What we shipped, in plain language.

Ties are the rule, not the exception — a journal puts every one of its legs on the same day by definition. On one tenant, 751 of 1,152 vendor rows, 2,320 of 2,637 customer rows and 31,638 of 32,888 GL lines share a posting date with a sibling.

Where the balance is accumulated in one order and the rows are shown in another, a run of credits appears to shrink the payable. The accumulation order is now stamped on each row and the Posting Date column sorts by it outright — which also settles the rows whose displayed date falls back to the document date.

Under any other sort the balance genuinely cannot chain, so it is greyed and italicised with a tooltip saying why. Greyed, not blanked: it is still that row’s own true balance. The Excel export cannot carry a tooltip, so it is always written in statement order with a header line saying the file does not follow the screen.

A balance accumulated in floating point lands a settled row a hair above zero rather than on it, which painted it as still owed. It is now compared against half a paisa.

Short Permission is counted in hours. Applying for it through the day-leave screen was written down as a day request, sent for approval, and refused only at the point of deduction — correct, and far too late: the request is a dead end whose only exits are Reject or Cancel, and the approver is told about a quota block that was never supposed to exist.

Nothing stopped it because the type appeared in the day-leave dropdown and neither day-granular entry path checked the unit. Both dropdowns now exclude hours types, and both entry paths refuse by name — naming the Permission screen rather than talking about quota blocks. The deduction-time refusal stays as the last rung, for a row written before this change.

A sales order BOM is one structure per manufactured material, not one per order line. Generating only the line’s own level left the fabric — two levels down, under the stitched garment and the cut panel — outside the order entirely, so nothing planned, costed or procured it.

The explosion now walks down through every manufactured component. A manufactured component with no structure behind it is reported, never swallowed, and an active BOM that happens to hold no components is named in a warnings list rather than producing an empty structure under a success message.

Two things that made this look broken when the walk was actually right: an order generated before multi-level explosion existed answered “already exists” and did nothing — Generate now fills in the missing sub-levels — and with all three levels present the list was ordered newest-first, so the sub-levels filled the first page and their finished good sat on page two. A tree is now contiguous and starts at its finished good.

Anything that totals a sales order now counts top-level structures only — the budget conversion above all, or the garment is charged two or three times over.

The Invoices, Planned Orders, Put-Away, Goods Issue to Cost Centre and Purchase Order grids now page, sort, search and filter on the server, and export the whole result set rather than the page on screen.

Where a component material has an unambiguous variant of its own matching the parent’s attributes, the requirement is now planned against that variant — so a size grid and a colour assortment plan per colour and size rather than in bulk. Everywhere the match is ambiguous the behaviour is exactly what it was.

The form has a guard that clears the selection when the customer or currency changes, so a choice made for one customer cannot leak into the next. On an edit screen the form mounts empty and the receipt loads a moment later — which the guard read as a change of customer, and it wiped the selection the loader had just restored.

The display was only half of it. The save then sent an empty allocation, which is taken as an instruction to delete the rows outright — so a save from the edit screen destroyed them, with nothing recording what the allocation had been, and the receipt afterwards settled the oldest open items in turn instead of the invoices the operator chose.

The loader now stamps the record’s own customer and currency before the guard sees them. The cross-customer protection is unchanged: changing customer or currency in edit mode still clears the selection.

A Gantt chart is a split pane, and the stylesheet for the splitter was never loaded, so both halves rendered full width and stacked — the chart landing on top of whatever followed it, and worse the more activities there were. The chart also sizes to its row count now, rather than leaving three bars above 300px of empty timeline.

Leaving the activity code empty now allocates one per project: multiples of ten, four digits, so 0015 can still be inserted by hand between 0010 and 0020. The maximum is read as a number, never as text, and a code that has been used and deleted is never reissued.

Three unlinked three-day activities with one person on all three all started on day one and asked that person for twelve hours a day against a capacity of eight. Nothing said so.

Capacity is now two separate acts. Conflicts are reported on every run and on page load; levelling moves work, and only when the project is set to. That choice is stored on the project and applied by one switch that schedules and saves — as a preview-then-commit pair a refresh lost it, and as a per-run flag the next plain run silently un-levelled the plan and restored an over-allocation nobody had chosen to accept.

