Changelog

Refined the boot-time recovery shipped on 2026-05-25. If the daily 02:00 UTC cycle is interrupted partway — for example the server is scaled down mid-run, as happened on 2026-05-29 after only a fraction of accounts had been emailed — the recovery now sends the daily report to every account the cycle never reached, while the per-account send ledger still guarantees nobody who already received today's email gets a duplicate. Previously a half-finished cycle was treated as "already done" and the remaining accounts were silently recomputed with no email, so most accounts got no report that morning. A single recovery lock ensures only one server instance performs the catch-up at a time.

The daily 02:00 UTC assessment cycle is now self-healing. If the production server is asleep across the scheduled slot — as happened on 2026-05-25 when no traffic woke the autoscale instance at 06:00 GST and no reports went out platform-wide — the next boot detects that today's cycle never produced the morning reports and runs the cycle, sending the report to every account that hasn't already received today's email. Same-day re-boots are idempotent: a single recovery lock guarantees only one server instance performs the recovery, and the per-account send ledger guarantees no inbox ever receives the same report twice.

Every monitored country now has a public, share-friendly page at /public/[country] that renders its current LEAVE and ENTER posture, the triggers actively driving each direction, the cycle delta versus the previous run, and a stable Open Graph image — no login, no PII, no manifest data. The pages are crawlable, sitemap-listed, and use server-side rendering so headlines match the API at the moment of fetch rather than at the moment of paint.

Clicking any trigger box on the Dashboard now opens a side drawer with the trigger's current status, the activation threshold in plain language, the source citation backing the most recent decision, and a 7-day status history strip so you can see at a glance whether a breach is freshly tripped or has been holding for days. Drawer state is URL-addressable so you can deep-link directly to a trigger.

Daily digests are no longer the only way CHARIS reaches you. New accounts now default to alerts only: one email per country whenever its risk band moves up or down (or its posture flips), with a magic-link button that drops you straight into the right country card. A second option — alerts plus a Saturday summary — adds a weekly roll-up on top. Existing users keep the daily digest until they opt out from Account Settings, and a per-country mute list suppresses noise from long-running incidents. Admins get a new card showing lifetime opens, clicks and bounces broken out by email type so it's clear whether the loop is being read.

The ENTER side of every country now has its own four-band classification table — GO (≥75%), READY (50–75%), WATCH (25–50%) and NOT_READY (<25%) — scored as the percentage of active ENTER triggers that are currently met. The Dashboard, the daily PDF and the re-entry distribution emails all share the same bands so there's a single readiness scale across surfaces.

The Methodology page now documents the per-country posture model that the rest of the platform is moving toward. Each country sits in one of four postures — OPERATING, PARTIAL_OPS, DEPARTED or WATCHING — and the posture decides which classification table is the headline reading and which side of the country card is shown first. A configuration UI for setting and flipping posture per country is the next phase of work.

Trigger boxes on the Dashboard and in the PDF now carry an explicit ✓ or ✗ glyph in addition to colour, so the breach state is legible to red-green colour-blind viewers and on monochrome printouts. The glyph appears on the box itself, in the legend and in the per-country narrative blocks.

The Help page has been rewritten end-to-end so it describes CHARIS as it actually exists today rather than a long-retired mock-up. The Methodology page now reads the live trigger count from the catalogue, explains how a trigger tagged for both LEAVE and ENTER is scored, and adds a short paragraph on the posture model that the rest of the platform is moving toward. This page — /changelog — is new and is editable directly from server/changelog.md without a deploy.

The persisted Run Now sweep log used to grow forever. We now keep the most recent 100 sweeps on disk and the Admin UI surfaces the latest 20. The prune runs on every boot and after every sweep completes, so months of admin testing no longer balloon the database.

Re-entry recommendations now include a clear downgrade path when readiness slips, and the PDF report's recommendations section was tightened so the next-step language matches the dashboard.

The two-touch re-entry setup nudge (first touch, then a follow-up at least 30 days later) now runs automatically every night in production at 03:00 UTC. Admins can still trigger it on demand and preview the qualifying recipient count without sending.

The dashboard's headline now shows the worst LEAVE country and the worst ENTER country side by side, with a per-target-country posture badge on each personnel group so it's obvious at a glance which group is gated by which country.

Admin Run Now sweeps now survive a page refresh. Each sweep is stored with its per-user delivery summary and the Admin UI exposes a dropdown of recent sweeps so you can revisit what was sent and to whom.

The Admin "Send Test Email" control gained a variant dropdown so admins can preview multiple email layout states — re-entry configured with personnel, the legacy no-re-entry banner, and re-entry configured with no personnel — without editing code or impersonating users.