The HEXL has been separated from the CommonFrame App!

• No changes have been made to the CommonFrame app since v0.55.0
• HEXL app is reachable from menu navbar or https://hexl.cframe.co (original HEXL pages still exist, but only accessible with direct URLs).

Authentication, Sessions & Security

• Fixed login redirect issue so login script properly recognizes successful authentication.
• Added return statement after login redirect to prevent further code execution when client auth is missing despite server-side login status.
• Fixed email verification failure so verification works without time sync issues.
• Removed demo user link from login page.
• Created “log out all users” button for admins to facilitate clean updates.
• Added crosstab persistence to allow users to stay logged in across all browser tabs.
• Added function to proactively clear expired local authentication before server rejection.
• Revamped session management to enforce auto-logout times:
  • Migrated from cookie-based sessions to Redis-backed session storage with automatic filesystem fallback.
  • Sessions are stored with TTL matching user auto-logout preferences.
  • Expired sessions are purged even during downtime.
  • Session expiration time is fixed at login and no longer auto-extends.
  • Missing or invalid expiration timestamps are treated as expired.
• Implemented new Remember Me logic:
  • Checked: authentication stored in localStorage and persists across browser sessions.
  • Unchecked: authentication stored in sessionStorage and cleared when the browser or tab closes.
  • Logout clears both storage locations for security.
  • Existing sessions automatically migrate to the correct storage on the next page load.
• Added logout timestamp display below logout button.
• Added verbose logging for login failures.

Navigation, Layout & Global UI

• Automatically collapsed desktop menu on page load.
• Refactored navbar dropdown behavior for improved accessibility and toggle reliability.
• Auto-collapse navbar when clicking outside of it.
• Disabled auto-collapse for navbar menu on admin pages when in desktop mode.
• Moved username and Logout button into the navbar menu.
• Added Log an Experience button to the top center of all pages except login and /entry.
• Added secondary navigation links to observatory pages.
• Reorganized Citizen Science pages and links to simplify navigation.

Responsive and Mobile UI

• Fixed calendar view on /logbook so it fits within mobile displays.
• Cleaned up Log Calendar mobile view.
• Cleaned up and corrected Sleep data pages to better represent Fitbit-provided data.

Pages, Visualizations & Analytics

• Created Day page to provide at-a-glance daily feedback.
• Created Correllelograph page to show relationships between collected values.
• Added mass correlelograph for users and admins to compare all collected metrics.
• Added basic substance use tracking page at /analytics/substance-tracking.
• Added View Context Events button to Log Calendar.
• Fixed Statistics card on /zk/logbook to correctly reflect selected calendar range.
• Added sleep score averages to Context Events.

Experience Logging & Entry Flow

• Added merger functions to ensure experience logs appear correctly in logbook views.
• Fixed race condition where form submission could occur before sheet initialization.
• Added save healthcheck to explain experience log save failures.
• Moved Stroop test to modal with explicit user consent after experience submission.
• Changed post-entry averages to time-of-day–specific averages using a ±1 hour window with admin controls.
• Added functionality to the Day page to automatically pre-fill experience log with past event date.
• Fixed extreme experience appearance to ensure all text fits nicely inside its card.

Fitbit and Biometric Integrations

• Added automatic Fitbit sleep synchronization on login:
  • Syncs up to 30 days prior or the user account creation date, whichever is shorter.
• Added automatic backfilling of sleep scores for users with 15 or more sleep logs.
• Added automatic 90-day backfill of intraday heart rate data for experience logs.
• Added in-the-moment heart rate capture during experience logging.
• Added heart rate data to the Day page.
• Added sleep score display to Sleep data pages.
• Added post-entry modal for Fitbit users to capture subjective sleep quality.
• Added login notification when Fitbit sleep data syncs.
• Reorganized Fitbit integration settings page and expanded consent logic for intraday data collection.

Data Deletion, Retention & Audit Logging

• Changed experience log deletion to soft-delete using a deleted_at timestamp.
• Added ability for users to undo deletions prior to permanent removal.
• Excluded deleted logs from statistics and removed associated Stroop test data.
• Added logging for manual and automatic experience log deletions.
• Fixed user deletion error.
• Updated account deletion flow to allow soft-delete with nightly permanent deletion.
• Added admin audit logging for account deletions.

Developer Experience & Infrastructure

• Cleaned up application startup messaging.
• Added Postgres schema update notifications.
• Enabled verbose container logging in test environments.
• Disabled verbose container logging in deployed environments.

• Replaced navbar with sidebar.
• Reworked stuff to make it look and function better on narrow displays.

• Added Fitbit total daily steps to user’s data.
• Added total and average steps per day to Context Events.
• Separated internal and context words from description on both user and HEXL navigation pages.
• Guarded the login landing entry query against database connection failures, logging the issue, rolling back the session, and returning no entry when a connection drops unexpectedly.
• Added Fitbit redirect URL environment variable to allow test environment full access to Fitbit functionality.

• Fixed Fitbit sleep data in Postgres to inherit correct fields.