# What changed after checking scheme_dbs__15_.sql

The first version of the module guessed several table and column names. All of these were corrected against your database dump.

| Area | First version | Now |
|---|---|---|
| Users | `first_name`, `last_name` | `firstName`, `lastName` |
| Certificates | table `new_certificates` | table `new_certificate` (matched on company_id + standard_id, active first) |
| Audit date | `audit_schedule_rows.audit_date` (does not exist) | `audit_schedules.schedule_date` through `schedule_id` |
| Co-auditors | `auditor_id`, `auditor_ids` on the row | table `audit_row_co_auditors`; lead auditor from `lead_auditor_id` |
| Standards of an audit | not checked | `audit_schedule_row_standards` + `audit_requests.standard_ids`; create rejects a standard that is not booked |
| Standard name | `name` only | `name` + `title`, for example "ISO 9001:2015" + "Quality Management System" (cover and header) |
| Stage | guessed from free text | `audit_type` (INITIAL / SURVEILLANCE / RECERTIFICATION) + `audit_stage` ("Stage 1") |
| Address | company address only | address + city + country (no duplicates) |
| Man-days, technical expert, employees | read from columns that do not exist | left for the auditor to type (they are not in the CRM) |
| Approver | role names `admin,superadmin,scheme`, no scheme check | same rule as your QAQC report approvals: super-admin ids 1, 8, 29 (env `AUDIT_REPORT_SUPER_ADMIN_IDS`), roles admin / superadmin see all schemes, role `scheme` or permission `report-approve` only for the user's own scheme (`users.primary_scheme` = `companies.scheme`) |
| Final PDF storage | own folder | your existing `AuditReportStorageService` (same `storage/auditReport/stage1|stage2/<rowId>/` folders, `new:` path scheme) |
| Link to the audit row | none | on approval the path is written to `stg1_audit_report` (Stage 1) or `stg2_audit_report` (all other stages) and the row is marked `report_qaqc_approved = 1`, so the tracker, the QAQC queue and the client portal use it. The earlier note that this was not possible was wrong. |
| Client portal | approved reports only | approved reports only and only when `report_qaqc_approved = 1` |
| Seed clash | four Stage 1 rows were all called "General" | stored as GEN-1..GEN-4 |
| New | | `GET /audit-reports/context/:rowId` (stage guess, booked standards, existing reports) for the create screen and Postman |
| New | | SQL adds the permission `report-approve` (module 54, audit-report) |
| New | | `POSTMAN_GUIDE.md` and the Postman collection |

Tested against a copy of your database (MySQL 8.0): create, edit, bulk save, NC creation, submit, return, approve, final PDF, reopen, client portal and the access rules, for a Stage 1 audit (row 545) and a Surveillance audit (row 594). In that test the NC module and mail service were replaced by small stand-ins, and PDFs were printed with a different engine (no Chromium in the test environment), so please run one report on your server with Chromium to confirm the PDF.

# ISO 14001:2026 (2026-11-03)

| Area | Change |
|---|---|
| Clause library | `seed/iso14001.seed.ts`: 25 readiness rows (Stage 1), 31 clause rows, 10 environmental-performance rows, risk, interested-party feedback / incidents, 6 statutory rows — from the two Form 04-2b Word files in `samples/`. Every row carries the "C" wording. Seeded under standard 33 by `migrations/005_iso14001_templates_and_clauses.sql`. |
| Seed endpoint | `POST /audit-reports/clause-library/seed/:key` (iso9001, iso14001) replaces the 9001-only route (old URL still works). |
| Templates | 4 `report_templates` rows for standard 33 (Form 04-2b, Issue 01, Rev 00) pointing at the shared Stage 1 / Stage 2 layout files. |
| Wording | New `report.standards.ts`: per-standard profile (categories, objective/criteria, audit brief, conclusion, section titles, interview line, attachments). `defaultSectionBody()` moved there. `form-04-2-stage2.hbs` and `report-docx.service.ts` read `vm.labels` instead of hard-coded QMS text; ISO 9001 output is unchanged. |
| Attachments | ISO 14001 adds the "MANDATORY DOCUMENTED INFORMATION VERIFIED" block (heading row + 15 tick items, keys m1..m15); editor and print handle heading rows. |
| Other standards | Standards without a profile now print neutral "management system" wording instead of QMS text. |
| Design (same day, later) | The ISO 14001 form is printed in the GREEN design of the sample Word files, not the blue 9001 design: `ReportTheme` on each profile in `report.standards.ts` (bars / header rows / label cells 3A7C22, clause headings 1F3864, title 007700, Form 04-2b document box 331430) and the green environmental cover picture `templates/cover-14001.jpg` (taken from the sample) with "FINAL AUDIT REPORT", company, standard and report no. placed over it. Both `.hbs` templates use CSS variables from `vm.theme`; `report-docx.service.ts` reads `this.T` (set per build). ISO 9001 keeps the blue theme unchanged. The sample's single blue bar on section 9 was treated as an oversight and printed green. |
| Stage 2 form details (same day) | Per-profile `audit_type_boxes` (ISO 14001 Stage 1: "Initial Certification — Stage 1"; Stage 2 form: Stage 2 (Initial) / Surveillance 1 / Surveillance 2 / Recertification, `extras.surveillance_no` = 1 or 2 chosen in the Conclusion panel), `form_subtitle`, and `finding_components` (the fixed 11-row "Category of Audit Findings" table of the 14001 form, counts matched by clause prefix, always printed). Sections 10–13 rows of ISO 14001 start with the "Doc. Ref. / Rev. / Date" line (`migrations/006`). The Word file now prints the interview row of section 10 for every standard (it was in the 9001 Word form but missing from the export). |

