What we shipped, in plain language.

The down payment request and detail screens were rebuilt, the GL posting for an advance was corrected, and the service behind them was simplified so a request, its approval, its payment and its later adjustment against an invoice behave consistently.

Down payments are included in the trace, since money can leave against an order before any invoice exists, but an advance already adjusted against one of the listed invoices is netted off the stage total. Where a stage cannot be read, its totals are shown as blank rather than zero, and no finding is raised from a stage that was never read.

A new PO History page walks the whole procure-to-pay journey around one order — the MRP requirement that caused it, the purchase requisition, the order, goods receipts or service entry sheets, invoice verification and posting, and the vendor payment — with a per-line matrix and a reconciliation of ordered against received, invoiced and paid. Nothing is stored: the trace follows the documents themselves, so it can never disagree with them.

Questions arrive as “the vendor is asking about invoice INV-4471”, not as a PO number. The page can be searched by requisition, MRP run, goods receipt, the vendor’s own delivery note, service entry sheet, vendor invoice (ours or the supplier’s number), payment or UTR. The order shown is in the address, so the answer can be pasted into a ticket.

The invoice column on the GR/IR report did not resolve the invoice for every line; the lookup has been corrected.

The copilot deliberately cannot post, reverse, cancel, delete or pay — those are decisions with an accounting consequence. It can block an invoice that has not yet been posted, and link a requisition only when exactly one unambiguous candidate exists. Every attempt is recorded, refusals included. Findings can be mirrored into the Management by Exception cockpit.

Eight detectors ship — three for maverick buying, two for process bottlenecks and three for duplicate payments. Each raises a finding carrying the evidence behind it, so the worklist can be worked rather than merely read. A finding that comes back keeps its original first-seen date, and one that has been dismissed with a reason is never raised again.

Stage dwell is benchmarked against that stage’s own 90th percentile from the mined event log rather than a hand-set number of days, so the threshold tracks how fast the business actually runs. A stage with too few observations refuses to produce a benchmark instead of inventing one.

Every finding is explained from its own evidence at scan time, at no cost. An AI explanation is available per finding on demand and falls back to the written one on failure — an audit control that goes dark when a credit balance runs out is not a control. Confidence is shown as Established / Strong match / Possible, never as a percentage.

Corrections to the Goods Receipt page, the Purchase Order page and both the PO-based and non-PO Vendor Invoice forms, including the journal query behind the posted document links.

A request for a deactivated workspace whose database was never created left the connection pointing at the missing database for every subsequent request on that worker, on every tenant. Seven unauthenticated requests were enough to take production down for about forty minutes. The tenant switch no longer mutates shared connection state, and a failed switch is contained to the request that caused it.

The Purchase Order print layout was reworked and the order now carries the issuing company address it was raised under, so a reprint shows the address in force at the time rather than the current one.

Every write from the Service Entry Sheet page was refused with a security error since 31 July, so a sheet could be listed but never created, edited, submitted, approved or posted. Reads kept working, which made it look like a permissions problem. The page now uses the shared API client, which carries the session and workspace identity on every request.

Requests for a deactivated workspace were dropped in a way that counted towards the automatic ban list, so one out-of-date link could ban a whole office or a shared mobile carrier range. They now answer with a proper “workspace unavailable” page, and the ban list is reserved for hostnames that were never issued. The office IP allow-list — which only ever covered one tenant — has been removed rather than extended.

Reversing a goods movement reused the original movement type, so reversing a goods receipt received the stock again and debited inventory a second time. The reversal now resolves the correct counterpart movement, and a line-level partial reversal is supported.

A Goods Receipt could be raised against a service line, moving a phantom quantity into a storage location and capitalising labour into inventory. A service line is now identified per line — not per order type — so one order can buy fittings (received into stock) and the fixing of them (entered on a Service Entry Sheet) without being split in two. A remediation command reverses receipts already posted this way.

Permission refusals now name the exact permission required, and a list that is empty because of row-level scoping says so (“No materials in your Purchasing Group”) instead of appearing blank. One refusal no longer discards every other list on the same form.

Service cost groups and account determination mirror the inventory matrix: posting a Service Entry Sheet accrues service expense against a service receipt/invoice (SR/IR) clearing account, so cost lands in the period the work was performed, and the vendor invoice then clears that accrual rather than booking the cost a second time. An unresolved account refuses the posting and names what to maintain, rather than guessing.

