What we shipped, in plain language.

The Sales Orders list checked three permission names that do not exist, so the check failed for everyone who was not a company administrator. Users who genuinely held the Sales Order permissions — a CRM Manager, for instance — could not see the View, Add or Edit buttons.

The names are corrected. Nothing about what the server allowed ever changed; only the buttons were missing.

The daily audit-chain check reported a company whose database was simply behind on upgrades as a verification failure — the same alarm as an audit trail edited directly in the database. The first production run would have sent a tampering alert for a routine upgrade backlog, and the next real one would have been ignored.

The two are now separate: the backlog case names the upgrade to run and states plainly that it is not a tampering signal, and the alert subject says a chain is broken only when one actually is.

Encrypted fields were implemented three separate times, and all three shared the same set of failures. There is now one implementation, and it closes each of them.

• A value that is not valid ciphertext, or that fails its authentication check, now raises. Previously a detected forgery was returned as though it were the real value — the one outcome worse than an error
• With no key configured the old code stored plaintext; it now refuses
• Each encrypted value is bound to the row it belongs to, so a ciphertext copied from one record into another is rejected instead of decrypting perfectly — verified by running that exact attack against the database
• Keys can now be rotated, which was previously impossible

Nothing stored changes with this release and no field has adopted it yet; this is the foundation the adoption is built on.

The audit trail carried tamper-evidence, but nothing was checking it on a schedule. A daily job now verifies the chain for every company and raises an alert on a break, so a tampered audit record is discovered rather than merely discoverable.

Table Explorer suppressed credentials, but every employee bank account number, PAN, Aadhaar, UAN and net salary was browsable, filterable and sortable in a generic grid. Thirty-four columns are now redacted.

• Redaction removes filtering, sorting and searching too — otherwise “net pay greater than” is a way of reading a salary without ever displaying it
• The distinctions are drawn carefully: an account number is hidden while the internal link to a bank account row is not, and one person’s net pay is hidden while a payroll run’s total across everybody is not
• A verification status about an identifier stays visible; the identifier itself does not
• An automated sweep now fails the build if any new sensitive-looking column is neither redacted nor explicitly reviewed, so this cannot quietly regress

“Ageing by Product Group” grouped on a hierarchy that is not the one the business means by material group, and which most materials do not carry — so the chart collapsed into a single blank bucket, or left the large majority of rows ungrouped.

It now reports the material group from the material hierarchy, which every material carries. On live data one company went from a single blank group to a named one, and another from 3 groups with 398 of 420 rows blank to 36 groups with none blank.

• A material attached above the material-group level is reported as its own group rather than dropped
• The chart and the grid column are retitled to match
• The separate Product Category filter is unchanged — it deliberately targets the product hierarchy

Posting a Service Entry Sheet whose services have no Service Cost Group returned an empty “Server Error” page. The refusal itself was right — without a cost group no expense or GR/IR account can be determined — but the message saying so never reached the person who could act on it.

The refusal is now returned properly and displayed, and the same applies to a missing fiscal year or a closed or locked posting period. Nothing changed about what posts — only about how a refusal is reported.

The Service Cost Group is the one setting that decides whether a service can post at all, and it was reachable only from the Service Accounting workspace — so a user looking at the service that had just refused to post had nowhere to fix it.

• The field is now on the Service Master form, and an existing service without a group is flagged with the consequence spelled out
• Material maintainers can now read the list of cost groups so the picker works for them; creating, renaming and deleting a cost group still belongs to the people who maintain the GL mapping

Every garment in a serialised order gets its own identity and its own scannable label. Pieces are scanned in by bundle at the first sewing operation and out piece by piece at the end of the line, so the shop floor knows exactly what is where.

• Serialisation is switched on per production order and is off by default — an order that has not opted in confirms exactly as it always did
• A scan is a permanent fact: it is never edited or deleted, and a mistake is corrected by a cancelling scan so that both the error and its correction remain visible
• A cut bundle reconciliation view shows what was cut against what was serialised

Administrators: re-seed roles after this upgrade to grant the piece tracking permissions.

Reworks are scanned against the existing defect catalogue, and the two questions a quality meeting actually asks are kept apart.

