
+    color = color || getFallbackLabelColor();
     board.addLabel(name, color);
     Popup.back();
   },
@@ -158,7 +180,16 @@ Template.editLabelPopup.events({
       ? selectedColorIcon.closest('.js-palette-color')
       : null;
     const selectedColorData = selectedPaletteNode && Blaze.getData(selectedPaletteNode);
-    const color = selectedColorData?.color || getFallbackLabelColor();
+    // #5514: a named swatch (has the check icon) wins; otherwise fall back to
+    // the custom color-wheel hex, then to the default palette color.
+    let color = selectedColorData?.color;
+    if (!color) {
+      const wheel = templateInstance.find('.js-label-color-wheel');
+      if (wheel && isHexColor(wheel.value)) {
+        color = wheel.value;
+      }
+    }
+    color = color || getFallbackLabelColor();
     board.editLabel(this._id, name, color);
     Popup.back();
   },

client/components/cards/minicard.css

@@ -183,6 +183,13 @@
 }
 .minicard .minicard-title {
   margin-inline-end: 1.5vw;
+  /* #6444: isolate each title's bidirectional context. The title is a
+     dir="auto" .viewer; under a global dir="rtl" document, non-isolated
+     dir="auto" runs share bidi state, so typing a strong RTL (e.g. Arabic)
+     character into another list's dir="auto" composer re-resolved the shared
+     context and visibly reflowed OTHER lists' minicard titles (no data change,
+     reverts on refresh). Isolation makes each title a self-contained run. */
+  unicode-bidi: isolate;
 }
 .minicard .minicard-title .card-number {
   color: #b3b3b3;
@@ -196,6 +203,12 @@
   .minicard .minicard-title .viewer {
     display: block;
     word-wrap: break-word;
+    /* #6465: the minicard title renders inside a .viewer, which inherits the
+       global `.viewer { min-height: 2.5vh }` (layouts.css). On tall screens that
+       reserves a big empty band under a one-line title, so half of every
+       minicard was white space. Collapse it to fit the text (same fix already
+       applied to the label .viewer above). */
+    min-height: 0;
   }
 }
 .minicard .dates {
@@ -448,6 +461,10 @@
   min-height: 50px;
   margin-bottom: 20px;
   overflow-y: auto;
+  /* #6444: isolate the composer's dir="auto" bidi run so typing a strong RTL
+     character here cannot perturb the rendering of the surrounding minicard
+     titles under a dir="rtl" document. */
+  unicode-bidi: isolate;
 }
 .parent-prefix {
   color: #b3b3b3;

client/components/cards/minicard.jade

@@ -3,7 +3,8 @@ template(name="minicard")
     class="{{#if isLinkedCard}}linked-card{{/if}}"
     class="{{#if isLinkedBoard}}linked-board{{/if}}"
     class="{{agingClass}}"
-    class="{{#if colorClass}}minicard-{{colorClass}}{{/if}}")
+    class="{{#if colorClass}}minicard-{{colorClass}}{{/if}}"
+    style="{{colorStyle}}")
     if canMoveCard
       if isTouchScreenOrShowDesktopDragHandles
         .handle
@@ -93,11 +94,11 @@ template(name="minicard")
         .minicard-labels(class="{{#if hiddenMinicardLabelText}}minicard-labels-no-text{{/if}}")
           each labels
             unless hiddenMinicardLabelText
-              span.js-card-label.card-label(class="card-label-{{color}}" title=name)
+              span.js-card-label.card-label(class="{{labelColorClass color}}" style="{{labelColorStyle color}}" title=name)
                 +viewer
                   = name
             if hiddenMinicardLabelText
-              .minicard-label(class="card-label-{{color}}" title="{{name}}")
+              .minicard-label(class="{{labelColorClass color}}" style="{{labelColorStyle color}}" title="{{name}}")
 
     .minicard-custom-fields
       each customFieldsWD

client/components/cards/minicard.js

@@ -6,6 +6,11 @@ import uploadProgressManager from '../../lib/uploadProgressManager';
 import { Utils } from '/client/lib/utils';
 import ChecklistItems from '/models/checklistItems';
 import Cards from '/models/cards';
+import { resolveCoverId } from '/models/lib/linkedCardCover';
+import {
+  parseChecklistItemTitles,
+  buildChecklistItemPayload,
+} from '/models/lib/checklistItemTitles';
 import { normalizeDependencies } from '/models/metadata/dependencies';
 
 function getMinicardFlag(board, onMinicardField, legacyField, defaultValue) {
@@ -164,8 +169,12 @@ Template.minicard.helpers({
     }
   },
   cover() {
-    if (!this.coverId) return null;
-    const attachment = ReactiveCache.getAttachment(this.coverId);
+    // #5666: for a linked card the cover lives on the real card it points at, so
+    // resolve the cover id through it (mirroring getTitle/getDue/...); a plain
+    // card resolves to its own coverId.
+    const coverId = resolveCoverId(this, id => ReactiveCache.getCard(id));
+    if (!coverId) return null;
+    const attachment = ReactiveCache.getAttachment(coverId);
     if (!attachment) return null;
     const coverLink = typeof attachment.link === 'function' ? attachment.link() : '';
     if (!coverLink) return null;
@@ -376,6 +385,28 @@ Template.minicardChecklist.helpers({
   },
 });
 
+// #6440: create the checklist item(s) for the minicard add-item form. Shared by
+// the Save-button click handler and the (rarely reached) form-submit handler.
+// The Save button needs an explicit click handler because the minicard — and so
+// the add-item <form> — is rendered inside the `a.minicard-wrapper` anchor, where
+// the native form `submit` event never reaches the Blaze event map; without this
+// the "+" add-item on the minicard did nothing. The blank-input guard and the
+// title parsing live in the pure, unit-tested models/lib/checklistItemTitles.js.
+function addMinicardChecklistItems(textarea, checklist) {
+  if (!textarea || !checklist) return;
+  const titles = parseChecklistItemTitles(textarea.value);
+  if (titles.length === 0) return;
+  const items = checklist.items();
+  const lastItem = items[items.length - 1] || null;
+  let sortIndex = Utils.calculateIndexData(lastItem, null).base;
+  titles.forEach(title => {
+    ChecklistItems.insert(buildChecklistItemPayload(title, checklist, sortIndex));
+    sortIndex += 1;
+  });
+  textarea.value = '';
+  textarea.focus();
+}
+
 Template.minicardChecklist.events({
   'click .js-convert-checklist-item-to-card'(event) {
     event.stopPropagation();
@@ -417,25 +448,26 @@ Template.minicardChecklist.events({
     }
     $form.find('.js-close-inlined-form').trigger('click');
   },
+  // #6440: explicit click handler for the minicard "+" add-item Save button.
+  // The native form `submit` event does not fire on the minicard (the form is
+  // inside the `a.minicard-wrapper` anchor), so — unlike card-detail — we cannot
+  // rely on `submit .js-add-checklist-item`. This mirrors the already-working
+  // `click .js-submit-edit-checklist-item-form` above.
+  'click .js-submit-add-checklist-item-form'(event) {
+    event.preventDefault();
+    event.stopPropagation();
+    const $form = $(event.currentTarget).closest('form');
+    const textarea = $form.find('textarea.js-add-checklist-item')[0];
+    const formData = Blaze.getData($form[0]) || Template.currentData() || {};
+    addMinicardChecklistItems(textarea, formData.checklist);
+  },
+  // Kept for completeness (e.g. card-detail-style contexts); on the minicard this
+  // rarely fires, so the click handler above is the real path. See #6440.
   'submit .js-add-checklist-item'(event, tpl) {
     event.preventDefault();
     const textarea = tpl.find('textarea.js-add-checklist-item');
-    if (!textarea) return;
-    const title = textarea.value.trim();
     const data = Template.currentData() || {};
-    const checklist = data.checklist;
-    if (!checklist || !title) return;
-    const items = checklist.items();
-    const lastItem = items[items.length - 1] || null;
-    const sortIndex = Utils.calculateIndexData(lastItem, null).base;
-    ChecklistItems.insert({
-      title,
-      checklistId: checklist._id,
-      cardId: checklist.cardId,
-      sort: sortIndex,
-    });
-    textarea.value = '';
-    textarea.focus();
+    addMinicardChecklistItems(textarea, data.checklist);
   },
   'click .js-delete-checklist-item': Popup.afterConfirm('checklistItemDelete', function () {
     Popup.back();

client/components/cards/subtaskViewHelpers.js

@@ -17,24 +17,69 @@ export function canNavigateToSubtaskBoard(board) {
 // the parent card again, and so the behaviour is unit-testable.
 //
 // Returns the FlowRouter 'card' route params taken from the subtask, or
-// undefined when the subtask's board is not loaded yet (see #4762 guard).
+// undefined for a malformed subtask (no usable card id / board id).
+//
+// #1853: "Subtask board id missing: cannot read property _id of undefined".
+// The subtask often lives on ANOTHER board (the deposit/target board) whose
+// document is not in minimongo while the parent card's board is open. In that
+// case subtask.board() yields nothing; instead of crashing (the original
+// TypeError) or silently doing nothing (the post-#4762 behaviour), fall back
+// to the subtask's own boardId and the default 'board' slug — the 'card'
+// route action only uses :boardId/:cardId (config/router.js) and its
+// subscriptions load the board, so navigation succeeds without a reload.
+// 'board' is the model's own default slug (models/boards.js).
 export function subtaskNavTarget(subtask) {
   if (!subtask) {
     return undefined;
   }
-  const board = typeof subtask.board === 'function' ? subtask.board() : undefined;
-  if (!canNavigateToSubtaskBoard(board)) {
-    return undefined;
-  }
   // Prefer the real card id (resolves linked subtask cards to their source);
   // fall back to the plain _id when getRealId is unavailable (e.g. in tests).
   const cardId =
-    typeof subtask.getRealId === 'function' ? subtask.getRealId() : subtask._id;
-  return {
-    boardId: board._id,
-    slug: board.slug,
-    cardId,
-    swimlaneId: subtask.swimlaneId,
-    listId: subtask.listId,
-  };
+    (typeof subtask.getRealId === 'function' ? subtask.getRealId() : undefined) ||
+    subtask._id;
+  if (!cardId) {
+    // Malformed subtask document: nothing sane to navigate to.
+    return undefined;
+  }
+  const board = typeof subtask.board === 'function' ? subtask.board() : undefined;
+  if (canNavigateToSubtaskBoard(board)) {
+    return {
+      boardId: board._id,
+      slug: board.slug,
+      cardId,
+      swimlaneId: subtask.swimlaneId,
+      listId: subtask.listId,
+    };
+  }
+  if (subtask.boardId) {
+    // Board doc missing locally (#1853 / #4762): navigate by id and let the
+    // route load the board. The slug segment is cosmetic for the card route.
+    return {
+      boardId: subtask.boardId,
+      slug: 'board',
+      cardId,
+      swimlaneId: subtask.swimlaneId,
+      listId: subtask.listId,
+    };
+  }
+  // No board reference at all: broken subtask, don't navigate (and don't
+  // throw — the caller shows a warning instead).
+  return undefined;
+}
+
+// Same idea for the "Go to board" popup entry (js-go-to-subtask-board):
+// prefer the loaded board's id/slug, fall back to the subtask's boardId so a
+// not-yet-subscribed deposit board is still reachable (#1853).
+export function subtaskBoardNavTarget(subtask) {
+  if (!subtask) {
+    return undefined;
+  }
+  const board = typeof subtask.board === 'function' ? subtask.board() : undefined;
+  if (canNavigateToSubtaskBoard(board)) {
+    return { id: board._id, slug: board.slug };
+  }
+  if (subtask.boardId) {
+    return { id: subtask.boardId, slug: 'board' };
+  }
+  return undefined;
 }

client/components/cards/subtasks.js

@@ -3,7 +3,10 @@ import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import Cards from '/models/cards';
 import { Filter } from '/client/lib/filter';
 import { subtaskStatusLabel } from './subtaskStatusHelpers';
-import { subtaskNavTarget } from './subtaskViewHelpers';
+import {
+  subtaskNavTarget,
+  subtaskBoardNavTarget,
+} from './subtaskViewHelpers';
 import { Utils } from '/client/lib/utils';
 
 Template.subtasks.events({
@@ -125,20 +128,34 @@ Template.subtaskActionsPopup.events({
       const subtask = Template.currentData().subtask;
       // #3743: open the SUBTASK card itself, not the parent/current card.
       // subtaskNavTarget derives boardId/slug/cardId from the subtask only.
-      // #4762: it also returns undefined while the subtask's board is not
-      // loaded yet (ReactiveCache miss), mirroring js-go-to-subtask-board.
+      // #1853 / #4762: when the subtask's board (often a DIFFERENT deposit
+      // board) is not in minimongo yet, it falls back to the subtask's own
+      // boardId so the route loads the board — no TypeError, no dead button.
+      // It only returns undefined for a truly broken subtask document.
       const target = subtaskNavTarget(subtask);
       if (target) {
         FlowRouter.go('card', target);
+      } else {
+        // Broken subtask (no card id / board id): warn instead of throwing.
+        console.warn(
+          'Cannot view subtask: missing board/card id on subtask',
+          subtask && subtask._id,
+        );
       }
     }
   },
   'click .js-go-to-subtask-board'() {
     const subtask = Template.currentData().subtask;
-    const board = subtask.board();
-    if (board) {
+    // #1853: fall back to subtask.boardId when the board doc is not loaded.
+    const target = subtaskBoardNavTarget(subtask);
+    if (target) {
       Popup.close();
-      FlowRouter.go('board', { id: board._id, slug: board.slug });
+      FlowRouter.go('board', target);
+    } else {
+      console.warn(
+        'Cannot go to subtask board: missing board id on subtask',
+        subtask && subtask._id,
+      );
     }
   },
   'click .js-delete-subtask' : Popup.afterConfirm('subtaskDelete', async function () {

client/components/forms/forms.css

@@ -130,8 +130,8 @@ textarea.editor {
 }
 input[type="submit"],
 button {
-  background: #000;
-  background: linear-gradient(#000, #000);
+  background: var(--theme-accent, #000);
+  background: linear-gradient(var(--theme-accent, #000), var(--theme-accent, #000));
   border: none;
   cursor: pointer;
   display: inline-block;
@@ -150,14 +150,14 @@ input[type="submit"]:hover,
 button:hover,
 input[type="submit"]:focus,
 button:focus {
-  background: #222;
-  background: linear-gradient(#222, #222);
+  background: var(--theme-accent, #222);
+  background: linear-gradient(var(--theme-accent, #222), var(--theme-accent, #222));
   color: #fff;
 }
 input[type="submit"]:active,
 button:active {
-  background: #111;
-  background: linear-gradient(#111, #111);
+  background: var(--theme-accent, #111);
+  background: linear-gradient(var(--theme-accent, #111), var(--theme-accent, #111));
   box-shadow: inset 0 3px 6px rgba(0,0,0,0.3);
   color: #fff;
 }
@@ -172,7 +172,7 @@ button:active:active {
 }
 input[type="submit"].primary,
 button.primary {
-  background: #005377;
+  background: var(--theme-accent, #005377);
   box-shadow: 0 1px 0 #4d4d4d;
   color: #fff;
 }
@@ -180,11 +180,11 @@ input[type="submit"].primary:hover,
 button.primary:hover,
 input[type="submit"].primary:focus,
 button.primary:focus {
-  background: #004766;
+  background: var(--theme-accent, #004766);
 }
 input[type="submit"].primary:active,
 button.primary:active {
-  background: #01628c;
+  background: var(--theme-accent, #01628c);
 }
 input[type="submit"].negate,
 button.negate {
@@ -298,6 +298,25 @@ textarea::-moz-placeholder {
   font-size: clamp(20px, 4vw, 26px);
   margin: 0.5vh 1.5vw;
 }
+/* CJK (Japanese/Chinese/Korean) labels contain no spaces, so browsers may
+   insert a line break between any two characters. In the narrow add-card /
+   edit footers this made short labels such as "追加" (Add) and "リンク"
+   (Link) wrap mid-word. `word-break: keep-all` forbids breaks inside CJK
+   words while leaving Latin wrapping behavior unchanged, and `flex-wrap`
+   lets the footer wrap between its links instead of inside them.
+   See https://github.com/wekan/wekan/issues/4023 */
+.edit-controls,
+.add-controls {
+  flex-wrap: wrap;
+  word-break: keep-all;
+}
+.edit-controls button[type=submit],
+.add-controls button[type=submit] {
+  white-space: nowrap;
+}
+.add-controls .quiet {
+  white-space: nowrap;
+}
 [type="checkbox"]:not(:checked),
 [type="checkbox"]:checked {
   position: absolute;

client/components/lists/list.css

@@ -736,9 +736,28 @@ form.inlined-form .list-composer {
   flex: 1 1 auto;
   flex-direction: column;
   display: flex;
-  overflow-y: auto;
+  /* #5439: always show a scrollbar on the list body across desktop and mobile
+     browsers (overlay scrollbars on macOS/iOS/Android/Firefox otherwise auto-
+     hide it). Keep these declarations in sync with models/lib/scrollbarCss.js
+     (alwaysVisibleScrollbarCss), which is unit tested. */
+  overflow-y: scroll;
+  scrollbar-width: thin;
+  scrollbar-color: rgba(0, 0, 0, 0.35) rgba(0, 0, 0, 0.08);
+  scrollbar-gutter: stable;
   padding: 5px 11px;
 }
+.list-body::-webkit-scrollbar {
+  width: 10px;
+  height: 10px;
+  -webkit-appearance: none;
+}
+.list-body::-webkit-scrollbar-track {
+  background: rgba(0, 0, 0, 0.08);
+}
+.list-body::-webkit-scrollbar-thumb {
+  background: rgba(0, 0, 0, 0.35);
+  border-radius: 5px;
+}
 .list-body .minicards {
   flex-grow: 1;
   flex-shrink: 0;

client/components/lists/list.js

@@ -3,6 +3,11 @@ import { TAPi18n } from '/imports/i18n';
 import { EscapeActions } from '/client/lib/escapeActions';
 import { MultiSelection } from '/client/lib/multiSelection';
 import { Utils } from '/client/lib/utils';
+import Cards from '/models/cards';
+import {
+  isDegenerateSortGap,
+  computeRepairedDropIndex,
+} from '/models/lib/cardSortRepair';
 require('/client/lib/jquery-ui.js')
 
 const { calculateIndex } = Utils;
@@ -19,9 +24,17 @@ const { calculateIndex } = Utils;
 //
 // The old per-list "min width / max width / automatic" knobs are gone — the
 // rendered width is now a single hard value (see list.jade).
+//
+// #5659: the default/minimum width and the resolution order live in ONE
+// Meteor-free module shared with models/users.js, so every path (member,
+// anonymous public-board visitor, fixed mode) falls back to the SAME default
+// and all lists render the same width when nothing is customized.
 // ---------------------------------------------------------------------------
-const DEFAULT_LIST_WIDTH = 272;
-const MIN_LIST_WIDTH = 270;
+import {
+  DEFAULT_LIST_WIDTH,
+  MIN_LIST_WIDTH,
+  resolveListWidth,
+} from '/models/lib/listWidth';
 
 function isPersonalListWidth(boardId) {
   const board = ReactiveCache.getBoard(boardId);
@@ -122,25 +135,28 @@ function saveAnonFixedListWidth(boardId, width) {
 
 function effectiveListWidth(list) {
   if (!list) return DEFAULT_LIST_WIDTH;
-  // #5729 In fixed width mode every list renders at the single shared value.
-  if (isFixedListWidth(list.boardId)) {
-    return fixedListWidthValue(list.boardId);
+  // #5659: all inputs are gathered here, but the fallback order and the ONE
+  // default width live in models/lib/listWidth.js (shared + unit tested).
+  const fixedEnabled = isFixedListWidth(list.boardId);
+  const personalMode = isPersonalListWidth(list.boardId);
+  let personalWidth = null;
+  if (personalMode) {
+    const user = ReactiveCache.getCurrentUser();
+    if (user) {
+      const widths = user.getListWidths();
+      personalWidth = widths[list.boardId] && widths[list.boardId][list._id];
+    } else {
+      personalWidth = readAnonListWidth(list.boardId, list._id);
+    }
   }
-  const shared =
-    typeof list.width === 'number' && list.width >= MIN_LIST_WIDTH
-      ? list.width
-      : DEFAULT_LIST_WIDTH;
-  if (!isPersonalListWidth(list.boardId)) {
-    return shared;
-  }
-  const user = ReactiveCache.getCurrentUser();
-  if (user) {
-    const widths = user.getListWidths();
-    const w = widths[list.boardId] && widths[list.boardId][list._id];
-    return typeof w === 'number' && w >= MIN_LIST_WIDTH ? w : shared;
-  }
-  const w = readAnonListWidth(list.boardId, list._id);
-  return w || shared;
+  return resolveListWidth({
+    // #5729 In fixed width mode every list renders at the single shared value.
+    fixedEnabled,
+    fixedWidth: fixedEnabled ? fixedListWidthValue(list.boardId) : null,
+    sharedWidth: list.width,
+    personalMode,
+    personalWidth,
+  });
 }
 
 // Can the current user change THIS list's width by dragging?
@@ -276,7 +292,35 @@ Template.list.onRendered(function () {
       const prevCardDom = ui.item.prev('.js-minicard').get(0);
       const nextCardDom = ui.item.next('.js-minicard').get(0);
       const nCards = MultiSelection.isActive() ? MultiSelection.count() : 1;
-      const sortIndex = calculateIndex(prevCardDom, nextCardDom, nCards);
+      let sortIndex = calculateIndex(prevCardDom, nextCardDom, nCards);
+
+      // #3826: cards created by the "add subtask" flow were all inserted with
+      // a constant sort of -1, so a list full of subtask cards contains only
+      // ties. No number lies strictly between two equal sorts, so
+      // calculateIndex returns base === neighbour sort with increment 0: the
+      // write is then discarded by Card.move()'s no-op guard and the card
+      // snaps back (and a multi-selection drop would give every selected card
+      // the SAME sort, losing their relative order). When the drop landed in
+      // such a degenerate gap, capture the target list's sibling cards in
+      // their current visual order (before sortable('cancel') reshuffles the
+      // DOM) so their sorts can be repaired below.
+      const prevCardData = prevCardDom ? Blaze.getData(prevCardDom) : null;
+      const nextCardData = nextCardDom ? Blaze.getData(nextCardDom) : null;
+      let orderedSiblingCards = null;
+      if (
+        isDegenerateSortGap(
+          prevCardData ? prevCardData.sort : null,
+          nextCardData ? nextCardData.sort : null,
+        )
+      ) {
+        orderedSiblingCards = ui.item
+          .parent()
+          .children(itemsSelector)
+          .not(ui.item)
+          .toArray()
+          .map(el => Blaze.getData(el))
+          .filter(Boolean);
+      }
       const listData = Blaze.getData(ui.item.parents('.list').get(0));
       const listId = listData._id;
       const currentBoard = Utils.getCurrentBoard();
@@ -303,6 +347,25 @@ Template.list.onRendered(function () {
       // Blaze with the below query.
       $cards.sortable('cancel');
 
