Release Notes

Hardware integrations
ONEPROOF LINK mobile ID — Direct in-process x86 DLL integration (LinkReaderService, MobileIdResult, FormMobileIdScan). Feeds mDL scans into the existing age-verification pipeline with full ISO 18013-5 field mapping and portrait handling. Superseded the earlier WPF bridge (kept under OneProofBridge/ for reference).
WiseScan600 + DocumentWriter — New wsdef.cs wrapper, SDK DLLs shipped under ExternalDlls/wisescandlls/ (including the wScanner_15-10-24_4max.icm calibration file), and MainForm wiring for the forensic motorized scanner. Multiple follow-up fixes for race conditions, resource leaks, and shutdown hangs.
M500 — Init refactored to match SDK demo (device info, ordering, timing) after NRE investigation.
Entra authentication
Config-driven auth profile loader (Hardcoded/ConfigFile/Registry) with active-profile selection.
Multi-tenant Entra profile — Hardcoded multi-tenant profile uses the /common authority and the multi-tenant Scanner-API client; both registrations have signInAudience: AzureADMultipleOrgs. Customer onboarding is a documented two-step admin consent (EntraOnboarding.BuildTwoStepConsentUrls): API resource SP first, then client app SP — single-step client consent reliably fails with AADSTS650052 in practice.
App-level session timeout — Strict-on-app-launch policy: cached MSAL tokens do not extend the application session; only proof-of-presence interactive login (EntraSessionGuard.RecordInteractiveLogin) resets the timer.
JWT role parsing fix — GetTokenRoles/TokenHasRole previously decoded the JWT payload with Convert.FromBase64String, which doesn't accept the base64url alphabet. Empty catch swallowed the resulting FormatException, so roles came back empty whenever the encoded payload contained -/_. Cross-tenant access tokens are larger and hit this case more often, surfacing as "Scanner.AdminUser isn't coming through for guest-tenant users". Replaced with a shared DecodeJwtSegment helper.
BasicUser pincode gate — form3x3Pad refuses access to pincode-protected settings when the signed-in Entra user only carries Scanner.BasicUser, with an explicit "elevated privileges required" message instead of letting them through. Re-login after a session timeout uses the same flow and copy as initial sign-in.
Unified Entra session across Scanner-API and Sync Unity, sharing the MSAL account so Scanner-API isn't collaterally signed out when Sync state changes.
Sync Entra login is now scoped to Unity mode only — Direct-only users never see the MSAL prompt on startup or from Test. CheckLogin lazily acquires the token when a Unity branch is about to run.
SendSyncData auto-reloads the UnitySync token after a configurable send-failure threshold to recover from silently-stale tokens without a full re-login.
Sign-in UX: login-success popup exposes "Sign in as a different account" / "Sign out" via a click-anywhere-on-popup menu; FormServerSettings has a "Sign Out of Sync" button and an "Enter Enrollment Code" flow that pulls login details from the enrollment service (matching the Android client). All user-facing "Sync Unity" strings renamed to "Sync".
Robustness fixes: scan INSERT no longer fails when the Entra token lacks upn/preferred_username/sub claims; soft sign-out invalidates the UnitySync session locally and via /session/close on Direct-login success.
Scan metadata and database
New tracked scan fields — ScanSource, IDType (DB v77), and ScanDurationMs (DB v78) — populated across every scan entry point (PDF417, MRZ, magstripe, mobile ID, manual, photo capture, AssureID, FM420).
DB self-heal: MaxVersion bump, idempotent UpdateDatabaseToVersion78, and EnsureRecentCustomerColumns safety net run both before the MaxVersion early-return and after the dispatch. Covers the stranded-DB case where MaxVersion wasn't bumped alongside a migration.
FormViewScans grid now includes human-readable "Scan Source" and "ID Type" columns (CamelCase split at capitals), with per-scan duration surfaced through the existing SELECT.
Customer.IDType carries [JsonProperty("IdDocumentType")] so the wire format matches the Sync server's DTO (inherited from the Android client); previously the server silently dropped it.
UI and reliability
Bento-style tab themes across all four color schemes, flicker-free MyTabControl with accent underline, GDI+ leak fixes on theme switching.
PopupNotifier toasts for login success and Unity auth failures, last-successful-server-type hint for faster VerifyLogin, per-scan re-probe of server type after sustained network failures.
Assorted crash/leak fixes: image leak on theme switch, UI freeze in DocumentWriter, shutdown hangs when settings change mid-session, WiseScan_DeviceChanged BeginInvoke guarded by IsHandleCreated.
Security: path-traversal validation for SAST findings, broader IDSentryHandler error logging and retry.