• Where a defect was found is observed — the system stamps it and nobody can type over it
• Where it was introduced is a judgement — optional, defaulting to nothing, and only ever an operation on that order’s own routing
• Defects nobody has attributed are their own Pareto bar, never spread across the operations that were attributed, and every attributed chart shows how much of the total it covers

Live dashboards read production rate, work in progress by operation, defects per hundred units and absorbed cost per good unit straight off the scans.

• The time between two scans is reported as elapsed time on the line, and is never presented as labour minutes — a piece waiting in a trolley is not a piece being worked on
• A quantity nobody has scanned shows as a dash, never as a zero — “not scanned” is a real answer, and a gap read as zero silently flatters every efficiency figure on the page
• The dashboards are built to hold up at full line volume: they read pre-summarised figures rather than re-reading millions of individual scans

Inventory Ageing reported stock as Non-Moving under a 180-day policy when nothing on hand was older than 86 days. Two separate faults combined to produce it.

• Every batch of a material was given the material’s aggregate verdict instead of its own. A batch received yesterday inherited a sibling batch’s staleness — and, far worse, a batch never issued at all was reported Fast because some other batch of the same material had just moved. Stagnant stock was hiding behind a sibling.
• Stock that had never been issued was called Non-Moving the moment it aged past the new-stock window, so the Non-Moving threshold you configured never applied to it at all.

Never-issued stock now walks the same ladder with the clock running from receipt — New, then Slow, then Non-Moving beyond your configured threshold. Stock on hand with no receipt on record stays Non-Moving: absence of evidence is not evidence of dead stock.

The Pareto calculation counted a material’s own consumption value before deciding which class it fell into, which pushed every material sitting on a cut down one class. Where a single material was most of the consumption value, that material was graded C and the company was left with no A class at all.

Each material is now graded on the cumulative share of everything ranked above it — the standard convention, where the A cut is the few materials making up the first 80% of value. Ties break consistently, so two runs over unchanged data give the same answer.

Ten scheduled jobs were set to run between 00:30 and 07:00 — hours in which the server is powered off. A job scheduled outside the running hours does not queue and run late; it simply never happens. Recurring task generation, licence usage snapshots, business-network subscription expiry and risk scoring, HR headcount snapshots and workflow delegation expiry had all been silently inactive.

They now run staggered through the early evening, heaviest first so the ones that loop over every company do not contend with each other. Morning-specific jobs are deliberately left where they are.

“Ageing by Vendor” showed one unnamed group containing everything, for every company. It was reading two master-data fields that nothing in the application ever writes — so they were empty on every material and every batch, everywhere.

The vendor is on the receiving document, so that is where it is now taken from: the purchase order line the goods receipt was posted against, using the earliest receipt so the vendor matches the same receipt the ageing clock already runs from.

• Stock received from your own production is reported as In-house, not as missing data
• Stock that is neither purchased nor produced is left blank rather than guessed at
• Master data still wins wherever anybody populates it, so nothing is lost by filling those fields in later
• The vendor filter read the same empty fields, so choosing a vendor emptied the grid. It now matches what the chart shows — a chart cannot name a vendor the filter beside it cannot find

The company logo was silently dropped from every PDF the product prints — invoices, orders, notes, statements — and replaced with an invisible placeholder. Nothing failed and nothing was logged; the documents simply came out unbranded.

Logos are now embedded directly into the document, which fixes every commercial document at once without weakening the protection that stops a tenant-edited layout fetching anything it likes from the internet.

Action items can now be owned by anyone on the project roster, not only by an employee — and the transfer routes the task to the right customer contact, vendor contact or employee. The commonest real case, an action on the customer, was previously untrackable.

The minute and the action register now show whose side an owner is on, because an action owed by the customer reads very differently from one owed internally.

Record a meeting the way it actually happens: an agenda, who attended, what was discussed, what was decided, and who is doing what by when. The minute is then printed as a PDF and circulated by email to the attendees.