+      // #3826: the drop landed between two cards whose sorts do not strictly
+      // increase (duplicate -1 sorts from subtask creation, or legacy data).
+      // Repair the sibling sorts with the minimal bumps that make the visible
+      // order strictly increasing, then recompute the drop index from the
+      // repaired neighbours: base now falls strictly between them and the
+      // increment is strictly positive (distinct sorts for a multi-selection).
+      if (orderedSiblingCards && prevCardData && nextCardData) {
+        const repairedDrop = computeRepairedDropIndex(
+          orderedSiblingCards,
+          prevCardData,
+          nextCardData,
+          nCards,
+        );
+        repairedDrop.updates.forEach(u => {
+          Cards.update(u._id, { $set: { sort: u.sort } });
+        });
+        sortIndex = { base: repairedDrop.base, increment: repairedDrop.increment };
+      }
+
       if (MultiSelection.isActive()) {
         ReactiveCache.getCards(MultiSelection.getMongoSelector(), { sort: ['sort'] }).forEach((card, i) => {
           const newSwimlaneId = targetSwimlaneId
@@ -326,37 +389,59 @@ Template.list.onRendered(function () {
       if (boardComponent) boardComponent.setIsDragging(false);
     },
     sort(event, ui) {
-      const $boardCanvas = $('.board-canvas');
-      const boardCanvas = $boardCanvas[0];
-
-      if (event.pageX < 10) { // scroll to the left
-        boardCanvas.scrollLeft -= 15;
-        ui.helper[0].offsetLeft -= 15;
+      // #443: the HORIZONTAL scroller is the .js-lists lane (.swimlane has
+      // overflow: auto), NOT .board-canvas, which only overflows vertically —
+      // the old code compared against a scrollLeftMax of 0 and never fired, so
+      // dragging a card toward an off-screen list never auto-scrolled the board.
+      const { computeEdgeScroll, findLaneUnderPointer } = require('/imports/lib/boardAutoScroll');
+      let scrolled = false;
+      const lanes = document.querySelectorAll('.js-lists');
+      const rects = Array.prototype.map.call(lanes, el => el.getBoundingClientRect());
+      const laneIndex = findLaneUnderPointer(rects, event.clientX, event.clientY);
+      if (laneIndex !== -1) {
+        const nextLeft = computeEdgeScroll({
+          pointer: event.clientX,
+          lowEdge: rects[laneIndex].left,
+          highEdge: rects[laneIndex].right,
+          scrollPos: lanes[laneIndex].scrollLeft,
+          scrollSize: lanes[laneIndex].scrollWidth,
+          clientSize: lanes[laneIndex].clientWidth,
+        });
+        if (nextLeft !== null) {
+          lanes[laneIndex].scrollLeft = nextLeft;
+          scrolled = true;
+        }
       }
-      if (
-        event.pageX > boardCanvas.offsetWidth - 10 &&
-        boardCanvas.scrollLeft < $boardCanvas.data('scrollLeftMax') // don't scroll more than possible
-      ) { // scroll to the right
-        boardCanvas.scrollLeft += 15;
+      // vertical auto-scroll stays on the board canvas
+      const canvas = document.querySelector('.board-canvas');
+      if (canvas) {
+        const crect = canvas.getBoundingClientRect();
+        const nextTop = computeEdgeScroll({
+          pointer: event.clientY,
+          lowEdge: crect.top,
+          highEdge: crect.bottom,
+          scrollPos: canvas.scrollTop,
+          scrollSize: canvas.scrollHeight,
+          clientSize: canvas.clientHeight,
+        });
+        if (nextTop !== null) {
+          canvas.scrollTop = nextTop;
+          scrolled = true;
+        }
       }
-      if (
-        event.pageY > boardCanvas.offsetHeight - 10 &&
-        event.pageY + boardCanvas.scrollTop < $boardCanvas.data('scrollTopMax') // don't scroll more than possible
-      ) { // scroll to the bottom
-        boardCanvas.scrollTop += 15;
+      // #6477: after an auto-scroll, jQuery UI sortable's cached container/item
+      // geometry is STALE — it snapshots positions at drag start and on its own
+      // placeholder moves, never on our manual scroll here. With long/overflowing
+      // lists (exactly what triggers auto-scroll) the drop then resolved against a
+      // stale map and parked the placeholder in the WRONG swimlane's copy of the
+      // list, so a card dragged between swimlanes snapped back into its source
+      // swimlane (the stop handler's ui.item.parents('.swimlane') faithfully
+      // persisted it). Re-cache positions so the placeholder and drop resolve
+      // against the scrolled layout. Complements the DOM-mutation refresh in
+      // listBody.js (#2769), which does not fire on scroll.
+      if (scrolled) {
+        $cards.sortable('refreshPositions');
       }
-      if (event.pageY < 10) { // scroll to the top
-        boardCanvas.scrollTop -= 15;
-      }
-    },
-    activate(event, ui) {
-      const $boardCanvas = $('.board-canvas');
-      const boardCanvas = $boardCanvas[0];
-      // scrollTopMax and scrollLeftMax only available at Firefox (https://developer.mozilla.org/en-US/docs/Web/API/Element/scrollTopMax)
-      // https://www.it-swarm.com.de/de/javascript/so-erhalten-sie-den-maximalen-dokument-scrolltop-wert/1069126844/
-      $boardCanvas.data('scrollTopMax', boardCanvas.scrollHeight - boardCanvas.clientTop);
-      // https://stackoverflow.com/questions/5138373/how-do-i-get-the-max-value-of-scrollleft/5704386#5704386
-      $boardCanvas.data('scrollLeftMax', boardCanvas.scrollWidth - boardCanvas.clientWidth);
     },
   });
 
@@ -384,6 +469,13 @@ Template.list.onRendered(function () {
     const currentBoardId = Tracker.nonreactive(() => {
       return Session.get('currentBoard');
     });
+    // #1554: reactive dependency so newly added / re-rendered minicards are
+    // (re)initialized as droppable for label/member drags. The dependency
+    // (Cards.find(...).fetch()) was dropped in 7673c77c5, so the autorun ran
+    // ONCE per list render and cards added afterwards silently rejected
+    // sidebar label/member drops until the board was re-entered. Re-running
+    // .droppable() on initialized elements is an idempotent option refresh.
+    ReactiveCache.getCards({ boardId: currentBoardId });
     Tracker.afterFlush(() => {
       $cards.find(itemsSelector).droppable({
         hoverClass: 'draggable-hover-card',

client/components/lists/listBody.jade

@@ -46,7 +46,7 @@ template(name="addCardForm")
     if getLabels
       .minicard-labels
         each getLabels
-          .minicard-label(class="card-label-{{color}}" title="{{name}}")
+          .minicard-label(class="{{labelColorClass color}}" style="{{labelColorStyle color}}" title="{{name}}")
     textarea.minicard-composer-textarea.js-card-title(autofocus dir="auto")
     if members.get
       .minicard-members.js-minicard-composer-members

client/components/lists/listBody.js

@@ -9,6 +9,14 @@ import Swimlanes from '/models/swimlanes';
 import { Filter } from '/client/lib/filter';
 import { MultiSelection } from '/client/lib/multiSelection';
 import { Utils } from '/client/lib/utils';
+import { isLinkableCardTarget } from '/models/lib/linkedCardTarget';
+import { listCardsSelector } from '/models/lib/swimlaneFilter';
+import { sortCardsByTitle } from '/models/lib/sortCardsByTitle';
+import { isLazyCards, BoardListCardCounts, windowCountId } from '/client/lib/lazyCards';
+import {
+  mutationsChangeDragGeometry,
+  findActiveCardDrag,
+} from '/client/lib/cardDragGeometry';
 import autosize from 'autosize';
 
 // SubsManager removed for Meteor 3 migration
@@ -338,20 +346,36 @@ Template.listBody.helpers({
     if (!sortBy) {
       sortBy = defaultSort;
     }
-    const selector = {
-      listId: Template.currentData()._id,
-      archived: false,
-    };
-    if (swimlaneId) {
-      // Fallback: also show cards with no swimlaneId (null/empty) so that
-      // pre-migration / orphaned cards are always visible without a DB migration.
-      selector.$or = [
-        { swimlaneId },
-        { swimlaneId: null },  // null covers null AND missing field
-        { swimlaneId: '' },    // empty string from shared-lists era
-      ];
+    // #6441: build the swimlane-membership fallback as a single `swimlaneId:
+    // { $in: [...] }` clause (via the shared, unit-tested helper) instead of a
+    // bare top-level `$or`, so it never competes with the board Filter's own
+    // top-level `$or` (labels/members/exceptions) and the label filter applies
+    // board-wide across every swimlane.
+    // #6443: in the first swimlane also surface orphaned cards (a swimlaneId
+    // pointing at a deleted swimlane) so they are not invisible in swimlane view.
+    const list = Template.currentData();
+    const selector = listCardsSelector(
+      list._id,
+      swimlaneId,
+      list.orphanedCardsSwimlaneIds
+        ? list.orphanedCardsSwimlaneIds(swimlaneId)
+        : undefined,
+    );
+    const mongoSelector = Filter.mongoSelector(selector);
+    // Lazy card loading: the board publication ships no cards, so subscribe to
+    // just this list/swimlane window (grows with `limit` as the user scrolls)
+    // plus its reactive total count. Default mode keeps everything in minimongo
+    // already, so these subscriptions are skipped.
+    if (list.boardId && isLazyCards(list.boardId)) {
+      tpl.subscribe('boardCardsWindow', list.boardId, mongoSelector, sortBy, limit);
+      tpl.subscribe(
+        'boardListCardCount',
+        windowCountId(list._id, swimlaneId),
+        list.boardId,
+        mongoSelector,
+      );
     }
-    const ret = ReactiveCache.getCards(Filter.mongoSelector(selector), {
+    const ret = ReactiveCache.getCards(mongoSelector, {
       // sort: ['sort'],
       sort: sortBy,
       limit,
@@ -362,6 +386,13 @@ Template.listBody.helpers({
   showSpinner(swimlaneId) {
     const tpl = Template.instance();
     const list = Template.currentData();
+    if (isLazyCards()) {
+      // In lazy mode minimongo only holds the loaded window, so the total comes
+      // from the server count published into BoardListCardCounts.
+      const countDoc = BoardListCardCounts.findOne(windowCountId(list._id, swimlaneId));
+      const total = countDoc ? countDoc.count : 0;
+      return total > tpl.cardlimit.get();
+    }
     return list.cards(swimlaneId).length > tpl.cardlimit.get();
   },
 
@@ -426,6 +457,80 @@ Template.listBody.events({
   },
 });
 
+// #2769 Card lands in the WRONG swimlane when it is dropped while a connected
+// list's layout changed mid-drag. jQuery UI sortable snapshots the geometry
+// of every connected `.js-minicards` container once at drag start
+// (_mouseStart runs refreshPositions() BEFORE the `start` callback) and only
+// re-snapshots after its own placeholder moves — never when Blaze mutates the
+// DOM. Two such mutations routinely happen during a drag: another user's
+// newly added card is reactively inserted into the target list (the issue's
+// "target column where a new card is being added"), and the dragging user's
+// own open add-card composer is closed by the `start` callback's
+// EscapeActions call, AFTER the snapshot. Every list/swimlane below the
+// change then shifts vertically while the cached rectangles stay put, so the
+// drop resolves against a stale map: the placeholder is parked in the
+// neighbouring swimlane's copy of the list (hence the reporter's "no drop
+// shadow in the target column") and the stop handler's
+// ui.item.parents('.swimlane') (client/components/lists/list.js) faithfully
+// persists that wrong swimlane.
+// Fix: watch each list's minicards for REAL DOM changes (Blaze insertions and
+// removals — not jQuery UI's own placeholder/helper churn, which the library
+// already follows with its own refresh) and re-cache the active drag's
+// geometry with sortable('refresh'). The decision helpers are pure and unit
+// tested in tests/cardDragGeometry.test.cjs.
+Template.listBody.onRendered(function () {
+  const minicardsEl = this.find('.js-minicards');
+  if (!minicardsEl || typeof MutationObserver === 'undefined') {
+    return;
+  }
+  this.dragGeometryRefreshQueued = false;
+  this.dragGeometryObserver = new MutationObserver(mutations => {
+    // Cheapest gate first: no drag helper on the page means no drag at all
+    // (this observer also fires on every ordinary reactive card update).
+    if (!document.getElementsByClassName('ui-sortable-helper').length) {
+      return;
+    }
+    if (!mutationsChangeDragGeometry(mutations)) {
+      return;
+    }
+    if (this.dragGeometryRefreshQueued) {
+      return;
+    }
+    this.dragGeometryRefreshQueued = true;
+    // Coalesce bursts (Blaze can insert several nodes per flush); by the time
+    // the timeout runs, this tick's layout is final and measurable.
+    setTimeout(() => {
+      this.dragGeometryRefreshQueued = false;
+      const active = findActiveCardDrag(
+        $('.js-minicards')
+          .toArray()
+          .map(el => $.data(el, 'ui-sortable')),
+      );
+      if (active) {
+        try {
+          // Re-collects the items of every connected container and re-measures
+          // all container rectangles, so the pointer is matched against the
+          // CURRENT layout for the rest of the drag.
+          active.refresh();
+        } catch (e) {
+          // A failed re-measure must never break the drag itself.
+        }
+      }
+    }, 0);
+  });
+  this.dragGeometryObserver.observe(minicardsEl, {
+    childList: true,
+    subtree: true,
+  });
+});
+
+Template.listBody.onDestroyed(function () {
+  if (this.dragGeometryObserver) {
+    this.dragGeometryObserver.disconnect();
+    this.dragGeometryObserver = null;
+  }
+});
+
 function toggleValueInReactiveArray(reactiveValue, value) {
   const array = reactiveValue.get();
   const valueIndex = array.indexOf(value);
@@ -706,14 +811,19 @@ Template.linkCardPopup.helpers({
       archived: false,
       linkedId: { $nin: ownCardsIds },
       _id: { $nin: ownCardsIds },
-      type: { $nin: ['template-card'] },
+      // #5808: never offer an existing linked card/board as a link target —
+      // linking to one builds a chain of linkedId pointers that renders the
+      // card inaccessible. Only real cards may be linked.
+      type: { $nin: ['template-card', 'cardType-linkedCard', 'cardType-linkedBoard'] },
     };
     if (tpl.selectedBoardId.get()) selector.boardId = tpl.selectedBoardId.get();
     if (tpl.selectedSwimlaneId.get()) selector.swimlaneId = tpl.selectedSwimlaneId.get();
     if (tpl.selectedListId.get()) selector.listId = tpl.selectedListId.get();
 
     const ret = ReactiveCache.getCards(selector, { sort: { sort: 1 } });
-    return ret;
+    // #5394: sort the Cards dropdown alphabetically by title
+    // (case-insensitive) so a card can be found on boards with many cards.
+    return sortCardsByTitle(ret);
   },
 
   isTitleDefault(title) {
@@ -790,6 +900,17 @@ Template.linkCardPopup.events({
       Popup.back();
       return;
     }
+    // #5808: refuse to link to a linked card/board or to a card that links back
+    // to this board — those build a chain/cycle of linkedId pointers that renders
+    // the cards inaccessible. The <select> already filters these out, but its
+    // options can be stale, so re-check the resolved target here.
+    const targetCard = ReactiveCache.getCard(linkedId);
+    const ownCardsIds = tpl.board.cards().map(card => card.getRealId());
+    if (!isLinkableCardTarget(targetCard, ownCardsIds)) {
+      alert(TAPi18n.__('error-linked-card-not-allowed'));
+      Popup.back();
+      return;
+    }
     const nextCardNumber = await tpl.board.getNextCardNumber();
     const sortIndex = tpl.getSortIndex();
     const _id = Cards.insert({

client/components/lists/listHeader.jade

@@ -1,7 +1,8 @@
 template(name="listHeader")
   .list-header.js-list-header.nodragscroll(
     class="{{#if limitToShowCardsCount}}list-header-card-count{{/if}}"
-    class=colorClass)
+    class=colorClass
+    style=colorStyle)
     //- #459: keyboard/screen-reader list reordering (visually hidden, focusable).
     .list-move-buttons.sr-only
       a.js-list-move-left(href="#" role="button" aria-label="{{_ 'move-list-left'}}") {{_ 'move-list-left'}}
@@ -15,7 +16,7 @@ template(name="listHeader")
             i.fa.fa-caret-left
       else
         if collapsed
-          if showCardsCountForList cards.length
+          if showCardsCountForList cardsCountWhole
             br
             span.cardCount {{cardsCount}}
       if isMiniScreen
@@ -26,10 +27,10 @@ template(name="listHeader")
             = title
           if wipLimit.enabled
            | (
-           span(class="{{#if exceededWipLimit}}highlight{{/if}}") {{cards.length}}
+           span(class="{{#if exceededWipLimit}}highlight{{/if}}") {{cardsCountWhole}}
            |/#{wipLimit.value})
-        if showCardsCountForList cards.length
-          span.cardCount {{cardsCount}} {{cardsCountForListIsOne cards.length}}
+        if showCardsCountForList cardsCountWhole
+          span.cardCount {{cardsCount}} {{cardsCountForListIsOne cardsCountWhole}}
           if hasNumberFieldsSum
             |  
             span.list-sum-badge(title="{{_ 'sum-of-number-fields'}}") ∑ {{numberFieldsSum}}
@@ -47,11 +48,11 @@ template(name="listHeader")
               = title
             if wipLimit.enabled
              | (
-             span(class="{{#if exceededWipLimit}}highlight{{/if}}") {{cards.length}}
+             span(class="{{#if exceededWipLimit}}highlight{{/if}}") {{cardsCountWhole}}
              |/#{wipLimit.value})
         unless collapsed
-          if showCardsCountForList cards.length
-            span.cardCount {{cardsCount}} {{cardsCountForListIsOne cards.length}}
+          if showCardsCountForList cardsCountWhole
+            span.cardCount {{cardsCount}} {{cardsCountForListIsOne cardsCountWhole}}
             if hasNumberFieldsSum
               |  
               span.list-sum-badge(title="{{_ 'sum-of-number-fields'}}") ∑ {{numberFieldsSum}}
@@ -100,6 +101,10 @@ template(name="listHeader")
                       i.fa.fa-plus
                   a.js-open-list-menu(title="{{_ 'listActionPopup-title'}}")
                     i.fa.fa-bars
+                  //- #6465: far-right add-list button. Opens the inline Add List
+                  //- composer AFTER this list (right in LTR / left in RTL).
+                  a.js-add-list-here.list-header-plus-top(title="{{_ 'add-list'}}")
+                    i.fa.fa-plus-square-o
 
 template(name="editListTitleForm")
   .list-composer
@@ -207,7 +212,10 @@ template(name="listMorePopup")
       span {{_ 'link-list'}}
       = ' '
       i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
-      input.inline-input(type="text" readonly value="{{ rootUrl }}")
+      //- #6459: was {{ rootUrl }}, a helper that does not exist anywhere, so the
+      //- link input was always empty. absoluteUrl resolves a URL via a card on
+      //- this list.
+      input.inline-input(type="text" readonly value="{{ absoluteUrl }}")
     | {{_ 'added'}}
     span.date(title=list.createdAt) {{ displayDate createdAt 'LLL' }}
     //unless currentUser.isWorker
@@ -279,6 +287,10 @@ template(name="setListColorPopup")
       span.card-label.palette-color.js-palette-color(class="card-details-{{color}}")
         if(isSelected color)
           i.fa.fa-check
+    // #5514: native color wheel for picking a custom RGB / hex color
+    .color-wheel-wrap
+      label(for="listColorWheel") {{_ 'custom-color'}}
+      input.js-list-color-wheel#listColorWheel(type="color" value=currentColorHex title="{{_ 'custom-color'}}")
     button.primary.confirm.js-submit {{_ 'save'}}
     button.js-remove-color.negate.wide.right {{_ 'unset-color'}}
 

client/components/lists/listHeader.js

@@ -5,8 +5,17 @@ import dragscroll from '@wekanteam/dragscroll';
 import { BoardSwimlaneListDialog } from '/client/lib/dialogWithBoardSwimlaneList';
 import Cards from '/models/cards';
 import { LIST_COLORS } from '/models/metadata/colors';
+import { isHexColor, toHex } from '/models/lib/contrastColor';
 import { MultiSelection } from '/client/lib/multiSelection';
 import { Utils } from '/client/lib/utils';
+import { lazyListCardCount } from '/client/lib/lazyCards';
+// #5659: single source of truth for the default/minimum list width, shared
+// with client/components/lists/list.js and models/users.js.
+import {
+  DEFAULT_LIST_WIDTH,
+  MIN_LIST_WIDTH,
+  normalizeListWidth,
+} from '/models/lib/listWidth';
 
 let listsColors;
 Meteor.startup(() => {
@@ -59,24 +68,33 @@ Template.listHeader.helpers({
       swimlaneId = list.swimlaneId || '';
     }
 
-    const ret = list.cards(swimlaneId).length;
-    return ret;
+    // In lazy mode minimongo holds only the loaded window, so use the accurate
+    // server count for the same selector; fall back to the loaded length.
+    const lazyCount = lazyListCardCount(list, swimlaneId);
+    return lazyCount !== null ? lazyCount : list.cards(swimlaneId).length;
   },
 
   reachedWipLimit() {
     const list = Template.currentData();
-    return (
-      list.getWipLimit('enabled') &&
-      list.getWipLimit('value') <= list.cards().length
-    );
+    const lazyCount = lazyListCardCount(list, undefined);
+    const count = lazyCount !== null ? lazyCount : list.cards().length;
+    return list.getWipLimit('enabled') && list.getWipLimit('value') <= count;
   },
 
   exceededWipLimit() {
     const list = Template.currentData();
-    return (
-      list.getWipLimit('enabled') &&
-      list.getWipLimit('value') < list.cards().length
-    );
+    const lazyCount = lazyListCardCount(list, undefined);
+    const count = lazyCount !== null ? lazyCount : list.cards().length;
+    return list.getWipLimit('enabled') && list.getWipLimit('value') < count;
+  },
+
+  // Accurate whole-list card count (used by the badge visibility, WIP-limit
+  // number and pluralization in the template). In lazy mode `cards.length`
+  // (= list.cards().length) is only the loaded window, so prefer the server count.
+  cardsCountWhole() {
+    const list = Template.currentData();
+    const lazyCount = lazyListCardCount(list, undefined);
+    return lazyCount !== null ? lazyCount : list.cards().length;
   },
 
   showCardsCountForList(count) {
@@ -141,10 +159,9 @@ Template.listHeader.helpers({
 Template.listHeader.onCreated(function () {
   this.reachedWipLimit = function () {
     const list = Template.currentData();
-    return (
-      list.getWipLimit('enabled') &&
-      list.getWipLimit('value') <= list.cards().length
-    );
+    const lazyCount = lazyListCardCount(list, undefined);
+    const count = lazyCount !== null ? lazyCount : list.cards().length;
+    return list.getWipLimit('enabled') && list.getWipLimit('value') <= count;
   };
 });
 
@@ -191,6 +208,20 @@ Template.listHeader.events({
     Utils.setListCollapseState(list, !status);
   },
   'click .js-open-list-menu': Popup.open('listAction'),
+  // #6465: open the inline Add List composer after this list. Record the
+  // swimlane it is displayed in (board-wide lists are not bound to one) so the
+  // new list is created in the right swimlane; the composer renders after this
+  // list in the DOM (right in LTR / left in RTL).
+  'click .js-add-list-here'(event) {
+    event.preventDefault();
+    const list = Template.currentData();
+    const swimlaneDom = $(event.currentTarget).closest('.js-swimlane');
+    const swimlaneId = swimlaneDom.length
+      ? swimlaneDom.attr('id').replace('swimlane-', '')
+      : null;
+    Session.set('wekan-add-list-swimlane', swimlaneId);
+    Session.set('wekan-add-list-after', list._id);
+  },
   'click .js-add-card.list-header-plus-top'(event) {
     const listDom = $(event.target).parents(
       `#js-list-${Template.currentData()._id}`,
@@ -305,11 +336,10 @@ Template.setWipLimitPopup.events({
   async 'click .js-enable-wip-limit'() {
     const list = Template.currentData();
     // Prevent user from using previously stored wipLimit.value if it is less than the current number of cards in the list
-    if (
-      !list.getWipLimit('enabled') &&
-      list.getWipLimit('value') < list.cards().length
-    ) {
-      await list.setWipLimit(list.cards().length);
+    const lazyCount = lazyListCardCount(list, undefined);
+    const count = lazyCount !== null ? lazyCount : list.cards().length;
+    if (!list.getWipLimit('enabled') && list.getWipLimit('value') < count) {
+      await list.setWipLimit(count);
     }
     Meteor.call('enableWipLimit', list._id);
   },
@@ -357,8 +387,10 @@ Template.listMorePopup.events({
         ],
       }).length === 0
     ) {
-      allCardIds.map(_id => Cards.remove(_id));
-      Lists.remove(list._id);
+      // Soft delete (docs/Features/Undo/Undo.md): mark the list + its cards deleted
+      // (server cascades) instead of destroying them, so the delete is restorable
+      // and undoable (#1023). Replaces the old hard Cards.remove / Lists.remove.
+      Meteor.call('lists.softRemove', list._id);
     } else {
       const message = `${TAPi18n.__(
         'delete-linked-cards-before-this-list',
@@ -476,6 +508,10 @@ Template.setListColorPopup.helpers({
       return tpl.currentColor.get() === color;
     }
   },
+  // #5514: current color as a '#rrggbb' hex for the native color wheel <input>.
+  currentColorHex() {
+    return toHex(Template.instance().currentColor.get()) || '#0079bf';
+  },
 });
 
 Template.setListColorPopup.events({
@@ -483,6 +519,13 @@ Template.setListColorPopup.events({
     const paletteData = Blaze.getData(event.currentTarget);
     tpl.currentColor.set(paletteData?.color);
   },
+  // #5514: picking from the native color wheel stores a custom hex.
+  'input .js-list-color-wheel'(event, tpl) {
+    const value = event.currentTarget.value;
+    if (isHexColor(value)) {
+      tpl.currentColor.set(value);
+    }
+  },
   async 'submit form'(event, tpl) {
     event.preventDefault();
     try {
@@ -542,12 +585,12 @@ function readAnonFixedListWidth(boardId) {
     if (stored) {
       const widths = JSON.parse(stored);
       const w = widths[boardId];
-      if (typeof w === 'number' && w >= 270) return w;
+      if (typeof w === 'number' && w >= MIN_LIST_WIDTH) return w;
     }
   } catch (e) {
     console.warn('Error reading fixed list width from localStorage:', e);
   }
-  return 272;
+  return DEFAULT_LIST_WIDTH;
 }
 
 function isFixedListWidth(boardId) {
@@ -591,8 +634,7 @@ Template.setListWidthPopup.helpers({
     if (isFixedListWidth(list.boardId)) {
       return fixedListWidthValue(list.boardId);
     }
-    const shared =
-      typeof list.width === 'number' && list.width >= 270 ? list.width : 272;
+    const shared = normalizeListWidth(list.width);
     if (!isPersonalListWidth(list.boardId)) {
       return shared;
     }
@@ -600,7 +642,7 @@ Template.setListWidthPopup.helpers({
     if (user) {
       const widths = user.getListWidths();
       const w = widths[list.boardId] && widths[list.boardId][list._id];
-      return typeof w === 'number' && w >= 270 ? w : shared;
+      return normalizeListWidth(w, shared);
     }
     return shared;
   },
@@ -682,7 +724,7 @@ Template.setListWidthPopup.events({
     const boardId = list.boardId;
     const width = parseInt(tpl.$('.list-width-value').val(), 10);
 
