Platform Updates

Finance Outflows now lets authorized finance auditors download clean evidence for a selected disbursement, matching the earlier dashboard’s evidence action. The Worker resolves the disbursement’s governed journal evidence, records the download in the Finance audit trail, and streams the file without exposing a media-provider URL. Local Finance browser checks, API type checks, security contracts, and the V2 production build passed; no financial record or evidence file was changed.

All V2 operational workspaces now show the same dismissible sandbox notice as Event Management, including Assets, Finance, Planning, Pawsports, Reports, Surveys, Linked Operations, Social Publishing, and Settings. Use test or disposable records while these workspaces are prepared for production deployment. EMS now places the nearest upcoming event at the top, followed by recent history and undated drafts. Local type, build, route-smoke, and browser checks passed; no operational data changed.

Asset Management, Finance, Event Planning, Pawsports, Reports, and Settings now use the same grouped left-rail navigation as Event Management. The active workspace remains visible across every route, Planning keeps its selected project context, and Reports keeps its role-scoped cross-ban link. Local type and production build checks passed; no operational data changed.

Partners V2, RegoSite V2, and the Furries PH Admin sign-in surfaces now provide password recovery whenever email-and-password sign-in is available. Reset links are checked for a live recovery session before a new-password form can be used, and the password-change request performs the same server-side check. Request a fresh link if the recovery session has expired; this update changes no accounts or passwords. Local type, build, and recovery-contract checks cover the change.

Administrators who have an authenticator app enabled can now finish a password reset by entering their current six-digit code on the recovery screen. This meets Supabase Auth’s second-factor requirement before the password is changed; the recovery link still expires normally and no password or account data is shown. Local type, build, API recovery-contract, and rendered synthetic-flow checks passed. Hosted publication remains pending.

Administrators can now review an incomplete attendee account in the protected directory and request permanent removal one account at a time. The action is available only when the account is not a test fixture, has no dashboard or partner access, and still has a linked sign-in. It requires current FPH-admin authorization, recent MFA, and a final confirmation; the server repeats those eligibility checks before removal. The separate bulk test-fixture cleanup stays limited to server-classified disposable identities. No accounts were removed by this release.

The Admin test-identity cleanup now explicitly hard-deletes the matching Supabase Auth user and, when no registration, safety, payment, or other operational dependency remains, removes the linked attendee record as well. The results distinguish Auth-user deletion from attendee-record removal and show when a record was safely retained instead of calling a partial cleanup a success. The cleanup still requires FPH-admin approval, recent MFA, and its final confirmation; no additional account was removed by this software update.

When a disposable test identity has active moderation work, the cleanup now returns that work to the unassigned queue before permanently removing the identity. Completed appeal history stays intact, with the former reviewer detached. This lets the reviewed cleanup complete in one database command without weakening the safeguards that prevent a claimed case from losing its owner unexpectedly. No account was removed by this release.

Removing a Supabase Auth user now preserves past moderation commands, notices, staff-role history, legal-hold history, and retention records while detaching the former user reference. Active moderation work is still released before the identity is removed. This resolves the database error shown for disposable test accounts without deleting any moderation record.

The Admin Attendees cleanup now removes a server-classified test profile and its dependent fixture data, not only its Supabase Auth identity. The database walks dependent test records in a safe order and preserves unrelated historical records by detaching the former identity where required. Normal attendee profiles and non-fixture orphan records are not included.