Changelog

Values computed for your workspace. The SAML setup step shows the four values your identity provider asks for — the sign-in (ACS) URL that ends in your workspace's ID, the entity ID, the single logout URL and the metadata URL — each with a note on what it is for, so the usual mix-ups ("reply URL does not match", a wrong audience) are hard to make. If your provider was configured with a different sign-in URL, update it to the one shown on the page.

A status that says what happened. Each connection reads Verified, Not yet verified, Unknown or Disabled, with the last sign-in (when, and who) and the last refusal with its reason in plain words. If the sign-in history cannot be read, the page says Unknown — "not the same as never" — rather than guessing. One line shows provisioning from your identity provider: its last call, and how many provisioned people are active.

Offboarding ends access everywhere at once. Whether someone is deactivated from your identity provider through SCIM or in Settings → Team, their signed-in sessions end and the API keys they created stop working in the same step, and your audit log records how many of each. Re-enabling the person restores their keys, so create integration keys under an account that stays.

Sign-out at your identity provider reaches Pact. A signed sign-out request from Okta or Entra ID ends the Pact session, including over the redirect binding both use by default. Sign-in assertions that are replayed, altered, unsigned, expired or issued for a different workspace are refused, recorded, and never create a user.

On a phone the status is one card per connection, state first; on a desktop it is a grid you can compare at a glance.

One export, the whole chain. Each of the 61 Trust Services criteria lists its owner, its governing policies and whether they are current, its evidence source, the steps for any evidence collected by hand, its last test and when the next is due. Anything missing is written into a gaps column rather than left blank.

The policies travel with the evidence. The package carries every governing policy word for word, each with its fingerprint in an index, a record of who acknowledged which policy, and an index of every evidence source with its own last result. The bundled verifier re-checks each of them against the package's signed digest.

No green that has not been earned. Evidence from a source that could not be reached is marked "Source unreachable" and does not count toward readiness. A policy past its review date is a finding that names the date. A policy acknowledged only by its owner is reported as an exception, not as communicated. When coverage cannot be read, the control sheet says "Policy coverage unknown" — never "no policy".

Where Pact stands, in plain words. The SOC 2 Type II audit has not started. The Trust Center lists it as "In preparation · not yet audited", and the security documentation says no independent audit has started. Customers who need the evidence package for their own vendor review can request it under NDA.

Admins collect evidence and download the package from Admin → SOC 2 Type II.

How to report, and what you get back. The new disclosure page lists what to include in a report, then the commitments: acknowledgement within 2 business days, updates through triage, fix and release, and a 90-day window before publication unless agreed otherwise. It sets out what is in scope and out of scope, and the safe harbor for research done in good faith.

One set of terms, everywhere. The disclosure page, the security page, the Trust Center and the machine-readable security.txt state the same contact and the same commitments, and security.txt now points to the full policy.

The penetration test, stated exactly. The external test is being scheduled: an independent firm will test the application and API by hand, signed in, across roles and across workspaces. What is ready now is listed beside it — the scope and rules of engagement, an inventory of every API route and how it authenticates generated from the code, and one-command test workspaces that hold sample data only.

No external test has run yet. Once the test and its fixes are complete, a summary and the firm's attestation letter will be published on the security page, and enterprise customers will be able to request the full report under NDA.

A won deal starts onboarding. Winning a deal on the board, on the deal page or through a paid order opens the onboarding plan and hands the kickoff task to the engagement manager, with the deal and its amount. Nothing is retyped.

Escalations and site follow-ups land with an owner. Manual and SLA escalations reach the engagement manager as a task, a notification and an entry on the account timeline. A consultant on site can send confirmed follow-ups as assigned tasks with one tap, and the card names who will receive them.

What a call agreed becomes a task. After a call is analyzed, its agreed next step becomes a task for the person who ran the call and is added to the account timeline. The due date comes only from the call's own words — "by Thursday", "within 3 days", "next week" — counted from the day of the call. Pact never invents one.

Leads and expansions reach their owner. A lead routed by a rule, assigned by a teammate or arriving through a form notifies its new owner with the source and why it is theirs. Promoting an expansion signal or play opens a deal owned by the account owner and tells both the owner and the engagement manager.

Every hand-off says why you. A "Handed to you" panel leads CS Today, and each account's Overview now has "Hand-offs on this account": what was handed over, from which team, to whom, and why that person — "owns the onboarding plan", for example. When nobody owns the account yet it says "nobody yet" instead of guessing.

Renewals read the latest health. At-risk on the renewals board follows the most recent health score, and a renewal with no score yet says "No health score yet · stage only". Solutions engineers can also pin evidence to a deal room; a customer quote without consent is refused.

Hand-off notices arrive in-app, and by email or push for people who have turned those on in Settings → Notifications.

One customer, seven steps, on every page that shows them. Lead, nurtured, in pipeline, won, onboarded, supported and renewed are always drawn, with the current step highlighted. The same view appears from the account, from any of its contacts and from any of its cases, and each step says what feeds it and links to the area that owns it.

A stage never reads as good news when the customer is at risk. "Supported", "Onboarding", "Just won", "In pipeline" and "Renewed" now carry health or churn risk in the same sentence, a critical score shows in red, and risk leads the account's highlight ahead of an expansion suggestion. A renewal set to cancel says so on its row. When risk cannot be determined, the page says "risk not established" rather than implying all is well.

Contradictions are shown, not resolved by hiding one. A customer that renewed and is also set to cancel shows both facts. A step you do not have access to is labeled as such, and a step that could not be loaded is named as a gap — never shown as an empty or a zero.

Lifecycle views count every account. The lifecycle lane on module homes now reads your whole book in pages, so its stage counts are your true totals rather than the first 50. A progress line shows while the rest load, and if a later page fails, what was read stays on screen with Try again.

The account page, the lifecycle lane and the CS journey board use the same risk rules, so they agree. On a phone, name, stage and next step sit on one row.

Every move says why. Each change names its reason — a deal opened, a deal was won, onboarding started, a case opened, a subscription renewed — and which team's activity caused it. Moves backward and skipped stages are labeled as such.

Time in stage, measured. Each stage shows how long the customer stayed there, drawn as a bar against the longest stay, so a slow stretch stands out at a glance.

Dates you can trust. A date comes from the record itself where one exists, such as the day a deal closed, and is otherwise marked as the day the change was seen. History begins the first time an account is opened after this release: that view records a starting point, and the card ends with "Not recorded before …". Pact never fills in or backdates what it did not see.

Readable from every seat. Sales, Customer Success and Support all see the same history. Deal names, amounts and health scores stay visible only to seats that have the area that owns them; everyone else sees that the move happened and where to find the detail.

It works on desktop and on phones, and a compact version sits beside the case on case pages.

A source under every reply. The call record labels each AI reply with where it came from — "From your CRM · deals", "Computed from pipeline totals", or "Not established" when nothing backed it.

A verdict at the top. One line answers whether the agent told the caller anything untrue, with the counts beside it: replies traced, confirmed, stopped, unconfirmed and unrecorded.

Claims are checked before they are spoken. When the agent tries to say something was sent, booked or saved and no action backs it up, those words are stopped and the caller never hears them; the record shows what was stopped. Answers that read no data cannot speak a figure, and answers from your data name their source out loud.

No added cost or delay. The checks are rule-based, run on every turn, and make no extra AI call.

Calls recorded before this release show a note in place of per-reply sources.

What-ifs, worked out. "What would a 10% discount do to our pipeline?" returns the arithmetic plus your own quote acceptance with and without a discount, labeled as an observation from your history rather than a prediction.

Questions that span modules. Ask for "accounts with an open case and an open deal", or "accounts with an open P1 case, a renewal this quarter and no nurture touch in 30 days", and you get the accounts that match every condition — answered from your records directly, without an AI model call.

A straight answer to a broad question. "How are we doing?" now gives a direct reading of your team's open pipeline, with one-tap follow-ups.