-    if (!width || width < 270) {
+    if (!width || width < MIN_LIST_WIDTH) {
       tpl.$('.list-width-error').click();
       return;
     }

client/components/main/customTheme.css

@@ -0,0 +1,49 @@
+/* Custom theme colors (docs/Theme/Theme.md) — the flat/clear categories let the
+ * user pick their own colors, applied as CSS variables on :root by
+ * globalThemeColor.js and consumed here. This is the initial, highest-impact
+ * surface (the header bars, primary buttons, sidebar button); deeper theming can
+ * grow from here. dark/special themes never set these variables. */
+
+/* Flat: a single accent recolors the header bars and primary controls. The class
+ * lives on <body>; #header / #header-quick-access are descendants. */
+.has-custom-theme-color #header,
+.has-custom-theme-color #header-quick-access {
+  background: var(--theme-accent) !important;
+}
+
+.has-custom-theme-color button[type=submit].primary,
+.has-custom-theme-color input[type=submit].primary,
+.has-custom-theme-color .sidebar .sidebar-content .sidebar-btn {
+  background-color: var(--theme-accent) !important;
+}
+
+/* Clear: a two-color slide (gradient) across the header bars. */
+.has-custom-theme-slide #header,
+.has-custom-theme-slide #header-quick-access {
+  background: linear-gradient(135deg, var(--theme-accent), var(--theme-accent-2)) !important;
+}
+
+/* Select Color picker: category groups with a visible name above each group of
+ * colour swatches (docs/Theme/Theme.md). */
+.theme-color-picker .theme-category-group {
+  margin-bottom: 8px;
+  clear: both; /* start below the previous group's floated swatches */
+}
+.theme-color-picker .theme-category-label {
+  display: block;
+  width: 100%;
+  clear: both;        /* drop below the previous group's floats... */
+  text-align: left;   /* ...so Flat/Clear/Dark/Special all sit at the left */
+  font-weight: bold;
+  margin: 2px 0 4px;
+  text-transform: capitalize;
+}
+/* No empty band above the first (Flat) title. */
+.theme-color-picker .theme-category-group:first-child .theme-category-label {
+  margin-top: 0;
+}
+/* Tighten the Default (no override) row above the groups (Member Settings). */
+.theme-color-picker ul.pop-over-list {
+  margin: 0 0 4px;
+  padding: 0;
+}

client/components/main/editor.js

@@ -383,10 +383,29 @@ Blaze.Template.registerHelper(
   'mentions',
   new Template('mentions', function() {
     const view = this;
+    // Admin Panel / Features / Security: read the setting FIRST (a reactive dependency
+    // of this viewer) and push the "always show all code as plain text" flag into the
+    // wekan-markdown package BEFORE rendering the inner markdown below. Doing it here —
+    // not only in the separate startup autorun — removes a re-render race: this viewer
+    // already re-renders whenever the setting doc changes (it reads it for stripLinks),
+    // and the inner markdown helper then reads the up-to-date flag in the SAME
+    // synchronous render, so toggling "always show all code as plain text" takes effect
+    // immediately. Without this the viewer could re-render (setting changed) BEFORE the
+    // startup autorun updated the flag, read the stale value, and never re-render again
+    // since it does not itself depend on that ReactiveVar.
+    const setting = ReactiveCache.getCurrentSetting();
+    if (typeof Markdown !== 'undefined' && Markdown.alwaysShowCodeAsText) {
+      Markdown.alwaysShowCodeAsText.set(!!(setting && setting.alwaysShowCodeAsText));
+    }
     let content = Blaze.toHTML(view.templateContentBlock);
+    // Admin Panel / Features: when "render links as plain text" is enabled, every
+    // link (markdown [label](url) and raw HTML <a href>) is stripped to plain,
+    // non-clickable text everywhere rich text is shown. Reactive: toggling the
+    // setting re-renders viewers.
+    const stripLinks = !!(setting && setting.renderLinksAsPlainText);
     const currentBoard = Utils.getCurrentBoard();
     if (!currentBoard)
-      return HTML.Raw(sanitizeHTML(content));
+      return HTML.Raw(sanitizeHTML(content, { stripLinks }));
     const knowedUsers = [...new Set([...currentBoard.members
       .filter(member => member.isActive)
       .map(member => {
@@ -440,7 +459,7 @@ Blaze.Template.registerHelper(
       content = content.replace(fullMention, Blaze.toHTML(link));
     }
 
-    return HTML.Raw(sanitizeHTML(content));
+    return HTML.Raw(sanitizeHTML(content, { stripLinks }));
   }),
 );
 
@@ -473,3 +492,17 @@ Template.viewer.events({
     }
   },
 });
+
+// Admin Panel / Features / Security: keep the wekan-markdown package's
+// "show all code as plain text" flag in sync with the alwaysShowCodeAsText setting.
+// The package cannot import app code, so we push the setting into the reactive flag
+// it exposes on the exported Markdown object; the markdown helper reads it reactively
+// and shows the raw source (escaped, non-clickable, non-running) when enabled.
+Meteor.startup(() => {
+  Tracker.autorun(() => {
+    const setting = ReactiveCache.getCurrentSetting();
+    if (typeof Markdown !== 'undefined' && Markdown.alwaysShowCodeAsText) {
+      Markdown.alwaysShowCodeAsText.set(!!(setting && setting.alwaysShowCodeAsText));
+    }
+  });
+});

client/components/main/globalSearch.css

@@ -88,17 +88,9 @@
   cursor: pointer;
   transition: background-color 0.2s;
 }
-.board-color-belize.js-new-search {
-  background-color: #216694 !important;
-  color: #fff !important;
-  border: none !important;
-}
-.board-color-belize.js-new-search:hover {
-  background-color: #1a4d6a !important;
-}
-.board-color-belize.js-new-search:active {
-  background-color: #0d334d !important;
-}
+/* The new-search button uses the .primary button style, so it follows the theme
+   override colour (default blue #005377, or the board/global theme). The old
+   hardcoded belize (#216694) rules were removed. */
 .global-search-operator {
   font-family: Courier;
 }

client/components/main/globalSearch.jade

@@ -71,8 +71,8 @@ template(name="globalSearch")
           aria-label="{{_ 'globalSearch-title'}}"
           autofocus dir="auto"
         )
-        button.js-new-search.board-color-belize(type="button" aria-label="{{_ 'globalSearch-title'}}" style="background: #216694 !important; background-color: #216694 !important; color: #fff !important; border: none !important;")
-          span(aria-hidden="true") 🧹
+        button.primary.js-new-search(type="submit" aria-label="{{_ 'trello-clear-job'}}")
+          | {{_ 'trello-clear-job'}}
       if searching
         +spinner
       else if hasResults

client/components/main/globalThemeColor.js

@@ -0,0 +1,74 @@
+import { Meteor } from 'meteor/meteor';
+import { Tracker } from 'meteor/tracker';
+import { Session } from 'meteor/session';
+import { ReactiveCache } from '/imports/reactiveCache';
+
+// #5778 + docs/Theme/Theme.md: apply the user's optional GLOBAL theme color to the
+// whole UI (All Boards, Search, Admin Panel, My Cards, etc.) via a `board-color-<name>`
+// class on <body>, and apply CUSTOM colors (flat = 1 accent, clear = 2 = a gradient)
+// as CSS variables consumed by customTheme.css.
+//
+// While viewing a single board, that board's own color owns the page, so we do NOT
+// put the global color class on <body> there; but we DO expose the ACTIVE context's
+// custom colors (the board's when on a board, the user's global override otherwise)
+// so custom-colored boards and the custom global theme both render.
+
+Meteor.startup(() => {
+  let appliedClass = null;
+
+  function applyClass(colorClass) {
+    if (colorClass === appliedClass) return;
+    try {
+      if (appliedClass) document.body.classList.remove(appliedClass);
+      if (colorClass) document.body.classList.add(colorClass);
+    } catch (_) {
+      // document.body may not exist yet in exotic embeddings; ignore.
+    }
+    appliedClass = colorClass;
+  }
+
+  function applyCustom(custom) {
+    try {
+      const root = document.documentElement;
+      const c1 = custom && custom[0];
+      const c2 = custom && custom[1];
+      if (c1) {
+        root.style.setProperty('--theme-accent', c1);
+        document.body.classList.add('has-custom-theme-color');
+      } else {
+        root.style.removeProperty('--theme-accent');
+        document.body.classList.remove('has-custom-theme-color');
+      }
+      if (c2) {
+        root.style.setProperty('--theme-accent-2', c2);
+        document.body.classList.add('has-custom-theme-slide');
+      } else {
+        root.style.removeProperty('--theme-accent-2');
+        document.body.classList.remove('has-custom-theme-slide');
+      }
+    } catch (_) {
+      // ignore
+    }
+  }
+
+  Tracker.autorun(() => {
+    const user = Meteor.user();
+    const globalColor = user && user.profile && user.profile.globalThemeColor;
+
+    if (globalColor) {
+      // #5778: a global override wins EVERYWHERE — including board pages. The header
+      // and .board-wrapper also prefer it (see header.jade / boardBody.jade), so the
+      // whole UI takes the chosen theme; unset it to return to per-board colors.
+      applyClass(`board-color-${globalColor}`);
+      applyCustom((user && user.profile && user.profile.globalThemeCustomColors) || []);
+      return;
+    }
+
+    // No global override: on a board expose that board's own custom colors (its color
+    // class already lives on .board-wrapper/#header); off a board, apply nothing.
+    const boardId = Session.get('currentBoard');
+    const board = boardId ? ReactiveCache.getBoard(boardId) : null;
+    applyClass(null);
+    applyCustom((board && board.customThemeColors) || []);
+  });
+});

client/components/main/header.css

@@ -5,8 +5,16 @@
   z-index: 17;
 }
 #header #header-main-bar {
-  height: 40px;
-  padding: 7px 10px 0;
+  /* Flex row (was float-based) so the right button group — which ends with the
+     sidebar hamburger — is always pinned to the right edge at every window width,
+     instead of drifting to the middle as floats wrap. */
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  min-height: 40px;
+  /* No right padding: the right gap is owned by the hamburger's margin so it can
+     match the ~8px gap to the right of the top-bar user name. (top right bottom left) */
+  padding: 7px 0 0 10px;
 }
 #header #header-main-bar h1 {
   font-size: 20px;
@@ -39,15 +47,17 @@
   opacity: 0.9;
 }
 #header #header-main-bar .board-header-btns {
-  display: block;
+  /* Flex so the buttons inside each group lay out (their float is ignored inside a
+     flex container) and the groups themselves are flex items of the header bar. */
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
   margin-top: 3px;
   width: auto;
 }
-#header #header-main-bar .board-header-btns.left {
-  float: inline-start;
-}
 #header #header-main-bar .board-header-btns.right {
-  float: inline-end;
+  /* Always hug the right edge (and, if the row wraps, the right of its row). */
+  margin-inline-start: auto;
 }
 #header #header-main-bar .board-header-btn {
   border-radius: 3px;
@@ -60,6 +70,15 @@
   line-height: 28px;
   margin: 0 12px;
 }
+/* The sidebar hamburger sits at the far right; drop its wide 12px side margins so
+   there is no button-sized empty space to its left or right. The cog before it also
+   drops its right margin so the two sit snugly together at the edge. */
+#header #header-main-bar .board-header-btn.js-toggle-sidebar {
+  margin-inline-start: 2px;
+  /* 8px to the right edge — the same small gap as to the right of the user name in
+     the top bar (.header-user-bar-name margin-inline-end). */
+  margin-inline-end: 8px;
+}
 #header #header-main-bar .board-header-btn i.fa {
   float: inline-start;
   display: block;
@@ -290,15 +309,19 @@ body:not(.board-view) #header #header-main-bar h1 {
 }
 
 /* Zoom Controls in Header */
+/* #6465: compact fixed-pixel pill. The vh/vw padding+shadow made the pill
+   taller than the 28px overflow-hidden quick-access row, so it rendered cut
+   off at every window size. */
 #header-quick-access .zoom-controls {
   display: flex;
   align-items: center;
-  gap: 0.5vw;
+  gap: 4px;
   background: rgba(255, 255, 255, 0.9);
-  padding: 0.5vh 1vw;
-  border-radius: 0.5vw;
-  box-shadow: 0 0.2vh 0.5vh rgba(0,0,0,0.1);
-  margin: 0 1vw;
+  padding: 2px 8px;
+  border-radius: 10px;
+  box-shadow: 0 1px 2px rgba(0,0,0,0.1);
+  margin: 0 8px;
+  max-height: 24px;
   float: inline-start;
 }
 

client/components/main/header.jade

@@ -5,7 +5,7 @@ template(name="header")
     Reddit "subreddit" bar.
     The first link goes to the boards page.
   if currentUser
-    #header-quick-access(class=currentBoard.colorClass role="navigation" aria-label="{{_ 'all-boards'}}")
+    #header-quick-access(class="{{#if currentUser.globalThemeColorClass}}{{currentUser.globalThemeColorClass}}{{else}}{{currentBoard.colorClass}}{{/if}}" role="navigation" aria-label="{{_ 'all-boards'}}")
       // Home icon - always at left side of logo
       span.home-icon.allBoards
         a(href="{{pathFor 'home'}}")
@@ -24,11 +24,13 @@ template(name="header")
           div#headerIsSettingDatabaseCallDone
             img(src="{{pathFor '/logo-header.png'}}" alt="{{currentSetting.productName}}" title="{{currentSetting.productName}}")
 
-        // Zoom controls - always visible
-        .zoom-controls
-          span.zoom-level.js-zoom-level-click(title="{{_ 'click-to-change-zoom'}}")
-            span.zoom-display {{zoomLevel}}%
-            input.zoom-input.js-zoom-input(type="number" value=zoomLevel min="50" max="300" step="10" style="display: none;")
+      // Mobile/desktop mode toggle (swapped with zoom)
+      .mobile-mode-toggle
+        a.board-header-btn.js-mobile-mode-toggle(title="{{_ 'mobile-desktop-toggle'}}" class="{{#if mobileMode}}mobile-active{{else}}desktop-active{{/if}}")
+          i.mobile-icon(class="{{#if mobileMode}}active{{/if}}")
+            i.fa.fa-mobile
+          i.desktop-icon(class="{{#unless mobileMode}}active{{/unless}}")
+            i.fa.fa-desktop
 
       // Drag handles toggle - between zoom and mobile mode toggle
       a.board-header-btn.js-toggle-desktop-drag-handles(title="{{_ 'show-desktop-drag-handles'}}")
@@ -78,12 +80,11 @@ template(name="header")
       //
         i.fa.fa-plus(title="Create a new board")
 
-      .mobile-mode-toggle
-        a.board-header-btn.js-mobile-mode-toggle(title="{{_ 'mobile-desktop-toggle'}}" class="{{#if mobileMode}}mobile-active{{else}}desktop-active{{/if}}")
-          i.mobile-icon(class="{{#if mobileMode}}active{{/if}}")
-            i.fa.fa-mobile
-          i.desktop-icon(class="{{#unless mobileMode}}active{{/unless}}")
-            i.fa.fa-desktop
+      // Zoom controls (swapped with the mobile/desktop toggle)
+      .zoom-controls
+        span.zoom-level.js-zoom-level-click(title="{{_ 'click-to-change-zoom'}}")
+          span.zoom-display {{zoomLevel}}%
+          input.zoom-input.js-zoom-input(type="number" value=zoomLevel min="50" max="300" step="10" style="display: none;")
 
       // Notifications
       +notifications
@@ -95,7 +96,7 @@ template(name="header")
 
       +headerUserBar
 
-  #header(class=currentBoard.colorClass)
+  #header(class="{{#if currentUser.globalThemeColorClass}}{{currentUser.globalThemeColorClass}}{{else}}{{currentBoard.colorClass}}{{/if}}")
     //-
       The main bar is a colorful bar that provide all the meta-data for the
       current page. This bar is contextual based.

client/components/main/layouts.css

@@ -157,8 +157,14 @@ input,
 select,
 textarea,
 button {
-  font: clamp(14px, 2.5vw, 18px) Roboto, Poppins, "Helvetica Neue", Arial, Helvetica, sans-serif;
-  line-height: 1.4;
+  /* #6465: back to the WeKan 6.09 desktop density. The clamp() introduced in
+     v7.98 (20e9cf114) and raised in v8.02 (67b078b80) resolved to 18px on any
+     window wider than 720px — +28.5% on EVERY font, input and button versus
+     6.09's 14px — which is the "everything is way too big" regression. Mobile
+     readability is handled by the mobile media queries, not by inflating the
+     desktop base font. */
+  font: 14px Roboto, Poppins, "Helvetica Neue", Arial, Helvetica, sans-serif;
+  line-height: 18px;
   color: #4d4d4d;
   /* Improve text rendering */
   -webkit-font-smoothing: antialiased;
@@ -217,8 +223,10 @@ body.mobile-mode #content {
   margin-top: 30vh;
 }
 #content > .wrapper {
-  margin-top: 1vh;
-  padding: 2vh 2vw;
+  /* #6465: 6.09 values; 2vh/2vw padding was ~21x38px on FullHD — the huge
+     empty header band on the All Boards page. */
+  margin-top: 10px;
+  padding: 15px;
 }
 #modal {
   position: absolute;
@@ -264,13 +272,36 @@ body.mobile-mode #content {
   float: inline-end;
   font-size: clamp(18px, 4vw, 24px);
 }
+/* Archived boards modal: full-width panel that extends to the bottom of the browser
+   window (so archived boards show full width with maximum vertical space). It is the
+   only modal that contains .archived-lists. */
+#modal .modal-content:has(.archived-lists) {
+  width: 96vw;
+  max-width: 96vw;
+  /* The header bar(s) sit above the modal (higher z-index), so start the archive
+     panel BELOW them — otherwise its top (and the close X) is hidden under the top
+     header bar. ~96px clears both the quick-access bar and the board header bar; on
+     the All Boards page (one bar) this leaves a small top gap. Then extend to the
+     bottom of the browser window. */
+  margin: 96px auto 0;
+  min-height: calc(100vh - 106px);
+  box-sizing: border-box;
+}
+/* Each archived board is a full-width row. */
+#modal .modal-content .archived-lists,
+#modal .modal-content .archived-lists .archived-lists-item {
+  width: 100%;
+  box-sizing: border-box;
+}
+/* #6465: heading sizes back to the 6.09 values (22/18/16px) — the vw clamps
+   resolved to 24/20/18px on desktop and compounded the density regression. */
 h1 {
-  font-size: clamp(18px, 4vw, 24px);
+  font-size: 22px;
   line-height: 1.2em;
   margin: 0 0 1vh;
 }
 h2 {
-  font-size: clamp(16px, 3.5vw, 20px);
+  font-size: 18px;
   line-height: 1.2em;
   margin: 0 0 0.8vh;
 }
@@ -278,7 +309,7 @@ h3,
 h4,
 h5,
 h6 {
-  font-size: clamp(14px, 3vw, 18px);
+  font-size: 16px;
   line-height: 1.25em;
   margin: 0 0 0.6vh;
 }

client/components/main/layouts.js

@@ -31,7 +31,10 @@ Template.userFormsLayout.onCreated(function () {
     Meteor.call('isOidcRedirectionEnabled', (_, result) => {
       if (result) {
         AccountsTemplates.options.socialLoginStyle = 'redirect';
-        options = {
+        // #5695: this is an ES module, so the body runs in strict mode and
+        // the previous undeclared `options = {...}` assignment threw a
+        // ReferenceError, breaking the OIDC_REDIRECTION_ENABLED auto-login.
+        const options = {
           loginStyle: AccountsTemplates.options.socialLoginStyle,
         };
         Meteor.loginWithOidc(options);
@@ -83,14 +86,23 @@ Template.userFormsLayout.onRendered(() => {
       })();
     });
 
+    // #4394 (security): a one-shot $('.at-signup-link').hide() does not survive
+    // the useraccounts form re-rendering that happens after a failed login (e.g.
+    // an LDAP "User not Found") — the links were recreated without the inline
+    // display:none and reappeared even though registration / forgot-password
+    // were disabled in the Admin Panel. Toggle a class on the stable <body>
+    // ancestor and hide the links via CSS (userForm.css) so the rule keeps
+    // applying to every freshly re-rendered copy of the links.
     Meteor.call('isDisableRegistration', (_, result) => {
       if (result) {
+        document.body.classList.add('registration-disabled');
         $('.at-signup-link').hide();
       }
     });
 
     Meteor.call('isDisableForgotPassword', (_, result) => {
       if (result) {
+        document.body.classList.add('forgotpwd-disabled');
         $('.at-pwd-link').hide();
       }
     });

client/components/main/myCards.jade

@@ -94,7 +94,7 @@ template(name="myCards")
                                 td
                                   .div
                                     each label in card.labelIds
-                                      span.card-label(class="card-label-{{labelColor board label}}" title=name)
+                                      span.card-label(class="{{labelColorClass (labelColor board label)}}" style="{{labelColorStyle (labelColor board label)}}" title=name)
                                         | {{labelName board label}}
                                 td
                                   if card.dueAt

client/components/main/popup.css

@@ -171,6 +171,12 @@
   overflow: visible;
   height: auto;
   flex: 1;
+  /* Auto-filling columns so as many languages as possible are visible at once when
+     there is browser width; collapses to a single column on narrow windows. */
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(170px, 1fr));
+  align-content: start;
+  column-gap: 4px;
 }
 
 /* Ensure content div in language popup contains all items */
@@ -197,8 +203,10 @@
   top: auto !important;
   inset-inline-start: auto !important;
   inset-inline-end: 20px !important;
-  width: auto !important;
-  max-width: 450px !important;
+  /* Wide enough for multiple language columns when the browser is wide, but never
+     wider than ~90% of the viewport (falls back to a single narrow column). */
+  width: min(90vw, 1100px) !important;
+  max-width: 90vw !important;
   height: 100vh !important;
   max-height: 100vh !important;
   min-height: 300px !important;

client/components/main/popup.js

@@ -9,7 +9,13 @@ Popup.template.events({
     Popup.close();
   },
   'click .js-confirm'() {
-    this.__afterConfirmAction.call(this);
+    // #6479: the action is stored on the Popup instance (see Popup.afterConfirm),
+    // not on this data context, so a re-rendered/immutable context can't lose it.
+    // Fall back to the legacy per-context field for any external caller.
+    const action = Popup._afterConfirmAction || this.__afterConfirmAction;
+    if (typeof action === 'function') {
+      action.call(this);
+    }
   },
   // #5942: On mobile/touch, tapping inside the card-detail sub-popups (assign
   // user / set due date) made the popup DISAPPEAR. The document-level

client/components/main/safeFilename.js

@@ -0,0 +1,15 @@
+import { Template } from 'meteor/templating';
+
+const { cleanFileName, sanitizeDownloadFileName } = require('/imports/lib/fileNameDisplay');
+
+// Global helpers for showing filenames safely EVERYWHERE (card attachments, admin
+// panel, etc.). No template needed — a filename is always shown as a plain, clean
+// string:
+//   {{cleanFilename name}}    -> URL-decoded, invisible chars removed, exploit
+//                                markup (HTML/JS/XML) removed, whitespace collapsed
+//   {{downloadFilename name}} -> the same, but never empty (falls back to "download")
+if (!Template.__safeFilenameHelpersRegistered) {
+  Template.registerHelper('cleanFilename', name => cleanFileName(name));
+  Template.registerHelper('downloadFilename', name => sanitizeDownloadFileName(name));
+  Template.__safeFilenameHelpersRegistered = true;
+}

client/components/main/themeColorPicker.jade

@@ -0,0 +1,32 @@
+//- Shared "Select Color" picker (docs/Theme/Theme.md), used by both Board Settings
+  and Member Settings. Colors are shown as VISIBLE swatches grouped by category, with
+  the category name as a header above each group; the native color wheel(s) appear
+  for the flat (1) / clear (2) categories once such a color is selected. `data.scope`
+  is 'board' or 'global'.
+template(name="themeColorPicker")
+  form.theme-color-picker.edit-label
+    if isGlobal
+      ul.pop-over-list
+        li(class="{{#if isNoneSelected}}active{{/if}}")
+          a.js-theme-none
+            i.fa.fa-ban
+            | {{_ 'theme-default'}}
+            if isNoneSelected
+              i.fa.fa-check
+    each themeGroups
+      .theme-category-group
+        .theme-category-label {{label}}
+        .board-backgrounds-list.clearfix
+          each colors
+            .board-background-select.js-select-theme(data-color="{{name}}")
+              span.background-box(class="board-color-{{name}}")
+                span {{name}}
+                if selected
+                  i.fa.fa-check
+    if showCustom
+      .color-wheel-wrap
+        label {{_ 'custom-color'}}
+        each customWheels
+          input.js-theme-wheel(type="color" data-index="{{index}}" value="{{value}}" title="{{_ 'custom-color'}}")
+      .theme-preview
+        span.background-box(class="{{previewClass}}" style="{{previewStyle}}")

