# Changelog

## V37
- Added production security bootstrap and secure session cookie handling.
- Added CSRF token framework.
- Added security headers.
- Hardened user and Super Admin login session handling.
- Added central active-license guard foundation with device-status enforcement.
- Hardened payment webhook endpoint with configured HMAC signature validation.
- Improved payment settlement to use plan duration and validate payment amount.
- Added V37 security migration and smoke test.
- Preserved all V36 features as baseline.

## V38 — License Enforcement & Plan Feature Gates
- Added centralized feature gate for OFFLINE, CLOUD, and MULTI_BRANCH.
- Operational APIs now require an active SaaS license.
- CLOUD sync requires a cloud-enabled plan.
- Multi-branch APIs require a multi-branch plan.
- New branch creation enforces licensed branch capacity.
- Protected requests carrying a device ID require that device to be activated on the license.
- Added license enforcement/device last-seen metadata.
- Added license status diagnostic endpoint.
- Renewal and plan-change workflows now use plan duration and synchronize device/branch limits.
- Added V38 migration and QA documentation.

### V38 known gaps
- Existing UI mutating requests still need universal CSRF header integration.
- Payment adapters remain provider-agnostic.
- Offline queued operations still need canonical transaction-service application.
- Real MySQL/MariaDB integration test suite remains required before production rollout.


## V40 — Stabilization, tenant isolation & schema repair
See `V40-CHANGELOG.md`.


## V41 — Sellable release
See `V41-CHANGELOG.md`.