Declines are rare, and explained. Ask declines only a small set of requests — classifying people by health or faith, for example, or exporting everything — and each decline says why and offers questions it can answer, ready to tap.

Faster, and honest about confidence on the phone. Answers drawn from your records start arriving about a quarter of a second sooner. On a call, an answer the agent is unsure of ends with "I'm not confident in that one." AI assistants connected through Pact's MCP server receive a confidence level and its reasons with every workspace answer.

Your promises come first. Overdue follow-ups from your calls, the ones due today or tomorrow, and recent undated ones now lead "Deals waiting on you" on Sales Today. Dates come only from what was said on the call; Pact never makes one up.

Open prep opens a brief. On Sales Today, "Open prep" now lands on the account's meeting-prep card. With a meeting on your calendar you get talking points, watch-outs and Join, Reschedule or Draft follow-up. With nothing scheduled, prep on demand draws on the account, its open deal and the last 14 days of activity. If your calendar could not be read, the card says so rather than claiming nothing is scheduled, and it only ever shows your own meetings.

Recaps travel. Every call recap has "Copy recap" and "Share to deal room", and the shared text says whether AI wrote it. Both fit on a phone.

Managers land on their desk. Sales managers now open on the manager's Today when they sign in, and the first-run tour follows your role instead of asking you to pick one.

You know what was sent. Sending a quote shows the outcome in the confirmation and on the quote's activity: sent, blocked with the reason, or email not set up. Quote emails carry a full link that opens from any mail client.

Invoices start as drafts. A new invoice has Send invoice and Mark as sent, and becomes Sent only when the email is accepted or a person records delivery. Existing invoices are unchanged.

PDFs open. Preview PDF on a quote and the PDF button on an invoice open the document in a new tab, popup blockers included. Quotes created from a deal download under their real name, accents and other non-English characters intact, and if a PDF cannot be produced the page says why instead of opening a blank tab.

Ownership follows the deal. A quote created from a deal is owned by the deal's owner, and conversion reporting credits that person.

An audit trail that names the client. The audit log records a client's accept, decline and signature — credited to the client, with one consistent identifier you can filter on — along with the order it creates and each privacy request opened and evidenced. Invitation entries name who invited and no longer show the invitee's full address.

A chat window for your website. Only the launcher button loads with your page; nothing is fetched or stored until a visitor opens the chat. It follows your cookie-banner rules, does no page tracking, works under a strict website security policy with two allow-list entries, and becomes a full-height sheet on phones.

Built for the queue, not the inbox. Visitor chats arrive as chat cases. Agent replies appear in the visitor's window and internal notes never do. Visitor-given names are labeled unverified and never matched to a contact. Per-visitor and per-workspace limits, a per-site allow-list and bot traps keep spam out, and the settings page shows the real limits. Each visitor message is triaged by AI and counts toward your workspace's AI budget.

A co-pilot that always shows up. Reply drafts, escalation risk, similar cases and deflection each load and retry on their own, so one slow panel no longer hides the rest, and a missing signal is named inside its panel. "Escalation not computed" replaces a misleading 0%.

From resolved case to article. "Draft article from this case" saves a review-pending knowledge-base draft with a Review draft link, or says why it cannot — the case isn't resolved, or the knowledge base already covers it.

Macros, filled in. Insert macro fills a saved macro for the open case, and a customer reply cannot go out while a field is still unfilled. Case pages use a single column on phones.

Media where your audience is. The composer has an Attachments field. X posts can carry up to four images, a GIF or a video, uploaded before the post is created so a failed upload never leaves a half-made post. YouTube posts upload the video, and the composer says up front that uploads from unaudited Google projects stay private and how much upload quota each one uses.

Bluesky, properly. Up to four images, clickable links and correctly threaded replies. Mentions, replies and quotes arrive in the Social inbox, and Delete really deletes.

Refused before scheduling, not after. A per-channel check shows what each network will accept before you schedule, and the server checks every file again. X posts over 280 characters are refused rather than cut off, and the inbox reply box counts down for X (280) and Bluesky (300).

One library for the team. Templates, snippets and hashtag bundles are saved for the workspace, so teammates and your other devices see the same library. Every item shows who added it, use counts are workspace-wide, only the author or an admin can edit or delete, and anything saved in a browser before can be moved up with one click.

X mentions arrive when your workspace's own X app is connected, and X accounts connected before this release need to be reconnected to attach media; text posts keep working.

Nothing switches on its own. A stored key serves AI only after an admin chooses it, and the confirmation says where your data will go and who will be billed.

Test before you trust. "Test" makes one real, tiny AI call through all the usual safeguards and reports the model, the latency and the cost — or a concrete next step if it fails.

Your region stays your region. With Bedrock, AI calls stay in the credential's region by default and never fall back to global routing; global is an explicit opt-in.

Fails closed. If Pact cannot confirm where an AI call will be routed, the call stops rather than quietly using a different provider. Usage on your own key is billed to your account and shown, at list prices, in your AI spend.

Risk, for the account you asked about. "What are my risks with" a named account is answered for that account only, and "nothing flagged" is said only after checking that account against the full risk list. A name said as words or digits, with or without punctuation, finds the same account, and a short name finds the full company name.

Misheard names are recovered. A short account name that speech recognition hears as a time is offered back as a "did you mean" from your own accounts, while real times still mean times when you are scheduling.

A specific reason, not a menu. When a turn cannot be answered, the agent names what went wrong and a next step instead of repeating the same generic help line.

Every suggestion works. Each phrase suggested in the voice hub, the "try saying" pill, the help panel and a first call's greeting is now checked automatically against what the agent actually handles; eight that went nowhere were removed and three quick-starts replaced. "What can you do?" now names six kinds of task in about 8 seconds, where it used to name three in about 17.

The work first. CS Today opens on its title with the action buckets straight after it; on a phone the first at-risk account now sits near the top of the screen. The day summary and the daily goal moved below the buckets, and the summary can be moved back up with one tap.

Arrange it your way. From Customize, minimize a bucket (it keeps its count), hide it, or reorder it. Your layout is saved, and CSMs and CS leads each keep their own.

Know where you are on a phone. Inside any of the ten modules, a row under the top bar names the section and module — "My accounts · Sales", for example. Tapping it opens the module's menu, which closes when you pick a page. It never names a section your role cannot open, and desktop is unchanged.

Links that land. Bookmarked and pasted room links open the right deal and update the address to the deal's permanent link. A link to a deal that doesn't exist says so instead of offering to set up a room, and the Voice Room tells "no deal matches this link" apart from "no room yet".

A QBR is a record, not a recalculation. A past quarter opens as a saved snapshot — "Saved snapshot · composed …" — offers Export only, and cannot be overwritten. A quarter with nothing saved says "No QBR was saved for" that period and links to the account.

Only ever your own. Deal rooms, voice rooms, renewal briefs and QBRs open only for records in your own workspace.

Staff access, in your own log. Each staff action that targets your workspace adds an entry attributed to Pact staff, including the reason given — for a suspension, or a sign-in on your behalf. When staff change a setting for someone in your workspace, that is recorded in your history too. Entries never include another workspace's users or the staff member's address, device or session, and timestamps carry an explicit time zone.

Sign-in and imports, tightened. Microsoft 365 add-in sign-in now relies only on a verified identity, and a workspace that is suspended or being closed cannot gain a new one. Imported files only ever add to your own workspace's records.

Entries begin with this release; earlier staff access is not back-filled.

Never stuck behind the sheet. When Pact asks you to confirm it's you before a sensitive action, Cancel and the password field work straight away; only Confirm waits, labeled "Starting…". The server still verifies every confirmation.

Authenticator status you can rely on. If Pact ever cannot check your authenticator app's codes, Settings says "Needs setup again" instead of "On", with "Remove to set up again" as the first action, and codes entered in that state never count toward a lockout. Recovery codes and your password keep working throughout, and the two-factor help page lists exactly the confirmation methods that work.

