What we shipped, in plain language.

Table Explorer suppressed credentials, but every employee bank account number, PAN, Aadhaar, UAN and net salary was browsable, filterable and sortable in a generic grid. Thirty-four columns are now redacted.

• Redaction removes filtering, sorting and searching too — otherwise “net pay greater than” is a way of reading a salary without ever displaying it
• The distinctions are drawn carefully: an account number is hidden while the internal link to a bank account row is not, and one person’s net pay is hidden while a payroll run’s total across everybody is not
• A verification status about an identifier stays visible; the identifier itself does not
• An automated sweep now fails the build if any new sensitive-looking column is neither redacted nor explicitly reviewed, so this cannot quietly regress

The audit trail carried tamper-evidence, but nothing was checking it on a schedule. A daily job now verifies the chain for every company and raises an alert on a break, so a tampered audit record is discovered rather than merely discoverable.

Ten scheduled jobs were set to run between 00:30 and 07:00 — hours in which the server is powered off. A job scheduled outside the running hours does not queue and run late; it simply never happens. Recurring task generation, licence usage snapshots, business-network subscription expiry and risk scoring, HR headcount snapshots and workflow delegation expiry had all been silently inactive.

They now run staggered through the early evening, heaviest first so the ones that loop over every company do not contend with each other. Morning-specific jobs are deliberately left where they are.

Inventory Ageing reported stock as Non-Moving under a 180-day policy when nothing on hand was older than 86 days. Two separate faults combined to produce it.

• Every batch of a material was given the material’s aggregate verdict instead of its own. A batch received yesterday inherited a sibling batch’s staleness — and, far worse, a batch never issued at all was reported Fast because some other batch of the same material had just moved. Stagnant stock was hiding behind a sibling.
• Stock that had never been issued was called Non-Moving the moment it aged past the new-stock window, so the Non-Moving threshold you configured never applied to it at all.

Never-issued stock now walks the same ladder with the clock running from receipt — New, then Slow, then Non-Moving beyond your configured threshold. Stock on hand with no receipt on record stays Non-Moving: absence of evidence is not evidence of dead stock.

The Pareto calculation counted a material’s own consumption value before deciding which class it fell into, which pushed every material sitting on a cut down one class. Where a single material was most of the consumption value, that material was graded C and the company was left with no A class at all.

Each material is now graded on the cumulative share of everything ranked above it — the standard convention, where the A cut is the few materials making up the first 80% of value. Ties break consistently, so two runs over unchanged data give the same answer.

“Ageing by Vendor” showed one unnamed group containing everything, for every company. It was reading two master-data fields that nothing in the application ever writes — so they were empty on every material and every batch, everywhere.

The vendor is on the receiving document, so that is where it is now taken from: the purchase order line the goods receipt was posted against, using the earliest receipt so the vendor matches the same receipt the ageing clock already runs from.

• Stock received from your own production is reported as In-house, not as missing data
• Stock that is neither purchased nor produced is left blank rather than guessed at
• Master data still wins wherever anybody populates it, so nothing is lost by filling those fields in later
• The vendor filter read the same empty fields, so choosing a vendor emptied the grid. It now matches what the chart shows — a chart cannot name a vendor the filter beside it cannot find

“Ageing by Product Group” grouped on a hierarchy that is not the one the business means by material group, and which most materials do not carry — so the chart collapsed into a single blank bucket, or left the large majority of rows ungrouped.

It now reports the material group from the material hierarchy, which every material carries. On live data one company went from a single blank group to a named one, and another from 3 groups with 398 of 420 rows blank to 36 groups with none blank.

• A material attached above the material-group level is reported as its own group rather than dropped
• The chart and the grid column are retitled to match
• The separate Product Category filter is unchanged — it deliberately targets the product hierarchy

A new screen under Administrator lets an authorised user browse the application’s own tables: choose a table, choose which columns to show, filter and sort them, page through the rows and export the result.

• Paging, sorting, searching and filtering all happen on the server, so a table with millions of rows opens as quickly as a small one
• Only tables belonging to your own company are browsable — platform-wide tables shared between tenants are never listed
• Sensitive columns such as password hashes and secret keys are removed everywhere they appear, and cannot be filtered, sorted or searched on either

Administrators: the permission is granted to no role by default. Grant View Tables to the roles that should have it after re-seeding roles.

The explorer has no way to edit, insert or delete a row, by design and not merely by hiding the buttons. A table maintenance screen bypasses every validation, posting rule and audit trail the application has.

Where data genuinely needs correcting, that is what the Operations Console and its reviewed, permission-gated commands are for.

The company logo was silently dropped from every PDF the product prints — invoices, orders, notes, statements — and replaced with an invisible placeholder. Nothing failed and nothing was logged; the documents simply came out unbranded.

Logos are now embedded directly into the document, which fixes every commercial document at once without weakening the protection that stops a tenant-edited layout fetching anything it likes from the internet.

Action items can now be owned by anyone on the project roster, not only by an employee — and the transfer routes the task to the right customer contact, vendor contact or employee. The commonest real case, an action on the customer, was previously untrackable.

The minute and the action register now show whose side an owner is on, because an action owed by the customer reads very differently from one owed internally.

A new Project People page holds everyone involved in a project — your own employees plus customer and vendor contacts — and meeting attendance is taken from that roster instead of typing a name and an email address into each minute.