client/components/main/themeColorPicker.js

@@ -0,0 +1,166 @@
+import { ReactiveCache } from '/imports/reactiveCache';
+import { ReactiveVar } from 'meteor/reactive-var';
+import { TAPi18n } from '/imports/i18n';
+import { Utils } from '/client/lib/utils';
+import { isHexColor, toHex } from '/models/lib/contrastColor';
+import { BOARD_COLORS } from '/models/metadata/colors';
+import {
+  THEME_CATEGORY_ORDER,
+  categoryOf,
+  colorsInCategory,
+  allowsCustomColor,
+  customColorCount,
+} from '/models/lib/themeCategories';
+
+// Shared "Select Color" picker (docs/Theme/Theme.md): VISIBLE color swatches grouped
+// by category (with the category name above each group) + native color wheel(s) for
+// the flat/clear categories once such a color is selected. data.scope is 'board'
+// (writes board.color) or 'global' (writes the user's #5778 global override).
+
+const DEFAULT_WHEEL = ['#2980b9', '#6dd5fa']; // stock flat accent / second slide stop
+
+function readCurrent(scope) {
+  if (scope === 'board') {
+    const b = Utils.getCurrentBoard();
+    return { color: (b && b.color) || BOARD_COLORS[0], custom: (b && b.customThemeColors) || [] };
+  }
+  const u = ReactiveCache.getCurrentUser();
+  return {
+    color: (u && u.getGlobalThemeColor && u.getGlobalThemeColor()) || null,
+    custom: (u && u.getGlobalThemeCustomColors && u.getGlobalThemeCustomColors()) || [],
+  };
+}
+
+Template.themeColorPicker.onCreated(function () {
+  const scope = this.data && this.data.scope === 'board' ? 'board' : 'global';
+  const cur = readCurrent(scope);
+  this.scope = scope;
+  this.color = new ReactiveVar(cur.color); // null for global = no override
+  this.customColors = new ReactiveVar((cur.custom || []).slice());
+});
+
+Template.themeColorPicker.helpers({
+  isGlobal() {
+    return Template.instance().scope === 'global';
+  },
+  isNoneSelected() {
+    const tpl = Template.instance();
+    return tpl.scope === 'global' && !tpl.color.get();
+  },
+  // Visible swatches grouped by category, each group labelled with its category name.
+  themeGroups() {
+    const cur = Template.instance().color.get();
+    return THEME_CATEGORY_ORDER.map(key => ({
+      key,
+      label: TAPi18n.__(`theme-category-${key}`),
+      colors: colorsInCategory(key).map(name => ({ name, selected: name === cur })),
+    }));
+  },
+  showCustom() {
+    const cur = Template.instance().color.get();
+    return cur ? allowsCustomColor(categoryOf(cur)) : false;
+  },
+  customWheels() {
+    const tpl = Template.instance();
+    const cur = tpl.color.get();
+    const n = cur ? customColorCount(categoryOf(cur)) : 0;
+    const cc = tpl.customColors.get();
+    const wheels = [];
+    for (let i = 0; i < n; i += 1) {
+      wheels.push({ index: i, value: toHex(cc[i]) || DEFAULT_WHEEL[i] || '#0079bf' });
+    }
+    return wheels;
+  },
+  previewClass() {
+    const color = Template.instance().color.get();
+    return color ? `board-color-${color}` : '';
+  },
+  // Inline preview of custom colors (the stock board-color-* CSS can't show arbitrary
+  // colors until the CSS-variable refactor; the preview swatch shows them directly).
+  previewStyle() {
+    const tpl = Template.instance();
+    const cur = tpl.color.get();
+    const cat = cur ? categoryOf(cur) : null;
+    if (!cat || !allowsCustomColor(cat)) return '';
+    const cc = tpl.customColors.get();
+    if (!cc.some(Boolean)) return '';
+    if (customColorCount(cat) === 2 && cc[0] && cc[1]) {
+      return `background: linear-gradient(135deg, ${cc[0]}, ${cc[1]}) !important;`;
+    }
+    if (cc[0]) return `background: ${cc[0]} !important;`;
+    return '';
+  },
+});
+
+// Collect the custom colors to save: [] unless the user actually engaged a wheel, in
+// which case read every wheel's current value (untouched ones contribute their shown
+// default) so the result is a complete set of the category's expected count.
+function gatherCustom(tpl) {
+  const color = tpl.color.get();
+  const cat = color ? categoryOf(color) : null;
+  if (!cat || !allowsCustomColor(cat)) return [];
+  if (!tpl.customColors.get().some(Boolean)) return [];
+  const n = customColorCount(cat);
+  const wheels = Array.from(tpl.findAll('.js-theme-wheel'))
+    .map(w => w.value)
+    .filter(isHexColor)
+    .slice(0, n);
+  return wheels.length === n ? wheels : [];
+}
+
+// Apply the current selection immediately (no Save button): board scope writes
+// board.color, global scope calls setGlobalThemeColor. `color`/`custom` are read
+// from the reactive state so the same helper serves the swatch click and the wheel.
+function applySelection(tpl) {
+  const color = tpl.color.get() || colorsInCategory(THEME_CATEGORY_ORDER[0])[0];
+  const custom = gatherCustom(tpl);
+  if (tpl.scope === 'board') {
+    const b = Utils.getCurrentBoard();
+    if (b) {
+      Promise.resolve(b.setColor(color, custom)).catch(e => {
+        if (process.env.DEBUG === 'true') console.error('board setColor error', e);
+      });
+    }
+  } else {
+    Meteor.call('setGlobalThemeColor', color, custom, err => {
+      if (err && process.env.DEBUG === 'true') console.error('setGlobalThemeColor error', err);
+    });
+  }
+}
+
+Template.themeColorPicker.events({
+  // Clicking a color swatch applies that theme IMMEDIATELY (there is no Save button).
+  'click .js-select-theme'(event, tpl) {
+    const color = event.currentTarget.dataset.color;
+    if (!color) return;
+    tpl.color.set(color);
+    tpl.customColors.set([]); // a fresh theme -> its stock colors
+    applySelection(tpl);
+  },
+  // Live-update the preview while dragging the wheel...
+  'input .js-theme-wheel'(event, tpl) {
+    const idx = parseInt(event.currentTarget.dataset.index, 10);
+    const val = event.currentTarget.value;
+    if (!isHexColor(val)) return;
+    const cc = tpl.customColors.get().slice();
+    cc[idx] = val;
+    tpl.customColors.set(cc);
+  },
+  // ...and apply the custom color when the wheel is committed (avoids spamming the
+  // server on every intermediate value during the drag).
+  'change .js-theme-wheel'(event, tpl) {
+    applySelection(tpl);
+  },
+  // Clear the global override (Default) — applies immediately too.
+  'click .js-theme-none'(event, tpl) {
+    event.preventDefault();
+    tpl.color.set(null);
+    tpl.customColors.set([]);
+    if (tpl.scope === 'board') {
+      const b = Utils.getCurrentBoard();
+      if (b) b.setColor(BOARD_COLORS[0], []);
+    } else {
+      Meteor.call('setGlobalThemeColor', null, null);
+    }
+  },
+});

client/components/main/uiFont.css

@@ -0,0 +1,40 @@
+/* Member Settings / Font (#4759): apply the user's chosen UI font. The class lives
+ * on <body> and the --wekan-ui-font variable is set by uiFont.js only for a
+ * validated, whitelisted font. Form controls are listed explicitly because their
+ * UA default font-family does not inherit. Icon fonts (Font Awesome etc.) set their
+ * own font-family on the element, so they are unaffected. */
+body.has-ui-font,
+body.has-ui-font button,
+body.has-ui-font input,
+body.has-ui-font textarea,
+body.has-ui-font select,
+body.has-ui-font .wekan-form-control {
+  font-family: var(--wekan-ui-font) !important;
+}
+
+/* Font size preset (#4759): scale the root font size. Elements using relative units
+ * (em/rem/%) scale with it; the variable is a percentage set by uiFont.js only for a
+ * known preset. 'default'/unset removes it. */
+body.has-ui-font-size {
+  font-size: var(--wekan-ui-font-size) !important;
+}
+
+/* Text color (#4759): the variable is a validated hex set by uiFont.js. Icon fonts
+ * keep their own color rules; this recolors ordinary UI text + form controls. */
+body.has-ui-text-color,
+body.has-ui-text-color button,
+body.has-ui-text-color input,
+body.has-ui-text-color textarea,
+body.has-ui-text-color select,
+body.has-ui-text-color .wekan-form-control {
+  color: var(--wekan-ui-text-color) !important;
+}
+
+/* Text background color (#4759). */
+body.has-ui-bg-color,
+body.has-ui-bg-color input,
+body.has-ui-bg-color textarea,
+body.has-ui-bg-color select,
+body.has-ui-bg-color .wekan-form-control {
+  background-color: var(--wekan-ui-bg-color) !important;
+}

client/components/main/uiFont.js

@@ -0,0 +1,34 @@
+import { Meteor } from 'meteor/meteor';
+import { Tracker } from 'meteor/tracker';
+import { fontFamilyValue, fontSizeValue, colorValue } from '/models/lib/uiFonts';
+
+// #4759: apply the user's chosen UI font AND font-size preset to the whole UI by
+// setting CSS variables on :root and toggling marker classes on <body> (uiFont.css
+// consumes them). fontFamilyValue()/fontSizeValue() return '' for anything not on the
+// curated whitelist/presets, so only known, safe values can ever reach the DOM — the
+// saved values are also validated server-side. Unset => nothing applied (defaults).
+
+Meteor.startup(() => {
+  function toggle(varName, className, value) {
+    try {
+      if (value) {
+        document.documentElement.style.setProperty(varName, value);
+        document.body.classList.add(className);
+      } else {
+        document.documentElement.style.removeProperty(varName);
+        document.body.classList.remove(className);
+      }
+    } catch (_) {
+      // document not ready in exotic embeddings; ignore.
+    }
+  }
+
+  Tracker.autorun(() => {
+    const user = Meteor.user();
+    const profile = (user && user.profile) || {};
+    toggle('--wekan-ui-font', 'has-ui-font', fontFamilyValue(profile.uiFont));
+    toggle('--wekan-ui-font-size', 'has-ui-font-size', fontSizeValue(profile.uiFontSize));
+    toggle('--wekan-ui-text-color', 'has-ui-text-color', colorValue(profile.uiTextColor));
+    toggle('--wekan-ui-bg-color', 'has-ui-bg-color', colorValue(profile.uiTextBgColor));
+  });
+});

client/components/notifications/notificationsDrawer.css

@@ -2,7 +2,8 @@ section#notifications-drawer {
   position: fixed;
   top: 48px;
   inset-inline-end: 0;
-  width: 400px;
+  width: 100vw;
+  max-width: 100vw;
   background-color: #fafafa;
   box-shadow: 0 1px 2px rgba(0,0,0,0.15);
   border-radius: 2px;
@@ -17,19 +18,20 @@ section#notifications-drawer .header {
   position: fixed;
   top: 48px;
   inset-inline-end: 0;
-  width: calc(400px - 32px);
+  width: 100vw;
+  box-sizing: border-box;
   padding: 8px 16px;
   background: #ededed;
   border-bottom: 1px solid #dbdbdb;
   z-index: 2;
+  /* Flex row: hamburger (left), title (centre), X (right), all vertically centred. */
+  display: flex;
+  align-items: center;
 }
 section#notifications-drawer .header .notification-menu-toggle {
-  position: absolute;
-  inset-inline-start: 16px;
-  top: calc(50% - 12px);
   font-size: 20px;
   cursor: pointer;
-  color: #333;
+  color: #000 !important; /* black hamburger menu (override themed white link colour) */
   line-height: 24px;
 }
 section#notifications-drawer .header .notification-menu-toggle:hover {
@@ -83,18 +85,33 @@ section#notifications-drawer .header .notification-menu .menu-item .menu-icon {
   margin-inline-end: 8px;
   font-size: 16px;
 }
+/* Menu-item icons (envelope / copy / trash / check) black. */
+section#notifications-drawer .header .notification-menu .menu-item .menu-icon,
+section#notifications-drawer .header .notification-menu .menu-item .menu-icon i.fa,
+section#notifications-drawer .header .notification-menu .menu-item .check-icon,
+section#notifications-drawer .header .notification-menu .menu-item .check-icon i.fa {
+  color: #000 !important;
+}
 section#notifications-drawer .header h5 {
+  flex: 1;            /* fill the middle so the title is centred, X sits at the right */
   text-align: center;
   margin: 0;
 }
 section#notifications-drawer .header .close {
-  position: absolute;
-  top: calc(50% - 12px);
-  inset-inline-end: 12px;
+  /* Flex item at the right edge, aligned with the title. position: static cancels
+     the GLOBAL `.close { position: absolute; top: 5px }` rule (boardBody.css) that
+     otherwise pulls the X out of the header row and drops it below the title. */
+  position: static;
+  margin-inline-start: 8px;
   font-size: 24px;
   height: 24px;
   line-height: 24px;
   opacity: 1;
+  color: #000 !important; /* black X (override themed white link colour) */
+}
+section#notifications-drawer .header .close i.fa,
+section#notifications-drawer .header .notification-menu-toggle i.fa {
+  color: inherit !important;
 }
 
 section#notifications-drawer ul.notifications {

client/components/rules/actions/boardActions.js

@@ -4,6 +4,7 @@ import Actions from '/models/actions';
 import Rules from '/models/rules';
 import Triggers from '/models/triggers';
 import { Utils } from '/client/lib/utils';
+import { canSelectBoardInRules } from '/models/lib/rulesBoardSelector';
 
 Template.boardActions.onCreated(function () {
   this.subscribe('boards');
@@ -11,19 +12,30 @@ Template.boardActions.onCreated(function () {
 
 Template.boardActions.helpers({
   boards() {
-    const ret = ReactiveCache.getBoards(
-      {
-        archived: false,
-        'members.userId': Meteor.userId(),
-        _id: {
-          $ne: ReactiveCache.getCurrentUser().getTemplatesBoardId(),
-        },
-      },
+    // #5698: don't restrict to boards where the user is a DIRECT member — that
+    // hid every board reached through an Organization / Team / email-domain
+    // share (the reporter's whole board dropdown was empty, current board
+    // included). Filter the already access-scoped client cache with the same
+    // visibility rule as Boards.userBoards() so org/team/domain boards show too.
+    const user = ReactiveCache.getCurrentUser();
+    if (!user) return [];
+    const ctx = {
+      userId: user._id,
+      orgIds: typeof user.orgIds === 'function' ? user.orgIds() : [],
+      teamIds: typeof user.teamIds === 'function' ? user.teamIds() : [],
+      emailDomains:
+        typeof user.emailDomains === 'function' ? user.emailDomains() : [],
+    };
+    const templatesBoardId = user.getTemplatesBoardId();
+    const boards = ReactiveCache.getBoards(
+      { archived: false },
       {
         sort: { sort: 1 /* boards default sorting */ },
       },
     );
-    return ret;
+    return boards.filter(board =>
+      canSelectBoardInRules(board, ctx, templatesBoardId),
+    );
   },
 
   loadingBoardsLabel() {
@@ -94,38 +106,19 @@ Template.boardActions.events({
     const boardId = Session.get('currentBoard');
     const destBoardId = tpl.find('#board-id').value;
     const desc = Utils.getTriggerActionDesc(event, tpl);
-    if (actionSelected === 'top') {
-      const triggerId = Triggers.insert(trigger);
-      const actionId = Actions.insert({
-        actionType: 'moveCardToTop',
-        listName,
-        swimlaneName,
-        boardId: destBoardId,
-        desc,
-      });
-      Rules.insert({
-        title: ruleName,
-        triggerId,
-        actionId,
-        boardId,
-      });
-    }
-    if (actionSelected === 'bottom') {
-      const triggerId = Triggers.insert(trigger);
-      const actionId = Actions.insert({
-        actionType: 'moveCardToBottom',
-        listName,
-        swimlaneName,
-        boardId: destBoardId,
-        desc,
-      });
-      Rules.insert({
-        title: ruleName,
-        triggerId,
-        actionId,
-        boardId,
-      });
-    }
+    // #5536: create the rule on the server (see server/rulesButton.js →
+    // rules.createRule) instead of three optimistic client Collection.insert()
+    // calls. The optimistic writes landed in minimongo limbo once the wizard
+    // subscription stopped, so the cross-board move action rendered BLANK; and
+    // the client allow/deny rules rejected them outright for non-owner members.
+    // The action keeps its own destination `boardId` (the board to move to).
+    Meteor.call('rules.createRule', boardId, ruleName, trigger, {
+      actionType: actionSelected === 'bottom' ? 'moveCardToBottom' : 'moveCardToTop',
+      listName,
+      swimlaneName,
+      boardId: destBoardId,
+      desc,
+    });
   },
   'click .js-add-gen-move-action'(event, tpl) {
     const desc = Utils.getTriggerActionDesc(event, tpl);
@@ -141,7 +134,11 @@ Template.boardActions.events({
     // documents land in minimongo limbo when the wizard subscription stops.
     Meteor.call('rules.createRule', boardId, ruleName, trigger, {
       actionType,
-      listTitle: '*',
+      // #6472: was `listTitle: '*'` since the original rules implementation,
+      // but performAction reads action.listName/action.swimlaneName — so every
+      // generic "move to top/bottom" rule created by this wizard did nothing.
+      listName: '*',
+      swimlaneName: '*',
       boardId,
       desc,
     });
@@ -191,20 +188,16 @@ Template.boardActions.events({
     const boardId = Session.get('currentBoard');
     const destBoardId = tpl.find('#board-id-link').value;
     const desc = Utils.getTriggerActionDesc(event, tpl);
-    const triggerId = Triggers.insert(trigger);
-    const actionId = Actions.insert({
+    // #5536: create on the server so the cross-board link action does not land
+    // blank in minimongo limbo / get rejected by client allow/deny. The action
+    // keeps its own destination `boardId` (the board to link the card into).
+    Meteor.call('rules.createRule', boardId, ruleName, trigger, {
       actionType: 'linkCard',
       listName,
       swimlaneName,
       boardId: destBoardId,
       desc,
     });
-    Rules.insert({
-      title: ruleName,
-      triggerId,
-      actionId,
-      boardId,
-    });
   },
   'click .js-sort-list-action'(event, tpl) {
     const data = Template.currentData();

client/components/rules/actions/cardActions.jade

@@ -100,8 +100,15 @@ template(name="cardActions")
           option(value="receivedAt") {{_'r-df-received-at'}}
       div.trigger-dropdown
         input(id="reldate-days",type="number",value="0")
+      div.trigger-dropdown
+        select(id="reldate-unit")
+          option(value="minutes") {{_'r-unit-minutes'}}
+          option(value="hours") {{_'r-unit-hours'}}
+          option(value="days",selected="selected") {{_'r-unit-days'}}
+          option(value="weeks") {{_'r-unit-weeks'}}
+          option(value="months") {{_'r-unit-months'}}
       div.trigger-text
-        | {{_'r-days-after'}}
+        | {{_'r-later'}}
     div.trigger-button.js-set-reldate-action.js-goto-rules
       i.fa.fa-plus
 

client/components/rules/actions/cardActions.js

@@ -238,12 +238,16 @@ Template.cardActions.events({
     const boardId = Session.get('currentBoard');
     const desc = Utils.getTriggerActionDesc(event, tpl);
     const dateField = tpl.find('#reldate-datefield').value;
+    // `days` keeps its name for backward compatibility: it is the numeric
+    // amount, interpreted together with `unit` (minutes/hours/days/weeks/months).
     const days = parseInt(tpl.find('#reldate-days').value, 10) || 0;
+    const unit = tpl.find('#reldate-unit').value;
     const triggerId = Triggers.insert(trigger);
     const actionId = Actions.insert({
       actionType: 'setDateRelative',
       dateField,
       days,
+      unit,
       boardId,
       desc,
     });

client/components/rules/rulesImportExport.js

@@ -1,9 +1,6 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
 import Papa from 'papaparse';
-import Actions from '/models/actions';
-import Rules from '/models/rules';
-import Triggers from '/models/triggers';
 
 const RULES_FORMAT = 'wekan-rules-1.0.0';
 const STRIP_FIELDS = ['_id', 'boardId', 'createdAt', 'modifiedAt', 'updatedAt'];
@@ -33,14 +30,43 @@ function collectBoardRules(boardId) {
     .filter(Boolean);
 }
 
+// #6472: the trigger matcher (server/rulesHelper.js buildMatchingFieldsMap)
+// queries every matching field of the trigger type with {$in: [value, '*']} —
+// a trigger DOCUMENT that lacks one of those fields can never match. Hand-
+// written or third-party JSON often omits fields like userId, so default every
+// known matching field to the '*' wildcard when absent. Extra fields on
+// trigger types that do not use them are harmless (never queried).
+const TRIGGER_MATCHING_FIELDS = [
+  'userId', 'username', 'cardTitle', 'listName', 'oldListName',
+  'swimlaneName', 'checklistName', 'checklistItemName', 'labelId',
+  'attachmentName',
+];
+
+function normalizeTrigger(trigger) {
+  const out = { ...trigger };
+  TRIGGER_MATCHING_FIELDS.forEach(f => {
+    if (out[f] === undefined || out[f] === null || out[f] === '') out[f] = '*';
+  });
+  return out;
+}
+
 // Insert an array of {title, trigger, action} onto the given target board.
 function importRules(rulesArray, boardId) {
   let count = 0;
   (rulesArray || []).forEach(entry => {
     if (!entry || !entry.trigger || !entry.action) return;
-    const triggerId = Triggers.insert({ ...stripDoc(entry.trigger), boardId });
-    const actionId = Actions.insert({ ...stripDoc(entry.action), boardId });
-    Rules.insert({ title: entry.title || 'Imported rule', triggerId, actionId, boardId });
+    // #6472: create via the rules.createRule server method (like the rules
+    // wizard since #5536) instead of three optimistic client inserts — those
+    // are rejected by the board-admin-only allow() rules for non-admins and
+    // land in minimongo limbo: the imported rule LOOKS created but never
+    // exists on the server, so it silently does nothing until it vanishes.
+    Meteor.call(
+      'rules.createRule',
+      boardId,
+      entry.title || 'Imported rule',
+      normalizeTrigger(stripDoc(entry.trigger)),
+      stripDoc(entry.action),
+    );
     count += 1;
   });
   return count;

client/components/rules/rulesList.jade

@@ -30,14 +30,14 @@ template(name="rulesList")
             else
               = title
           div.rules-btns-group
-            button.primary.wide.js-goto-details(type="submit")
+            button.primary.wide.js-goto-details(type="submit" data-rule-id="{{_id}}")
               i.fa.fa-eye
               | {{_ 'r-view-rule'}}
             if canAdmin
-              button.primary.wide.js-edit-rule(type="submit")
+              button.primary.wide.js-edit-rule(type="submit" data-rule-id="{{_id}}")
                 i.fa.fa-pencil
                 | {{_ 'r-edit-rule'}}
-              button.primary.wide.js-delete-rule(type="submit")
+              button.primary.wide.js-delete-rule(type="submit" data-rule-id="{{_id}}")
                 i.fa.fa-trash
                 | {{_ 'r-delete-rule'}}
       else

client/components/rules/rulesList.js

@@ -1,7 +1,5 @@
 import { ReactiveCache } from '/imports/reactiveCache';
-import Actions from '/models/actions';
 import Rules from '/models/rules';
-import Triggers from '/models/triggers';
 
 function boardRuleIds() {
   const boardId = Session.get('currentBoard');
@@ -62,9 +60,10 @@ Template.rulesList.events({
     getSelected().forEach(ruleId => {
       const rule = ReactiveCache.getRule(ruleId);
       if (rule) {
-        Rules.remove(rule._id);
-        Actions.remove(rule.actionId);
-        Triggers.remove(rule.triggerId);
+        // Delete the rule + its trigger + action server-side (see
+        // server/rulesButton.js `rules.deleteRule`): three client-side
+        // Collection.remove() calls were rejected with 403 "Access denied".
+        Meteor.call('rules.deleteRule', rule._id);
       }
     });
     setSelected([]);

client/components/rules/rulesMain.js

@@ -1,9 +1,6 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import { Utils } from '/client/lib/utils';
-import Actions from '/models/actions';
-import Rules from '/models/rules';
-import Triggers from '/models/triggers';
 
 Template.rulesMain.onCreated(function () {
   this.rulesCurrentTab = new ReactiveVar('rulesList');
@@ -81,11 +78,20 @@ function sanitizeObject(obj) {
 }
 