Sample data comes out on purpose. Removing sample data takes two separate actions: typing your workspace's name, then confirming it's you. A mistyped name removes nothing. Only records tagged as sample are removed — your own records are never touched — and the page now correctly says the removal can be undone for 30 days.

Straight to the thing. A parked call or a failed transfer opens that call. An alert from an automation rule opens Rules with that rule highlighted, and says so if the rule was deleted. Dashboard alerts open the dashboard, enrichment budget alerts open the budgets page, and enrichment job updates open the account.

People, too. Access requests and sign-in security alerts open the person's admin page.

Older ones work as well. Notifications already in your inbox open their item wherever the original link or record can still be found.

Usage checks that don't grow with usage. On a copy of real data, the monthly usage read went from about 130 milliseconds to under a tenth of a millisecond. When many requests arrive at once, one refresh serves them all: 20 simultaneous requests now cause one usage query instead of 40.

What is kept. Monthly usage totals are kept permanently. Per-request usage detail is rolled up into daily totals after 90 days, so older months still show their usage.

The API reference, ready on arrival. Right after an update, the API reference now opens immediately instead of taking up to about 18 seconds to build.

Measured, or marked. For a Salesforce, HubSpot or Pipedrive source, the pipeline page links straight to that source's Sync now, which reports measured counts. Run says plainly when nothing ran rather than recording a run.

Nothing deleted. Runs from earlier builds are kept, badged Not measured, and left out of the success rate. Sample pipelines stay labeled Sample.

Health trends you can trust. Health sparklines draw only scores that were recorded, and say so when there is no history yet.

Every claim cites its release. Each capability card on the homepage links to the feature's own page and to the changelog entry that made it true.

Try before you talk to anyone. Visitors can call the live voice agent with no signup, then request access to a narrated guided tour of a sample workspace.

Pricing in context. The price comparison sits side by side with what the same coverage costs elsewhere, with a pricing explainer.

Setup guides that open. The Setup docs button on each public integration page now opens a real setup guide, or does not appear when there is none. The homepage reads well in light and dark, from a phone to an ultrawide screen.

On a large book, Accounts loaded the first 6,000 records and searched only those, so a search could answer “0 of 18,311” for a name that matched thousands further down. Search, every filter and every sort now run over your whole book, and the count line shows true totals such as “2,289 matching of 18,311”. Filter counts in the side rail cover every account and say so when they could not be loaded, instead of showing zeros. The list loads more as you scroll, and phones load 200 cards at a time.

One customer record. An account's Overview now opens on the record itself. Each field sits beside where its value came from. A provider that disagrees is shown next to your value, never over it, stale values are marked, and you can see what was merged into the account and what each module holds for this customer. Support-only and CS-only seats can open the record too, and a section that fails to load says so rather than showing 0.

Merging duplicates moves the whole customer. Merging two accounts now moves the duplicate's contacts, opportunities and other linked records onto the surviving account, and a link to the merged-away account lands on the survivor and says so. Merges completed before this release are not re-run.

It remembers, with receipts. The agent can recall what you discussed on your own calls from the last 30 days, quoting your words and when you said them, or tell you plainly that it found nothing about that topic. It never paraphrases a memory, never draws on another user's calls, and never counts something you interrupted as discussed.

Meeting prep by voice. “Prep me for my three o'clock”, “prep me for my next meeting” or just “prep me” gives who and when first, then the attendees, the related deal, the last meeting and recent activity, one thing to watch for and a suggested opener. It works for in-person and dial-in meetings as well as video calls, and says what is missing rather than skipping it.

“Tell me about” an account is a real brief. You hear its open deals, contacts on file, any risk or slippage, the last 14 days of team activity and one recommended next step, all scoped to the account you named. Say yes to the offer that follows and it opens the battle card or meeting prep.

Your own mail and files. “Search my Gmail for the renewal” searches the caller's own connected Gmail, Outlook or Google Drive, never a colleague's, and merges the matches with CRM results, each with where it came from. A source that can't be searched gets its own reason: not connected, missing permission, expired or timed out. Nothing from your mailbox is copied into Pact. Drive search depends on your Google connection being current, and Slack, Teams and Notion aren't searchable yet; the agent says so when asked.

Five more requests get done. Over the phone you can now create an account, prep a one-on-one with a direct report, pull evidence from a deal, set up a demo sandbox and save a dictated playbook. Each is read back before it is committed, and “done” is said only after the result is confirmed. The agent also answers questions about Pact itself and your team, and opens a support ticket once you say yes.

Sales Today is the first page where every panel is yours to arrange. Customize, next to the page title, lists the page's panels; on a phone it opens as a bottom sheet with thumb-sized controls. Minimise a panel and it keeps a one-line summary, such as “Coaching tips · 6 tips”, so the signal stays on screen without the bulk. Hide one and a single line remains, “Day summary is hidden · Show”, so nothing disappears without a way back.

Reorder by touch, with the arrow buttons, or with Alt+↑ and Alt+↓ from the keyboard, and Reset returns the page to its default. The layout is saved to your account for that page, and if it can only be kept on this device the sheet says so. Sales Today also now opens with its own “Today” title.

Deals needing you. Manager Today now opens on your team's open deals that need you this morning, each with its reason: a next step promised on a call that is overdue or due soon, or a late-stage deal that has stalled or passed its close date. A stall is measured against your own team's usual time in that stage, as in “26 days in Negotiation · team usually 11 days”. The list covers your whole reporting line and can be narrowed to a sub-team. A read that failed says “Not checked”, never “Nothing needs you”.

The forecast follows the board. Moving a deal to a new stage, whether by dragging it, from the action palette or in a bulk move, now sets its forecast category to match, so a deal dragged to Closed Won counts as won and a reopened deal leaves Won. A category you set explicitly still wins, and deals moved before this release keep the category they had. When the quarter's quota is already made, Forecast says so and treats the rest as upside.

Each rep's real numbers. Manager Forecast now shows each rep's real Commit, Best case and Pipeline, where it had read $0 for every rep, and Gap analysis loads instead of spinning. The Team scorecard counts deals recorded under a rep's email as well as their name and dates wins and losses by their close date, so some managers will see corrected figures.

Charts with receipts. The pipeline funnel, velocity, open-rate and top-accounts charts on the dashboard each show their unit, how many records they read, when they loaded and a link to those records, with a table view and a CSV download that keeps raw numbers. On a phone, bar charts become a ranked list with full names and tappable rows, so no value needs a hover. A day with no sends is a gap rather than 0%, the current week is drawn dashed as “so far”, and a failed load names the request that failed instead of saying “No pipeline yet”.

Rates that are computed. A sequence's Open rate and Reply rate now show the evidence behind them, such as “212 of 501 email sends opened”, counting each email once and a click as an open, or “Not measured” with the reason when your email provider hasn't reported. Journey A/B variant reports count only messages the provider accepted and each open once. Some of these figures will read lower than before, because they now count only what happened.

One at-risk ARR. “What's our at-risk ARR?” gets one answer across Ask and CS Today, and it now covers every at-risk account in your book rather than the eight shown on cards. Ask says when it could not compute a number instead of calling it zero, the report builder offers Deals directly, and exported reports keep their report's name.

Zero only when it's zero. Attribution now counts consent violations and journey touches, which had never been computed, so those numbers may change. Attribution, Forecasts, the SE scorecard, Data pipelines and the Analytics Today sequence heatmap show “Couldn't load” with a retry when a read fails. Saved reports built on the older opportunities data now read deals, like every other surface.