Levelling adds real dependencies rather than just moving dates, so float and the critical chain stay meaningful; it never moves a pinned activity; and zero capacity on file means “nothing to compare”, never “no hours”.

Why nobody had ever seen an over-allocation: adding a person through Project People created their row with zero capacity, a rule meant for external contacts. Only external kinds are zeroed now, and capacity is editable for the first time, from a column on the Project People page. Existing employee rows already stored at zero are not repaired automatically — audit them.

An advance applied to an invoice used to be silently detached when the payment was reversed, leaving its journal standing. The invoice reopened in the sub-ledger while the general ledger still showed the payable relieved.

The application is now unwound properly, and a give-back that cannot post abandons the whole reversal rather than deleting a row against a live journal.

The Bank Book is the bank account’s ledger read by posting date, so a July payment reversed in September showed the cash gone for two months that the bank statement never lost — and no reconciliation in between could close.

Each contra now mirrors its own original’s date, so an advance paid in July and applied in August produces two contras on two dates. A closed period is refused by name, never slid forward to today. A dishonoured cheque is the one real later event and states today explicitly.

The payables reversal produced an unlinked contra: a journal that merely happened to be the opposite of another. Nothing then stopped a second contra being posted — which credits the bank all over again — the GL ledger marked neither side, and the Bank Book could not pair them to hide a reversed pair. Both are now linked, and a journal that is already reversed is refused.

TDS reversal had never run once: it filtered on a column the record did not have, so every call failed into a one-line log entry and a reversed payment left its tax standing in the statutory register for ever. The register now carries the payment reference, the original row is marked reversed rather than deleted with a negative mirror booked beside it, and the register nets to zero with both facts still on it. The same missing field is why a payment advice has never shown its per-section TDS breakdown; it does now.

Administrators: run batch_migrate --app fi_ap_core and batch_migrate --app fi_ap per tenant, then set the realized gain and loss accounts per company under Finance › FX Revaluation.

A foreign-currency advance is booked at the payment-date rate and the payable at the invoice-date rate, so applying one moves two different rupee amounts. Posting both legs at a single rate left a residue in Trade Payables that no invoice explained and no allocation ever cleared.

Applying an advance now debits Trade Payables at the invoice’s rate, credits Advance to Vendors at the advance’s rate, and posts the difference to exchange gain or loss — the payables mirror of the customer receipt engine, reading the same configured accounts.

A rate of exactly 1.000000 on a foreign document means “nobody entered one”, not one-to-one. It is refused at entry, which is the only moment it can still be typed correctly, as well as at allocation. A domestic allocation still posts exactly the two legs it always did.

The step that exists to state what is really on the server was reading the hand-maintained frontend version rather than the one the release bot bumps on every merge. It now reports the authoritative version, and the frontend value separately, so any drift between them stays visible instead of silently misreporting the release.

Thirty-one lists across the Project System declared a filter and none of them applied one. Asking for a single project’s activities was accepted, ignored, and answered with the whole tenant — so the Schedule tab drew every project’s activities, and so did Cost, Procurement, Billing, Issues, Meetings and Revenue. Nothing errored, because an ignored filter looks exactly like an empty one.

Until now the only way an activity could be created was the MS Project importer — which refuses a project that already has activities, so the first import was also the last, and a project created on screen could never have a network at all.

The new Network tab adds, edits and deletes activities and relationships beneath the Gantt. The Gantt itself stays read-only: the scheduling columns are engine-owned. Confirming what actually happened and changing the plan are now gated separately, so a technically complete project refuses new scope while still accepting the news that old scope finished. A tenant is no longer limited to one seeded calendar: a new Calendars page maintains them.

The cost plan had no screen either, so a plan line was uncreatable. Since a baseline copies its planned cost from the approved plan, that is why every project reported a budget at completion of ₹0 — and presented it as an answer.

The new Cost Plan tab carries plan versions, a line editor and approval; baselines now carry planned cost and record which plan it came from; and earned value returns a stated absence with a reason where there is no plan, rather than a zero.

The WBS tab only ever had a create path — no edit, no delete, no status change — and even Add was disabled once the project left draft. The backend had supported all of it since the module shipped; nothing reached it.

