What we shipped, in plain language.

Add Element switched itself off after the first WBS element on a project that was still a draft, and the status transition buttons never appeared at all. Neither was a screen fault: the project status was simply not being sent with the project, so every project read as though it were already past draft.

The same omission left the Status column blank on the project grid and on the portfolio board.

The status is now served with the project — for reading only. A status change still goes through the transition action, so the rules that govern which move is allowed cannot be sidestepped by writing the field directly. The actual start and end dates, stamped by those same transitions, are served beside it and the “Actual start” field on the detail screen is no longer permanently blank.

The leave type dropdown on Employee Self-Service was empty, so no employee could raise a leave request at all. Leave types are tenant configuration and the screen correctly invents nothing — but that left a tenant that had never configured them with no way through the screen.

A starting catalogue is now seeded — Earned, Casual, Sick, Maternity, Paternity, Bereavement, Compensatory Off and Loss of Pay — modelled on a common Indian private-sector policy. It is a starting point for your HR team to confirm, not a policy: seeding is idempotent by leave-type code, so an edit made by an administrator survives a re-run, and a leave type already in use is never removed.

Seeding a type grants nobody any leave. An entitlement is a quota recorded against an employee, with a number and a validity period, and that stays an HR decision: until quotas exist the balance panel reads zero and a quota-bearing type refuses the request.

Administrators: a tenant with no users yet is skipped by the deploy-time seed rather than having an author invented for it — run seed_leave_types for that tenant afterwards.

A Sales Order line can now carry an output tax code from the tax master, and the code drives the line’s tax percentage instead of the rate being typed in by hand.

The tax code carries across when a quotation is converted into a sales order, so the rate the customer was quoted is the rate the order is raised at.

The daily, weekly and quarterly overtime caps in Overtime Management now read from the roster compliance rules for the plant, so one place governs the limits.

Where no rule has been configured the existing limits continue to apply exactly as before — removing a warning that fires today would itself be the change nobody asked for.

A posted vendor invoice can now be reversed. A reversal cancels a posting — it does not erase the document, which stays visible with its reversal recorded against it.

• Everything the posting did is unwound together, not just the journal: the stock revaluation, the reverse-charge accrual, any vendor advances the invoice consumed, and the vendor sub-ledger entry
• Reversing releases the goods receipt again, so the receipt can be re-invoiced instead of being held shut for ever by a cancelled invoice, and the withholding-tax threshold no longer counts the reversed amount
• An invoice that has been paid is refused by name, rather than being reversed out from under the payment
• A reason is required, and the reversal posts into an open period

The General Ledger Journal Entries screen can reverse a posted journal, generating the opposite entry and linking the two.

It reverses manual journals only. A journal raised automatically by a document — an invoice, a receipt, a depreciation run — is one leg of that document and is reversed from the document itself, so the rest of what the document did is unwound with it.

The time and attendance records were all in place, but nothing answered the question underneath them: which employee is on which shift on which date. That plan now exists — shifts, breaks, rotation patterns, crews and a generated roster per period.

• A rest day is a recorded off day, never a missing row. A gap in a rotation pattern silently understates absence and overstates overtime, so a pattern that does not cover its whole cycle cannot be activated and the builder shows the undefined day in red
• Generating and publishing are separate acts. A draft roster that breaches a limit is useful — it shows the manning problem — but publishing one is refused, naming each breach, because publishing a statutory breach is the breach
• Re-generating a roster replaces only the days the pattern produced, and reports how many human decisions it left alone
• Moving an employee between crews is recorded as history with effective dates, so past rosters that payroll was already computed against are not rewritten
• A locked period is a fact: correct it with a new period, never by editing the old one
• Night-shift eligibility is checked against what is on file — no exemption recorded means not permitted

Administrators: re-seed roles after this upgrade, and seed the roster configuration for each plant.

Attendance terminals can post punches directly, and each day is evaluated against the published roster to produce worked hours, lateness, early leaving and proposed overtime.