Five connectors that sync. Connect a pipeline-first CRM or ActiveCampaign to bring in accounts, contacts and deals, or connect Mailchimp (every audience), Klaviyo or Kit to bring in contacts. Syncs are read-only and incremental: nothing is written back, a person on two audiences stays one contact, a blank vendor field never overwrites good data, and fields a rep has edited are kept. Each run shows “N in · N failed” with the first error, and a rejected key shows as a red run with a sentence on how to fix it. Runs start once you choose a schedule or press Sync now. Vendor unsubscribes are counted but not yet turned into Pact consent.

Migrate from Close and Apollo with the same wizard as the other supported CRMs: paste an API key, review the inventory and field mapping, preview a dry run, import, and roll back if you need to. Close brings accounts, contacts, deals and activity history, including notes, calls, meetings, texts and email subjects. From Apollo, contacts marked unsubscribed arrive as withdrawn and everyone else as consent unknown, never granted. Anything the source would not let Pact read is listed as a named gap, a run with gaps says “Imported — with gaps”, and re-running a migration never imports a record twice.

Counts that were measured. A data source now shows a record count only when a connector actually measured it. Salesforce and HubSpot sources run the real connector on Sync now and show what it imported, and a source type with no connector says sync isn't available yet and points to the import wizard. The integrations directory leads with “Credential storage only” for connectors that store a key but don't move data yet, and no longer undersells Resend, SendGrid, Zoom, Teams and Google Meet, which already work.

An authenticator app for sensitive changes. Settings now sets up an authenticator app from a QR code, and nothing turns on until one code checks out. You get ten one-time recovery codes, and the dialog can't be closed until you confirm you've saved them. Settings shows whether it's on, when it was last used and how many recovery codes remain, with a warning at three. After five wrong codes in a row it locks for a stated time, and you can still confirm with your password or a recovery code. It confirms sensitive changes; it is not asked for at sign-in.

Stricter confirmation. Confirming a sensitive action now always requires a real proof, such as your password or an authenticator code, and every confirmation attempt, successful or not, is recorded in the audit log. Passkey confirmation for sensitive actions is paused until a fully verified check is in place.

A texted code for phone callers. When a caller is recognized only by their number, Pact texts a six-digit code to the phone on that user's own profile before it sends an email or text, books a meeting, launches a campaign or merges records. It asks at most once per call and never for reads, and three wrong codes lock the check. If a code can't be sent, the action is refused and the reason is spoken. It's on by default, and admins can see exactly what it guards under Admin → Voice → Security.

Tighter workspace boundaries. Account, contact, related-record and consent views read only your own workspace's records, and a request whose sign-in can't be confirmed is refused rather than guessed. Customer-success figures, win/loss, the dashboard's win rate, closed-won and top-owner revenue, and per-rep closed-won count only your workspace's records, so some of those tiles may move to their true values. An IP allowlist is always checked against the workspace you're signed into, and background enrichment updates only companies in the workspace that asked for it.

Shared links that behave. Shared report links now open for the people you send them to, revoking one really revokes it, and a shared link no longer exposes internal identifiers. Links created before this release were never saved, so share the report again to get a working link.

Consent before the phone rings. Every outbound call Pact places, including campaigns, transfers, callbacks, briefings and alerts, calls started from Slack, deal rooms, conference and huddle calls, now checks your do-not-call and suppression list and withdrawn consent before dialing, plus prior express consent when your workspace requires it. Previously most of these paths skipped the check. A refused dial never rings and gives a one-sentence reason where you started it, and a blocked warm transfer takes the customer off hold. Queued callback requests now actually dial.

Consent state on every person. Contacts, the contact card, the Sales people list and the contact header now show consented, withdrawn, expired or no record, each badge saying when the answer was recorded and where it came from, where every person used to read “unknown”. “No record” is stated plainly as not permission, and a failed read shows “Unavailable”. Imports can carry an email-marketing consent column; a bare yes/no column is refused because it can't say which way it points, and an import never overturns a withdrawal. Records imported before this release are not re-evaluated.

Privacy requests that finish. A request can be verified and fulfilled from its page again, either by an emailed link the requester opens or by an ID hashed in your browser plus a reviewer's sign-off, and the email route shows the real delivery result. An erasure that could not remove all of a person's stored contact details is no longer marked complete; it stays open with the reason, and running it again finishes the job.

Clearer records. Preference-center purposes now show their names and legal basis, with a badge for those that need double opt-in, and account pages describe recent activity in plain words instead of system event codes.

No dead air. Some answers used to leave callers in 4 to 17 seconds of silence. There is now a firm limit: you hear the start of the answer within about five seconds, or “I couldn't pull that in time. Want me to try again?”, and “yes” retries. A save already in progress is never cut off, and a slow lookup is never reported as “nothing found”. “Can you hear me?” mid-answer gets “Yes, I can hear you” and the answer still arrives, and on speakerphone the agent ignores its own voice.

Instant everyday asks. “Tell me my top five”, “actually, never mind, cancel that”, “tell me about yourself” and “how did July go?” right after a scorecard now answer immediately. “How did I do in Q2?” is a short headline you can follow with “what about Q3?”, and a quarter that has ended is reported as finished, hit or missed and by how much, in your fiscal quarter if your year doesn't start in January.

The numbers you said. A deal update said in one breath reads back the stage, amount, probability and owner you gave: “seven fifty thousand” is $750,000 and “one point five million” is $1,500,000. An update that names both a stage and an amount saves both after you confirm. Amounts are spoken the way a person says them, as in “12 dollars and 50 cents”.

Answers about what you asked. Asking why a named account is stalled or at risk gets an answer about that account, with the reasons behind the flag, instead of the whole at-risk list, and a cause-and-effect question gets that question answered or a plain statement of what's missing. “Yes” and “hello?” are never taken as account names, picking from a “which one?” menu opens the one you picked, and replies are plain words, with no on-screen labels and no talk of tools.

Callers who aren't your team. An outside caller asking for a teammate is told they have reached an AI assistant and can leave a message, which lands in your voicemail inbox, addressed to that person when the name matches one teammate. Only an explicit goodbye ends a call. The recording question is now 13 words and never re-asks, and an unclear answer continues without recording.

Mail and mornings. “Read my email” says right away why it can't and how to fix it, such as reconnecting Gmail in Settings. The spoken morning standup reads your account signals as plain sentences and ends with the one account to reach out to first.

My pipeline means yours. Owners, admins and managers opening My pipeline saw every deal in the workspace under a “My” title; it now shows the deals you own, and the whole team stays on Pipeline. A deal created from My pipeline now appears on it right away, through the same Add deal dialog as the main board. The New deal dialog no longer wipes what you typed while it finishes loading, and an untouched currency uses your workspace default. Sales Win/Loss shows the closed deals you recorded, rather than one teammate's for everyone. The API reference for creating opportunities now names the deals endpoint whose records appear on the board.

Quotes and decks for every rep. A rep's “Add from catalog” list was empty, so rep-built quotes carried only custom $0 lines. Reps now see your active, published products with list prices, while the catalog stays admin-edited, and members can generate, regenerate and edit decks; templates and deleting decks stay with admins. A quote whose title contains an em dash, an accent or a non-Latin character now exports its PDF, named after the quote.

Every deal links to its rooms. A deal page now has a strip linking to its Deal Room, Voice Room and call brief, plus a renewal brief for renewal deals, and each Customer Success account has a quarterly-review picker listing the quarters with a saved deck. Account links from My accounts, a deal page and Win/Loss open the account again. Deal rooms where someone reacted to a message load their messages and threads again.

Questions that cross the business. A question that spans marketing, sales, outbound, support and customer health is now answered as one filtered result, and the answer shows how the records were linked, flagging weaker links such as a match by email address. When two parts of the business aren't connected, the answer says so in one line, with what would close the gap, instead of returning a silently partial answer. “What happened to the leads from…” returns a status breakdown of those leads.

Everyday pipeline questions answer. “What is our win rate this quarter?”, “deals closing this quarter”, “overdue deals”, “trend of deals closing by month” and “accounts with a follow-up due this month” now return correct counts, where they had answered that the read failed.

