What we shipped, in plain language.

The administration screen’s token box was discarded on every save, so the column stayed empty and the push endpoint then refused every terminal because a device with no token cannot push. The ingestion path shipped in the Shift Rotation and Rostering release had never carried a punch, and nothing reported it — a device that never pushed and a device whose token was never stored look identical.

A blank token on an edit now means leave it alone, never clear it: the dialog cannot prefill a write-only value, so taken literally, correcting a terminal’s location would have silently revoked its credential and surfaced hours later as a missing shift. The last-seen timestamp is also stamped in the plant’s zone; it had been recorded five and a half hours in the future on Indian sites, which suppressed the silent-device alarm for the length of a shift.

Both ingestion paths resolve a punch to a row in a catalogue that no migration, command or fixture had ever populated — so on a fresh tenant every punch would have been rejected. It stayed invisible for as long as it existed because nothing had ever got far enough to reach the lookup. It is now seeded.

An unusable plant time zone also degraded silently to the system default. Every plant on two tenants was configured with a value that is not a real zone name. That fallback is right for a report, which should render rather than crash, and wrong for ingestion — a punch is a permanent fact, and storing one against a plant whose zone cannot be resolved means it can never afterwards be proved right. Ingestion now refuses by name.

Administrators: check that every plant’s time zone is a real zone name (for example Asia/Kolkata) before registering an agent.

Nothing had ever triggered time evaluation. It was reachable only by a person pressing a button on a screen most tenants never open. Ingestion is deliberately inert — writing down a fact never derives a conclusion — so punches accumulated and no register, exception or overtime proposal was ever produced. A rolling three-day window is now re-derived on a schedule, per tenant.

A dead agent runs on a machine in the customer’s network that nobody here can log in to, and a monitoring screen only answers the question for whoever opens it — which nobody does on the day it matters. A daily sweep asks across every tenant and mails the result. A tenant that is behind on its upgrade is reported as such with its fix, rather than mailed as “agent down” twice a day until people stop reading.

A new Time › Integrations screen carries the silent-agent banner, status, credential rotation, the held-punch worklist, batch history and the employee mappings. On production the evaluation runs every six hours, which assumes nothing about a customer’s shift times and derives a conventional night shift within fifteen minutes of it ending.

The device-shaped push endpoint is promoted into an agent-shaped contract: a credential that is hashed rather than stored, a source transaction id with a database constraint behind it, a batch audit row, an employee mapping table, and a rejection that is kept rather than counted.

A rejection is a row carrying the whole original payload. That is what makes the agent’s checkpoint honest: it may move past a punch we refused only because we are holding it. Counting and discarding forces the agent either to stall on one bad row or to lose it. Held punches appear on a worklist with Replay, Ignore and Add mapping.

A punch travels as plant-local wall clock plus a named zone. A timestamp carrying its own offset is refused, and a declared zone that disagrees with the plant refuses the whole batch and stores nothing — converting would move every punch onto the wrong roster day and nothing downstream would report it. The zones are compared by resolved offset rather than by spelling, and probed twice in the year, so two zones that agree in one season and diverge in the other are caught now rather than in June.

A credential rotation keeps the previous secret alive for seven days, because revoking on rotation means the agent is dead from the button press until somebody has driven to the site. A repeated batch returns the stored result and re-processes nothing. An enrolment number gets reissued, so the employee mapping is date-effective — without that window a leaver’s punches silently become a new joiner’s, retrospectively.

Extraction returns the currency as a three-letter code and nothing ever mapped it to a currency record, so posting failed outright. The code is now resolved, and the posting path walks a ladder of authority — document, purchase order, vendor master, company — refusing by name rather than quietly defaulting.

The tax code picker offered every configuration in the tenant: roughly 300 codes across eleven companies in both directions under near-identical labels, and picking another company’s code reached for an input-tax account that was never configured there. Both pickers now scope to the company and to input tax, the invoice’s company is the vendor’s company rather than the first one in the tenant, and a mismatched code is refused by name before the generic accounting error appears.

Exceptions could not be worked at all: an active vendor was compared against a status spelling no tenant stores, so every active vendor raised a vendor mismatch nobody could ever clear, and a document in exception could never be re-validated.

Clicking the exceptions cell now opens a correction dialog that edits the data and the GL coding in place and re-validates, resolving only the exceptions whose check actually passes. What gates correcting is the accounting record, not the approval step — an invoice can sit approved with exceptions open, and refusing to correct it there was the dead end. Re-checking a late correction does not demote a document an approver has already signed.

