v3.9.7

TaskMate v3.9.7 — a new customization feature plus a wide-ranging audit hardening sweep.

✨ New

• Custom, unlimited time-of-day periods (#393, Closes #391)
  The previous release made the four fixed periods' times editable; now the set of periods itself is editable. From Settings → Time-of-day boundaries in the admin panel you can:

  • Add unlimited periods (e.g. School run, Bedtime) with their own start/end times
  • Rename any period, including the built-in four
  • Pick an icon per period (full MDI icon picker)
  • Delete periods — blocked with a clear message (naming the chores to reassign) while any chore still references one
  • Reset to defaults in one click

  Periods form a non-overlapping sequence sorted by start time (overlaps rejected client- and server-side); gaps fall back to the built-in, all-day, undeletable Anytime. Existing customized times are carried forward automatically via a fallback chain — no migration step. Chore time-category dropdowns across the HA config flow, panel dialogs and the child-card editor are now built dynamically from your period list.

🛡️ Security & hardening (#392)

• Access control: all ten ws_notif_* WebSocket handlers are now admin-gated — previously any authenticated non-admin user could read notification/recipient config, enumerate notify.* services and rewrite routing.
• Service privilege: parent-privileged services (approvals, add/remove points, penalties, bonuses, chore/badge/task-group management, set_chore_order, skip_chore, etc.) now require an admin when invoked with a user context. Automations/scripts (no user context) and child-flow services are unchanged.
• header_color is validated as a hex colour before being interpolated into card <style> blocks (CSS-injection hardening).
• Penalty/Bonus points are clamped non-negative (a negative penalty would otherwise have granted points).
• CI actions pinned to commit SHAs; ruff pinned.

🐛 Correctness fixes (#392)

• Timed tasks: overnight stale-session cleanup no longer throws on a tz-naive/aware mismatch that silently scored the overnight segment 0 points.
• Double awards: a second approval of the same chore completion (mobile double-tap) no longer awards points twice.
• Rejection reversal: streak/last_completion_date only roll back when the rejected completion was the child's sole completion that day.
• Recurrence: monthly / every-3-months / every-6-months now use real calendar months with end-of-month clamping, and quarterly/biannual chores now actually appear on calendars.
• Perfect-week bonus compares against days the child was actually scheduled (weekday-only households could never earn it).
• Front-end double-submit: approve/reject/claim/allocate handlers early-return while a call is in flight (double-click no longer = double points/spend).
• Midnight maintenance tasks run sequentially with per-step logging and a single save; malformed notification templates fall back to raw text; week/streak/graph day-anchors derive from the HA-configured timezone (off-by-one fix); card event-subscription/listener/timer/AudioContext leaks cleaned up.

⚡ Performance (#392)

• Dynamic service descriptions re-register only when selector option sets actually change (was a full deepcopy + re-register every 30s).
• WS state snapshot no longer does an O(n²) per-chore re-scan.
• Graph card redraws only on hass/config/_mode change.

🌐 i18n & CI

• Reworded add_badge/update_badge criteria descriptions so {…} sequences pass the newer hassfest placeholder check (#394).
• Backfilled 11 missing service translation blocks and a missing panel string across all 8 locales; new period editor strings translated for all locales.

📦 Updating

HACS → TaskMate → Redownload → select 3.9.7, then restart Home Assistant. After restart, do a hard refresh (or clear cache) so the updated admin panel JavaScript loads.

Full changelog: v3.9.6...v3.9.7