Influence you can see. “Which pursuits did our events influence?” gets a real answer, using first-touch or any-touch logic over tracking events, form submissions and email clicks and replies, and says how many touches it could place on an account, or “not established” rather than 0. New website and form touches from a known contact now attach to that contact's account as they arrive; earlier touches are not back-filled.

Suggestions with context. Next-best-action suggestions and buyer-persona insights now draw on your actual deals, account details, recent activity, support tickets and notes, and if one piece can't be read the others still reach the AI.

Social posts on schedule. A scheduled post now publishes on its own at its time, exactly once, and links to the live post. The list shows each state: Scheduled, Publishing, Retrying with the attempt count, Published, or Failed with the network's reason and Try again. A post more than a day late is not published on its own; it fails and says how late it is. The composer marks channels that can't publish yet, such as TikTok and YouTube, as drafts only, refuses an X post over 280 characters instead of cutting it off, and shows scheduled times in your own time zone. Publishing to LinkedIn company pages isn't supported yet and is refused with a reason.

Campaigns reach their segment. A campaign sent to a contacts segment now reaches the segment's real members, and the pre-send check counts the same people the send reaches; consent and email-safety checks still decide every recipient. Re-routing a lead that matches no routing rule now keeps its current owner and says “No rule matched”.

Segments keep what you asked for. Describe a segment in plain language and every condition is either applied or refused by name on its chip, so a segment is never saved broader than you asked. New conditions include not-equal, between, is empty, starts or ends with, and “no activity in N days, including never”. Facebook Page, Instagram, Messenger and WhatsApp steps preview as the recipient will see them, with merge tags filled and any reason Meta would refuse the send. The Forms gallery shows each form's real submissions, and its Edit button opens the builder.

Saves that stick. In the CS workspace, “Create plan” could report success while the list still read “No active onboarding plans”, and the same was true of every CS write. All fifteen write actions, covering onboarding plans and milestones, save-play runs, expansion triage and promote, quotas, and QBR slide edits and reorders, now save before they confirm. Changes that did not save before this release are not recovered, so a plan that never appeared needs to be entered again.

QBR decks for every account. Opening a QBR deck failed on some accounts, a deck that did compose wasn't kept, and Export PPTX couldn't download. Decks now compose with seven slides, are saved, and export as a real PowerPoint file. Exported slides render bold and italic properly with no stray formatting symbols or internal source notes, including decks created earlier, and the editor previews each slide as your client will see it.

Cases and at-risk. Open a support case from the number customers quote, such as CASE-1014, and every co-pilot panel on the case loads, always within your own workspace. When churn predictions are off for a workspace, the At-risk page says so and points to CS Today instead of showing “Not Found”. The customer lifecycle panel now opens on SE Today, Support Today and every module home for anyone who can open that page.

Field Rep in the switcher. Field Rep now appears in the module switcher for workspaces whose plan includes it, and opens on Today at phone and desktop widths. “Plan a visit” on any account opens Today with the stop filled in and linked to that account, and a precise on-site check-in pins an account that has no location yet, never moving an existing pin.

Visits that survive the field. Field visit pages open again, with a pre-visit brief built from your open deals on that account. Losing signal keeps the visit on screen with a dated “No signal” notice and Retry, and your draft note survives a reload in that tab. “Add photo” opens the rear camera and attaches the picture to your note; photos need a signal, and the button says so. The main action, “I've arrived”, now sits above the phone's tab bar where a thumb can reach it, and the visit note can be saved while still on site. Consulting workspaces get consulting outcomes when they depart, such as Workshop held or Decision needed from client.

For solutions engineers. SE Today's calendar panel shows your meetings for today, where it had shown “Couldn't load” for everyone. Uploading an RFP now returns as soon as the file is saved; the page shows “Reading questions…” and updates itself when they're ready, or says it couldn't read them and asks for a re-upload. Battlecards and the RFP list tell “couldn't load” apart from “nothing here”, and a slow upload no longer shows a failure that invites a duplicate.

Reuse before you buy. Each enriched field now has a shelf life, such as 30 days for a job title, 90 for revenue and a year for headquarters. A repeat lookup inside it calls no vendor and costs nothing, so only missing or out-of-date fields are bought. The result leads with what you spent, then lists each field as New, Reused (“checked 2 days ago · good until Oct 22”) or Unknown with its reason. A value someone on your team entered is never re-bought, “Re-check current values too” forces a fresh lookup, and if your enrichment budget can't be read, nothing is bought and the dialog says so.

What can be filled, before you ask. The Enrich sheet on an account shows only the fields an account can actually get, with a line such as “9 of 23 fields can be filled now” and the provider connection that would unlock the rest. Person-only lookups are no longer run against an account, so you aren't charged for lookups that could never match. Data sources Pact can't sync yet, such as Stripe, Marketo and Mixpanel, appear under “Not built yet” with a request link and the CSV import path instead of asking for a secret key.

A key is checked before it's stored. Connecting Apollo, Cognism, Lusha, RocketReach or ZoomInfo with your own key now checks it with the provider first. A key the provider refuses is not saved, and the sheet says “Nothing was stored” with the provider's reason. Each provider card shows connected, needs attention or unverified, the published per-lookup price or “Not published”, and a Disconnect button.

A Finance role. A finance lead can now read revenue recognition without being a workspace admin, while running the sweep and closing a month stay with owners and admins. Anyone allowed can record a wire, ACH or check payment against an invoice, and recording never moves money. Partial payments add up and the invoice turns Paid only when the balance reaches zero. The dialog shows what's still owed, refuses an over-payment, a repeated bank reference or a closed invoice, and flags a reference that doesn't match the invoice's wire reference.

Invites say where people land. All three invite dialogs gain a “Works as” field with a line explaining what that role can do, the role picker accepts Compliance and Finance, and an invite can no longer grant more access than the person sending it has.

Your name on what clients see. Proposals, quote PDFs and invoice PDFs now carry the sender name set in your branding, or your workspace name, instead of “Pact”, and a custom domain in the quote PDF footer no longer loses its first letters. In the consent app, the privacy-request shortcut now shows where identity verification stands and links to the request page to finish it.

Branch in sequences. The sequence builder's Branch step is now a real step: draw a Yes and a No path, choose which engagement counts (replied, clicked a link or opened), and both paths save together. Opens are off by default, and the inspector explains why: mail-privacy proxies open messages automatically. The builder refuses routing it can't follow, such as a loop, and warns when a path ends the sequence. On a phone, the sequence reads as an outline with each path indented under Yes or No.

Branch in playbooks. A playbook Branch now has a structured condition, with field, operator and value including “is one of”, and saves both its Then and Else paths, where the builder used to keep only Then and drop the condition. The inspector says which path a record with a missing field takes, and a test run shows which path a given record would follow.

Workflows say what can't run. Six step types with nothing to run them yet, namely incoming email, cost cap hit, assign owner, voice call, generate RFP and run report, are marked unavailable with the reason, and a workflow that uses one won't save until it's removed. Existing workflows are not changed, and the dry run says how many steps would do nothing.

These are builder changes: what you design now saves exactly as drawn, and test runs show the path it takes.

A way in to every page. The Sales rail now includes Tasks, Meetings, AI Radar, Calls and Power calling, plus Approvals for managers; Support gains Cases, and Admin gains Workflows. Eight pages you could only reach by typing an address now have a link: My contacts and Win/Loss in the Sales rail, a Meetings card in Settings, Currency & FX in admin settings, inbound webhook receivers, 24-hour slow-query trends, and a Live monitor on sent campaigns. Support agents, sales engineers, field reps and compliance users now land in their own module when your plan includes it, and SSO groups such as “Customer Support” or “Field Sales” map to them.

A switch that sticks. After switching from Support to Sales, opening Inbox or Home used to bring Support back. The module you choose now stays chosen on phone and desktop, and tapping Home on your module's home scrolls to the top. In sections with their own tab strip, such as IAM and Social, the strip keeps its place as you move between pages.

