PR

Please note: we will close your PR without comment if you do not check the boxes above and provide ALL requested information.

• Have you followed the contributing guidelines?
• Have you explained what your changes do, and why they add value to the Platform?

---

Promotes develop → stage (owner request: review/merge the open non-draft PRs, then cascade to Stage and Stage Apps for desktop prereleases). After this lands and Release Stage tags the new stage head, a stage → stage-apps PR follows to build the six Electron app prereleases. No stage → master (owner hold since 2026-10-18).

Security / platform

• Node.js 26.11.1 → 26.12.1 security release in .nvmrc, every .deploy/* Dockerfile stage and the workflows (ever-co/ever-gauzy#11317); README Node requirement (ever-co/ever-gauzy#11331)
• sanitize-html 2.18.0 → 2.18.1 (ever-co/ever-gauzy#11315), markdown-it 14.3.2 → 14.3.3 (ever-co/ever-gauzy#11217), both lockfile-only

Fixes

• Statistics: MikroORM task statistics on MySQL/SQLite (ever-co/ever-gauzy#11215); members widget counted each log once per slot (ever-co/ever-gauzy#11211)
• Time Off: policies save with employees as objects or omitted (ever-co/ever-gauzy#11213); clearing a request's document URL removes it (ever-co/ever-gauzy#11312)
• Projects: module updates keep their tasks (ever-co/ever-gauzy#11195); copied task statuses keep todo/in-progress/done (ever-co/ever-gauzy#11196)
• Channels: moving the fallback region in any order (ever-co/ever-gauzy#11205)
• GraphQL: a cursor whose row was deleted resumes at its position (ever-co/ever-gauzy#11207)

Features (UI)

• Project page: comments panel (ever-co/ever-gauzy#11313), activity pagination (ever-co/ever-gauzy#11264), daily activity grid (ever-co/ever-gauzy#11278), task drawer (ever-co/ever-gauzy#11203), board drag and drop (ever-co/ever-gauzy#11200), edit page polish (ever-co/ever-gauzy#11177)
• Goals: objective comments (ever-co/ever-gauzy#11202); employees card grid navigation (ever-co/ever-gauzy#11176)
• CI: egress-audit and uptime allow-list updates (ever-co/ever-gauzy#11175, ever-co/ever-gauzy#11198, ever-co/ever-gauzy#11199)

Checks: no migrations in stage..develop. Each fix PR was reviewed against the five-rule runbook; core specs, type-checks and (for #11211/#11213) a booted API on Postgres were run before merge. Develop Build on c9cc8b13ad6 passed.

🤖 Generated with Claude Code

---

Summary by cubic

Promotes develop to stage with the Node.js 26.12.1 security release, two lockfile-only dependency bumps (sanitize-html, markdown-it), and a set of project/goal features and statistics fixes. No migrations and no stage → master (owner hold); once this lands, a stage → stage-apps PR follows to build the Electron prereleases.

Fixes

• Statistics: MikroORM task statistics return rows on MySQL and SQLite; each time log counts once in the members widget.
• Time Off: policies save when employees come as ids or rows, or are omitted; clearing a request's document URL removes it.
• Projects: module updates without a task list keep their tasks; copied task statuses keep the todo/in-progress/done flags.
• Channels: the fallback region can move to any position in the set.
• GraphQL: a cursor whose row was deleted resumes at its position instead of restarting or answering an empty page.

New Features

• Project page: comments panel, activity pagination, a daily activity year grid, a task drawer, board drag and drop, and a redesigned edit form.
• Goals: objective comments with threads; the employees card grid opens the profile view.
• Docs: the Documents panel takes multiple files and drag-and-drop uploads, and the attach dialog supports multi-select.