v1.27.0

This release makes the SDAT-CH import strict enough to bill from, and makes a late meter-data correction show up on the invoices it affects instead of passing unnoticed. It also starts a redesign of the interface for consistency, with the tariff screen first. Read Upgrading before you update: production now requires PostgreSQL, and the readings API no longer accepts writes.

SDAT-CH imports you can bill from

Metering → Import history → New Import → SDAT-CH (ebIX XML) now accepts one profile: E66 ValidatedMeteredData, 15-minute active energy in kWh, as .xml or .xml.gz. A file with an unknown meter, a missing interval or a conflicting value is rejected whole, and the protocol names the meter, block and position. Before, such a file imported partly.

A replacement delivery (Status 5) with a newer creation time overwrites the values it names; the same file sent twice changes nothing. Temporary values (condition 21) and information-only deliveries (C38) are held: stored, never billed, and listed under Held observations below the raw readings in Metering → Chart. If a meter reports consumption and feed-in under two IDs, enter the second as Secondary meter ID on the metering point.

Cancellations (Status 1), hourly data and automated exchange are not supported. Check the protocol of your first imports: not every grid operator's files have been tested yet.

Corrections flag invoices instead of changing them

When an import overwrites readings, CSV or SDAT-CH, or readings are deleted in a period that already has invoices, those invoices get a Data review flag naming the delivery or file and the intervals it changed. The invoice itself never changes. The period checklist under Overview gains a Data corrections step.

A draft only needs Regenerate invoice. An issued invoice with payments goes through Correct invoice → Reverse the invoice; one without payments has no button yet and is cancelled through the API (POST /api/v1/invoices/invoices/<id>/cancel/). Then generate the period again. Participants see the flag, not the evidence. Only changes made after the upgrade are tracked, and editing a historical assignment does not flag anything.

A more consistent interface, starting with tariffs

This is the first step of a redesign (#1070, rules in #1015 and ADR 0040): one way to open each kind of task, unsaved input never lost, and labels only where they help. The community setup and import wizards and the invoice labels follow in later releases.

The tariff screen is the pilot. Setup → Tariffs opens a tariff in a pane beside the list, and you view and edit it there; the three edit dialogs are gone. On a narrow screen it replaces the list.

A new tariff can be created with its bands in one step. A dynamic tariff shows its price chart and says when prices are missing for time already passed, before invoice generation stops on them.

The same rules now apply across the app. Closing a dialog with unsaved input asks before discarding it. The slide-in drawers are gone: an audit event opens in a pane beside the log, and missing days open in a dialog. Status pills that said nothing new are gone; real problems read as red or amber text.

Also new

• Record payment is in the More menu of a sent invoice's row under Billing. After a partial payment, Mark Paid reads Mark rest as paid.
• Managers and viewers can search the audit log under Setup → Settings → Audit log.
• The readiness checklist, period overview, energy dashboard, metering-point list, reports and the feasibility calculator's prefill load faster.

Fixes worth knowing about

• An HT/NT tariff billed every hour at HT when its NT band had no time window: those hours fell through to the first band. Such a band now covers every hour the others leave open, shown as all other hours. Issued invoices stay as they are; regenerate affected drafts.
• An admin impersonating a user could create an analytics token or connect an energy data source that outlived the session. This is now refused and logged. Check tokens created since 1.26.0 under Platform → Accounts → Tokens & keys.
• An OAuth sign-in could be completed in a different browser from the one that started it. It is now bound to the starting browser.
• The audit log stored IBAN changes and a few credential fields unmasked. New events mask them; older events are unchanged.

Under the hood

Imports, reading deletions and invoice generation take one lock per community; large SDAT-CH files are written in batches of 1,000 rows. See ADRs 0041 to 0043.

Thanks

Most of this release is the work of @spalinger: the SDAT-CH import, correction flags and held observations, audit search, payments from the row menu, the security fixes and the faster page loads. They also co-wrote the UI patterns spec behind the redesign.

Upgrading

PostgreSQL is now required in production. The lock above works only there. SQLite stays fine for development; MariaDB is no longer supported.

Breaking changes:

• POST, PUT, PATCH and DELETE on the readings API return 405. Write readings through a CSV or SDAT-CH import instead.
• A metering point with billable or held readings, or supplementary energy data, can no longer be deleted, moved to another community or change meter type. To retire one, end its assignment and deactivate it.
• Meter IDs, including secondary IDs, must be unique across the instance.
• OAuth callbacks must keep the path /api/v1/auth/oauth/callback/<slug>/; a proxy that rewrites it breaks sign-in with invalid_state. Sign-ins in progress during the upgrade fail once.

Seven migrations, all additive, no downtime expected:

• metering.0009–0011: reading source fields, held observations, import-protocol counters
• invoices.0029: invoice review flags
• zev.0046, 0047: secondary meter ID and its constraint
• accounts.0031: OAuth browser binding

New optional setting AUDIT_LIST_THROTTLE_RATE (default 60/minute per account). ZEV transfer archives are now format 10; older versions cannot read them.

Full change list

1.27.0 (2026-10-30)

⚠ BREAKING CHANGES

• metering: Metering points with billable, held or supplementary history can no longer be deleted or change community/type. Remove or reconcile the protected history before changing their configuration.

Features

• audit: enable scoped search and repair audit redaction (#1079) (1e5ea9a)
• invoices: record payments from the period row menu (#1084) (f9000e9)
• metering: add SDAT-CH import and invoice correction review (#1083) (1ee04a8)
• metering: surface reading quality and held observations (#1104) (446be58)
• tariffs: a band without a time window prices all other hours (#1118) (25e2b73), closes #1109
• tariffs: create a tariff together with its initial bands (#1119) (712ca8d)
• tariffs: page the fetched-price table in the tariff pane (#1144) (863c6cd)
• tariffs: quieter badges in the tariff pane (#1139) (d0990f2), closes #1133
• tariffs: rework the pane's edit forms and show band hours as text (#1137) (fcd3703)
• tariffs: say that corrections do not recalculate invoices and shorten the VAT note (#1142) (71aedf2), closes #1116
• tariffs: say when a dynamic tariff is missing prices and show its chart (#1129) (5f900a7), closes #1114
• tariffs: tariff split view, the detail-pane pilot (UI patterns phase 1) (#1081) (1dfdf4a)

Bug Fixes

• auth: bind OAuth login state to the initiating browser (#1095) (a7b25af)
• auth: stop impersonation from minting durable credentials (#1094) (14ceb67)
• backups: use a 24-hour time field for the schedule time (#1145) (58e6e4b), closes #1138
• billing: space scope notices inside tab panels (#1087) (aaa83d4)
• frontend: menu focus, scrolling row menus and a modal phone drawer (#1143) (c2723be)
• sdat: bound reading persistence batches (#1093) (b75e527)
• tariffs: duplicating an ended version drops the obsolete end date (#1141) (0f09661)
• ui: give dynamic source tables the shared white surface (#1085) (42c29c0)

Performance Improvements

• reduce metering and invoice page-load times (#1097) (68c9494)
• reduce report, dashboard and feasibility loading work (#1130) (ee6d5cb)