Pages that start with themselves. Marketing, Analytics, Data, Consent, Settings, Home, onboarding and admin pages now open with their own title, and module homes put their own content above the customer lifecycle, which now reads in plain language with its sources behind “How we know”. Several “coming soon” notes became the working feature: an email draft sends straight into a new campaign, billing usage shows what you're billed and how much of each allowance you've used, and the HubSpot and Pipedrive cards connect through Data sources.

Errors that don't take the page. If a page inside a module hits an error, the module's navigation stays usable, with Try again and a Report that includes a reference for support. The “Watch the 90-second tour” button can now be dismissed, and every tour stays one click away under Help → Tours.

Nothing rests over content. The floating corner button that covered Dashboard activity rows is now a sixth tab, Actions, in the bottom bar, with its count badge. Stacked notices take a single row and disappear once dismissed. Dashboard Recent activity shows business activity with readable headlines such as “Email · Logged” and names instead of ids, and leaves out sign-ins and automated calls.

Your work sooner. On a phone, the Home greeting is one line instead of a large card, so today's deals are on the first screen, and dashboard KPI tiles drop their decorative icons. The Dashboard title is never cut to “Dash…” at any width from 320 to 1920 pixels; when the header is tight, the Sample label moves to a small line beneath it.

Hey Pact fits. The Hey Pact panel stays on screen with its close button and your question visible, only the conversation scrolls, the text box stays above the keyboard, and swiping to dismiss no longer fires while you scroll.

Readable details. Small labels, including phone tab names, sidebar badges and changelog tags, render at their designed size and color, so “Records” no longer truncates on a small phone. Warning notes on call recaps, deal decisions, the email composer, lead scoring, and support, customer success and admin pages were white on pale amber and are now readable in the light theme.

Releases you don't notice. When a new version rolls out, each server now finishes the requests it's handling before it stops, so pages that are loading, live updates and clicks keep working, and live views such as notifications and activity reconnect right away.

Lighter tabs. A page-preloading hint was chaining endlessly, so every open tab kept re-requesting pages for as long as it stayed open; a page load now preloads its few likely next pages once. App sounds load the first time they play, and never for someone with sound turned off.

Live again. The incoming-call overlay appears again when a call comes in, and the Pipeline and My pipeline boards update live when a teammate moves a deal. Snoozing the setup checklist now sticks across devices, and snoozing the daily goal works.

Things that now do what they say. A saved report's CSV and the audit-log export buttons download the file, with a reason if a download fails. Browser push registers your browser and says what will arrive, with a real test send; AI-agent calls with a recording play it; data sources list their full run history; contacts show when each person was last touched; and sequences and journeys can be shared by link. On SSO settings, Show SP metadata displays your service-provider metadata. Records created through the public booking page, forms, surveys, campaigns, segments, journeys and templates come back with their real identity, so a new booking links to its calendar event.

Held, not dropped. If a workspace is suspended, incoming email events, Slack messages and calls are kept and processed when it resumes; once a workspace is scheduled for deletion, new inbound data is refused.

ask_workspace answers like Ask. Agents connected over MCP that call ask_workspace used to get answers from a different engine with no confidence information. They now get the same answer a person gets in Ask: a counted answer arrives with its measured confidence, an unmeasured one says “not established” instead of giving a number, and conversation threads continue.

This changes the payload. The response now carries answer_tier, confidence, kpis, gaps and steps, and ai_powered, sources_searched and retrieval_unavailable are no longer top-level fields. An integration that read those keys should read gaps instead.

iOS SDK. The PactSDKCombine product the package listed now has code behind it: its publishers start on first demand, can be cancelled, and pass Pact errors through unchanged. The SDK builds under Swift 6 strict concurrency with no errors, and every Swift sample on the iOS SDK page compiles, including corrected quickstart and offline-queue samples.

The sample workspace is how most people first see Pact, and it used to be a set of disconnected rows. Account stages, deals, calls, health scores, deal rooms, buying committees, quotas, win/loss, battlecards, forms, templates and the activity feed now describe the same eight accounts, so a story you start on Sales Today continues on CS Today and in Analytics. Sample pipeline boards have their columns, Manager Today and Forecast show a real Commit instead of $0, and dates stay relative to today.

Every sample row is still labelled as sample, and removing it still takes two deliberate steps that leave your own records untouched.

The same release fixes two things for every workspace: Support's knowledge-base search returns articles again, and a WhatsApp or Messenger mention can no longer blank the unified inbox.

Every new workspace starts with sample data so the product is not empty on day one. Until now that data had no lifecycle: it looked like yours, it went out in your exports, and clearing it meant trusting a script.

Labeled. One rule decides what is sample — a seed marker, or a row older than the workspace's go-live moment on a table that carries a watermark. Nothing is inferred at render time. On the dashboard the label is now a compact ✦ Sample tag beside the title instead of a widget in the way of your own numbers; tap it to see the seeded record counts by entity.

Kept out of exports, with a count. A data-subject access answer, a GDPR export and a portability bundle all leave sample rows out and say how many were left out and why. Before this, a customer's "here is everything we hold about you" bundle silently mixed our demo rows into their evidence.

Purged without touching a real row. The go-live purge builds every statement on the same engine that deletes a whole workspace, so every delete carries a workspace predicate, and it proves real rows survived independently of its own predicate. Demo usage no longer counts toward a real meter, and seeded users no longer receive credentials that can be derived from the seed.

Deleting a whole workspace is now provable, too. A relation map of every table in the schema classifies each one — deleted by workspace id, deleted through a parent, retained with a written reason, anonymized, or rebuilt — and a statement guard fails if any emitted delete lacks a workspace predicate. Suppression and audit rows are never plain-deleted; an address becomes a hashed tombstone so a person who asked not to be contacted stays not-contacted after their data is gone. A customer who asks for their workspace to be deleted can be answered with evidence instead of a promise.

Of the four request types the DPO console offered, only delete did anything when a request was marked fulfilled. Access collected evidence nobody sent, rectify marked the request done and left the record unchanged, and portability produced nothing. There were no request types for restriction or objection, nothing checked that the requester was the data subject, and nothing chased a missed deadline.

Access now emails the subject a single-request download link, and the answer says what was searched and what was not. Portability produces a versioned bundle — profile, consent ledger, form submissions, identities. Rectification applies the requested changes, re-encrypts and re-hashes the record, and keeps a per-field before/after with identifiers masked. Restriction adds a suppression that every gate honors — sends, retrieval into a model's context, agent memory, enrichment — while storage is untouched. Objection lands as withdrawals on the consent ledger. Erasure worked before and is unchanged, plus a guard for shared addresses.

Identity is verified before fulfillment, and an overdue request is escalated hourly instead of aging quietly.

Underneath, a privacy drill against a copy of production found the paths that did not survive contact and fixed them: an erasure used to *unsuppress* a person by deleting their suppression row, so mail could resume; the retained list now keeps a hashed tombstone. A suspended, pending-deletion or deleted workspace is now refused on sessions, API keys, webhooks, scheduled jobs, AI jobs, billing, inbound voice and sequence sends — and an unreadable status fails closed.

A read can end three ways, and each needs its own answer. Ok, nothing there gets the page's own empty state, and a real zero is a zero. Failed gets one named failure with a request reference and a Try again. Refused gets a lock, the module named, whether the workspace or the seat lacks it, who can grant it, and a working link.

Before this, Analytics tiles printed $0 in pipeline over a 0% win rate while the read was in flight or after it failed — byte-identical to a workspace with no pipeline. Support Today printed "Inbox zero — nice" over a cases table the server could not read. The manager coaching page printed "the team is moving deals at expected dwell" over a query that had never once executed, beside a skill rubric that scored a rep 100 on discovery from an empty result. Two privacy-portal reads told a data subject they had no consent records when the read had raised.

