v0.10.0 ## Added - IR reports. Blue teams upload incident response reports as PDFs to a dropbox, staff grade them against a rubric, and each team's IR total is kept alongside its uptime and inject scores - An IR settings page for staff. The dropbox opens on a timed window or by hand (hidden, open, closed), can allow one report per team or several, and can carry an example report that blue teams can download while the dropbox is open. A window whose close comes before its open is refused - One IR rubric shared by every report, seeded with Professionalism (40) and Accuracy of attack (60). Changing a line's max points rescales every report already scored against it, and removing a line removes the scores given against it - A blue team IR reports page. A team sees the dropbox state, uploads one PDF per request so a failed file is named on its own, and can retract a report while the dropbox is open and before anyone has graded it. A team sees what it uploaded and when, never its score. While the dropbox is hidden the page learns only that it is hidden, so the schedule is not published early - IR grading for staff. Reports are listed per team with whether each has been reviewed, open beside a PDF preview, and are scored line by line with feedback. A score over a line's max points, or from a grader not on the roster, is refused. A line left out of a save keeps its previous score - IR scores for staff, per report and per team total. They are staff only, like inject scores. No blue team or public route returns them - `POST /api/scores/recalculate` rebuilds every team's cached uptime, inject and IR totals from the rows behind them. The cache has several writers, and this puts it right without working out which one missed - Uploads are checked to be PDFs, and every route except bulk import stops reading a body past 26 MB instead of buffering it whole. The 25 MB document cap is now enforced before the upload is read, not after - The frontend sends you to the login page when any API call returns 401 - IR requests in the Bruno collection, under "blue team actions/ir" and "admin actions/ir" ## Changed - Graders are shared between injects and IR reports. The routes moved from `/api/injects/graders` to `/api/graders`, which breaks any existing caller. The Bruno requests moved to "admin actions/graders" - The inject submission review page and the IR review page use one shared review form - `Team_Score_Current` holds `uptime_score`, `injects_score` and `ir_reports_score`. The cumulative `passed_checks` and `failed_checks` columns are gone, since nothing read them and `Round_Scores` keeps the per-round counts. Each scoring category writes only its own column, so finishing a round can no longer reset a graded score - The round broadcast's scores use `uptime_score` in place of `score`. The bundled scoreboards are updated, and any other consumer has to follow - Creating an inject template requires `sort_order`, and a negative one is refused - Bulk settings import requires ADMIN instead of BLACK - Schema changes for an existing database, which `setup_db.go` does not touch: `Inject_Graders` renamed to `Graders`, the `inject_access_type` enum renamed to `access_type`, the `Team_Score_Current` columns above, and the new `IR_Config`, `IR_Rubric_Items`, `IR_Submissions`, `IR_Document_Submissions`, `IR_Reviewed_Submissions` and `IR_Submission_Scored_Items` tables ## Fixed - `Inject_Template_Documents.template_uuid` and `Inject_Document_Submissions.submission_id` are now unique, so a template or submission cannot end up with two documents - The timed and manual inject access tables were created without an error check, so a failure there went unreported during setup