4.771.0

Summary

This Release delivers a broad RMS hardening update across records, incident reporting, evidence, disclosures, retention, authorization, and NERIS submission workflows.

What changed

Records and incident reports

• Added support for department-specific custom fields on RMS records and incident reports, including authoring, publishing, projection by permission, storage with version pinning, and inclusion in departmental record views.
• Added the ability to create and link a closed historical Call from a Run draft.
• Improved draft save behavior for restricted content so hidden restricted values are preserved instead of being overwritten by callers without the required permission.
• Added row identity support for editable incident casualty and vehicle rows so hidden restricted rows can be safely retained during edits and reordering.
• Added incident report attachment management with upload, download, removal, scanner enforcement, classification, revision-aware retrieval, and audit coverage.
• Added rich-text narrative support for departmental records with sanitization that allows basic formatting while removing active or unsafe content.

Departmental record output and review

• Added a records document service for rendering immutable departmental revisions as HTML, PDF, CSV, and JSON.
• Added revision comparison support with printable PDF diffs.
• Included custom fields, evidence, and attachments in departmental revision snapshots and document output.
• Added dedicated document views and exports in the web UI for records, incident reports, and incident analyses.

Evidence and inventory

• Expanded evidence capture to enforce live authorization, row-version checks, source validation, and stronger provenance tracking.
• Added evidence selection workflows for web users so source-authorized chat, tracking, certification, and other evidence can be reviewed before capture.
• Added evidence history access for records.
• Added inventory consumption workflows tied to records and incident reports, including optional evidence refresh/capture and audit support.
• Added stronger integrity tracking for evidence capture requests and inventory usage references.

Disclosures

• Expanded disclosures with formal review workflows before production, including per-record, per-field, and per-attachment decisions.
• Added support for reviewed attachment replacements, redaction logging with authority/basis, packet PDF creation, JSON/ZIP download formats, and authorized attachment review during disclosure preparation.
• Added delivery tracking on release, including delivery method and delivery reference.
• Changed disclosure release behavior so unresolved scope items keep the request open instead of silently closing it.
• Added authorization rechecks throughout disclosure reads, production, download, and release.

Retention and legal hold

• Added legal hold management services and UI/API endpoints for placing and releasing holds.
• Added retention policy history so past policy versions can still determine the correct retention period for older revisions.
• Reworked retention purging to use a dedicated purge path that:
  • rechecks holds and policy under lock,
  • removes content from RMS storage,
  • preserves tombstones and audit inventory,
  • tracks pending search-index erasure separately.
• Added durable search-erasure tracking and completion so database purges are only fully acknowledged after committed search index removal.

Search

• Hardened Lucene indexing to avoid stale writes after a record is changed or purged.
• Added committed delete expunging support and durable purge erasure handling.
• Deferred Lucene directory opening until first use so processes can start without requiring the search volume immediately.
• Improved change-feed cursor handling with opaque cursor IDs and scope stamps so clients can detect permission/scope changes and reset caches safely.

Authorization and visibility

• Expanded records authorization services with active-member checks, department admin checks, permission evaluation, source call access checks, inventory source checks, and cache-scope fingerprints.
• Applied active membership and visibility checks more consistently across records, dashboard counts, search, change feeds, attachments, evidence, disclosures, and incident workflows.
• Updated dashboard and queue counts to respect record visibility and current group scope.

NERIS submission hardening

• Added local contract validation for queued NERIS incident and analysis payloads before any outbound request is made.
• Embedded the pinned NERIS OpenAPI contract and introduced schema-based validation plus additional cross-field payload rules.
• Tightened NERIS endpoint handling so environment selection is explicit, sandbox cannot fall back to production, and misconfigured endpoints fail before sending requests.
• Added durable destination identity tracking for submissions.
• Added submission exchange journaling so each outbound attempt, response, and applied outcome is retained.
• Added reconciliation workflows for ambiguous or externally verified submission outcomes, including:
  • reviewing exchange history,
  • binding unsent legacy submissions,
  • reconciling verified destination receipts,
  • confirming verified “not created” outcomes without retrying automatically.
• Prevented automatic create retries when delivery may have succeeded without a usable receipt.

API and idempotency

• Hardened command idempotency with durable reservations and receipts, including pending-state protection so a command cannot be repeated when its outcome is uncertain.
• Added new API endpoints for:
  • record custom fields,
  • record inventory usage,
  • record legal holds,
  • submission reconciliation and exchange history,
  • disclosure review, attachment review, and packet download.
• Added attachment classification support to upload completion APIs.

Infrastructure and workers

• Added migration support for the new RMS hardening data, including command receipts, submission exchanges, custom-field metadata, attachment classification, search erasure tracking, delivery metadata, and related fields.
• Updated workers to resolve services within fresh scopes during execution.
• Improved unit-of-work transaction cleanup so completed or failed transactions do not poison later operations.

Terminology and localization

• Clarified that incident CallArrival means the call arriving at dispatch/PSAP, not first unit on scene.
• Updated the localized CallArrival label across supported languages to reflect that meaning.

Functional impact

These changes make RMS workflows safer and more auditable by preserving immutable revision content, enforcing live authorization at read/write time, preventing unsafe retries or stale overwrites, supporting departmental custom fields and richer disclosures, and strengthening retention, evidence, and NERIS submission handling.