 Template.rulesMain.events({
-  'click .js-delete-rule'() {
-    const rule = Template.currentData();
-    Rules.remove(rule._id);
-    Actions.remove(rule.actionId);
-    Triggers.remove(rule.triggerId);
+  'click .js-delete-rule'(event) {
+    // #6490: the button lives in the rulesList child template's `each`, but this
+    // handler is on the parent rulesMain, so Template.currentData() returned the
+    // PARENT's data context (not the clicked rule) — the rule id resolved to null,
+    // so delete failed server-side with "Match error: Expected string, got null".
+    // Read the rule id from the button's explicit data-rule-id instead.
+    const ruleId = event.currentTarget.getAttribute('data-rule-id');
+    if (!ruleId) return;
+    // Delete the rule + its trigger + action in one server call. Doing this
+    // client-side as three separate Collection.remove() calls failed with 403
+    // "Access denied" whenever a trigger/action document's boardId did not
+    // resolve to a board in the allow() rule; the method authorizes once and
+    // removes all three server-side.
+    Meteor.call('rules.deleteRule', ruleId);
   },
   'click .js-goto-trigger'(event, tpl) {
     event.preventDefault();
@@ -141,8 +147,12 @@ Template.rulesMain.events({
   },
   'click .js-goto-details'(event, tpl) {
     event.preventDefault();
-    const rule = Template.currentData();
-    tpl.ruleId.set(rule._id);
+    // #6490: same as delete — Template.currentData() returned the parent context
+    // here, so "View rule" always opened the same (first) rule regardless of which
+    // one was clicked. Read the clicked rule's id from its data-rule-id.
+    const ruleId = event.currentTarget.getAttribute('data-rule-id');
+    if (!ruleId) return;
+    tpl.ruleId.set(ruleId);
     tpl.rulesCurrentTab.set('ruleDetails');
   },
 });

client/components/rules/rulesWorkflow.jade

@@ -12,7 +12,7 @@ template(name="rulesWorkflow")
             .workflow-node.workflow-node-when
               span.workflow-node-label {{_ 'r-when'}}
               span.workflow-node-text= builderTriggerLabel
-              a.workflow-slot-clear.js-clear-when(title="{{_ 'remove'}}") ✕
+              a.workflow-slot-clear.js-clear-when(title="{{_ 'r-remove'}}") ✕
           else
             span.workflow-slot-placeholder {{_ 'r-when'}}: {{_ 'r-drop-trigger'}}
         .workflow-arrow
@@ -22,7 +22,7 @@ template(name="rulesWorkflow")
             .workflow-node.workflow-node-then
               span.workflow-node-label {{_ 'r-action'}}
               span.workflow-node-text= builderActionLabel
-              a.workflow-slot-clear.js-clear-then(title="{{_ 'remove'}}") ✕
+              a.workflow-slot-clear.js-clear-then(title="{{_ 'r-remove'}}") ✕
           else
             span.workflow-slot-placeholder {{_ 'r-action'}}: {{_ 'r-drop-action'}}
       .workflow-builder-controls

client/components/rules/rulesWorkflow.js

@@ -1,4 +1,5 @@
 import { ReactiveCache } from '/imports/reactiveCache';
+import { TAPi18n } from '/imports/i18n';
 import { Utils } from '/client/lib/utils';
 import Actions from '/models/actions';
 import Rules from '/models/rules';
@@ -12,31 +13,44 @@ import Triggers from '/models/triggers';
 // can be built entirely by dragging. Parameterized rules (specific list, label,
 // member, schedule time, …) are still created with the form builder on the
 // List view.
+// Each palette entry carries an i18n `labelKey` (translated at render time via
+// TAPi18n.__) instead of a hardcoded English string, so the whole workflow view
+// follows the UI language. `labelParams` is passed to TAPi18n.__ for labels that
+// need a placeholder (e.g. the scheduled time). Existing rule keys are reused
+// where they fit; workflow-only labels use new `r-w-*` keys (see en.i18n.json).
 const TRIGGER_PALETTE = [
-  { label: 'Card is created', doc: { activityType: 'createCard', listName: '*', swimlaneName: '*', cardTitle: '*', userId: '*' } },
-  { label: 'Card is moved', doc: { activityType: 'moveCard', listName: '*', oldListName: '*', swimlaneName: '*', cardTitle: '*', userId: '*' } },
-  { label: 'Card is archived', doc: { activityType: 'archivedCard', userId: '*' } },
-  { label: 'Card is unarchived', doc: { activityType: 'restoredCard', userId: '*' } },
-  { label: 'Any label is added', doc: { activityType: 'addedLabel', labelId: '*', userId: '*' } },
-  { label: 'Any label is removed', doc: { activityType: 'removedLabel', labelId: '*', userId: '*' } },
-  { label: 'A member is added', doc: { activityType: 'joinMember', username: '*', userId: '*' } },
-  { label: 'A member is removed', doc: { activityType: 'unjoinMember', username: '*', userId: '*' } },
-  { label: 'A checklist is added', doc: { activityType: 'addChecklist', checklistName: '*', userId: '*' } },
-  { label: 'An attachment is added', doc: { activityType: 'addAttachment', userId: '*' } },
-  { label: 'Every day at 09:00', doc: { activityType: 'scheduledTrigger', scheduleKind: 'calendar', scheduleType: 'daily', atTime: '09:00', listName: '*', swimlaneName: '*' } },
+  { labelKey: 'r-w-card-created', doc: { activityType: 'createCard', listName: '*', swimlaneName: '*', cardTitle: '*', userId: '*' } },
+  { labelKey: 'r-when-a-card-is-moved', doc: { activityType: 'moveCard', listName: '*', oldListName: '*', swimlaneName: '*', cardTitle: '*', userId: '*' } },
+  { labelKey: 'r-w-card-archived', doc: { activityType: 'archivedCard', userId: '*' } },
+  { labelKey: 'r-w-card-unarchived', doc: { activityType: 'restoredCard', userId: '*' } },
+  { labelKey: 'r-w-label-added', doc: { activityType: 'addedLabel', labelId: '*', userId: '*' } },
+  { labelKey: 'r-w-label-removed', doc: { activityType: 'removedLabel', labelId: '*', userId: '*' } },
+  { labelKey: 'r-w-member-added', doc: { activityType: 'joinMember', username: '*', userId: '*' } },
+  { labelKey: 'r-w-member-removed', doc: { activityType: 'unjoinMember', username: '*', userId: '*' } },
+  { labelKey: 'r-w-checklist-added', doc: { activityType: 'addChecklist', checklistName: '*', userId: '*' } },
+  { labelKey: 'r-w-attachment-added', doc: { activityType: 'addAttachment', userId: '*' } },
+  { labelKey: 'r-w-every-day-at', labelParams: { time: '09:00' }, doc: { activityType: 'scheduledTrigger', scheduleKind: 'calendar', scheduleType: 'daily', atTime: '09:00', listName: '*', swimlaneName: '*' } },
 ];
 
 const ACTION_PALETTE = [
-  { label: 'Move card to top', doc: { actionType: 'moveCardToTop', listName: '*', swimlaneName: '*' } },
-  { label: 'Move card to bottom', doc: { actionType: 'moveCardToBottom', listName: '*', swimlaneName: '*' } },
-  { label: 'Archive card', doc: { actionType: 'archive' } },
-  { label: 'Unarchive card', doc: { actionType: 'unarchive' } },
-  { label: 'Mark card complete', doc: { actionType: 'markCardComplete' } },
-  { label: 'Mark card incomplete', doc: { actionType: 'markCardIncomplete' } },
-  { label: 'Remove all members', doc: { actionType: 'removeMember', username: '*' } },
-  { label: 'Set received date to now', doc: { actionType: 'setDate', dateField: 'receivedAt' } },
+  { labelKey: 'r-d-move-to-top-gen', doc: { actionType: 'moveCardToTop', listName: '*', swimlaneName: '*' } },
+  { labelKey: 'r-d-move-to-bottom-gen', doc: { actionType: 'moveCardToBottom', listName: '*', swimlaneName: '*' } },
+  { labelKey: 'r-d-archive', doc: { actionType: 'archive' } },
+  { labelKey: 'r-d-unarchive', doc: { actionType: 'unarchive' } },
+  { labelKey: 'r-mark-complete', doc: { actionType: 'markCardComplete' } },
+  { labelKey: 'r-mark-incomplete', doc: { actionType: 'markCardIncomplete' } },
+  { labelKey: 'r-remove-all', doc: { actionType: 'removeMember', username: '*' } },
+  { labelKey: 'r-w-set-received-now', doc: { actionType: 'setDate', dateField: 'receivedAt' } },
 ];
 
+// Translate a palette entry's label for display / storage in the current UI
+// language (matches the classic Rules view, which also stores already-translated
+// description text at creation time).
+function paletteLabel(entry) {
+  if (!entry) return '';
+  return TAPi18n.__(entry.labelKey, entry.labelParams);
+}
+
 Template.rulesWorkflow.onCreated(function () {
   this.builderTrigger = new ReactiveVar(null);
   this.builderAction = new ReactiveVar(null);
@@ -52,24 +66,22 @@ Template.rulesWorkflow.helpers({
     return Utils.getCurrentBoard();
   },
   triggerPalette() {
-    return TRIGGER_PALETTE.map((t, idx) => ({ idx, label: t.label }));
+    return TRIGGER_PALETTE.map((t, idx) => ({ idx, label: paletteLabel(t) }));
   },
   actionPalette() {
-    return ACTION_PALETTE.map((a, idx) => ({ idx, label: a.label }));
+    return ACTION_PALETTE.map((a, idx) => ({ idx, label: paletteLabel(a) }));
   },
   builderTrigger() {
     return Template.instance().builderTrigger.get();
   },
   builderTriggerLabel() {
-    const t = Template.instance().builderTrigger.get();
-    return t ? t.label : '';
+    return paletteLabel(Template.instance().builderTrigger.get());
   },
   builderAction() {
     return Template.instance().builderAction.get();
   },
   builderActionLabel() {
-    const a = Template.instance().builderAction.get();
-    return a ? a.label : '';
+    return paletteLabel(Template.instance().builderAction.get());
   },
   createDisabled() {
     const tpl = Template.instance();
@@ -96,9 +108,11 @@ function persistRule(tpl) {
   if (!t || !a) return;
   const boardId = Session.get('currentBoard');
   const titleField = tpl.find('.js-workflow-rule-title');
-  const title = (titleField.value || '').trim() || `${t.label} → ${a.label}`;
-  const triggerId = Triggers.insert({ ...t.doc, boardId, desc: t.label });
-  const actionId = Actions.insert({ ...a.doc, boardId, desc: a.label });
+  const tLabel = paletteLabel(t);
+  const aLabel = paletteLabel(a);
+  const title = (titleField.value || '').trim() || `${tLabel} → ${aLabel}`;
+  const triggerId = Triggers.insert({ ...t.doc, boardId, desc: tLabel });
+  const actionId = Actions.insert({ ...a.doc, boardId, desc: aLabel });
   Rules.insert({ title, triggerId, actionId, boardId });
   tpl.builderTrigger.set(null);
   tpl.builderAction.set(null);
@@ -140,7 +154,7 @@ Template.rulesWorkflow.events({
     const a = ACTION_PALETTE[tpl.dragItem.idx];
     const boardId = Session.get('currentBoard');
     const oldActionId = rule.actionId;
-    const newActionId = Actions.insert({ ...a.doc, boardId, desc: a.label });
+    const newActionId = Actions.insert({ ...a.doc, boardId, desc: paletteLabel(a) });
     Rules.update(ruleId, { $set: { actionId: newActionId } });
     if (oldActionId) Actions.remove(oldActionId);
     tpl.dragItem = null;
@@ -163,8 +177,9 @@ Template.rulesWorkflow.events({
     const ruleId = node && node.dataset.ruleId;
     const rule = ReactiveCache.getRule(ruleId);
     if (!rule) return;
-    Rules.remove(rule._id);
-    Actions.remove(rule.actionId);
-    Triggers.remove(rule.triggerId);
+    // Delete the rule + its trigger + action server-side (see
+    // server/rulesButton.js `rules.deleteRule`): three client-side
+    // Collection.remove() calls were rejected with 403 "Access denied".
+    Meteor.call('rules.deleteRule', rule._id);
   },
 });

client/components/rules/triggers/boardTriggers.jade

@@ -106,6 +106,9 @@ template(name="boardCardTitlePopup")
     form
       label
         | {{_ 'boardCardTitlePopup-title'}}
-        input.js-card-filter-name(type="text" value=title autofocus)
+        //- #2345: cardTitleFilter is passed as the popup's data context by the
+        //- js-open-card-title-popup handler so reopening the popup shows the
+        //- filter that is already set (it used to always render empty).
+        input.js-card-filter-name(type="text" value=cardTitleFilter autofocus)
       input.js-card-filter-button.primary.wide(type="submit" value="{{_ 'set-filter'}}")
 

client/components/rules/triggers/boardTriggers.js

@@ -1,4 +1,31 @@
+import { TAPi18n } from '/imports/i18n';
 import { Utils } from '/client/lib/utils';
+import {
+  cardTitleFilterOrWildcard,
+  appendCardTitleFilterToDesc,
+} from '/models/lib/ruleCardTitleFilter';
+
+// #2345: fallback reference to the live boardTriggers template instance, so the
+// card-title-filter popup can still store its value even if the Blaze
+// data-context walk in Popup.getOpenerComponent() does not resolve (same
+// module-level pattern as cardActions.js' sharedCardColorButtonValue).
+let activeBoardTriggersTemplate = null;
+
+// #2345: the trigger description is assembled from the wizard's DOM text, which
+// never includes the card-title filter (it lives in a popup). Append it so the
+// created rule's details actually show the filter.
+function descWithCardTitleFilter(desc, cardTitle) {
+  let label = 'card title filter';
+  try {
+    const translated = TAPi18n.__('boardCardTitlePopup-title');
+    if (translated && translated !== 'boardCardTitlePopup-title') {
+      label = translated.toLowerCase();
+    }
+  } catch (e) {
+    // keep the English fallback label
+  }
+  return appendCardTitleFilterToDesc(desc, cardTitle, label);
+}
 
 Template.boardTriggers.onCreated(function () {
   this.provaVar = new ReactiveVar('');
@@ -7,6 +34,13 @@ Template.boardTriggers.onCreated(function () {
   this.setNameFilter = (name) => {
     this.cardTitleFilters[this.currentPopupTriggerId] = name;
   };
+  activeBoardTriggersTemplate = this;
+});
+
+Template.boardTriggers.onDestroyed(function () {
+  if (activeBoardTriggersTemplate === this) {
+    activeBoardTriggersTemplate = null;
+  }
 });
 
 Template.boardTriggers.events({
@@ -14,16 +48,24 @@ Template.boardTriggers.events({
     const funct = Popup.open('boardCardTitle');
     const divId = $(event.currentTarget.parentNode.parentNode).attr('id');
     tpl.currentPopupTriggerId = divId;
-    funct.call(this, event);
+    // #2345: hand the already-stored filter to the popup as its data context so
+    // reopening it shows the current value instead of an empty input.
+    funct.call({ cardTitleFilter: tpl.cardTitleFilters[divId] || '' }, event);
   },
   'click .js-add-create-trigger'(event, tpl) {
-    const desc = Utils.getTriggerActionDesc(event, tpl);
     const datas = Template.currentData();
     const listName = tpl.find('#create-list-name').value;
     const swimlaneName = tpl.find('#create-swimlane-name').value;
     const boardId = Session.get('currentBoard');
     const divId = $(event.currentTarget.parentNode).attr('id');
-    const cardTitle = tpl.cardTitleFilters[divId];
+    // #2345: an unset/empty filter is stored as the '*' wildcard so the trigger
+    // document always carries a cardTitle field (the server matches with
+    // cardTitle: { $in: [...] }, which a document missing the field never satisfies).
+    const cardTitle = cardTitleFilterOrWildcard(tpl.cardTitleFilters[divId]);
+    const desc = descWithCardTitleFilter(
+      Utils.getTriggerActionDesc(event, tpl),
+      cardTitle,
+    );
     // move to generic funciont
     datas.triggerVar.set({
       activityType: 'createCard',
@@ -36,13 +78,16 @@ Template.boardTriggers.events({
   },
   'click .js-add-moved-trigger'(event, tpl) {
     const datas = Template.currentData();
-    const desc = Utils.getTriggerActionDesc(event, tpl);
     const swimlaneName = tpl.find('#create-swimlane-name-2').value;
     const actionSelected = tpl.find('#move-action').value;
     const listName = tpl.find('#move-list-name').value;
     const boardId = Session.get('currentBoard');
     const divId = $(event.currentTarget.parentNode).attr('id');
-    const cardTitle = tpl.cardTitleFilters[divId];
+    const cardTitle = cardTitleFilterOrWildcard(tpl.cardTitleFilters[divId]);
+    const desc = descWithCardTitleFilter(
+      Utils.getTriggerActionDesc(event, tpl),
+      cardTitle,
+    );
     if (actionSelected === 'moved-to') {
       datas.triggerVar.set({
         activityType: 'moveCard',
@@ -68,12 +113,22 @@ Template.boardTriggers.events({
   },
   'click .js-add-gen-moved-trigger'(event, tpl) {
     const datas = Template.currentData();
-    const desc = Utils.getTriggerActionDesc(event, tpl);
     const boardId = Session.get('currentBoard');
+    const divId = $(event.currentTarget.parentNode).attr('id');
+    // #2345: this trigger ignored the card-title-filter popup entirely AND
+    // stored no cardTitle field at all — and since the server matches triggers
+    // with cardTitle: { $in: [...] }, a moveCard trigger without the field
+    // never fired for any card. Store the filter (or the '*' wildcard).
+    const cardTitle = cardTitleFilterOrWildcard(tpl.cardTitleFilters[divId]);
+    const desc = descWithCardTitleFilter(
+      Utils.getTriggerActionDesc(event, tpl),
+      cardTitle,
+    );
 
     datas.triggerVar.set({
       activityType: 'moveCard',
       boardId,
+      cardTitle,
       swimlaneName: '*',
       listName: '*',
       oldListName: '*',
@@ -82,13 +137,20 @@ Template.boardTriggers.events({
   },
   'click .js-add-arch-trigger'(event, tpl) {
     const datas = Template.currentData();
-    const desc = Utils.getTriggerActionDesc(event, tpl);
     const actionSelected = tpl.find('#arch-action').value;
     const boardId = Session.get('currentBoard');
+    const divId = $(event.currentTarget.parentNode).attr('id');
+    // #2345: the archive/unarchive trigger also dropped the card-title filter.
+    const cardTitle = cardTitleFilterOrWildcard(tpl.cardTitleFilters[divId]);
+    const desc = descWithCardTitleFilter(
+      Utils.getTriggerActionDesc(event, tpl),
+      cardTitle,
+    );
     if (actionSelected === 'archived') {
       datas.triggerVar.set({
         activityType: 'archivedCard',
         boardId,
+        cardTitle,
         desc,
       });
     }
@@ -96,6 +158,7 @@ Template.boardTriggers.events({
       datas.triggerVar.set({
         activityType: 'restoredCard',
         boardId,
+        cardTitle,
         desc,
       });
     }
@@ -104,15 +167,27 @@ Template.boardTriggers.events({
 
 Template.boardCardTitlePopup.events({
   submit(event) {
+    // #2345: preventDefault FIRST — if anything below throws, a real form
+    // submit would reload the page and silently drop the filter.
+    event.preventDefault();
     const title = $(event.target)
       .find('.js-card-filter-name')
       .val()
       .trim();
-    const opener = Popup.getOpenerComponent();
-    if (opener?.setNameFilter) {
+    let opener = null;
+    try {
+      opener = Popup.getOpenerComponent();
+    } catch (e) {
+      opener = null;
+    }
+    if (!opener || typeof opener.setNameFilter !== 'function') {
+      // #2345: fall back to the live boardTriggers instance when the Blaze
+      // data-context walk cannot resolve the opener.
+      opener = activeBoardTriggersTemplate;
+    }
+    if (opener && typeof opener.setNameFilter === 'function') {
       opener.setNameFilter(title);
     }
-    event.preventDefault();
     Popup.back();
   },
 });

client/components/settings/adminFeatures.jade

@@ -0,0 +1,93 @@
+template(name="adminFeatures")
+  .setting-content
+    unless currentUser.isAdmin
+      | {{_ 'error-notAuthorized'}}
+    else
+      .content-title.ext-box
+        span
+          span.emoji-icon
+          i.fa.fa-flask
+          | {{_ 'features'}}
+      .content-body
+        .side-menu
+          ul
+            li(class="{{#if isPerformanceActive}}active{{/if}}")
+              a.js-features-menu(data-id="performance")
+                span.emoji-icon
+                i.fa.fa-tachometer
+                | {{_ 'features-performance'}}
+            li(class="{{#if isSecurityActive}}active{{/if}}")
+              a.js-features-menu(data-id="security")
+                span.emoji-icon
+                i.fa.fa-shield
+                | {{_ 'features-security'}}
+            li(class="{{#if isNotificationsActive}}active{{/if}}")
+              a.js-features-menu(data-id="notifications")
+                span.emoji-icon
+                i.fa.fa-bell
+                | {{_ 'features-notifications'}}
+        .main-body
+          if isPerformanceActive
+            ul.setting-detail
+              li.layout-form
+                .title {{_ 'cards-loading'}}
+                p.description {{_ 'cards-loading-description'}}
+          if isSecurityActive
+            ul.setting-detail
+              li
+                a.flex.js-toggle-render-links-as-plain-text
+                  .materialCheckBox(class="{{#if renderLinksAsPlainText}}is-checked{{/if}}")
+                  span {{_ 'render-links-as-plain-text'}}
+                p.description {{_ 'render-links-as-plain-text-description'}}
+              li
+                a.flex.js-toggle-always-show-code-as-text
+                  .materialCheckBox(class="{{#if alwaysShowCodeAsText}}is-checked{{/if}}")
+                  span {{_ 'always-show-code-as-text'}}
+                p.description {{_ 'always-show-code-as-text-description'}}
+              li
+                a.flex.js-toggle-disable-all-import
+                  .materialCheckBox(class="{{#if disableAllImport}}is-checked{{/if}}")
+                  span {{_ 'disable-all-import'}}
+                p.description {{_ 'disable-all-import-description'}}
+              li
+                a.flex.js-toggle-disable-all-export
+                  .materialCheckBox(class="{{#if disableAllExport}}is-checked{{/if}}")
+                  span {{_ 'disable-all-export'}}
+                p.description {{_ 'disable-all-export-description'}}
+              li
+                a.flex.js-toggle-disable-import-avatars
+                  .materialCheckBox(class="{{#if disableImportAvatars}}is-checked{{/if}}")
+                  span {{_ 'disable-import-avatars'}}
+                p.description {{_ 'disable-import-avatars-description'}}
+              li
+                a.flex.js-toggle-disable-export-avatars
+                  .materialCheckBox(class="{{#if disableExportAvatars}}is-checked{{/if}}")
+                  span {{_ 'disable-export-avatars'}}
+                p.description {{_ 'disable-export-avatars-description'}}
+              li
+                a.flex.js-toggle-anonymize-import-users
+                  .materialCheckBox(class="{{#if anonymizeImportUsers}}is-checked{{/if}}")
+                  span {{_ 'anonymize-import-users'}}
+                p.description {{_ 'anonymize-import-users-description'}}
+              li
+                a.flex.js-toggle-anonymize-export-users
+                  .materialCheckBox(class="{{#if anonymizeExportUsers}}is-checked{{/if}}")
+                  span {{_ 'anonymize-export-users'}}
+                p.description {{_ 'anonymize-export-users-description'}}
+          if isNotificationsActive
+            ul.setting-detail
+              li
+                a.flex.js-toggle-disable-activities
+                  .materialCheckBox(class="{{#if disableActivities}}is-checked{{/if}}")
+                  span {{_ 'disable-activities'}}
+                p.description {{_ 'disable-activities-description'}}
+              li
+                a.flex.js-toggle-disable-notifications
+                  .materialCheckBox(class="{{#if disableNotifications}}is-checked{{/if}}")
+                  span {{_ 'disable-notifications'}}
+                p.description {{_ 'disable-notifications-description'}}
+              li
+                a.flex.js-toggle-disable-watch
+                  .materialCheckBox(class="{{#if disableWatch}}is-checked{{/if}}")
+                  span {{_ 'disable-watch'}}
+                p.description {{_ 'disable-watch-description'}}

client/components/settings/adminFeatures.js

@@ -0,0 +1,104 @@
+import { ReactiveCache } from '/imports/reactiveCache';
+import { ReactiveVar } from 'meteor/reactive-var';
+import Settings from '/models/settings';
+
+// Admin Panel / Features — a home for optional / performance / tier-gated
+// capabilities. First entry: "Card loading" (all | lazy), which also mirrors the
+// CARDS_LOADING env var. Grouped by category in the side menu so more feature
+// toggles (and, later, pricing-tier gating) can be added here.
+Template.adminFeatures.onCreated(function () {
+  this.activePane = new ReactiveVar('performance');
+  Meteor.subscribe('setting');
+});
+
+Template.adminFeatures.helpers({
+  isPerformanceActive() {
+    return Template.instance().activePane.get() === 'performance';
+  },
+  isSecurityActive() {
+    return Template.instance().activePane.get() === 'security';
+  },
+  isNotificationsActive() {
+    return Template.instance().activePane.get() === 'notifications';
+  },
+  renderLinksAsPlainText() {
+    return (ReactiveCache.getCurrentSetting() || {}).renderLinksAsPlainText;
+  },
+  alwaysShowCodeAsText() {
+    return (ReactiveCache.getCurrentSetting() || {}).alwaysShowCodeAsText;
+  },
+  disableAllImport() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableAllImport;
+  },
+  disableAllExport() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableAllExport;
+  },
+  disableImportAvatars() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableImportAvatars;
+  },
+  disableExportAvatars() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableExportAvatars;
+  },
+  anonymizeImportUsers() {
+    return (ReactiveCache.getCurrentSetting() || {}).anonymizeImportUsers;
+  },
+  anonymizeExportUsers() {
+    return (ReactiveCache.getCurrentSetting() || {}).anonymizeExportUsers;
+  },
+  disableActivities() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableActivities;
+  },
+  disableNotifications() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableNotifications;
+  },
+  disableWatch() {
+    return (ReactiveCache.getCurrentSetting() || {}).disableWatch;
+  },
+});
+
+// Toggle one boolean setting field, saving immediately.
+function toggleSettingField(field) {
+  const setting = ReactiveCache.getCurrentSetting();
+  if (setting) {
+    Settings.update(setting._id, { $set: { [field]: !setting[field] } });
+  }
+}
+
+Template.adminFeatures.events({
+  'click .js-features-menu'(event, tpl) {
+    tpl.activePane.set(event.currentTarget.dataset.id);
+  },
+  'click .js-toggle-render-links-as-plain-text'() {
+    toggleSettingField('renderLinksAsPlainText');
+  },
+  'click .js-toggle-always-show-code-as-text'() {
+    toggleSettingField('alwaysShowCodeAsText');
+  },
+  'click .js-toggle-disable-all-import'() {
+    toggleSettingField('disableAllImport');
+  },
+  'click .js-toggle-disable-all-export'() {
+    toggleSettingField('disableAllExport');
+  },
+  'click .js-toggle-disable-import-avatars'() {
+    toggleSettingField('disableImportAvatars');
+  },
+  'click .js-toggle-disable-export-avatars'() {
+    toggleSettingField('disableExportAvatars');
+  },
+  'click .js-toggle-anonymize-import-users'() {
+    toggleSettingField('anonymizeImportUsers');
+  },
+  'click .js-toggle-anonymize-export-users'() {
+    toggleSettingField('anonymizeExportUsers');
+  },
+  'click .js-toggle-disable-activities'() {
+    toggleSettingField('disableActivities');
+  },
+  'click .js-toggle-disable-notifications'() {
+    toggleSettingField('disableNotifications');
+  },
+  'click .js-toggle-disable-watch'() {
+    toggleSettingField('disableWatch');
+  },
+});

client/components/settings/adminReports.css

@@ -1,60 +1,51 @@
 /* Search + pagination controls for the admin report tabs (files, rules,
    boards, cards). Styled to match the admin People panel (peopleBody.css). */
 