Simulate shows the journal the invoice would post, through the same engine the manual invoice screen uses. The invoice is built in memory and saved separately, so the preview is produced by the code that does the posting and cannot drift from it — and the preview’s blockers are the posting’s refusals, in the same words.

The vendor’s balance was computed as the total of the aging buckets. That answers what is open and how old is it, not what is this vendor’s balance, and the two agree only while the ledger holds nothing the buckets cannot see: an opening balance is not a transaction, an invoice with no due date is skipped outright, an unallocated payment or advance has no bucket at all, and a posted adjustment note that reduced the payable in the general ledger was invisible in the balance.

Separately, the statement’s running balance left TDS out, so the card and the last row of the grid disagreed by exactly the tax withheld.

Both now accumulate opening plus credits less debits less TDS, so the card and the bottom of the statement are the same figure by construction. The buckets stay what they always were: an aging of what is still open.

A negative closing balance is now possible and correct — it is a vendor sitting in advance, which a bucket total could not express. The KPI row reconciles too: TDS, debit-note and credit-note cards appear when non-zero, and Total Payment counts payments and advances rather than every debit.

Administrators: rebuild_vendor_ledger_balances recomputes the stored values per tenant, reporting by default. On one tenant it corrected 53 closing balances, 33 of which revealed vendor advances nobody could see.

The approvals list exempted administrators and handed them every approval in the system. The dashboard count and the tasks sidebar both read that list, so an administrator saw other people’s approvals presented as their own work and could only find out otherwise by pressing Approve and being refused. Maker-checker working correctly looked like a broken permission.

The queue is now scoped to the caller for everyone. Organisation-wide oversight is not lost — it lives on the workflow instances screen, which is what the administration page actually reads. Every row now also states whether you may act on it, and Approve, Reject and Return are disabled with a tooltip saying why when you may not.

Approval authority in this engine is maker-checker: only the person an approval is assigned to may act on it, and whoever submitted the document is excluded from being resolved as its approver. Delegation offered two ways around that, both now closed by one shared rule.

• The delegate action rewrote the assignment with no checks at all, so anyone who could load an approval could route it to themselves and then approve it. It now refuses a non-holder, a self-delegation, and delegating to the submitter.
• A standing delegation was never checked against the submitter, so a delegation pointing at the person who raised the document handed the approval straight back to them at assignment time. Such a delegation is now dropped with a warning and the approval stays with the original approver, who is a valid checker.

The money columns are renamed to plain Debit and Credit, with Debit placed first, in the reading order of a statement.

The single combined foreign-currency column becomes two. It held whichever side had a value, so it could not say which way a document moved the balance without the reader looking across at the rupee columns. Both sides are now real fields, which is also what keeps the Excel export right.

Columns can be picked, dragged and resized, and the result saved as a named layout, set as your default, reset or deleted. Every such choice previously died with the page.

The control is now one button rather than a name field beside a button: its label is the layout in force and its menu carries the picker above the actions. It sits in the tab strip, so it costs no vertical space at all. The same control is applied to the Tasks worksheet, which keeps its unsaved-edits guard.

Two different documents were being written under one label: a debit note from the vendor, which increases the payable, and a debit note we raise on the vendor, which reduces it. The ledger chose its branch from the label, so an AP debit note took the payable branch, found nothing on the side it looked at, and stored an outstanding amount of zero.

That failed every “is anything open” test in the product, so a posted note with its journal already in the ledger could not be seen, aged or settled anywhere — absent from the vendor open items, from the ledger’s Outstanding tab and from the payment screen.

The side the amount actually sits on now decides, everywhere the label used to stand in for it: the ledger row, the aging buckets, open items, outstanding invoices and the four payable figures on the AP dashboard. No closing balance moves.

An invoice’s paid status was decided from allocations and adjustments but not TDS — the third thing that settles a vendor invoice. Paying the whole of what was actually owed on an invoice with tax withheld still stamped it partially paid, while the outstanding amount stored underneath it was correctly zero.

Only the label was wrong, which is why worklists behaved correctly throughout. A repair command re-stamps the invoices already recorded — 174 on one tenant.

The payment screen was fed by a list of invoices and had no concept of a credit, so an unadjusted advance or a posted adjustment note was money already with the vendor that the screen could warn about but not use. Ticking a credit now applies it: the invoices are relieved by the credits and the cash together, and the bank sends the difference.