• A missing punch is reported as a missing punch, never as zero hours — zero pays nothing for a day somebody worked, and a full shift pays for a day nobody can evidence
• A device that has gone quiet is flagged as silent. A whole shift with no data looks exactly like a whole shift absent on every report downstream
• Overtime is proposed, never posted. A supervisor accepts it into the existing overtime request process, where the existing caps apply unchanged
• Which shift-day a night punch belongs to is decided once and stored, so payroll, overtime and the shop-floor rollups all count the same night the same way

The daily audit-chain check reported a company whose database was simply behind on upgrades as a verification failure — the same alarm as an audit trail edited directly in the database. The first production run would have sent a tampering alert for a routine upgrade backlog, and the next real one would have been ignored.

The two are now separate: the backlog case names the upgrade to run and states plainly that it is not a tampering signal, and the alert subject says a chain is broken only when one actually is.

The Sales Orders list checked three permission names that do not exist, so the check failed for everyone who was not a company administrator. Users who genuinely held the Sales Order permissions — a CRM Manager, for instance — could not see the View, Add or Edit buttons.

The names are corrected. Nothing about what the server allowed ever changed; only the buttons were missing.

Encrypted fields were implemented three separate times, and all three shared the same set of failures. There is now one implementation, and it closes each of them.

• A value that is not valid ciphertext, or that fails its authentication check, now raises. Previously a detected forgery was returned as though it were the real value — the one outcome worse than an error
• With no key configured the old code stored plaintext; it now refuses
• Each encrypted value is bound to the row it belongs to, so a ciphertext copied from one record into another is rejected instead of decrypting perfectly — verified by running that exact attack against the database
• Keys can now be rotated, which was previously impossible

Nothing stored changes with this release and no field has adopted it yet; this is the foundation the adoption is built on.

Posting a Service Entry Sheet whose services have no Service Cost Group returned an empty “Server Error” page. The refusal itself was right — without a cost group no expense or GR/IR account can be determined — but the message saying so never reached the person who could act on it.

The refusal is now returned properly and displayed, and the same applies to a missing fiscal year or a closed or locked posting period. Nothing changed about what posts — only about how a refusal is reported.

“Ageing by Product Group” grouped on a hierarchy that is not the one the business means by material group, and which most materials do not carry — so the chart collapsed into a single blank bucket, or left the large majority of rows ungrouped.

It now reports the material group from the material hierarchy, which every material carries. On live data one company went from a single blank group to a named one, and another from 3 groups with 398 of 420 rows blank to 36 groups with none blank.

• A material attached above the material-group level is reported as its own group rather than dropped
• The chart and the grid column are retitled to match
• The separate Product Category filter is unchanged — it deliberately targets the product hierarchy

“Ageing by Vendor” showed one unnamed group containing everything, for every company. It was reading two master-data fields that nothing in the application ever writes — so they were empty on every material and every batch, everywhere.

The vendor is on the receiving document, so that is where it is now taken from: the purchase order line the goods receipt was posted against, using the earliest receipt so the vendor matches the same receipt the ageing clock already runs from.

• Stock received from your own production is reported as In-house, not as missing data
• Stock that is neither purchased nor produced is left blank rather than guessed at
• Master data still wins wherever anybody populates it, so nothing is lost by filling those fields in later
• The vendor filter read the same empty fields, so choosing a vendor emptied the grid. It now matches what the chart shows — a chart cannot name a vendor the filter beside it cannot find

Ten scheduled jobs were set to run between 00:30 and 07:00 — hours in which the server is powered off. A job scheduled outside the running hours does not queue and run late; it simply never happens. Recurring task generation, licence usage snapshots, business-network subscription expiry and risk scoring, HR headcount snapshots and workflow delegation expiry had all been silently inactive.

They now run staggered through the early evening, heaviest first so the ones that loop over every company do not contend with each other. Morning-specific jobs are deliberately left where they are.