-.admin-report-search {
+/* One controls row per report: the search field on the left, the pagination
+   controls pushed to the right (margin-inline-start:auto mirrors automatically in
+   RTL). No separate Search button — typing + Enter searches. The controls use the
+   theme accent (Member Settings → Change color sets --theme-accent on :root),
+   falling back to WeKan blue when no custom theme is chosen. */
+.admin-report-controls {
   display: flex;
   flex-direction: row;
   align-items: center;
   gap: 10px;
-  height: 34px;
   margin-bottom: 12px;
 }
 
-.admin-report-search input {
-  flex: 1;
+.admin-report-controls input {
+  flex: 0 1 320px;
   max-width: 320px;
   padding: 0 8px;
   height: 34px;
 }
 
-.admin-report-search button {
-  min-width: 90px;
-  height: 34px;
-  background: #01628c;
-  color: #fff;
-  border: none;
-  border-radius: 0.4vw;
-  cursor: pointer;
-  padding: 0 12px;
-}
-
-.admin-report-search button:hover {
-  background: #005377;
-}
-
-.admin-report-search button:active {
-  background: #004766;
-}
-
 .admin-report-pagination {
+  margin-inline-start: auto; /* push pagination to the end of the controls row */
   display: flex;
   align-items: center;
   gap: 6px;
-  margin-bottom: 12px;
 }
 
 .admin-report-pagination button {
   min-width: 32px;
   height: 30px;
-  border: 1px solid #bbb;
-  background: #fff;
+  border: 1px solid var(--theme-accent, #01628c);
+  background: transparent;
+  color: var(--theme-accent, #01628c);
   border-radius: 0.4vw;
   cursor: pointer;
 }
 
+.admin-report-pagination button:hover:not(.disabled) {
+  background: var(--theme-accent, #01628c);
+  color: #fff;
+}
+
 .admin-report-pagination button.active {
-  background: #01628c;
-  border-color: #01628c;
+  background: var(--theme-accent, #01628c);
+  border-color: var(--theme-accent, #01628c);
   color: #fff;
 }
 
@@ -66,5 +57,45 @@
 .admin-report-page-info {
   min-width: 72px;
   text-align: center;
-  color: #333;
 }
+
+/* Problems page: menu separator between the event streams (Summary/Security/
+   Speed/Tests) and the moved report items, and the read-only event table. */
+.admin-reports-content .side-menu .admin-reports-separator hr {
+  margin: 6px 0;
+  border: 0;
+  border-top: 1px solid rgba(0,0,0,0.15);
+}
+.admin-event-controls {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin-bottom: 8px;
+}
+.admin-event-controls input {
+  flex: 0 1 320px;
+  max-width: 320px;
+  height: 34px;
+  padding: 0 8px;
+}
+.admin-event-controls .admin-event-pagination {
+  margin-inline-start: auto;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+.admin-event-controls .admin-event-pagination a {
+  cursor: pointer;
+  color: var(--theme-accent, #01628c);
+  font-weight: bold;
+  padding: 0 6px;
+}
+.admin-event-controls .admin-event-pagination a.disabled { opacity: 0.4; pointer-events: none; }
+table.admin-event-table { width: 100%; border-collapse: collapse; }
+table.admin-event-table th, table.admin-event-table td {
+  text-align: start; padding: 4px 8px; border-bottom: 1px solid rgba(0,0,0,0.08); vertical-align: top;
+}
+table.admin-event-table .admin-event-at { white-space: nowrap; }
+table.admin-event-table .admin-event-sev[data-sev="high"],
+table.admin-event-table .admin-event-sev[data-sev="critical"] { color: #c0392b; font-weight: bold; }
+table.admin-event-table .admin-event-detail { word-break: break-word; }

client/components/settings/adminReports.jade

@@ -6,6 +6,34 @@ template(name="adminReports")
       .content-body
         .side-menu
           ul
+            li
+              a.js-report-summary(data-id="report-summary")
+                i.fa.fa-list
+                | {{_ 'summary'}}
+
+            li
+              a.js-report-security(data-id="report-security")
+                i.fa.fa-shield
+                | {{_ 'securityReportTitle'}}
+
+            li
+              a.js-report-speed(data-id="report-speed")
+                i.fa.fa-tachometer
+                | {{_ 'speedReportTitle'}}
+
+            li
+              a.js-report-tests(data-id="report-tests")
+                i.fa.fa-flask
+                | {{_ 'testsReportTitle'}}
+
+            li
+              a.js-report-cpu(data-id="report-cpu")
+                i.fa.fa-tachometer
+                | {{_ 'cpuReportTitle'}}
+
+            li.admin-reports-separator
+              hr
+
             li
               a.js-report-broken(data-id="report-broken")
                 i.fa.fa-chain-broken
@@ -31,9 +59,24 @@ template(name="adminReports")
                 i.fa.fa-id-card-o
                 | {{_ 'cardsReportTitle'}}
 
+            li
+              a.js-report-impersonation(data-id="report-impersonation")
+                i.fa.fa-user-secret
+                | {{_ 'impersonationReportTitle'}}
+
         .main-body
           if loading.get
             +spinner
+          else if showSummary.get
+            +problemsSummary
+          else if showSecurity.get
+            +eventStreamReport(stream="security")
+          else if showSpeed.get
+            +eventStreamReport(stream="speed")
+          else if showTests.get
+            +eventStreamReport(stream="tests")
+          else if showCpu.get
+            +eventStreamReport(stream="cpu")
           else if showBrokenCardsReport.get
             +brokenCardsReport
           else if showFilesReport.get
@@ -44,6 +87,8 @@ template(name="adminReports")
             +boardsReport(currentPage=boardsCurrentPage totalPages=boardsTotalPages hasPrevPage=hasBoardsPrevPage hasNextPage=hasBoardsNextPage)
           else if showCardsReport.get
             +cardsReport(currentPage=cardsCurrentPage totalPages=cardsTotalPages hasPrevPage=hasCardsPrevPage hasNextPage=hasCardsNextPage)
+          else if showImpersonationReport.get
+            +impersonationReport(currentPage=impersonationCurrentPage totalPages=impersonationTotalPages hasPrevPage=hasImpersonationPrevPage hasNextPage=hasImpersonationNextPage)
 
 
 template(name="brokenCardsReport")
@@ -56,17 +101,14 @@ template(name="brokenCardsReport")
 
 template(name="rulesReport")
   h1 {{_ 'rulesReportTitle'}}
-  .admin-report-search
-    input.js-rules-search-input(type="text" placeholder="{{_ 'search'}}")
-    button.js-rules-search-button
-      i.fa.fa-search
-      | {{_ 'search'}}
-  .admin-report-pagination
-    button.js-rules-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
-      | <
-    span.admin-report-page-info {{currentPage}} / {{totalPages}}
-    button.js-rules-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
-      | >
+  .admin-report-controls
+    input.js-rules-search-input(type="search" placeholder="{{_ 'search'}}")
+    .admin-report-pagination
+      button.js-rules-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
+        | <
+      span.admin-report-page-info {{currentPage}} / {{totalPages}}
+      button.js-rules-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
+        | >
   if resultsCount
     table
       thead
@@ -88,17 +130,14 @@ template(name="rulesReport")
 
 template(name="filesReport")
   h1 {{_ 'filesReportTitle'}}
-  .admin-report-search
-    input.js-files-search-input(type="text" placeholder="{{_ 'search'}}")
-    button.js-files-search-button
-      i.fa.fa-search
-      | {{_ 'search'}}
-  .admin-report-pagination
-    button.js-files-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
-      | <
-    span.admin-report-page-info {{currentPage}} / {{totalPages}}
-    button.js-files-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
-      | >
+  .admin-report-controls
+    input.js-files-search-input(type="search" placeholder="{{_ 'search'}}")
+    .admin-report-pagination
+      button.js-files-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
+        | <
+      span.admin-report-page-info {{currentPage}} / {{totalPages}}
+      button.js-files-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
+        | >
   if resultsCount
     table
       thead
@@ -113,7 +152,7 @@ template(name="filesReport")
       each att in results
         tbody
           tr
-            td {{ att.name }}
+            td {{ cleanFilename att.name }}
             td.right {{ fileSize att.size }}
             td {{ att.type }}
             td {{ att._id }}
@@ -124,17 +163,14 @@ template(name="filesReport")
 
 template(name="cardsReport")
   h1 {{_ 'cardsReportTitle'}}
-  .admin-report-search
-    input.js-cards-search-input(type="text" placeholder="{{_ 'search'}}")
-    button.js-cards-search-button
-      i.fa.fa-search
-      | {{_ 'search'}}
-  .admin-report-pagination
-    button.js-cards-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
-      | <
-    span.admin-report-page-info {{currentPage}} / {{totalPages}}
-    button.js-cards-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
-      | >
+  .admin-report-controls
+    input.js-cards-search-input(type="search" placeholder="{{_ 'search'}}")
+    .admin-report-pagination
+      button.js-cards-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
+        | <
+      span.admin-report-page-info {{currentPage}} / {{totalPages}}
+      button.js-cards-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
+        | >
   if resultsCount
     table.table
       thead
@@ -158,19 +194,50 @@ template(name="cardsReport")
   else
     div {{_ 'no-results' }}
 
+template(name="impersonationReport")
+  h1 {{_ 'impersonationReportTitle'}}
+  .admin-report-controls
+    input.js-impersonation-search-input(type="search" placeholder="{{_ 'search'}}")
+    .admin-report-pagination
+      button.js-impersonation-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
+        | <
+      span.admin-report-page-info {{currentPage}} / {{totalPages}}
+      button.js-impersonation-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
+        | >
+  if resultsCount
+    table.table
+      thead
+        tr
+          th {{_ 'date'}}
+          th {{_ 'impersonation-admin'}}
+          th {{_ 'impersonation-user'}}
+          th {{_ 'board'}}
+          th {{_ 'reason'}}
+      each row in results
+        tbody
+          tr
+            td {{ formatDate row.createdAt }}
+            td
+              if row.adminId
+                a.edit-user.js-impersonation-edit-user(data-user-id="{{ row.adminId }}") {{ userName row.adminId }}
+            td
+              if row.userId
+                a.edit-user.js-impersonation-edit-user(data-user-id="{{ row.userId }}") {{ userName row.userId }}
+            td {{ row.boardId }}
+            td {{ row.reason }}
+  else
+    div {{_ 'no-results' }}
+
 template(name="boardsReport")
   h1 {{_ 'boardsReportTitle'}}
-  .admin-report-search
-    input.js-boards-search-input(type="text" placeholder="{{_ 'search'}}")
-    button.js-boards-search-button
-      i.fa.fa-search
-      | {{_ 'search'}}
-  .admin-report-pagination
-    button.js-boards-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
-      | <
-    span.admin-report-page-info {{currentPage}} / {{totalPages}}
-    button.js-boards-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
-      | >
+  .admin-report-controls
+    input.js-boards-search-input(type="search" placeholder="{{_ 'search'}}")
+    .admin-report-pagination
+      button.js-boards-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
+        | <
+      span.admin-report-page-info {{currentPage}} / {{totalPages}}
+      button.js-boards-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
+        | >
   if resultsCount
     table.table
       thead
@@ -195,3 +262,40 @@ template(name="boardsReport")
             td {{teams board.teams }}
   else
     div {{_ 'no-results' }}
+
+template(name="eventStreamReport")
+  .global-search-results-list-wrapper
+    h1 {{streamTitle}}
+    .admin-event-controls
+      input.js-event-search(type="search" placeholder="{{_ 'search'}}" value="{{searchTerm}}")
+      span.admin-event-pagination
+        a.js-event-prev(class="{{prevDisabled}}") ‹
+        span.admin-event-page {{currentPage}} / {{totalPages}}
+        a.js-event-next(class="{{nextDisabled}}") ›
+    if rowCount
+      table.admin-event-table
+        thead
+          tr
+            th {{_ 'event-datetime'}}
+            th {{_ 'event-category'}}
+            th {{_ 'event-bleed'}}
+            th {{_ 'event-severity'}}
+            th {{_ 'event-action'}}
+            th {{_ 'event-source'}}
+            th {{_ 'username'}}
+            th {{_ 'event-detail'}}
+        tbody
+          each row in rows
+            tr
+              td.admin-event-at {{formatAt row.at}}
+              td {{row.category}}
+              td {{row.bleed}}
+              td.admin-event-sev(data-sev="{{row.severity}}") {{row.severity}}
+              td {{row.action}}
+              td {{row.source}}
+              td
+                if row.userId
+                  a.edit-user.js-event-edit-user(data-user-id="{{ row.userId }}") {{ userName row.userId }}
+              td.admin-event-detail {{row.detail}}
+    else
+      p {{_ 'no-new-problems'}}

client/components/settings/adminReports.js

@@ -6,6 +6,7 @@ import SessionData from '/models/usersessiondata';
 import Boards from '/models/boards';
 import Cards from '/models/cards';
 import Rules from '/models/rules';
+import ImpersonatedUsers from '/models/impersonatedUsers';
 const { filesize } = require('filesize');
 
 // --- Shared helper functions (formerly AdminReport base class methods) ---
@@ -60,17 +61,25 @@ function reportConfig(tmpl) {
     'report-rules': { page: tmpl.rulesPage, count: tmpl.rulesCount, search: tmpl.rulesSearch, pub: 'rulesReport', countMethod: 'getRulesReportCount' },
     'report-boards': { page: tmpl.boardsPage, count: tmpl.boardsCount, search: tmpl.boardsSearch, pub: 'boardsReport', countMethod: 'getBoardsReportCount' },
     'report-cards': { page: tmpl.cardsPage, count: tmpl.cardsCount, search: tmpl.cardsSearch, pub: 'cardsReport', countMethod: 'getCardsReportCount' },
+    'report-impersonation': { page: tmpl.impersonationPage, count: tmpl.impersonationCount, search: tmpl.impersonationSearch, pub: 'impersonationReport', countMethod: 'getImpersonationReportCount' },
   };
 }
 
 Template.adminReports.onCreated(function () {
   this.subscription = null;
+  // Problems page opens on the Summary tab (the acknowledge checkbox list).
+  this.showSummary = new ReactiveVar(true);
+  this.showSecurity = new ReactiveVar(false);
+  this.showSpeed = new ReactiveVar(false);
+  this.showTests = new ReactiveVar(false);
+  this.showCpu = new ReactiveVar(false);
   this.showFilesReport = new ReactiveVar(false);
   this.showBrokenCardsReport = new ReactiveVar(false);
   this.showOrphanedFilesReport = new ReactiveVar(false);
   this.showRulesReport = new ReactiveVar(false);
   this.showCardsReport = new ReactiveVar(false);
   this.showBoardsReport = new ReactiveVar(false);
+  this.showImpersonationReport = new ReactiveVar(false);
   this.sessionId = SessionData.getSessionId();
   this.error = new ReactiveVar('');
   this.loading = new ReactiveVar(false);
@@ -81,15 +90,18 @@ Template.adminReports.onCreated(function () {
   this.rulesPage = new ReactiveVar(1);
   this.boardsPage = new ReactiveVar(1);
   this.cardsPage = new ReactiveVar(1);
+  this.impersonationPage = new ReactiveVar(1);
   this.filesCount = new ReactiveVar(0);
   this.rulesCount = new ReactiveVar(0);
   this.boardsCount = new ReactiveVar(0);
   this.cardsCount = new ReactiveVar(0);
+  this.impersonationCount = new ReactiveVar(0);
   // Current search term per report (empty string = no filter).
   this.filesSearch = new ReactiveVar('');
   this.rulesSearch = new ReactiveVar('');
   this.boardsSearch = new ReactiveVar('');
   this.cardsSearch = new ReactiveVar('');
+  this.impersonationSearch = new ReactiveVar('');
 
   // (Re)subscribe the given report for its current page and refresh its total
   // count. Server-side search + limit/skip means only the matching page ever
@@ -109,8 +121,21 @@ Template.adminReports.onCreated(function () {
     const searchTerm = cfg.search.get();
     const limit = REPORTS_PER_PAGE;
     const skip = (cfg.page.get() - 1) * REPORTS_PER_PAGE;
-    this.subscription = Meteor.subscribe(cfg.pub, searchTerm, limit, skip, () => {
-      this.loading.set(false);
+    this.subscription = Meteor.subscribe(cfg.pub, searchTerm, limit, skip, {
+      onReady: () => {
+        this.loading.set(false);
+      },
+      // A publication that errors (or is stopped) must never leave the report
+      // stuck on the loading spinner forever: clear the spinner and, on a real
+      // error, surface it. Without this an admin only ever saw an endless spinner
+      // whenever a report subscription failed on the server.
+      onStop: (error) => {
+        if (error) {
+          console.error(`Report subscription '${cfg.pub}' failed:`, error);
+          this.error.set(error.reason || error.message || String(error));
+        }
+        this.loading.set(false);
+      },
     });
     Meteor.call(cfg.countMethod, searchTerm, (error, count) => {
       if (error) {
@@ -131,6 +156,21 @@ Template.adminReports.onCreated(function () {
 });
 
 Template.adminReports.helpers({
+  showSummary() {
+    return Template.instance().showSummary;
+  },
+  showSecurity() {
+    return Template.instance().showSecurity;
+  },
+  showSpeed() {
+    return Template.instance().showSpeed;
+  },
+  showTests() {
+    return Template.instance().showTests;
+  },
+  showCpu() {
+    return Template.instance().showCpu;
+  },
   showFilesReport() {
     return Template.instance().showFilesReport;
   },
@@ -149,6 +189,9 @@ Template.adminReports.helpers({
   showBoardsReport() {
     return Template.instance().showBoardsReport;
   },
+  showImpersonationReport() {
+    return Template.instance().showImpersonationReport;
+  },
   loading() {
     return Template.instance().loading;
   },
@@ -185,9 +228,32 @@ Template.adminReports.helpers({
     const tpl = Template.instance();
     return tpl.cardsPage.get() < Math.max(1, Math.ceil((tpl.cardsCount.get() || 0) / REPORTS_PER_PAGE));
   },
+
+  impersonationCurrentPage() { return Template.instance().impersonationPage.get(); },
+  impersonationTotalPages() { return Math.max(1, Math.ceil((Template.instance().impersonationCount.get() || 0) / REPORTS_PER_PAGE)); },
+  hasImpersonationPrevPage() { return Template.instance().impersonationPage.get() > 1; },
+  hasImpersonationNextPage() {
+    const tpl = Template.instance();
+    return tpl.impersonationPage.get() < Math.max(1, Math.ceil((tpl.impersonationCount.get() || 0) / REPORTS_PER_PAGE));
+  },
 });
 
 Template.adminReports.events({
+  'click a.js-report-summary'(event) {
+    switchMenu(event, Template.instance());
+  },
+  'click a.js-report-security'(event) {
+    switchMenu(event, Template.instance());
+  },
+  'click a.js-report-speed'(event) {
+    switchMenu(event, Template.instance());
+  },
+  'click a.js-report-tests'(event) {
+    switchMenu(event, Template.instance());
+  },
+  'click a.js-report-cpu'(event) {
+    switchMenu(event, Template.instance());
+  },
   'click a.js-report-broken'(event) {
     switchMenu(event, Template.instance());
   },
@@ -203,6 +269,9 @@ Template.adminReports.events({
   'click a.js-report-boards'(event) {
     switchMenu(event, Template.instance());
   },
+  'click a.js-report-impersonation'(event) {
+    switchMenu(event, Template.instance());
+  },
 
   // --- Pagination controls (buttons live inside the report sub-templates,
   // their clicks bubble up to this parent template) ---
@@ -214,16 +283,15 @@ Template.adminReports.events({
   'click .js-boards-next-page'(event, tmpl) { goNextPage(event, tmpl, 'report-boards'); },
   'click .js-cards-prev-page'(event, tmpl) { goPrevPage(event, tmpl, 'report-cards'); },
   'click .js-cards-next-page'(event, tmpl) { goNextPage(event, tmpl, 'report-cards'); },
+  'click .js-impersonation-prev-page'(event, tmpl) { goPrevPage(event, tmpl, 'report-impersonation'); },
+  'click .js-impersonation-next-page'(event, tmpl) { goNextPage(event, tmpl, 'report-impersonation'); },
 
   // --- Search (one input + button per report, mirrors the People panel) ---
-  'click .js-files-search-button'(event, tmpl) { runSearch(tmpl, 'report-files', '.js-files-search-input'); },
   'keydown .js-files-search-input'(event, tmpl) { if (event.keyCode === 13 && !event.shiftKey) runSearch(tmpl, 'report-files', '.js-files-search-input'); },
-  'click .js-rules-search-button'(event, tmpl) { runSearch(tmpl, 'report-rules', '.js-rules-search-input'); },
   'keydown .js-rules-search-input'(event, tmpl) { if (event.keyCode === 13 && !event.shiftKey) runSearch(tmpl, 'report-rules', '.js-rules-search-input'); },
-  'click .js-boards-search-button'(event, tmpl) { runSearch(tmpl, 'report-boards', '.js-boards-search-input'); },
   'keydown .js-boards-search-input'(event, tmpl) { if (event.keyCode === 13 && !event.shiftKey) runSearch(tmpl, 'report-boards', '.js-boards-search-input'); },
-  'click .js-cards-search-button'(event, tmpl) { runSearch(tmpl, 'report-cards', '.js-cards-search-input'); },
   'keydown .js-cards-search-input'(event, tmpl) { if (event.keyCode === 13 && !event.shiftKey) runSearch(tmpl, 'report-cards', '.js-cards-search-input'); },
+  'keydown .js-impersonation-search-input'(event, tmpl) { if (event.keyCode === 13 && !event.shiftKey) runSearch(tmpl, 'report-impersonation', '.js-impersonation-search-input'); },
 });
 
 function goPrevPage(event, tmpl, reportId) {
@@ -261,12 +329,18 @@ function switchMenu(event, tmpl) {
   const target = $(event.target);
   if (!target.hasClass('active')) {
     tmpl.loading.set(true);
+    tmpl.showSummary.set(false);
+    tmpl.showSecurity.set(false);
+    tmpl.showSpeed.set(false);
+    tmpl.showTests.set(false);
+    tmpl.showCpu.set(false);
     tmpl.showFilesReport.set(false);
     tmpl.showBrokenCardsReport.set(false);
     tmpl.showOrphanedFilesReport.set(false);
     tmpl.showRulesReport.set(false);
     tmpl.showBoardsReport.set(false);
     tmpl.showCardsReport.set(false);
+    tmpl.showImpersonationReport.set(false);
     if (tmpl.subscription) {
       tmpl.subscription.stop();
     }
@@ -276,7 +350,24 @@ function switchMenu(event, tmpl) {
     const targetID = target.data('id');
     tmpl.activeReport.set(targetID);
 
-    if ('report-broken' === targetID) {
+    // Summary + the Security/Speed/Tests streams load their own data (via methods,
+    // not a subscription), so just show them and clear the spinner.
+    if ('report-summary' === targetID) {
+      tmpl.showSummary.set(true);
+      tmpl.loading.set(false);
+    } else if ('report-security' === targetID) {
+      tmpl.showSecurity.set(true);
+      tmpl.loading.set(false);
+    } else if ('report-speed' === targetID) {
+      tmpl.showSpeed.set(true);
+      tmpl.loading.set(false);
+    } else if ('report-tests' === targetID) {
+      tmpl.showTests.set(true);
+      tmpl.loading.set(false);
+    } else if ('report-cpu' === targetID) {
+      tmpl.showCpu.set(true);
+      tmpl.loading.set(false);
+    } else if ('report-broken' === targetID) {
       tmpl.showBrokenCardsReport.set(true);
       tmpl.subscription = Meteor.subscribe(
         'brokenCards',
@@ -305,6 +396,11 @@ function switchMenu(event, tmpl) {
       tmpl.cardsPage.set(1);
       tmpl.cardsSearch.set('');
       tmpl.loadReport('report-cards');
+    } else if ('report-impersonation' === targetID) {
+      tmpl.showImpersonationReport.set(true);
+      tmpl.impersonationPage.set(1);
+      tmpl.impersonationSearch.set('');
+      tmpl.loadReport('report-impersonation');
     }
   }
 }
@@ -313,10 +409,31 @@ function switchMenu(event, tmpl) {
 
 Template.filesReport.helpers({
   results() {
-    return collectionResults(Attachments, { name: 1 });
+    // The filename cell renders via the global {{cleanFilename}} helper: the name
+    // is URL-decoded, homoglyphs are folded, and invisible / exploit characters
+    // are removed, so it is always shown as a plain, readable name.
+    //
+    // Prefer the UNDERLYING reactive minimongo collection (Attachments.collection):
+    // the 'attachmentsList' publication delivers the page via this.added, and a
+    // plain Mongo.Collection cursor reacts to those adds and yields plain docs,
+    // whereas the ostrio FilesCursor (Attachments.find()) does not reliably re-run
+    // in a Blaze helper. Fall back to the wrapper if .collection is unavailable and
+    // NEVER throw: a throwing helper would abort the whole filesReport render
+    // (blank pane instead of the report + its "no results" state).
+    const coll = (Attachments && Attachments.collection) || Attachments;
+    try {
+      return collectionResults(coll, { name: 1 });
+    } catch (e) {
+      return [];
+    }
   },
   resultsCount() {
-    return collectionResultsCount(Attachments);
+    const coll = (Attachments && Attachments.collection) || Attachments;
+    try {
+      return collectionResultsCount(coll);
+    } catch (e) {
+      return 0;
+    }
   },
   fileSize(size) {
     return fileSizeHelper(size);
@@ -399,7 +516,8 @@ Template.boardsReport.helpers({
 