Every writable field is now editable, including the parent: moving an element re-numbers its sub-tree, and how many elements moved is reported back rather than left for the planner to discover. Nothing is gated by a greyed-out button — the rules live on the server and a refusal is shown verbatim, which is the whole reason it names what is in the way.

Delete needed a guard before it could be offered at all. Removing an element would have left posted cost, open commitments and captured time addressing a work package that no tree shows, because a soft delete does not fire the database’s own protections. Every reference into the element is now counted first, walking the relationships themselves so a new one is covered the day it is added.

Administrators: run setup_rbac after upgrading — the scheduling permission now means “may change the plan”, so re-check who holds it.

A reporting screen over every task in the tenant, with the grid and a pivot over the same rows, lead time and completion type derived consistently in one place, and an Excel export.

Work that was never on the plan can be recorded as such instead of being quietly appended to a project as though it had been scheduled, so the difference between what was planned and what actually happened survives into the report.

Both ingestion paths resolve a punch to a row in a catalogue that no migration, command or fixture had ever populated — so on a fresh tenant every punch would have been rejected. It stayed invisible for as long as it existed because nothing had ever got far enough to reach the lookup. It is now seeded.

An unusable plant time zone also degraded silently to the system default. Every plant on two tenants was configured with a value that is not a real zone name. That fallback is right for a report, which should render rather than crash, and wrong for ingestion — a punch is a permanent fact, and storing one against a plant whose zone cannot be resolved means it can never afterwards be proved right. Ingestion now refuses by name.

Administrators: check that every plant’s time zone is a real zone name (for example Asia/Kolkata) before registering an agent.

The administration screen’s token box was discarded on every save, so the column stayed empty and the push endpoint then refused every terminal because a device with no token cannot push. The ingestion path shipped in the Shift Rotation and Rostering release had never carried a punch, and nothing reported it — a device that never pushed and a device whose token was never stored look identical.

A blank token on an edit now means leave it alone, never clear it: the dialog cannot prefill a write-only value, so taken literally, correcting a terminal’s location would have silently revoked its credential and surfaced hours later as a missing shift. The last-seen timestamp is also stamped in the plant’s zone; it had been recorded five and a half hours in the future on Indian sites, which suppressed the silent-device alarm for the length of a shift.

Nothing had ever triggered time evaluation. It was reachable only by a person pressing a button on a screen most tenants never open. Ingestion is deliberately inert — writing down a fact never derives a conclusion — so punches accumulated and no register, exception or overtime proposal was ever produced. A rolling three-day window is now re-derived on a schedule, per tenant.

A dead agent runs on a machine in the customer’s network that nobody here can log in to, and a monitoring screen only answers the question for whoever opens it — which nobody does on the day it matters. A daily sweep asks across every tenant and mails the result. A tenant that is behind on its upgrade is reported as such with its fix, rather than mailed as “agent down” twice a day until people stop reading.

A new Time › Integrations screen carries the silent-agent banner, status, credential rotation, the held-punch worklist, batch history and the employee mappings. On production the evaluation runs every six hours, which assumes nothing about a customer’s shift times and derives a conventional night shift within fifteen minutes of it ending.

The device-shaped push endpoint is promoted into an agent-shaped contract: a credential that is hashed rather than stored, a source transaction id with a database constraint behind it, a batch audit row, an employee mapping table, and a rejection that is kept rather than counted.

A rejection is a row carrying the whole original payload. That is what makes the agent’s checkpoint honest: it may move past a punch we refused only because we are holding it. Counting and discarding forces the agent either to stall on one bad row or to lose it. Held punches appear on a worklist with Replay, Ignore and Add mapping.

A punch travels as plant-local wall clock plus a named zone. A timestamp carrying its own offset is refused, and a declared zone that disagrees with the plant refuses the whole batch and stores nothing — converting would move every punch onto the wrong roster day and nothing downstream would report it. The zones are compared by resolved offset rather than by spelling, and probed twice in the year, so two zones that agree in one season and diverge in the other are caught now rather than in June.

A credential rotation keeps the previous secret alive for seven days, because revoking on rotation means the agent is dead from the button press until somebody has driven to the site. A repeated batch returns the stored result and re-processes nothing. An enrolment number gets reissued, so the employee mapping is date-effective — without that window a leaver’s punches silently become a new joiner’s, retrospectively.