• Names, organisations and email addresses are read live from CRM and vendor master data, so a contact renamed there is renamed on every minute that cites them
• Enrolling people is done in bulk, and offers only the people not already on the roster
• External people are not schedulable: they do not enter capacity planning, the labour roll-up or the project resource count

Record a meeting the way it actually happens: an agenda, who attended, what was discussed, what was decided, and who is doing what by when. The minute is then printed as a PDF and circulated by email to the attendees.

• A meeting does not have to belong to a project — a management review or a vendor call is a first-class record of its own
• Minutes are numbered through the configurable document numbering rules; a company that has not configured a series gets a sensible one automatically
• A minute prints and circulates even where print layouts or an email channel have never been set up
• Circulation that reaches nobody is reported as a failure and leaves the minute where it was, rather than marking it circulated

Administrators: re-seed roles after this upgrade to grant the meeting permissions.

An action item agreed in a meeting can be transferred into Task Management in one step, and from then on the task is the record of progress — the minute keeps the record of what was agreed. Two separately-editable statuses for one piece of work drift within a week, and then nobody can say which is true.

• The transfer reports exactly why any item was not taken — no due date, or an owner with no record to point at — instead of quietly inventing one
• Transferring the same item twice does nothing the second time
• The action item shows the live status of its task

If a later approval step’s role had no active member, the note became stuck: the first approver approved it, the next step went live with nobody able to act on it, and the note stayed in Pending Approval — looking un-approved to the very person who had just approved it — with no way out from inside the application.

• Submission now checks every remaining step up front and refuses, naming the role that needs staffing, while the note can still be corrected
• Notes stranded before this fix can be recovered by an administrator — either re-routed once the role is staffed, keeping the approvals already given, or returned to draft

All 46 Real Estate lists now fetch one page at a time instead of loading every record into the browser, so a portfolio with a long history of payments, leases and inspections opens as quickly as a small one.

• Searching, sorting and filtering are done by the server over the whole list, not over the page on screen
• Excel export writes out everything the filter matches, not the visible page
• Sorting on a column the server cannot order by is no longer offered, instead of being accepted and ignored

The reason list on a debit or credit note now reads in business terms — goods return, price adjustment, additional discount or rebate, quality issue, billing error, short supply, rate difference and order cancellation.

Rent Roll, Lease Expiry, Rent Arrears, Occupancy & Vacancy, Property Income & Expense and Tenant Ledger, each filterable and exportable.

• Occupancy is derived from the leases that are actually running, not from a status field somebody has to remember to update
• Property income is what was received, never what was billed — the two differ by exactly the arrears the Rent Arrears report exists to show

A cash sale is a tax document, so it now prints as a full invoice rather than only as the on-screen till receipt.

• Two layouts from the same document: an A4 tax invoice for the customer and statutory copy, and an 80mm roll for the till printer
• Company header, party details, HSN and tax columns, tax summary and the amount in words
• Every reprint is marked DUPLICATE, so the original copy stays identifiable
• A missing company address, logo or customer address never stops the printout — the cashier is waiting

Simulate shows the journal entry a note would post — which side the payable or receivable lands on, which offset and tax accounts take the counter entry, and whether it balances — straight from the form, before the note is saved, submitted or approved.

• The preview is built by the same engine that does the real posting, so it is the document you will get
• A supplier with no control account, a tax code with no GL account, or a closed period are shown beside the preview as blockers, while the form is still editable
• Nothing is written and no document number is used up — an abandoned preview costs nothing

After the export permission gate shipped, some grids — Sales Orders most visibly — could fail to draw with a scripting error, and row selection or column sorting could stop responding. Which grids misbehaved depended on which screens had been opened first in that session, which is why it looked intermittent and why it behaved differently on a fresh sign-in.

• The gate now applies to each grid individually, instead of altering behaviour shared by every grid in the application
• Where a tenant has withdrawn no export rights, the grid is left completely untouched — a change that takes nothing away should do nothing at all
• Screens no longer load export machinery they never use, so they load lighter

Earnings, allowances, overtime, terminal benefits, deductions, statutory and technical wage types are seeded into every tenant, so compensation plans, income-tax records and payslips can be configured immediately instead of starting from an empty list.

Seeding is keyed on the wage type code, so a re-run changes nothing and an administrator’s edits to an existing wage type are never reverted.

The Inventory Dashboard grouped receipt history by material and stamped that one date on every batch of it. Batch-managed stock therefore reported a single age for every batch:

• On the goods-receipt basis, the material’s earliest ever receipt was applied to everything, so stock received this morning was reported as months old and fell into the wrong ageing bucket
• On the last-receipt basis, one new receipt reset the reported age of all existing stock of that material to zero — hiding genuinely old stock from the slow-moving and write-off reports, which is the dangerous direction

Each batch is now aged from its own history, with the material rollup used only for stock that is not batch-managed. A back-dated report also no longer picks up receipts that had not happened yet.

The report date used to change only the age arithmetic — the quantities were always today’s, so an “as at 30 June” report showed current stock against June ages and could never tie to the stock balance on that date.

• Quantities are now reconstructed for the chosen date by rolling back the movements since, so the report ties to the balance as at that date
• A NEW stock class separates recently-arrived stock from the ageing buckets it would otherwise distort
• Ageing policy — bucket boundaries and the ageing basis — is set per company