 Template.cardsReport.helpers({
   results() {
-    return collectionResults(Cards, { boardId: 1, sort: 1 });
+    // Match the server publication's index-backed sort (see cards.js).
+    return collectionResults(Cards, { boardId: 1, createdAt: -1 });
   },
   resultsCount() {
     return collectionResultsCount(Cards);
@@ -418,6 +536,36 @@ Template.cardsReport.helpers({
   },
 });
 
+// --- impersonationReport template ---
+
+Template.impersonationReport.helpers({
+  results() {
+    // The publication already paginates + sorts newest-first; mirror that sort.
+    return collectionResults(ImpersonatedUsers, { createdAt: -1 });
+  },
+  resultsCount() {
+    return collectionResultsCount(ImpersonatedUsers);
+  },
+  userName(userId) {
+    if (!userId) return '';
+    return ReactiveCache.getUser(userId)?.username || userId;
+  },
+  formatDate(date) {
+    return date ? new Date(date).toLocaleString() : '';
+  },
+});
+
+Template.impersonationReport.events({
+  // Clicking a username opens the same "Edit user" popup as Admin Panel / People.
+  'click .js-impersonation-edit-user'(event) {
+    event.preventDefault();
+    const userId = event.currentTarget.getAttribute('data-user-id');
+    if (userId) {
+      Popup.open('editUser').call({ userId }, event);
+    }
+  },
+});
+
 // --- brokenCardsReport template ---
 
 Template.brokenCardsReport.onCreated(function () {
@@ -456,3 +604,80 @@ Template.brokenCardsReport.events({
     tpl.search.previousPage();
   },
 });
+
+// --- Read-only event stream report (Security / Speed / Tests) ---
+// Reads the eventlog collection through the admin-only eventLogPage/eventLogCount
+// methods and shows a paginated, searchable, READ-ONLY table (no acknowledge —
+// that lives only on the Summary page). See docs/Security/Remediation/WeKan.md.
+const EVENTS_PER_PAGE = 25;
+
+function eventStreamTitleKey(stream) {
+  return { security: 'securityReportTitle', speed: 'speedReportTitle', tests: 'testsReportTitle', cpu: 'cpuReportTitle' }[stream] || 'summary';
+}
+
+Template.eventStreamReport.onCreated(function () {
+  this.stream = this.data.stream;
+  this.page = new ReactiveVar(1);
+  this.total = new ReactiveVar(0);
+  this.rows = new ReactiveVar([]);
+  this.search = new ReactiveVar('');
+  this.load = () => {
+    const stream = this.stream;
+    const search = this.search.get();
+    const page = this.page.get();
+    Meteor.call('eventLogCount', stream, search, (err, count) => {
+      if (!err) this.total.set(count || 0);
+    });
+    Meteor.call('eventLogPage', stream, EVENTS_PER_PAGE, (page - 1) * EVENTS_PER_PAGE, search, (err, rows) => {
+      if (!err) this.rows.set(Array.isArray(rows) ? rows : []);
+    });
+  };
+  this.load();
+});
+
+Template.eventStreamReport.helpers({
+  rows() { return Template.instance().rows.get(); },
+  rowCount() { return (Template.instance().rows.get() || []).length; },
+  currentPage() { return Template.instance().page.get(); },
+  totalPages() { return Math.max(1, Math.ceil(Template.instance().total.get() / EVENTS_PER_PAGE)); },
+  searchTerm() { return Template.instance().search.get(); },
+  streamTitle() { return TAPi18n.__(eventStreamTitleKey(Template.instance().stream)); },
+  prevDisabled() { return Template.instance().page.get() <= 1 ? 'disabled' : ''; },
+  nextDisabled() {
+    const t = Template.instance();
+    return t.page.get() >= Math.max(1, Math.ceil(t.total.get() / EVENTS_PER_PAGE)) ? 'disabled' : '';
+  },
+  formatAt(at) {
+    if (!at) return '';
+    try { return new Date(at).toISOString().replace('T', ' ').slice(0, 19); } catch (e) { return String(at); }
+  },
+  // The user who triggered the event (e.g. who uploaded a sanitized file). Empty
+  // for events with no associated user.
+  userName(userId) {
+    if (!userId) return '';
+    return ReactiveCache.getUser(userId)?.username || userId;
+  },
+});
+
+Template.eventStreamReport.events({
+  // Clicking the uploader opens the same "Edit user" popup as Admin Panel / People.
+  'click .js-event-edit-user'(event) {
+    event.preventDefault();
+    const userId = event.currentTarget.getAttribute('data-user-id');
+    if (userId) {
+      Popup.open('editUser').call({ userId }, event);
+    }
+  },
+  'input .js-event-search'(event, tmpl) {
+    tmpl.search.set(event.currentTarget.value.trim());
+    tmpl.page.set(1);
+    tmpl.load();
+  },
+  'click .js-event-prev'(event, tmpl) {
+    if (tmpl.page.get() > 1) { tmpl.page.set(tmpl.page.get() - 1); tmpl.load(); }
+  },
+  'click .js-event-next'(event, tmpl) {
+    const totalPages = Math.max(1, Math.ceil(tmpl.total.get() / EVENTS_PER_PAGE));
+    if (tmpl.page.get() < totalPages) { tmpl.page.set(tmpl.page.get() + 1); tmpl.load(); }
+  },
+});

client/components/settings/attachments.jade

@@ -51,6 +51,22 @@ template(name="attachments")
                 span.emoji-icon
                 i.fa.fa-cloud
                 | {{_ 'gcs-storage'}}
+            li(class="{{#if isDatabaseMigrationActive}}active{{/if}}")
+              a.js-attachments-menu(data-id="database-migration")
+                span.emoji-icon
+                i.fa.fa-exchange
+                | {{_ 'database-migration'}}
+            li(class="{{#if isBackupActive}}active{{/if}}")
+              a.js-attachments-menu(data-id="backup")
+                span.emoji-icon
+                i.fa.fa-archive
+                | {{_ 'backup'}}
+            if isSandstorm
+              li(class="{{#if isSandstormActive}}active{{/if}}")
+                a.js-attachments-menu(data-id="sandstorm")
+                  span.emoji-icon
+                  i.fa.fa-hdd-o
+                  | Sandstorm
 
         .main-body
           if loading.get
@@ -475,6 +491,144 @@ template(name="attachments")
                   if cloudTestError.gcs
                     p.form-text.text-danger {{_ 'cloud-connection-failed'}}: {{cloudTestError.gcs}}
 
+          else if isDatabaseMigrationActive
+            ul#attachment-database-migration-setting.setting-detail
+              li
+                h3 {{_ 'database-migration'}}
+                .description {{_ 'database-migration-description'}}
+                .form-group
+                  button.js-migrate-to-ferretdb.btn.btn-primary(type="button" disabled=migrateRunning) {{_ 'database-migrate-to-ferretdb'}}
+                  button.js-migrate-to-mongodb.btn.btn-primary(type="button" disabled=migrateRunning) {{_ 'database-migrate-to-mongodb'}}
+                if migrateStatus
+                  .move-progress-section
+                    .move-progress-counter
+                      | {{_ 'database-migration-phase'}}: {{migrateStatus.phase}}
+                      if migrateStatus.collection
+                        |  — {{migrateStatus.collection}} ({{migrateStatus.collDone}}/{{migrateStatus.collTotal}}), {{migrateStatus.collectionsDone}}/{{migrateStatus.collectionsTotal}}
+                    if migrateStatus.error
+                      p.form-text.text-danger {{migrateStatus.error}}
+                    if migrateSuccess
+                      p.form-text.text-success {{_ 'database-migration-done'}}
+
+          else if isBackupActive
+            ul#attachment-backup-setting.setting-detail
+              li
+                h3 {{_ 'backup'}}
+                .description {{_ 'backup-description'}}
+                .form-group
+                  label
+                    input.js-backup-attachments(type="checkbox" checked="checked")
+                    |  {{_ 'attachments'}}
+                  label
+                    input.js-backup-avatars(type="checkbox" checked="checked")
+                    |  {{_ 'avatars'}}
+                  label
+                    input.js-backup-data(type="checkbox" checked="checked")
+                    |  {{_ 'backup-data'}}
+                .form-group
+                  label {{_ 'backup-storage'}}
+                  select.wekan-form-control.js-backup-storage
+                    option(value="filesystem") {{_ 'filesystem-storage'}}
+                    option(value="s3") {{_ 's3-minio-storage'}}
+                    option(value="azure") {{_ 'azure-blob-storage'}}
+                    option(value="gcs") {{_ 'gcs-storage'}}
+                .form-group
+                  button.js-run-backup.btn.btn-primary(type="button" disabled=backupRunning) {{_ 'backup-now'}}
+                if backupStatus
+                  p.form-text {{_ 'database-migration-phase'}}: {{backupStatus.phase}} {{backupStatus.detail}}
+                  if backupStatus.error
+                    p.form-text.text-danger {{backupStatus.error}}
+                  if backupSuccess
+                    p.form-text.text-success {{_ 'backup-done'}}: {{backupStatus.file}}
+
+                h4 {{_ 'backup-schedule'}}
+                .form-group
+                  label {{_ 'backup-frequency'}}
+                  select.wekan-form-control.js-backup-frequency
+                    option(value="off" selected=scheduleOff) {{_ 'backup-frequency-off'}}
+                    option(value="daily" selected=scheduleDaily) {{_ 'backup-frequency-daily'}}
+                    option(value="weekly" selected=scheduleWeekly) {{_ 'backup-frequency-weekly'}}
+                    option(value="monthly" selected=scheduleMonthly) {{_ 'backup-frequency-monthly'}}
+                .form-group
+                  label {{_ 'backup-time'}}
+                  input.wekan-form-control.js-backup-time(type="time" value=scheduleTime)
+                .form-group
+                  label {{_ 'backup-day-of-week'}}
+                  input.wekan-form-control.js-backup-dow(type="text" value=scheduleDow placeholder="Sunday")
+                .form-group
+                  label {{_ 'backup-day-of-month'}}
+                  input.wekan-form-control.js-backup-dom(type="number" min="1" max="28" value=scheduleDom)
+                .form-group
+                  button.js-save-backup-schedule.btn.btn-primary(type="button") {{_ 'save'}}
+
+                h4 {{_ 'backup-restore'}}
+                .form-group
+                  button.js-list-backups.btn.btn-secondary(type="button") {{_ 'backup-list'}}
+                if backupList
+                  table.gridfs-stats-table
+                    tr
+                      th
+                      th {{_ 'backup-storage'}}
+                      th {{_ 'backup-datetime'}}
+                      th {{_ 'backup-path'}}
+                    each backupList
+                      tr
+                        td
+                          input.js-backup-select(type="radio" name="backup-select" value=path)
+                        td {{storage}}
+                        td {{datetime}}
+                        td {{path}}
+                  .form-group
+                    label {{_ 'backup-restore-mode'}}
+                    select.wekan-form-control.js-restore-mode
+                      option(value="add-missing") {{_ 'backup-restore-add-missing'}}
+                      option(value="replace-all") {{_ 'backup-restore-replace-all'}}
+                  .form-group
+                    button.js-restore-backup.btn.btn-warning(type="button" disabled=backupRunning) {{_ 'backup-restore'}}
+
+          else if isSandstormActive
+            ul#attachment-sandstorm-setting.setting-detail
+              li
+                h3 Sandstorm
+                .description {{_ 'sandstorm-migration-description'}}
+                if sandstormStatus
+                  .form-group
+                    strong {{_ 'sandstorm-migration-status'}}
+                    if sandstormStatus.migrationSuccess
+                      span.text-success  {{_ 'sandstorm-migration-success'}}
+                    else if sandstormStatus.migrationDone
+                      span.text-danger  {{_ 'sandstorm-migration-failed'}}
+                    else
+                      span.text-muted  {{_ 'sandstorm-migration-pending'}}
+                    if sandstormStatus.status
+                      p.form-text.text-muted {{_ 'database-migration-phase'}}: {{sandstormStatus.status.phase}}
+                  table.gridfs-stats-table
+                    tr
+                      th {{_ 'sandstorm-storage-item'}}
+                      th {{_ 'sandstorm-disk-usage'}}
+                    tr
+                      td {{_ 'sandstorm-raw-mongodb'}}
+                      td {{rawMongoSize}}
+                    tr
+                      td FerretDB (SQLite)
+                      td {{ferretSize}}
+                    tr
+                      td {{_ 'attachments'}}
+                      td {{attachmentsSize}}
+                    tr
+                      td {{_ 'avatars'}}
+                      td {{avatarsSize}}
+                  if sandstormStatus.rawMongoExists
+                    .form-group
+                      .description {{_ 'sandstorm-delete-raw-mongodb-description'}}
+                      button.js-sandstorm-delete-raw-mongodb.btn.btn-warning(type="button" disabled=sandstormDeleteDisabled) {{_ 'sandstorm-delete-raw-mongodb'}}
+                      if sandstormDeleteResult
+                        p.form-text.text-success {{_ 'sandstorm-raw-mongodb-deleted'}} ({{sandstormDeleteFreed}})
+                      if sandstormDeleteError
+                        p.form-text.text-danger {{sandstormDeleteError}}
+                else
+                  p.form-text.text-muted {{_ 'loading'}}
+
 template(name="moveAttachments")
   .move-storage-form
     .move-storage-selects

client/components/settings/attachments.js

@@ -234,6 +234,15 @@ Template.attachments.onCreated(function () {
   this.activeSection = new ReactiveVar('move');
   this.storageSettingsSubscription = Meteor.subscribe('attachmentStorageSettings');
   this.attachmentStorageSettings = new ReactiveVar(null);
+  // #6473: the real storage paths only exist on the SERVER (WRITABLE_PATH is a
+  // server environment variable — process.env in the browser never has it, so
+  // computing the path client-side always showed the misleading "/data").
+  this.storagePaths = new ReactiveVar(null);
+  Meteor.call('getAttachmentStoragePaths', (err, paths) => {
+    if (!err && paths) {
+      this.storagePaths.set(paths);
+    }
+  });
   this.attachmentLimitUnits = new ReactiveVar({
     attachmentsUploadMaxBytes: 'mb',
     attachmentsDownloadMaxBytes: 'mb',
@@ -267,6 +276,28 @@ Template.attachments.onCreated(function () {
   this.cloudTestResults = new ReactiveVar({});
   this.cloudTestErrors = new ReactiveVar({});
   this.loading = new ReactiveVar(false);
+  this.migrateStatus = new ReactiveVar(null);
+  this.migratePoll = null;
+  this.backupStatus = new ReactiveVar(null);
+  this.backupList = new ReactiveVar(null);
+  this.backupSchedule = new ReactiveVar(null);
+  this.selectedBackup = new ReactiveVar('');
+  this.backupPoll = null;
+  Meteor.call('getBackupSchedule', (err, s) => { if (!err && s) this.backupSchedule.set(s); });
+
+  // Sandstorm: MongoDB 3 -> FerretDB migration status + raw-MongoDB disk usage.
+  this.sandstormStatus = new ReactiveVar(null);
+  this.sandstormDeleteResult = new ReactiveVar(null);
+  this.sandstormDeleteError = new ReactiveVar('');
+  // Fetch (once) when the Sandstorm tab is opened. Migration runs in start.js
+  // before the app boots, so the status is static by the time the UI is shown.
+  this.autorun(() => {
+    if (this.activeSection.get() === 'sandstorm') {
+      Meteor.call('sandstormMigrationStatus', (err, res) => {
+        if (!err && res) this.sandstormStatus.set(res);
+      });
+    }
+  });
 
   this.autorun(() => {
     const ready = this.storageSettingsSubscription.ready();
@@ -279,6 +310,54 @@ Template.attachments.onCreated(function () {
   });
 });
 
+Template.attachments.onDestroyed(function () {
+  if (this.migratePoll) {
+    Meteor.clearTimeout(this.migratePoll);
+    this.migratePoll = null;
+  }
+  if (this.backupPoll) {
+    Meteor.clearTimeout(this.backupPoll);
+    this.backupPoll = null;
+  }
+});
+
+// Text-data database migration (MongoDB <-> FerretDB v1 SQLite) helpers.
+function pollMigrateStatus(tpl) {
+  Meteor.call('migrateTextDatabaseStatus', (err, status) => {
+    if (err || !status) return;
+    tpl.migrateStatus.set(status);
+    if (status.running) {
+      tpl.migratePoll = Meteor.setTimeout(() => pollMigrateStatus(tpl), 2000);
+    }
+  });
+}
+
+function startDbMigration(tpl, direction) {
+  const which = direction === 'toFerretDB' ? 'FerretDB v1 (SQLite)' : 'MongoDB';
+  // eslint-disable-next-line no-alert
+  if (!window.confirm(TAPi18n.__('database-migration-confirm', { db: which }))) {
+    return;
+  }
+  tpl.migrateStatus.set({ running: true, phase: 'starting', direction });
+  Meteor.call('migrateTextDatabase', direction, error => {
+    if (error) {
+      tpl.migrateStatus.set({ phase: 'error', error: error.reason || error.message, success: false });
+    } else {
+      pollMigrateStatus(tpl);
+    }
+  });
+}
+
+function pollBackupStatus(tpl) {
+  Meteor.call('backupStatus', (err, status) => {
+    if (err || !status) return;
+    tpl.backupStatus.set(status);
+    if (status.running) {
+      tpl.backupPoll = Meteor.setTimeout(() => pollBackupStatus(tpl), 2000);
+    }
+  });
+}
+
 Template.attachments.helpers({
   loading() {
     return Template.instance().loading;
@@ -298,6 +377,89 @@ Template.attachments.helpers({
   isGcsActive() {
     return Template.instance().activeSection.get() === 'gcs';
   },
+  isDatabaseMigrationActive() {
+    return Template.instance().activeSection.get() === 'database-migration';
+  },
+  migrateStatus() {
+    return Template.instance().migrateStatus.get();
+  },
+  migrateRunning() {
+    const s = Template.instance().migrateStatus.get();
+    return !!(s && s.running);
+  },
+  migrateSuccess() {
+    const s = Template.instance().migrateStatus.get();
+    return !!(s && s.success === true);
+  },
+  isBackupActive() {
+    return Template.instance().activeSection.get() === 'backup';
+  },
+  isSandstorm() {
+    return !!(
+      Meteor.settings &&
+      Meteor.settings.public &&
+      Meteor.settings.public.sandstorm
+    );
+  },
+  isSandstormActive() {
+    return Template.instance().activeSection.get() === 'sandstorm';
+  },
+  sandstormStatus() {
+    return Template.instance().sandstormStatus.get();
+  },
+  rawMongoSize() {
+    const s = Template.instance().sandstormStatus.get();
+    return s ? filesize(s.rawMongoBytes || 0) : '';
+  },
+  ferretSize() {
+    const s = Template.instance().sandstormStatus.get();
+    return s ? filesize(s.ferretBytes || 0) : '';
+  },
+  attachmentsSize() {
+    const s = Template.instance().sandstormStatus.get();
+    return s ? filesize(s.attachmentsBytes || 0) : '';
+  },
+  avatarsSize() {
+    const s = Template.instance().sandstormStatus.get();
+    return s ? filesize(s.avatarsBytes || 0) : '';
+  },
+  sandstormDeleteDisabled() {
+    const s = Template.instance().sandstormStatus.get();
+    // Only allow deleting the raw MongoDB files after a confirmed-successful
+    // migration, and only while they still exist.
+    return !(s && s.migrationSuccess && s.rawMongoExists);
+  },
+  sandstormDeleteResult() {
+    return Template.instance().sandstormDeleteResult.get();
+  },
+  sandstormDeleteFreed() {
+    const r = Template.instance().sandstormDeleteResult.get();
+    return r ? filesize(r.freedBytes || 0) : '';
+  },
+  sandstormDeleteError() {
+    return Template.instance().sandstormDeleteError.get();
+  },
+  backupStatus() {
+    return Template.instance().backupStatus.get();
+  },
+  backupRunning() {
+    const s = Template.instance().backupStatus.get();
+    return !!(s && s.running);
+  },
+  backupSuccess() {
+    const s = Template.instance().backupStatus.get();
+    return !!(s && s.success === true && s.phase === 'completed');
+  },
+  backupList() {
+    return Template.instance().backupList.get();
+  },
+  scheduleOff() { const s = Template.instance().backupSchedule.get(); return !s || !s.frequency || s.frequency === 'off'; },
+  scheduleDaily() { const s = Template.instance().backupSchedule.get(); return !!(s && s.frequency === 'daily'); },
+  scheduleWeekly() { const s = Template.instance().backupSchedule.get(); return !!(s && s.frequency === 'weekly'); },
+  scheduleMonthly() { const s = Template.instance().backupSchedule.get(); return !!(s && s.frequency === 'monthly'); },
+  scheduleTime() { const s = Template.instance().backupSchedule.get(); return (s && s.time) || '04:00'; },
+  scheduleDow() { const s = Template.instance().backupSchedule.get(); return (s && s.dayOfWeek) || 'Sunday'; },
+  scheduleDom() { const s = Template.instance().backupSchedule.get(); return (s && s.dayOfMonth) || 1; },
   avatarsUploadBlocked() {
     const settings = Template.instance().attachmentStorageSettings.get();
     return settings?.limitSettings?.avatarsUploadBlocked === true;
@@ -384,16 +546,20 @@ Template.attachments.helpers({
   isS3Active() {
     return Template.instance().activeSection.get() === 's3';
   },
+  // #6473: these paths come from the getAttachmentStoragePaths server method —
+  // WRITABLE_PATH is a server-side environment variable, so reading
+  // process.env here in the browser always produced the misleading "/data".
   filesystemPath() {
-    return process.env.WRITABLE_PATH || '/data';
+    const paths = Template.instance().storagePaths.get();
+    return paths ? paths.writablePath : '';
   },
   attachmentsPath() {
-    const writablePath = process.env.WRITABLE_PATH || '/data';
-    return `${writablePath}/attachments`;
+    const paths = Template.instance().storagePaths.get();
+    return paths ? paths.attachments : '';
   },
   avatarsPath() {
-    const writablePath = process.env.WRITABLE_PATH || '/data';
-    return `${writablePath}/avatars`;
+    const paths = Template.instance().storagePaths.get();
+    return paths ? paths.avatars : '';
   },
   filesystemEnabled() {
     const tpl = Template.instance();
@@ -561,6 +727,84 @@ Template.attachments.events({
 
     tpl.activeSection.set(targetID);
   },
+  'click .js-sandstorm-delete-raw-mongodb'(event, tpl) {
+    event.preventDefault();
+    if (!window.confirm(TAPi18n.__('sandstorm-delete-raw-mongodb-confirm'))) {
+      return;
+    }
+    tpl.sandstormDeleteError.set('');
+    Meteor.call('sandstormDeleteRawMongo', (error, result) => {
+      if (error) {
+        tpl.sandstormDeleteError.set(error.reason || error.message);
+        return;
+      }
+      tpl.sandstormDeleteResult.set(result);
+      // Refresh disk usage / status after deletion.
+      Meteor.call('sandstormMigrationStatus', (err, res) => {
+        if (!err && res) tpl.sandstormStatus.set(res);
+      });
+    });
+  },
+  'click .js-migrate-to-ferretdb'(event, tpl) {
+    event.preventDefault();
+    startDbMigration(tpl, 'toFerretDB');
+  },
+  'click .js-migrate-to-mongodb'(event, tpl) {
+    event.preventDefault();
+    startDbMigration(tpl, 'toMongoDB');
+  },
+  'click .js-run-backup'(event, tpl) {
+    event.preventDefault();
+    const opts = {
+      attachments: tpl.$('.js-backup-attachments').is(':checked'),
+      avatars: tpl.$('.js-backup-avatars').is(':checked'),
+      data: tpl.$('.js-backup-data').is(':checked'),
+    };
+    const storage = tpl.$('.js-backup-storage').val() || 'filesystem';
+    tpl.backupStatus.set({ running: true, phase: 'starting' });
+    Meteor.call('runBackup', opts, storage, error => {
+      if (error) tpl.backupStatus.set({ phase: 'error', error: error.reason || error.message, success: false });
+      else pollBackupStatus(tpl);
+    });
+  },
+  'click .js-save-backup-schedule'(event, tpl) {
+    event.preventDefault();
+    const schedule = {
+      enabled: (tpl.$('.js-backup-frequency').val() || 'off') !== 'off',
+      frequency: tpl.$('.js-backup-frequency').val() || 'off',
+      time: tpl.$('.js-backup-time').val() || '04:00',
+      dayOfWeek: tpl.$('.js-backup-dow').val() || 'Sunday',
+      dayOfMonth: parseInt(tpl.$('.js-backup-dom').val(), 10) || 1,
+      attachments: tpl.$('.js-backup-attachments').is(':checked'),
+      avatars: tpl.$('.js-backup-avatars').is(':checked'),
+      data: tpl.$('.js-backup-data').is(':checked'),
+      storage: tpl.$('.js-backup-storage').val() || 'filesystem',
+    };
+    Meteor.call('saveBackupSchedule', schedule, (error, saved) => {
+      if (!error && saved) tpl.backupSchedule.set(saved);
+    });
+  },
+  'click .js-list-backups'(event, tpl) {
+    event.preventDefault();
+    Meteor.call('listBackups', (error, list) => {
+      if (!error) tpl.backupList.set(list || []);
+    });
+  },
+  'change .js-backup-select'(event, tpl) {
+    tpl.selectedBackup.set($(event.currentTarget).val());
+  },
+  'click .js-restore-backup'(event, tpl) {
+    event.preventDefault();
+    const zipPath = tpl.selectedBackup.get();
+    if (!zipPath) { window.alert(TAPi18n.__('backup-restore-select-first')); return; }
+    const mode = tpl.$('.js-restore-mode').val() || 'add-missing';
+    if (!window.confirm(TAPi18n.__('backup-restore-confirm'))) return;
+    tpl.backupStatus.set({ running: true, phase: 'restore' });
+    Meteor.call('restoreBackup', zipPath, mode, error => {
+      if (error) tpl.backupStatus.set({ phase: 'error', error: error.reason || error.message, success: false });
+      else pollBackupStatus(tpl);
+    });
+  },
   'change select.js-attachment-limit-unit'(event, tpl) {
     const fieldName = event.currentTarget.dataset.field;
     const selectedUnit = event.currentTarget.value;

client/components/settings/informationBody.jade

@@ -29,15 +29,37 @@ template(name='statistics')
         tr
           th {{_ 'Node_version'}}
           td {{statistics.process.nodeVersion}}
+        tr
+          th {{_ 'Database_type'}}
+          td {{statistics.mongo.databaseType}}
         tr
           th {{_ 'MongoDB_version'}}
           td {{statistics.mongo.mongoVersion}}
+        tr
+          th {{_ 'Database_commit'}}
+          td {{statistics.mongo.databaseCommit}}
+        if statistics.mongo.ferretdbVersion
+          tr
+            th {{_ 'FerretDB_version'}}
+            td {{statistics.mongo.ferretdbVersion}}
+          tr
+            th {{_ 'FerretDB_commit'}}
+            td {{statistics.mongo.ferretdbCommit}}
         tr
           th {{_ 'MongoDB_storage_engine'}}
           td {{statistics.mongo.mongoStorageEngine}}
         tr
           th {{_ 'MongoDB_Oplog_enabled'}}
           td {{formatBoolean statistics.mongo.mongoOplogEnabled}}
+        tr
+          th {{_ 'Reactivity_mode'}}
+          td {{statistics.mongo.reactivity}}
+        tr
+          th {{_ 'Reactivity_order'}}
+          td {{statistics.mongo.reactivityOrder}}
+        tr
+          th {{_ 'DDP_transport'}}
+          td {{statistics.mongo.ddpTransport}}
         tr
           th {{_ 'OS_Type'}}
           td {{statistics.os.type}}

client/components/settings/peopleBody.css

@@ -38,7 +38,7 @@ table tr:nth-child(even) {
 }
 .ext-box button {
   min-width: 90px;
-  background: #01628c;
+  background: var(--theme-accent, #01628c);
   color: #fff;
   border: none;
   border-radius: 0.4vw;
@@ -47,11 +47,11 @@ table tr:nth-child(even) {
 }
 