Inventory Ageing reported stock as Non-Moving under a 180-day policy when nothing on hand was older than 86 days. Two separate faults combined to produce it.

• Every batch of a material was given the material’s aggregate verdict instead of its own. A batch received yesterday inherited a sibling batch’s staleness — and, far worse, a batch never issued at all was reported Fast because some other batch of the same material had just moved. Stagnant stock was hiding behind a sibling.
• Stock that had never been issued was called Non-Moving the moment it aged past the new-stock window, so the Non-Moving threshold you configured never applied to it at all.

Never-issued stock now walks the same ladder with the clock running from receipt — New, then Slow, then Non-Moving beyond your configured threshold. Stock on hand with no receipt on record stays Non-Moving: absence of evidence is not evidence of dead stock.

The Pareto calculation counted a material’s own consumption value before deciding which class it fell into, which pushed every material sitting on a cut down one class. Where a single material was most of the consumption value, that material was graded C and the company was left with no A class at all.

Each material is now graded on the cumulative share of everything ranked above it — the standard convention, where the A cut is the few materials making up the first 80% of value. Ties break consistently, so two runs over unchanged data give the same answer.

The Service Cost Group is the one setting that decides whether a service can post at all, and it was reachable only from the Service Accounting workspace — so a user looking at the service that had just refused to post had nowhere to fix it.

• The field is now on the Service Master form, and an existing service without a group is flagged with the consequence spelled out
• Material maintainers can now read the list of cost groups so the picker works for them; creating, renaming and deleting a cost group still belongs to the people who maintain the GL mapping

Every garment in a serialised order gets its own identity and its own scannable label. Pieces are scanned in by bundle at the first sewing operation and out piece by piece at the end of the line, so the shop floor knows exactly what is where.

• Serialisation is switched on per production order and is off by default — an order that has not opted in confirms exactly as it always did
• A scan is a permanent fact: it is never edited or deleted, and a mistake is corrected by a cancelling scan so that both the error and its correction remain visible
• A cut bundle reconciliation view shows what was cut against what was serialised

Administrators: re-seed roles after this upgrade to grant the piece tracking permissions.

Live dashboards read production rate, work in progress by operation, defects per hundred units and absorbed cost per good unit straight off the scans.

• The time between two scans is reported as elapsed time on the line, and is never presented as labour minutes — a piece waiting in a trolley is not a piece being worked on
• A quantity nobody has scanned shows as a dash, never as a zero — “not scanned” is a real answer, and a gap read as zero silently flatters every efficiency figure on the page
• The dashboards are built to hold up at full line volume: they read pre-summarised figures rather than re-reading millions of individual scans

Reworks are scanned against the existing defect catalogue, and the two questions a quality meeting actually asks are kept apart.

• Where a defect was found is observed — the system stamps it and nobody can type over it
• Where it was introduced is a judgement — optional, defaulting to nothing, and only ever an operation on that order’s own routing
• Defects nobody has attributed are their own Pareto bar, never spread across the operations that were attributed, and every attributed chart shows how much of the total it covers

Table Explorer suppressed credentials, but every employee bank account number, PAN, Aadhaar, UAN and net salary was browsable, filterable and sortable in a generic grid. Thirty-four columns are now redacted.

• Redaction removes filtering, sorting and searching too — otherwise “net pay greater than” is a way of reading a salary without ever displaying it
• The distinctions are drawn carefully: an account number is hidden while the internal link to a bank account row is not, and one person’s net pay is hidden while a payroll run’s total across everybody is not
• A verification status about an identifier stays visible; the identifier itself does not
• An automated sweep now fails the build if any new sensitive-looking column is neither redacted nor explicitly reviewed, so this cannot quietly regress

The audit trail carried tamper-evidence, but nothing was checking it on a schedule. A daily job now verifies the chain for every company and raises an alert on a break, so a tampered audit record is discovered rather than merely discoverable.