# IMS — ISO 9001 + ISO 14001 + ISO 45001 (2026-11-03)

| Area | Change |
|---|---|
| When it applies | A COMBINED report (standard_id 0) of an audit booked for two or more of ISO 9001 / 14001 / 45001, or a report on the umbrella standard "ISO 9001, 14001 & 45001" (standards.id 1). Single-standard reports keep their own form. The combined report used to concatenate each standard's list with the 9001 wording; it now prints the IMS form. |
| Clause library | `seed/ims.seed.ts` from `samples/IMS_Stage1 _Audit Report.docx` and `IMS_Stage2_Surveillance_Recert_Report final.docx`: 31 readiness rows (common / 9001 / 14001 / 45001 / general groups), 39 clause rows, 13 core-element rows, risk, customer feedback, 6 statutory. Clause numbers that appear twice (6.1.2 EMS / OH&S, 8.2, 9.1.2 …) carry a code suffix and print the plain number. Seeded under standard 1 by `migrations/007_ims_templates_and_clauses.sql` (applied); endpoint key `ims`. |
| Routing | `report.standards.ts`: profile `library_standard_id` (1) — `create()` loads that list and resolves the template rows of standard 1 for the combined report. 4 `report_templates` rows for standard 1 (Form 04-2a, Rev 04 / 04-1). |
| Wording | IMS profile: categories, objective / criteria / conclusion with a `{STANDARDS}` placeholder filled from the covered standards ("ISO 9001:2015, ISO 14001:2026 and ISO 45001:2018"), section 10 "core elements verification (QMS / EMS / OH&S)", 7 interview roles, 15-row Category of Audit Findings table. Title "INTEGRATED MANAGEMENT SYSTEM (IMS) AUDIT REPORT" + standards line, document box "Integrated Management System (A, B & C)". |
| Design | `THEME_IMS`: light-blue fills C1E4F5 with dark text (new `primary_text` on every theme), clause headings 1F3864, document box 331430. Cover `templates/cover-ims.jpg` + `crest-cover.png` from the sample with FINAL AUDIT REPORT, company, three coloured standard columns (QMS 404F8E / EMS 3E5E2F / OH&S D75C2D), "THIRD-PARTY INTEGRATED MANAGEMENT SYSTEM AUDIT REPORT", report no. and the white bottom band text. Stage 1 HTML table prints group heading rows when the list has several groups. Cover section bottom margin reduced (needed for the band text; the other covers end far above it). |

# ISO 45001:2018 (2026-11-03)

| Area | Change |
|---|---|
| Clause library | `seed/iso45001.seed.ts` from `samples/ISO 45001_Stage1_Audit_Report.docx` and `ISO_45001_2018_Stage2_Surveillance_Recert_Report.docx`: 28 readiness rows, 30 clause rows, 8 OH&S performance rows, hazard/risk row, incidents & near-misses row, 6 statutory rows, each with its "C" wording. Seeded under standard 6 by `migrations/008_iso45001_templates_and_clauses.sql` (applied); endpoint key `iso45001`. |
| Templates | 4 `report_templates` rows for standard 6 (Form 04-2a, Rev 04 / 04-1) on the shared layout files. |
| Wording | `ISO45001` profile: OHSMS categories, objective / criteria / conclusion, section 10 "OH&S performance verification", section 11 "Hazard identification & risk management" (new optional label `risk_title`), section 12 "Incidents, near misses & ill-health", 12-row Category of Audit Findings table, HSE interview roles, OH&S audit-brief line. |
| Design | `THEME_ORANGE`: fills FF9966 with white text, clause headings 1F3864, orange title / brand BF4E14, cover `templates/cover-45001.jpg` with "FINAL AUDIT REPORT", company and a two-tone "ISO 45001:2018" (new optional `std_color2`). |
| Existing data | Report 34 (surveillance, standard 6) was created with borrowed 9001 clause rows; it now prints with the 45001 wording and theme but keeps those rows. Recreate it to get the 45001 clause list. |