 .ext-box button:hover {
-  background: #005377;
+  background: var(--theme-accent, #005377);
 }
 
 .ext-box button:active {
-  background: #004766;
+  background: var(--theme-accent, #004766);
 }
 .content-wrapper {
   margin-top: 10px;
@@ -93,30 +93,30 @@ table td:first-child {
   min-width: auto;
 }
 #divAddOrRemoveTeam {
-  background: #01628c;
+  background: var(--theme-accent, #01628c);
   display: none;
 }
 #addOrRemoveTeam {
-  background: #01628c;
+  background: var(--theme-accent, #01628c);
   color: #fff;
 }
 #addOrRemoveTeam:hover {
-  background: #005377;
+  background: var(--theme-accent, #005377);
 }
 #divAddOrRemoveTeamContainer {
   display: none;
   margin: auto;
   width: 50%;
-  border: 3px solid #01628c;
+  border: 3px solid var(--theme-accent, #01628c);
   padding: 10px;
 }
 #cancelBtn {
   margin-inline-start: 5% !important;
-  background: #01628c;
+  background: var(--theme-accent, #01628c);
   color: #fff;
 }
 #cancelBtn:hover {
-  background: #005377;
+  background: var(--theme-accent, #005377);
 }
 #deleteAction {
   margin-inline-start: 5% !important;
@@ -150,7 +150,7 @@ table td:first-child {
 .unlock-all-btn {
   margin-top: 20px;
   margin-inline-start: 15px;
-  background-color: #01628c;
+  background-color: var(--theme-accent, #01628c);
   color: #fff;
   border: none;
   border-radius: 0.4vw;
@@ -164,7 +164,7 @@ table td:first-child {
 }
 
 .unlock-all-btn:hover {
-  background-color: #005377;
+  background-color: var(--theme-accent, #005377);
 }
 
 .unlock-all-btn .fa {
@@ -185,7 +185,7 @@ table td:first-child {
   top: 10%;
   left: 50%;
   transform: translateX(-50%);
-  background-color: #01628c;
+  background-color: var(--theme-accent, #01628c);
   color: white;
   padding: 10px 20px;
   border-radius: 4px;
@@ -206,7 +206,7 @@ table td:first-child {
 }
 
 .text-green {
-  color: #01628c;
+  color: var(--theme-accent, #01628c);
 }
 
 .js-toggle-lock-status {
@@ -223,15 +223,16 @@ table td:first-child {
 .people-pagination button {
   min-width: 32px;
   height: 30px;
-  border: 1px solid #bbb;
-  background: #fff;
+  border: 1px solid var(--theme-accent, #01628c);
+  background: transparent;
+  color: var(--theme-accent, #01628c);
   border-radius: 0.4vw;
   cursor: pointer;
 }
 
 .people-pagination button.active {
-  background: #01628c;
-  border-color: #01628c;
+  background: var(--theme-accent, #01628c);
+  border-color: var(--theme-accent, #01628c);
   color: #fff;
 }
 
@@ -256,15 +257,16 @@ table td:first-child {
 .org-pagination button {
   min-width: 32px;
   height: 30px;
-  border: 1px solid #bbb;
-  background: #fff;
+  border: 1px solid var(--theme-accent, #01628c);
+  background: transparent;
+  color: var(--theme-accent, #01628c);
   border-radius: 0.4vw;
   cursor: pointer;
 }
 
 .org-pagination button.active {
-  background: #01628c;
-  border-color: #01628c;
+  background: var(--theme-accent, #01628c);
+  border-color: var(--theme-accent, #01628c);
   color: #fff;
 }
 
@@ -289,15 +291,16 @@ table td:first-child {
 .team-pagination button {
   min-width: 32px;
   height: 30px;
-  border: 1px solid #bbb;
-  background: #fff;
+  border: 1px solid var(--theme-accent, #01628c);
+  background: transparent;
+  color: var(--theme-accent, #01628c);
   border-radius: 0.4vw;
   cursor: pointer;
 }
 
 .team-pagination button.active {
-  background: #01628c;
-  border-color: #01628c;
+  background: var(--theme-accent, #01628c);
+  border-color: var(--theme-accent, #01628c);
   color: #fff;
 }
 
@@ -378,3 +381,59 @@ table td:first-child {
 .roles-settings .roles-description {
   margin-bottom: 1rem;
 }
+
+/* Admin Panel > People > Domains table: search + column sort + pagination,
+   matching the Board Table view / other admin tables. */
+.domain-controls {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin-bottom: 8px;
+}
+
+.domain-controls input.js-domain-search {
+  flex: 1 1 auto;
+  height: 30px;
+  padding: 0 8px;
+  border: 1px solid #bbb;
+  border-radius: 0.4vw;
+}
+
+.domain-controls button.js-domain-search-button {
+  height: 30px;
+  padding: 0 12px;
+  border: 1px solid #bbb;
+  background: #fff;
+  border-radius: 0.4vw;
+  cursor: pointer;
+}
+
+.domain-pagination {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin-bottom: 12px;
+}
+
+.domain-pagination button {
+  min-width: 32px;
+  height: 30px;
+  padding: 0 10px;
+  border: 1px solid var(--theme-accent, #01628c);
+  background: transparent;
+  color: var(--theme-accent, #01628c);
+  border-radius: 0.4vw;
+  cursor: pointer;
+}
+
+.domain-pagination button.disabled {
+  opacity: 0.5;
+  pointer-events: none;
+}
+
+.domain-page-info {
+  min-width: 72px;
+  text-align: center;
+  color: #333;
+}
+

client/components/settings/peopleBody.jade

@@ -122,7 +122,7 @@ template(name="people")
           else if templatesSetting.get
             +templatesGeneral
           else if domainSetting.get
-            +domainGeneral(domainList=domainList)
+            +domainGeneral
 
 
 template(name="orgGeneral")
@@ -146,21 +146,27 @@ template(name="orgGeneral")
         th
           | {{_ 'org-shared-templates'}}
           br
-          a.js-org-feature-all(href="#", data-feature="orgSharedTemplates", data-value="true") {{_ 'select-all'}}
-          |  /
-          a.js-org-feature-all(href="#", data-feature="orgSharedTemplates", data-value="false") {{_ 'unselect-all'}}
+          a.js-org-feature-all(href="#", data-feature="orgSharedTemplates", data-value="true", title="{{_ 'select-all'}}")
+            i.fa.fa-check-square-o
+          |  
+          a.js-org-feature-all(href="#", data-feature="orgSharedTemplates", data-value="false", title="{{_ 'unselect-all'}}")
+            i.fa.fa-square-o
         th
           | {{_ 'org-propagate-members-to-boards'}}
           br
-          a.js-org-feature-all(href="#", data-feature="orgPropagateMembersToBoards", data-value="true") {{_ 'select-all'}}
-          |  /
-          a.js-org-feature-all(href="#", data-feature="orgPropagateMembersToBoards", data-value="false") {{_ 'unselect-all'}}
+          a.js-org-feature-all(href="#", data-feature="orgPropagateMembersToBoards", data-value="true", title="{{_ 'select-all'}}")
+            i.fa.fa-check-square-o
+          |  
+          a.js-org-feature-all(href="#", data-feature="orgPropagateMembersToBoards", data-value="false", title="{{_ 'unselect-all'}}")
+            i.fa.fa-square-o
         th
           | {{_ 'org-sync-members-from-auth'}}
           br
-          a.js-org-feature-all(href="#", data-feature="orgSyncMembersFromAuth", data-value="true") {{_ 'select-all'}}
-          |  /
-          a.js-org-feature-all(href="#", data-feature="orgSyncMembersFromAuth", data-value="false") {{_ 'unselect-all'}}
+          a.js-org-feature-all(href="#", data-feature="orgSyncMembersFromAuth", data-value="true", title="{{_ 'select-all'}}")
+            i.fa.fa-check-square-o
+          |  
+          a.js-org-feature-all(href="#", data-feature="orgSyncMembersFromAuth", data-value="false", title="{{_ 'unselect-all'}}")
+            i.fa.fa-square-o
     tbody
       tr
       each org in orgList
@@ -187,21 +193,27 @@ template(name="teamGeneral")
         th
           | {{_ 'team-shared-templates'}}
           br
-          a.js-team-feature-all(href="#", data-feature="teamSharedTemplates", data-value="true") {{_ 'select-all'}}
-          |  /
-          a.js-team-feature-all(href="#", data-feature="teamSharedTemplates", data-value="false") {{_ 'unselect-all'}}
+          a.js-team-feature-all(href="#", data-feature="teamSharedTemplates", data-value="true", title="{{_ 'select-all'}}")
+            i.fa.fa-check-square-o
+          |  
+          a.js-team-feature-all(href="#", data-feature="teamSharedTemplates", data-value="false", title="{{_ 'unselect-all'}}")
+            i.fa.fa-square-o
         th
           | {{_ 'team-propagate-members-to-boards'}}
           br
-          a.js-team-feature-all(href="#", data-feature="teamPropagateMembersToBoards", data-value="true") {{_ 'select-all'}}
-          |  /
-          a.js-team-feature-all(href="#", data-feature="teamPropagateMembersToBoards", data-value="false") {{_ 'unselect-all'}}
+          a.js-team-feature-all(href="#", data-feature="teamPropagateMembersToBoards", data-value="true", title="{{_ 'select-all'}}")
+            i.fa.fa-check-square-o
+          |  
+          a.js-team-feature-all(href="#", data-feature="teamPropagateMembersToBoards", data-value="false", title="{{_ 'unselect-all'}}")
+            i.fa.fa-square-o
         th
           | {{_ 'team-sync-members-from-auth'}}
           br
-          a.js-team-feature-all(href="#", data-feature="teamSyncMembersFromAuth", data-value="true") {{_ 'select-all'}}
-          |  /
-          a.js-team-feature-all(href="#", data-feature="teamSyncMembersFromAuth", data-value="false") {{_ 'unselect-all'}}
+          a.js-team-feature-all(href="#", data-feature="teamSyncMembersFromAuth", data-value="true", title="{{_ 'select-all'}}")
+            i.fa.fa-check-square-o
+          |  
+          a.js-team-feature-all(href="#", data-feature="teamSyncMembersFromAuth", data-value="false", title="{{_ 'unselect-all'}}")
+            i.fa.fa-square-o
     tbody
       tr
       each team in teamList
@@ -239,11 +251,18 @@ template(name="selectAllUser")
   input.allUserChkBox(type="checkbox", id="chkSelectAll")
 
 template(name="domainGeneral")
+  .domain-controls
+    input.js-domain-search(type="text" placeholder="{{_ 'search'}}" aria-label="{{_ 'search'}}")
+    button.js-domain-search-button(type="button") {{_ 'search'}}
+  .domain-pagination
+    button.js-domain-prev-page(type="button" class="{{#unless hasPrevPage}}disabled{{/unless}}" aria-label="{{_ 'previous'}}") {{_ 'previous'}}
+    span.domain-page-info {{currentPage}} / {{totalPages}}
+    button.js-domain-next-page(type="button" class="{{#unless hasNextPage}}disabled{{/unless}}" aria-label="{{_ 'next'}}") {{_ 'next'}}
   table
     thead
       tr
-        th {{_ 'domain'}}
-        th {{_ 'domain-user-count'}}
+        th(scope="col") {{_ 'domain'}}
+        th(scope="col") {{_ 'domain-user-count'}}
     tbody
       if domainList.length
         each domainList

client/components/settings/peopleBody.js

@@ -14,6 +14,7 @@ import InviteToBoardRolesSettings, {
 const orgsPerPage = 25;
 const teamsPerPage = 25;
 const usersPerPage = 25;
+const domainsPerPage = 25;
 let userOrgsTeamsAction = ""; //poosible actions 'addOrg', 'addTeam', 'removeOrg' or 'removeTeam' when adding or modifying a user
 let selectedUserChkBoxUserIds = [];
 
@@ -28,9 +29,9 @@ Template.people.onCreated(function () {
   this.lockedUsersSetting = new ReactiveVar(false);
   this.rolesSetting = new ReactiveVar(false);
   this.templatesSetting = new ReactiveVar(false);
-  // #5850: Admin Panel > People > Domains tab.
+  // #5850: Admin Panel > People > Domains tab. The domains table itself
+  // (domainGeneral) now owns its data via getDomainsWithUserCountsPage.
   this.domainSetting = new ReactiveVar(false);
-  this.domains = new ReactiveVar([]);
   this.subscribe('inviteToBoardRolesSettings');
   this.findOrgsOptions = new ReactiveVar({});
   this.findTeamsOptions = new ReactiveVar({});
@@ -205,12 +206,9 @@ Template.people.onCreated(function () {
       this.templatesSetting.set('templates-setting' === targetID);
       this.domainSetting.set('domains-setting' === targetID);
 
-      // #5850: load the domains + per-domain user counts when the tab opens.
-      if ('domains-setting' === targetID) {
-        Meteor.call('getDomainsWithUserCounts', (err, res) => {
-          if (!err) this.domains.set(res || []);
-        });
-      }
+      // The Domains table (domainGeneral) now fetches its own single page from
+      // getDomainsWithUserCountsPage (server-side search / sort / pagination), so
+      // the parent no longer eagerly loads every domain into the browser.
 
       // When switching to locked users tab, refresh the locked users list
       if ('locked-users-setting' === targetID) {
@@ -292,9 +290,6 @@ Template.people.helpers({
   domainSetting() {
     return Template.instance().domainSetting;
   },
-  domainList() {
-    return Template.instance().domains.get();
-  },
   orgList() {
     const tpl = Template.instance();
     // The 'org' publication already returns only the current page (server-side
@@ -1176,31 +1171,30 @@ Template.modifyTeamsUsers.events({
     selectedEltValue = selectedElt.options[selectedElt.selectedIndex].text;
     selectedEltValueId = selectedElt.options[selectedElt.selectedIndex].value;
 
+    // #4593: `teams` is a forbidden field for direct client-side Users.update
+    // (see server/permissions/users.js: only the owner may update, and never
+    // `teams`), so the previous Users.update() calls here were silently denied
+    // by the server and the bulk team assignment never persisted — a user
+    // "added" to a team this way never saw the boards that team is assigned
+    // to. Use the admin-only `editUser` method instead, which persists the
+    // change and also grants the user membership of the boards the gained
+    // team is assigned to.
     if(document.getElementById('addAction').checked){
       for(let i = 0; i < selectedUserChkBoxUserIds.length; i++){
         currentUser = ReactiveCache.getUser(selectedUserChkBoxUserIds[i]);
-        userTms = currentUser.teams;
-        if(userTms == undefined || userTms.length == 0){
-          userTms = [];
+        // Copy, so the cached minimongo document is not mutated in place.
+        userTms = (currentUser.teams || []).slice();
+        currUserTeamIndex = userTms.findIndex(function(t){ return t.teamId == selectedEltValueId});
+        if(currUserTeamIndex == -1){
           userTms.push({
             "teamId": selectedEltValueId,
             "teamDisplayName": selectedEltValue,
-          })
-        }
-        else if(userTms.length > 0)
-        {
-          currUserTeamIndex = userTms.findIndex(function(t){ return t.teamId == selectedEltValueId});
-          if(currUserTeamIndex == -1){
-            userTms.push({
-              "teamId": selectedEltValueId,
-              "teamDisplayName": selectedEltValue,
-            });
-          }
+          });
         }
 
-        Users.update(selectedUserChkBoxUserIds[i], {
-          $set:{
-            teams: userTms
+        Meteor.call('editUser', selectedUserChkBoxUserIds[i], { teams: userTms }, (error) => {
+          if (error) {
+            console.error('Error updating user teams:', error);
           }
         });
       }
@@ -1208,18 +1202,15 @@ Template.modifyTeamsUsers.events({
     else{
       for(let i = 0; i < selectedUserChkBoxUserIds.length; i++){
         currentUser = ReactiveCache.getUser(selectedUserChkBoxUserIds[i]);
-        userTms = currentUser.teams;
-        if(userTms !== undefined || userTms.length > 0)
-        {
-          currUserTeamIndex = userTms.findIndex(function(t){ return t.teamId == selectedEltValueId});
-          if(currUserTeamIndex != -1){
-            userTms.splice(currUserTeamIndex, 1);
-          }
+        userTms = (currentUser.teams || []).slice();
+        currUserTeamIndex = userTms.findIndex(function(t){ return t.teamId == selectedEltValueId});
+        if(currUserTeamIndex != -1){
+          userTms.splice(currUserTeamIndex, 1);
         }
 
-        Users.update(selectedUserChkBoxUserIds[i], {
-          $set:{
-            teams: userTms
+        Meteor.call('editUser', selectedUserChkBoxUserIds[i], { teams: userTms }, (error) => {
+          if (error) {
+            console.error('Error updating user teams:', error);
           }
         });
       }
@@ -1897,3 +1888,74 @@ Template.settingsUserPopup.helpers({
     return Template.instance().errorMessage.get();
   },
 });
+
+// Admin Panel > People > Domains table. Self-contained (like the Board Table
+// view): it keeps its own search / sort / page state and fetches only ONE page
+// from the server method getDomainsWithUserCountsPage, so the whole domain list
+// is never loaded into the browser.
+Template.domainGeneral.onCreated(function () {
+  this.searchQuery = new ReactiveVar('');
+  this.page = new ReactiveVar(1);
+  this.pageData = new ReactiveVar({ rows: [], total: 0, totalPages: 1 });
+
+  this.autorun(() => {
+    const params = {
+      search: this.searchQuery.get(),
+      page: this.page.get(),
+      perPage: domainsPerPage,
+    };
+    Meteor.call('getDomainsWithUserCountsPage', params, (err, res) => {
+      if (!err && res) {
+        this.pageData.set(res);
+        // Server clamps the page into range; mirror that so the controls agree.
+        if (typeof res.page === 'number' && res.page !== this.page.get()) {
+          this.page.set(res.page);
+        }
+      }
+    });
+  });
+});
+
+Template.domainGeneral.helpers({
+  domainList() {
+    return Template.instance().pageData.get().rows;
+  },
+  currentPage() {
+    return Template.instance().page.get();
+  },
+  totalPages() {
+    return Template.instance().pageData.get().totalPages || 1;
+  },
+  hasPrevPage() {
+    return Template.instance().page.get() > 1;
+  },
+  hasNextPage() {
+    const tpl = Template.instance();
+    return tpl.page.get() < (tpl.pageData.get().totalPages || 1);
+  },
+});
+
+Template.domainGeneral.events({
+  'click .js-domain-search-button'(event, tpl) {
+    event.preventDefault();
+    tpl.searchQuery.set(tpl.$('.js-domain-search').val() || '');
+    tpl.page.set(1);
+  },
+  'keydown .js-domain-search'(event, tpl) {
+    if (event.keyCode === 13) {
+      event.preventDefault();
+      tpl.searchQuery.set(tpl.$('.js-domain-search').val() || '');
+      tpl.page.set(1);
+    }
+  },
+  'click .js-domain-prev-page'(event, tpl) {
+    event.preventDefault();
+    const current = tpl.page.get();
+    if (current > 1) tpl.page.set(current - 1);
+  },
+  'click .js-domain-next-page'(event, tpl) {
+    event.preventDefault();
+    const current = tpl.page.get();
+    if (current < (tpl.pageData.get().totalPages || 1)) tpl.page.set(current + 1);
+  },
+});

client/components/settings/problemsSummary.jade

@@ -0,0 +1,16 @@
+template(name="problemsSummary")
+  .global-search-results-list-wrapper
+    h1 {{_ 'summary'}}
+    if hasProblems
+      p {{_ 'problems-summary-help'}}
+      .admin-problem-banner
+        each area in areas
+          label.admin-problem-item
+            input.js-problem-check(type="checkbox" data-stream="{{area.stream}}")
+            i.fa.fa-exclamation-triangle
+            span.admin-problem-path {{_ 'admin-panel'}} → {{_ 'problems'}} → {{areaLabel area.stream}}
+            span.admin-problem-count {{area.count}} {{_ 'new-problems'}}
+        .admin-problem-actions
+          button.js-ack-checked.primary {{_ 'acknowledge'}}
+    else
+      p {{_ 'no-new-problems'}}

client/components/settings/problemsSummary.js

@@ -0,0 +1,52 @@
+import { TAPi18n } from '/imports/i18n';
+
+// Admin Panel → Problems → Summary page: a checkbox list of problem areas
+// (Security / Speed / Tests) with each area's menu path and its count of NEW
+// (unacknowledged) problems, plus ONE Acknowledge button that acknowledges every
+// checked area. This is the ONLY place problems are acknowledged — the Security /
+// Speed / Tests detail pages are read-only.
+// Design: docs/Security/Remediation/WeKan.md. Data: the admin-only
+// eventLogProblemAreas / acknowledgeEventLog methods (models/eventLog.js).
+
+const STREAM_LABEL_KEY = {
+  security: 'securityReportTitle',
+  speed: 'speedReportTitle',
+  tests: 'testsReportTitle',
+};
+
+Template.problemsSummary.onCreated(function () {
+  this.areas = new ReactiveVar([]);
+  this.reload = () => {
+    Meteor.call('eventLogProblemAreas', (err, res) => {
+      if (!err) this.areas.set(Array.isArray(res) ? res : []);
+    });
+  };
+  this.reload();
+  this.timer = Meteor.setInterval(this.reload, 30000);
+});
+
+Template.problemsSummary.onDestroyed(function () {
+  if (this.timer) Meteor.clearInterval(this.timer);
+});
+
+Template.problemsSummary.helpers({
+  areas() {
+    return Template.instance().areas.get();
+  },
+  hasProblems() {
+    return (Template.instance().areas.get() || []).length > 0;
+  },
+  areaLabel(stream) {
+    return TAPi18n.__(STREAM_LABEL_KEY[stream] || stream);
+  },
+});
+
+Template.problemsSummary.events({
+  'click .js-ack-checked'(event, templateInstance) {
+    const streams = Array.from(templateInstance.findAll('.js-problem-check:checked'))
+      .map(el => el.getAttribute('data-stream'))
+      .filter(Boolean);
+    if (!streams.length) return;
+    Meteor.call('acknowledgeEventLog', streams, () => templateInstance.reload());
+  },
+});

client/components/settings/settingBody.css

@@ -117,11 +117,17 @@
 }
 
 /* Force tables to always trigger horizontal scrolling */
-.setting-content .content-body .main-body table td,
-.setting-content .content-body .main-body table th {
+.setting-content .content-body .main-body table td {
   white-space: nowrap;
   min-width: 120px;
 }
+/* #6465: headers may wrap — nowrap on long header labels (e.g. the org/team
+   feature columns) blew the column widths up to the whole label length. */
+.setting-content .content-body .main-body table th {
+  white-space: normal;
+  min-width: 120px;
+  max-width: 240px;
+}
 
 /* Ensure there's enough content to trigger vertical scrolling */
 .setting-content .content-body .main-body {
@@ -131,19 +137,19 @@
 
 /* Admin panel buttons should use theme darker color */
 .setting-content .content-body .main-body .setting-detail button.btn {
-  background: #005377;
+  background: var(--theme-accent, #005377);
   color: #fff;
   border: none;
 }
 
 .setting-content .content-body .main-body .setting-detail button.btn:hover,
 .setting-content .content-body .main-body .setting-detail button.btn:focus {
-  background: #004766;
+  background: var(--theme-accent, #004766);
   color: #fff;
 }
 
 .setting-content .content-body .main-body .setting-detail button.btn:active {
-  background: #01628c;
+  background: var(--theme-accent, #01628c);
   color: #fff;
 }