The top bar had the same shape in the one place nobody checked: the notification bell disappeared entirely on any failed count — a 502 during a deploy looked like a workspace that had never bought notifications. It now stays, in the same footprint, and says what failed.

The primitive underneath was fixed as well. The read-isolation helper recorded a gap only when a read *raised*; a helper that swallowed its own failure and returned an empty list exited cleanly, and on Postgres left the shared transaction aborted for the next query. It now records the failure that does not raise, so the surfaces above cannot be lied to by the layer below them.

The standing rule is no shell pages: real data, no placeholders, no dead links. A code read and a sweep found the places still breaking it, and every one is now either real, honestly empty, or gone. Nothing unreal was made to look more real.

The live voice page played a timer-driven scripted call with invented tools and sentiment; it now opens the real Live tab over your actual calls, and the scripted view is deleted. A campaign's A/B tab split untagged sends into variants by the parity of their id and spread opens across them; untagged sends are now counted as untagged and never bucketed, rates are null unless opens are variant-tagged, and a campaign with no variants says it is not a test. The send-time tab printed a hardcoded "9:30–11:00, +18% open"; it now shows the optimizer's recommendation for the campaign's segment, or the reason there is none. Customer-success playbooks listed five invented auto-enroll plays with activity counts and outcome claims; they are removed and the real expansion plays kept. The marketing settings page printed a made-up mail domain, caps and DMARC status; it is now an index of the real configuration pages that says what is not configurable.

Alongside them, toast-only controls that confirmed actions they never performed, test harnesses reachable from production, and links to pages that did not exist were removed or wired to the thing they named.

Asked out loud on a phone, "What caused the 3M stall?" arrived as "What caused the three m stall?" and Pact replied that it could not find anything matching that in the workspace — about a workspace that holds an account named 3M. The spoken form now resolves to the record, and it resolves on the structured branches too, so a question about one account is answered about that account rather than tenant-wide. A near miss never narrows the answer, and an ambiguous name is left ambiguous and logged.

When there is genuinely no match, the suggestions under the answer are the closest records on file instead of the three most recently added — and the gap sentence no longer points at "the suggestions below" on a surface, or a phone line, that has none.

A retrieval that could not run is no longer rendered as a workspace that holds nothing. The engine learned the difference two weeks ago; every consumer dropped the flag on the floor. It now reaches all six — the panel, the thread, the phone, the widget, the API payload and the extractive fallback — and a seventh engine the review never named. On screen, retrieval failed, matched nothing, not entitled and has results are four distinct states.

Time is bounded and accounted for. The interactive path inherited a batch retry policy that could take 92 seconds to give up; it now spends a 15-second wall-clock budget and, when that expires, degrades to the record list and says so. Every answer carries a request total and a per-stage ledger, so a slow answer can say where the seconds went instead of leaving a mystery. Time nothing names is reported as unaccounted, never dropped.

In the AI usage ledger, an error is now filed under its exception class instead of "unknown", and three ordinary words containing "rate" no longer file a failure as a rate limit.

The bell said 285 unread over a dropdown holding roughly forty items, because 140 of those rows were one unfinished passkey enrollment reported 140 times and forty more were one usage threshold reported forty times. The twenty mentions and nine access requests that actually needed a person were underneath them.

A burst of one standing condition now renders as one item and counts as one. Two mentions two hours apart still count as two, and two different threshold conditions never collapse into one line — the earlier grouping key was coarser than the condition it named, so an abandoned enrollment and a failed one shared a row and could re-raise each other's payload. Muting a kind moves the badge. Clicking a collapsed row clears the whole group, and a row with no destination can still be dismissed.

The unified inbox — the one surface built to be "everything that needs you, triaged" — asked for the uncollapsed feed and was the last place still rendering a condition as 140 rows. It now asks for groups, dismissing a grouped row archives every id it stands for, opening one marks them all read, and a standing condition is badged as a volume while an event kind is badged as updates.

The notification test-send in settings answered 200 and sent nothing; it now either produces a notification or says why it could not.

The lifecycle lane stopped at Won and resumed at Supported. The stretch between the signature and the second invoice — implementation, and the renewal decision — was drawn as the absence of anything, and that is where customers are actually lost. It was never a data problem: onboarding plans, subscriptions and expansion signals have carried an account id for months. The lane simply never reached them.

The lane now has seven rungs, each with a written map of what it can and cannot count. Onboarded and renewed are real counts from real ledgers, scoped to your workspace. A rung whose ledger did not answer is a named reason, never a zero.

The view itself was rebuilt at both widths, replacing a rung strip over a table that named the same accounts twice. Journey draws one account on a vertical, dated line, newest at the bottom, a today marker, and the future below it — an SLA ceiling in five days, a renewal decision in nineteen. Portfolio is five columns — account, lifecycle, needs attention, health, open — with one attention cell per row on three levels, the rung strip folded into the row as a seven-segment bar, sorted by urgency.

Open cases and expansion signals were undated on the wire, which is why a timeline was not possible before. Both now carry the dates their tables have always held, so the line can show causality: an expansion converted on the 2nd, four P1 cases on the 8th, health down 22 points, a ceiling in five days, a decision in nineteen — readable in one screen on a phone.

Dashboards now show open pipeline from the deals ledger, with an explicit stage predicate on every money aggregate. The match is by substring, so a stage such as "Renewal — Lost" is closed and excluded, not counted as a live renewal.

Five figures that were never right went with it. The pipeline-value total on every stored snapshot summed a column that did not exist, so it had been 0.0 on every snapshot ever taken. The My Day widget returned a server error on Postgres. Two readers filtered on a status column that was not there. A customer-success renewal read was not scoped to the workspace. And the inbound caller's open pipeline — the number that decides whether a known caller is bumped up the queue — had read $0 on every call because the query raised and the failure was swallowed.

A voice-agent call's turns were in the database and already served by two working endpoints, but the call page only knew how to resolve a call-log id or a recording id and dead-ended on everything else. Measured on one workspace: calls a person could open from Calls went from 167 of 551 to 551 of 551. Another workspace's call is refused with the same answer as a missing one, so an id cannot be probed.

The inbound screen-pop — the card that appears when a known contact calls in — returned a server error for every caller it matched, and the transfer whisper went silent with it. It is fixed, and it now serves a caller context pack: who is calling, their open deals and cases, and the last conversation. A transfer carries a handoff evidence pack so the next person is not starting from nothing.

The relay could also lose a turn the caller had already heard answered, or store it twice stamped as an interruption that never happened, when the socket tore down at the wrong instant. Exactly one row per answered turn is now written whatever the teardown does, and no interruption is fabricated — which also stops those phantom rows polluting the cut-rate analysis.

The custom media transport's admit gate had imported a module deleted two weeks earlier, so every call that reached it raised a server error instead of speaking its refusal; the import is fixed and the whole admit path now fails closed with spoken TwiML.

Every fix here was measured on real calls, not on a fixture. Say "update that" followed by a stage and Pact applies it; it no longer asks "anything for the deal amount? … anything for the close date? … you can say skip" for every optional field before doing what you asked.

A filtered search that returned zero used to be spoken as "you have no open deals right now" — on a call that had just counted 27. The call now remembers what it resolved, and a zero from a filter is spoken as a zero from that filter. When the workspace holds the account you named, "tell me about three m" reaches 3M instead of an invented account built from a filler word.

A voice-CRM write that ran past the turn's timeout was narrated backwards: "sorry, that took too long," followed by an invitation to retry — while the deal was updated anyway. The write is idempotent and its receipt is durable, so after a timeout Pact reads the receipt and tells you what actually happened.

"Of course —" and "No problem —" no longer open a sentence that goes on to report a miss. Amounts are spoken in full — "four hundred and eighty thousand dollars", not "$480k". A capability menu is no longer recited on every failure.

