Lagebuch v0.5.0

Attachment handling, PDF export control, more depth in CO-Messung and accessibility —
plus every P0/P1 fix from the 2026-09 architecture, security and performance review (#304).

Added

• Drag and drop attachments onto the Dateien tab (#273)
• Delete an attachment, with a confirmation prompt (#271)
• PDF export: pick which sections go in, with progress and status feedback, and the incident
  remembers where it was last exported to (#269)
• CO-Messung: colour-coded ppm danger severity and a warning on implausible readings (#278)
• CO-Messung: per-floor unit counts and labels (#268)
• CO-Messung: an OG HINZUFÜGEN button to add upper floors (#263)
• A visible ÖFFNEN button on each recent-incidents row (#276)
• Search box on the Links tab, and ÖFFNEN now shows and says that it opens the system browser (#262, #275)
• Accessibility: AutomationProperties labelling and keyboard navigation for the Kräfte flyouts (#283)
• The project logo and slogan (#281)

Changed

• CO-Messung: ABBRECHEN in the Wohnung editor now actually discards. Status, CO-Wert,
  Bezeichnung, Bewohnername and Schlüssel are buffered until FERTIG, so an intermediate or
  mistyped ppm reading no longer lands in the Einsatztagebuch. The tile previews the pending
  state while the sidebar is open. (#242)
• The PIN field on the join screen accepts digits only (#277)
• Removing a unit asks for confirmation first, and Kräfte/Stammdaten explain why a control is
  disabled or a label abbreviated (#257)
• Release notes are generated from this file's section for the tag being built (#261)
• Dependency updates across Avalonia, Microsoft.Data.Sqlite, the SignalR client and the test SDK

Fixed

• Stop a Kraft's Stärke-Historie from duplicating on every save: each save was re-inserting
  the whole edit history on top of what was already on disk, so a file saved N times held N
  copies of every correction. Existing files are deduplicated the next time they are opened. (#279)
• Surface a failed background save (disk full, read-only, locked/corrupt DB) as a persistent
  red banner in the Einsatz workspace instead of silently leaving the incident unsaved (#280)
• Leaving an open Einsatz via the top command bar (ÜBERSICHT, STAMMDATEN, ÖFFNEN, NEUER EINSATZ,
  VERBINDEN) instead of the workspace's own "ZUR STARTSEITE" no longer leaks its subscription to
  the background save-failure store (#280)
• Navigating home no longer leaves the incident workspace running in the background: closing it
  now stops its once-a-second ticker (Atemschutz, Aufgaben, ILS-Erinnerung) and unsubscribes it
  from further changes, and a joined client also drops its host-connection event handlers. (#284)
• Funktionen: the Rolle suggestions now open on focus and on click, not only while typing (#266)
• Kräfte: the Zugführer flag no longer adds a seat on top of the vehicle's own capacity (#264)

Security

• Harden CI workflows: ci.yml now runs with read-only contents permission and enforces
  dotnet format in CI; claude.yml only responds to @claude mentions from repo owners,
  members and collaborators; Dependabot now tracks the Android and acceptance-test projects'
  own Directory.Packages.props files in addition to the root one.
• Attachment names from a joined device can no longer escape the temp directory or smuggle in an
  executable type. A file name is reduced to its last path segment and capped at 255 bytes on the
  way into the domain (and on load, so a name already in a snapshot or file is neutralised too),
  its extension must match the declared file type, ÖFFNEN copies the bytes into a fresh private
  directory under the app's own temp root instead of the shared system temp directory, and the
  desktop launcher refuses anything that is not a regular image or PDF file inside that root. (#285)
• JsonTrustStore now takes its lock for reads too, closing a race where the TLS
  certificate-pin check on a join could read the trusted-thumbprint cache while another
  handshake was writing it; the trust file is also now written via a temp file plus rename, so
  a crash mid-write can no longer leave a corrupt trust.json behind. Joining another device's
  incident no longer has an "accept any certificate" fallback — a trust store is required, so a
  join is always TLS-pinned. (#286)
• Android: the FileProvider now grants access to only its shared/ and lagebuch/
  subdirectories, not the whole cache directory — import.json, picked attachments and the
  synced-attachment cache are no longer reachable through a shared or opened URI. A malicious
  content provider's DISPLAY_NAME for a picked attachment can no longer escape the app's cache
  directory via ../ path traversal; it is now sanitised to a bare file name with a safe fallback. (#303)

Getaggter Release-Build.

Plattform	Datei
Windows	lagebuch-0.5.0-x64.msi
Linux	lagebuch_0.5.0_amd64.deb
Android	lagebuch-0.5.0.apk

Ein macOS-Build (Apple Silicon, .dmg) wird auf Anfrage bereitgestellt und dann hier
angehängt.

Die Pakete sind nicht signiert. Beim ersten Start:

• Windows: SmartScreen → Weitere Informationen → Trotzdem ausführen.
• Linux: sudo dpkg -i lagebuch_*.deb (oder sudo apt install ./lagebuch_*.deb).
• Android: aktiviere einmalig Installation aus unbekannten Quellen für den
  Browser/Dateimanager, mit dem die APK geöffnet wird.
• macOS: Rechtsklick auf Lagebuch.app → Öffnen (einmalig bestätigen),
  oder xattr -dr com.apple.quarantine /Applications/Lagebuch.app.