Credits are applied first, inside the payment’s own transaction. Doing it after the cash leg would let the payment clear an amount the credit had already taken — the exact double payment the warning exists to prevent. The acknowledgement now counts only credits left unapplied, so applying one no longer also demands a tick saying you meant not to.

An adjustment note is not an advance, and that difference is why it needed its own path. An advance sits in Advance to Vendors and applying it reclassifies the payable; a posted AP note has already debited Trade Payables, so applying it must post no journal at all — anything else relieves the payable twice. A note application is therefore a matching record, and a note is not available at all until it is posted.

Three separate errors in the journal writer, each of them fatal, meant the posting had never once completed: the currency was assigned as a plain code where the ledger expects a currency record, the reference was written to a field that does not exist, and the journal lines were created against the wrong field name and without their line numbers.

All three are fixed, the entry’s total is set from the debit side rather than left at zero, and the lines are numbered debits first so the entry reads the way it would be written by hand. Verified end to end on a real run: a balanced journal in the right period, with its posting log recorded.

Three production deploys reported success over a checkout that never moved: a stale local edit made the code update abort, the pipeline carried on regardless, ran the database upgrade against the old code, restarted every service and printed “updated” — a line that was never conditional on the update having worked. Four releases, including a security fix, sat undeployed with no signal anywhere.

The step now refuses instead of silently skipping: a failing command fails the stage, a modified tracked file is a named failure with the file list and the remedy, the checkout must be on the release branch, a diverged checkout is refused rather than quietly merged, and the deployed commit is asserted against the release afterwards. The closing summary now reads the deployed commit and version back off the server instead of asserting what the pipeline intended.

The upload took the first sheet in the workbook, blindly. One real file carried fourteen sheets and position one held a TA sheet for a different, earlier order — which parsed perfectly and named a project that was not the one being uploaded. Sheets are now scored on whether they name a project, carry a planned start date and hold task rows; the best one wins, every task sheet found is offered, and an explicit choice still overrides. A workbook with no task sheet at all is refused by name instead of falling back to sheet one.

The header block was read only below the column headings, only from rows carrying a particular flag, and only from the end-date column. Real files do none of those three reliably, so the whole grid is scanned now, in any column. Labels are matched exactly, then as a phrase inside a longer cell, then by close spelling — and a column heading can never be mistaken for a header label, which is what previously turned the heading row into data and the first task into a heading.

The first heading row is not always the complete one: in that file only the second row named Employee ID and Employee Name, so every task imported unassigned. Columns the first row omits are now filled in from a later one, and columns it does name are never overridden.

When a value really is missing, the message now names what the pass did read and lists the cells it could not match, with their references — so a sheet the parser does not recognise stops looking like a blank cell.

The assignee name reached for a field the list query did not fetch, so every row paid a second database round trip — and when that re-fetch found nothing, the whole list raised an error instead of rendering. Serving a 78-task project now costs four queries.

Department is now a visible column on the task worksheet, and every other field the task list can answer is added alongside it — hidden by default and reachable from the column chooser, so the default sheet stays the width it was.

What that adds: assignment (department, role), the dates the plan actually moved on (revised end, actual start and end), ordering and verification, the scheduling pass’s own output (earliest and latest start and finish, total and free float, weight) and provenance (WBS element, task definition, generation date). The new columns are deliberately read-only: a column that looks editable but is dropped on save is worse than one that plainly is not.

One vendor held a ₹5,00,000 approved advance with nothing allocated, and two open invoices. The manual payment screen showed the invoices and had no concept of a credit at all.

Open credit is now reported on the screen, in two tiers split on currency. A credit in the same currency as a selected invoice could have cleared it, so it is named and totalled and the payment waits on a written acknowledgement — a tick box reading “pay without applying ₹X of open credit”. A credit in any other currency could not have been applied to this payment anyway; it is reported and blocks nothing, because asking for a confirmation on a payment that was never at risk is how confirmations become reflexive.

The rule lives in the endpoint, not only on the screen. It is deliberately soft: an advance is not proof that it belongs to the invoices being paid, and a hard refusal would strand an operator who has no right to apply the credit either. A bypass is stamped on the payment’s own notes naming each credit left unapplied — and nothing is stamped when the box was ticked but no credit was actually open, because that would be a false statement on the document.