# Combined report — remove a standard from the print (2026-11-04)

| Area | Change |
|---|---|
| Create screen | When "Combined audit report — all N standards" is chosen, a third dropdown "Standards shown on the report" lets the auditor remove a booked standard (chips with ✕ / restore). At least two must stay. Sent as `exclude_standard_ids` on `POST /audit-reports`. |
| Editor | Combined reports get a "Standards shown on the report" card at the top of the Details panel (same dropdown + chips); saved with the Details button as `extras.hidden_standards` through `PATCH /audit-reports/:id/header`. At least one must stay. |
| Storage | `extras_json.hidden_standards` = standards.id values left off the print. `crm_json.all_standards` now carries `id`; new `crm_json.booked_standards` keeps every booked standard so hidden ones can be restored later. Reports created before this date have no ids, so the editor card does not appear for them (recreate the report to get it). |
| Print | `buildViewModel()` drops hidden standards from the cover (incl. IMS columns), title / document box, `meta.standard_name` and the `{STANDARDS}` wording. The FORM stays the one the report was created with (IMS list is not changed); clause rows are untouched. `refreshFromCrm()` keeps the hidden list. |

# IMS audit brief (2026-11-04)

| Area | Change |
|---|---|
| Narrative → Audit brief | The IMS profile now uses `BRIEF_AREAS` (the ten focus-area paragraphs, same as ISO 9001) after the two intro paragraphs and the two "Work …" lines. Stage 1 keeps the short Stage 1 closing line instead, as before. Existing combined drafts whose brief still equalled the old short default were updated in place. |

# ISO 14001 and IMS — cover line and findings table (2026-11-05)

| Area | Change |
|---|---|
| Cover | The horizontal line printed between "FINAL AUDIT REPORT" and the company name came from the cover pictures themselves. It was painted out of `templates/cover-14001.jpg` and `templates/cover-ims.jpg` (rows blended from the background above and below). Word, PDF and HTML preview all use these pictures, so no code changed. ISO 45001 cover (orange line) untouched. |
| Category of Audit Findings | ISO 14001 and IMS profiles now have `finding_components: null`, i.e. the table is built like ISO 9001: one row per clause that has a raised finding, with Major / Minor / Observation counts and totals, and the table is hidden when no finding was raised. ISO 45001 keeps its fixed component list. |

# Cover — standard only, no system title (2026-11-05)

| Area | Change |
|---|---|
| ISO 14001 cover | "ENVIRONMENTAL MANAGEMENT SYSTEM" was part of `templates/cover-14001.jpg`; painted out, so the cover shows only "ISO 14001:…" under the company name. |
| IMS cover | `THEME_IMS.cover.show_sub = false`: the three columns print only the standard names; the system-name row under them is skipped in Word (`report-docx.service.ts`) and in the HTML preview (both .hbs forms). `show_sub` now governs the IMS column row as well as the single-standard sub line. |

# IMS cover — bottom band text (2026-11-05)

| Area | Change |
|---|---|
| IMS cover | "QUALITY REGISTRAR SYSTEMS / U.A.E / qrsyst.com" moved up (Word 263 / 269 / 274 mm, HTML preview 267 / 273 / 278 mm). LibreOffice prints the cover lines ~4 mm below the coded value, so U.A.E was cut by the picture's bottom edge (285 mm) and qrsyst.com fell off the picture. |

# ISO 14001:2015 (2026-11-10)

From the two new Word files in `samples/` (`ISO14001_2015_Stage1_Audit_Report.docx`, `ISO14001_2015_Stage2_Surveillance_Recert_Report.docx`). Nothing existing was removed; ISO 14001:2026 (std 33) is unchanged.