Which roles see which page is now a setting in the RBAC workspace rather than a code change, and the same verdict is applied to a typed or bookmarked URL — a hidden page no longer renders just because its address was pasted in. A refusal keeps the sidebar and names the permission to ask for. Enforcement can be switched off per tenant without a deployment, and any page the registry does not know stays visible.

Services are maintained on their own master screen with their unit of measure, tax code and cost group, and a migration command moves service-flagged materials onto it while keeping open orders resolvable.

A Sales Order form needs materials, a Vendor Invoice needs suppliers, a Journal Entry needs GL accounts — modules those users are correctly not members of. Dropdown lists are now served by a dedicated reference endpoint returning only code and label, gated by its own lightweight permission, so a Sales Officer can fill a form without being handed the whole material master. Row-level scoping still applies.

Open-item selection ignored currency, so a receipt in one currency could be allocated against an invoice in another. Allocation now matches on currency; reporting views (ageing, collections) are unchanged and still show every open item.

The receipt simulation now shows both foreign and local currency debit and credit columns, and a per-invoice working — amount settled, invoice rate against receipt rate, amount booked against amount received, and the resulting difference — so an operator can see which invoice produced a gain or loss before accepting it.

A foreign-currency invoice is booked at the invoice-date rate; the money arrives at a different one. The receivable is now relieved at each settled invoice’s own booking rate and the difference is posted to a realized exchange gain or loss account, so no unexplained residue is left in Accounts Receivable. The realized gain and loss accounts are maintained per company alongside the existing revaluation accounts, and an unconfigured account blocks the receipt rather than absorbing the difference silently.

The GR/IR report gains a pivot view for analysing the goods-received-not-invoiced balance by vendor, material, period and document.

The role seeding routine ran after every deployment and unconditionally reset each seeded role’s permissions, so any permission an administrator added or removed was wiped with no warning and no record. A role edited through the UI is now marked as customised and is skipped by the seeder, which reports exactly which roles it left alone and who customised them. A role can be handed back to the product deliberately.

Roles can be compared, cloned, exported and imported between tenants (by permission code, so the right permissions land), and every grant and revoke is recorded with who made it — including changes made by the seeder, so “a deployment took that away” is checkable rather than suspected. Users can be assigned to a role in bulk.

Service cost groups, the service GL determination matrix and a completeness check are maintained at a new Service Accounting screen. The completeness tab reports the two configuration causes of a refused posting — a group missing its expense or SR/IR account, and an active service with no group — before anyone meets them at posting time, and the Service Entry Sheet page links straight to it.

Permissions can be renamed and recategorised in your own vocabulary, and custom permissions can be created. Shipped permissions keep their identity so existing screens continue to enforce what they always did, and a permission dropped by a release is retired rather than deleted, so the roles holding it keep the record.

A new Audit tab reports, for the deployed code, which API operations each permission guards, which operations are guarded by nothing, which permissions the code enforces that no role can be granted, and which pages are ungated. Each permission now shows its endpoint count with a drill-down.

The Explain tab answers the question every access ticket actually asks: it traces whether a user holds a permission, through which role assignment, granted by whom and when, alongside their row-level scope — because a refused page and a page whose rows were all filtered away look identical to the user and are fixed in different screens. Simulate resolves what another user would see; it is not impersonation and grants no ability to act as them.

The RBAC workspace is no longer restricted to full administrators. A delegated administrator may not grant a permission they do not themselves hold, and may not edit, clone, delete or assign a role carrying administrator rights — without both rules, delegating role maintenance would be a one-click path to full access.

Eight near-identical mail routines across the application were consolidated into a single dispatch service, so every message honours the configured channel and every send is recorded in one Send Log. If no channel is configured, mail goes out exactly as it did before — configuring channels can never stop mail from being sent.

A new Email Channels workspace lets you register your own sending accounts — SMTP or an email API — and assign one per category of message (finance, procurement, HR, support, and so on), with a tenant default behind them. Notices, statements and dunning letters then reach your customers and vendors from your own domain rather than a shared platform address.

SMTP passwords and API keys are stored encrypted and are never returned by the API — a channel reports only whether a secret is set. Leaving the field blank on an edit keeps the existing secret rather than erasing it.

The HSN/SAC seed data file was excluded by a blanket rule that ignored JSON files, so the migration that loads it failed for every tenant during deployment. The file is now tracked and the seeding completes.