• A meeting does not have to belong to a project — a management review or a vendor call is a first-class record of its own
• Minutes are numbered through the configurable document numbering rules; a company that has not configured a series gets a sensible one automatically
• A minute prints and circulates even where print layouts or an email channel have never been set up
• Circulation that reaches nobody is reported as a failure and leaves the minute where it was, rather than marking it circulated

Administrators: re-seed roles after this upgrade to grant the meeting permissions.

An action item agreed in a meeting can be transferred into Task Management in one step, and from then on the task is the record of progress — the minute keeps the record of what was agreed. Two separately-editable statuses for one piece of work drift within a week, and then nobody can say which is true.

• The transfer reports exactly why any item was not taken — no due date, or an owner with no record to point at — instead of quietly inventing one
• Transferring the same item twice does nothing the second time
• The action item shows the live status of its task

A new Project People page holds everyone involved in a project — your own employees plus customer and vendor contacts — and meeting attendance is taken from that roster instead of typing a name and an email address into each minute.

• Names, organisations and email addresses are read live from CRM and vendor master data, so a contact renamed there is renamed on every minute that cites them
• Enrolling people is done in bulk, and offers only the people not already on the roster
• External people are not schedulable: they do not enter capacity planning, the labour roll-up or the project resource count

If a later approval step’s role had no active member, the note became stuck: the first approver approved it, the next step went live with nobody able to act on it, and the note stayed in Pending Approval — looking un-approved to the very person who had just approved it — with no way out from inside the application.

• Submission now checks every remaining step up front and refuses, naming the role that needs staffing, while the note can still be corrected
• Notes stranded before this fix can be recovered by an administrator — either re-routed once the role is staffed, keeping the approvals already given, or returned to draft

All 46 Real Estate lists now fetch one page at a time instead of loading every record into the browser, so a portfolio with a long history of payments, leases and inspections opens as quickly as a small one.

• Searching, sorting and filtering are done by the server over the whole list, not over the page on screen
• Excel export writes out everything the filter matches, not the visible page
• Sorting on a column the server cannot order by is no longer offered, instead of being accepted and ignored

The reason list on a debit or credit note now reads in business terms — goods return, price adjustment, additional discount or rebate, quality issue, billing error, short supply, rate difference and order cancellation.

Simulate shows the journal entry a note would post — which side the payable or receivable lands on, which offset and tax accounts take the counter entry, and whether it balances — straight from the form, before the note is saved, submitted or approved.

• The preview is built by the same engine that does the real posting, so it is the document you will get
• A supplier with no control account, a tax code with no GL account, or a closed period are shown beside the preview as blockers, while the form is still editable
• Nothing is written and no document number is used up — an abandoned preview costs nothing

Rent Roll, Lease Expiry, Rent Arrears, Occupancy & Vacancy, Property Income & Expense and Tenant Ledger, each filterable and exportable.

• Occupancy is derived from the leases that are actually running, not from a status field somebody has to remember to update
• Property income is what was received, never what was billed — the two differ by exactly the arrears the Rent Arrears report exists to show

A cash sale is a tax document, so it now prints as a full invoice rather than only as the on-screen till receipt.

• Two layouts from the same document: an A4 tax invoice for the customer and statutory copy, and an 80mm roll for the till printer
• Company header, party details, HSN and tax columns, tax summary and the amount in words
• Every reprint is marked DUPLICATE, so the original copy stays identifiable
• A missing company address, logo or customer address never stops the printout — the cashier is waiting

A new screen under Administrator lets an authorised user browse the application’s own tables: choose a table, choose which columns to show, filter and sort them, page through the rows and export the result.

• Paging, sorting, searching and filtering all happen on the server, so a table with millions of rows opens as quickly as a small one
• Only tables belonging to your own company are browsable — platform-wide tables shared between tenants are never listed
• Sensitive columns such as password hashes and secret keys are removed everywhere they appear, and cannot be filtered, sorted or searched on either

Administrators: the permission is granted to no role by default. Grant View Tables to the roles that should have it after re-seeding roles.

The explorer has no way to edit, insert or delete a row, by design and not merely by hiding the buttons. A table maintenance screen bypasses every validation, posting rule and audit trail the application has.

Where data genuinely needs correcting, that is what the Operations Console and its reviewed, permission-gated commands are for.