| Area | Change |
|---|---|
| Standard | ISO 14001:2015 = `standards.id` 5 (479+ bookings). Before this it borrowed the 2026 wording and had no clause list. |
| Clause library | `seed/iso14001-2015.seed.ts` (set key `iso14001_2015`): 24 Stage 1 readiness rows + 30 clause rows + 18 rows for sections 10–13, requirement wording copied verbatim from the Word files. 2015 vs 2026: no 6.1.5 / 6.3; 6.1.1 holds risks & opportunities, 6.1.4 = planning action; 6.2.1/6.2.2 and 9.2.1/9.2.2 split; single 9.3; 10.3 added. Section 10 rows PERF-3/5/6 renamed (outsourced processes / R&O register 6.1.1 / control of planned & unintended changes 8.1). The Word files leave evidence blank, so `default_evidence` reuses the 2026 text where the clause matches and new text for 2015-only rows. |
| Templates | migration `009_iso14001_2015_templates_and_clauses.sql`: 4 `report_templates` rows for std 5 (Form 04-2b, Issue 01 Rev 00, 01-08-2026, shared hbs files) + the clause rows. **Must be applied** (or call `POST /audit-reports/clause-library/seed/iso14001_2015 {"standard_id":5}` and insert the 4 template rows). |
| Wording | `report.standards.ts`: profile `ISO14001_2015` = the 14001 profile (same green design, cover, boxes) with the 2015 objective/criteria, section-10 intro and mandatory documented-information list (16 items). Matched by `/14001\s*:\s*2015/` before the generic `/14001/`. Combined reports still use the IMS form. |
| My Audit Reports | new column **Audit Report**: when the report is approved and its final PDF exists it shows **Digital Report**, which opens a popup (`frontend/.../my-audits/DigitalReportModal.tsx`) to download the Word (.docx) and PDF versions (existing `/:id/docx` and `/:id/pdf` endpoints). Other rows show "Not generated yet". |

## 2026-11-11 — Auditor text formatting: bold / italic / underline

The auditor formats any report text from the editor; the Word file, the PDF and the HTML preview all print it.

| Marker | Button / key | Prints as |
|---|---|---|
| `**text**` | **B** / Ctrl+B | bold |
| `*text*` | *I* / Ctrl+I | italic (a single `*` only counts in pairs on one line, so "5 * 3" stays as typed) |
| `__text__` | U / Ctrl+U | underline |
| `• text` | List | bullet |
| combined, e.g. `***text***` | | bold + italic |

- `services/rich-text.util.ts`: runs carry `i` (italic); new `stripRich()` for plain-text copies.
- `services/report-docx.service.ts`: italics in `richParas` + `evidenceTextCell`; new `sectionParas()` prints Objective, Criteria, Organisation brief, Audit brief, Previous NC and Improvement comments formatted (before only Conclusion was). Old approved snapshots without `sections_rich` fall back to the old `paras()`.
- `services/report-builder.service.ts`: `sections.*` plain copy has the markers removed (no literal `**` anywhere).
- `services/report-render.service.ts`: `richRun` Handlebars helper (escaped HTML, `<b>/<i>/<u>`); all three .hbs forms use it, and form-04-2a / form-04-1-stage1 now print the rich sections too (fallback to plain).
- Frontend `panels/richText.ts` (`toggleItalic`, `clearFormatting`, `parseRich`), new `panels/RichPreview.tsx` ("Prints as" live preview + Ctrl shortcuts), `RichTextArea.tsx` and `ClausesPanel.tsx` gained I / U / Clear buttons. Nothing was removed.
- Not formatted on purpose: Header fields (plain CRM fields) and the Raise-NC statement (stored in the NC module, which prints it as plain text elsewhere).

## 2026-11-11 — PDF spacing + clause Enable / Disable

| Area | Change |
|---|---|
| PDF / Word spacing | `report-docx.service.ts`: no forced page break before section 9 (clause findings) and section 10 (performance) — they left half pages blank; clause / performance / risk / feedback / statutory rows no longer `cantSplit` and their minimum height is 400 twips (was 740 / 1000 / 1480 / 920), so a long row continues on the next page (header row repeats) instead of leaving a blank strip; paragraph gaps reduced (narrative 160→80, rich 100→60, evidence 80→40). Report S2-2026-000074 went from 16 to 15 pages. Photo rows still keep `cantSplit`. |
| Clause Enable / Disable | Clauses panel: new **On report** column with an Enabled/Disabled switch per row + **Enable all / Disable all** for the open group. Default = every row enabled. Saved at once as `extras_json.disabled_clauses` (audit_report_clauses ids) via `PATCH /audit-reports/:id/header` — no DB change. `buildViewModel()` drops disabled rows (Word, PDF, HTML preview; a group with every row disabled disappears); `submit()` does not ask for a status on disabled rows; progress counts ignore them. Works for every standard (asked for 14001 / 45001). NCs raised on a disabled clause still print in the Summary of audit (they come from the NC module). Approved reports print from their snapshot, so they are unchanged. |
| ConclusionPanel | no longer sends `disabled_clauses` / `hidden_standards` (its copy of extras could be old and would undo the Clauses / Details panel). |