The recognizer's vocabulary bias — the list of your accounts and contacts that helps speech-to-text hear them — was built and cached on every call and then never sent on the transport that serves most of them. It is sent now, under a byte bound that is raised one rung at a time only after a real call connects on the rung below. A misheard tool phrase is recovered by sound against phrases already seen, with zero wrong claims on 522 real turns. Chained requests — "open a deal with 3M and progress it to prospecting" — are split where they should be and left whole where splitting would be harmful.

This is the batch's security work, stated plainly. Everything below is live; nothing here is a switch waiting to be thrown.

Reads across workspaces. A link-unfurl endpoint took its workspace from a request header and carried no authentication, so an anonymous request could read any workspace's deals, accounts and contacts by naming the workspace and guessing an id. A workspace's AI-cost overview grouped by workspace with no predicate, so any customer's admin saw the platform's five biggest workspaces and their exact spend. A company that belonged to no workspace was readable by every workspace across eight routes. Event and collaboration WebSockets authenticated only when a variable production never set was set, and a signed-in user could stream another workspace's events by naming it. All closed, and a static gate now runs in CI so a new one-sided join fails the build.

Writes across workspaces. Feature flags are global — one row per flag for the whole fleet — and every route that could create, retarget or delete one was gated on a workspace-level permission, so any workspace admin could remove the gate governing everyone else. Those routes are now Pact-staff surfaces; the per-workspace path is untouched. An erasure in one workspace deleted matching notifications in every workspace. A suspended workspace could un-suspend itself and any owner could self-upgrade their plan. A share link for a report never wrote its expiry, so every share link ever issued was permanent; they expire now.

Callbacks. Twelve inbound webhook routes accepted an unsigned POST from outside. Email-provider webhooks, e-signature callbacks, calendar and social callbacks, and the Twilio voice-room routes now verify a signature or refuse in production, and a signature-bypass flag is ignored when the app runs as production. An unauthenticated media socket is closed after fifteen seconds instead of being held open for half an hour. The bounce-and-complaint webhook that verified nothing — so an anonymous caller could suppress any workspace's mail to any address — verifies now.

Underneath. Every production transaction now runs bound to its workspace or on an explicitly elevated, named path, and the isolation checks in CI evaluate each table's policy as a non-bypass role rather than only checking that a policy exists. The database role switch that makes Postgres enforce those policies is still staged, as the runbook records; this batch makes the day it is thrown a smaller one.

Every mobile defect reported in the week to the 15th was found by a person looking at their own phone, while six mobile gates ran green every night. The gates measured boxes; none of them put a finger on anything. Three things changed.

Drag handles. One grip — 44 by 44 pixels below the laptop breakpoint, with touch-action none — replaced seven hand-rolled ones. Six of the eight reorderable lists in the product could not be moved by a thumb; they can now, and a gate drives real touch events at 390 by 844 and fails if the list does not move.

The top bar at 1024–1279 px. The sidebar takes 260 px and the right-hand cluster could not shrink, so on 31 routes the bell and account menu ran 50–230 px past the edge. In that band the view-as label goes icon-only, the tier and Hey Pact pills wait for a wider screen, and the account name hides. Every control stays reachable.

The analytics range rail at 390 px. The rail's port was 138 px against 315 px of chips, so four of seven ranges were off-screen with nothing saying so — and on the year-to-date range the active chip sat entirely out of view, so the page rendered "7d 14d 30d" with nothing highlighted above figures scoped by that selection. The rail now scrolls the active chip into view and says when more is hidden. The same page also took its whole route into its error boundary whenever the summary arrived without KPIs; it degrades per-tile now.

Tracking on a phone is its own design rather than the desktop table narrowed, with a paging count that no longer lies while the browser-side source filter is on, and an empty table that says which kind of empty it is. And an announcement banner that overflowed both edges at 360 px — the one real defect behind eleven of the layout backlog's failures — is fixed.

Today, Route, Territory, Scorecard and Visit all opened on an error for every rep. The module's client was the only one in the product on a raw fetch with no API prefix and no authorization header, and the browser proxies only the prefixed paths. It now uses the standard client, and a contract test covers every request it can make.

Once the pages were reachable, reading them turned up three more defects. A visit or territory belonging to another rep in the same workspace was open to any rep; it now answers not-found, identical to a missing record, on all seven visit routes and on territory read and archive. An outcome, objective or check-in method wider than its database column crashed the save with a server error; each now gets a validation error naming the field. And the offline outbox never actually worked offline — a queued visit is now kept with no signal and replayed, in its own savepoint, when the connection returns, and each queued action can only touch the queuing rep's own visit.

Every module root now lands on that module's Today.

The account list is the page a rep opens most, often on a phone, and it had sat on its script budget through three bumps. Its first load now carries 46 kB less JavaScript to download, parse and run before the list is interactive — 279 kB to 233 kB, exact gzip sums, with the budget left where it was.

Nothing looks different. The bulk-action bar loads on the first row selection, the guided tour on the first "Take the tour" click, the right-click Ask Pact dialog and its voice stack on the first open, and a base64 fallback that no browser takes is no longer bundled at all. Each deferred surface is fixed-position or absent until opened, so nothing shifts, and a guard test fails if any of the four static imports comes back.

The sidebar is the one component every page mounts, and it rendered 239 rows with nothing that could be put away: 11.5 screens of scrolling in the expanded desktop rail, 17.5 in the phone drawer. Measured in a real browser off the real component.

Nav groups are now collapsible. The state is persisted per user and per rail scope, so what you closed on the main rail stays closed there and the admin rail keeps its own. The default is every group open except the thirteen admin groups, which hold 123 of the 239 items and are visible to owners and admins only — who already have a focused admin rail for the same territory. With that default the expanded rail drops to 116 rows and 6.3 screens on a desktop, 9.6 on a phone. Nothing is reordered and nothing is removed.

The video-meetings integration's route matched any provider segment, so the app answered "unknown provider" for fifteen endpoints across five other integrations before the router that owned them was ever reached — and the settings pages rendered that as Not connected or Not configured for integrations that were wired correctly. The route now declines anything that is not a video provider and lets the request fall through, whatever the router order.

Journey attribution joined enrolled subjects to contacts on a plaintext email column that a migration dropped months ago. The query failed on every database, the failure was swallowed, and every journey showed $0 attributed pipeline on the list and on detail. Enrolled subjects are now matched through the workspace-salted email hash, the same way segments already match, and opportunities are filtered to the workspace rather than matched by company name across all of them.

For anyone integrating against the API, /health now returns the deployed commit, so a support conversation can start from what is actually running.

An assistant that answers in one confident voice makes you trust the weakest sentence as much as the strongest. Ask Pact no longer does that.

Every element of an answer now carries a provenance tier. A number read straight out of your workspace is marked as measured. A number computed from those is marked as derived. A model's judgement is marked as such. And when a piece of the answer could not be obtained at all, that is its own tier — a labelled gap that names what failed, rather than a zero, a blank, or a plausible-sounding sentence covering the hole.

The answer also arrives differently. It decomposes first: you see the question broken into the parts it will answer, then each part fills in, with live progress and an honest estimate of what is left. The spinner that used to run forever when a step died now resolves into the gap that killed it.

Asking about something your workspace has no row for used to produce a confident answer about nothing. Now the premise is corrected first — "there is no account by that name; here are the three closest" — and then the question is answered against what does exist. Pivots to the adjacent question sit one tap away.

The same ladder is spoken. Ask over the phone on 1-424-PACT-MCP or through Hey Pact and you get the reading first, the gap as an answer rather than as silence, and consent enforced fail-closed on every path.

Underneath it is a catalog, a planner and an executor over a measured cube — exercised against a 151-question breadth corpus with zero refusals.

Passkeys were the sign-in path most likely to leave you stuck with a button that did nothing.

Three separate faults are fixed. Cross-device sign-in — scan the QR code with your phone to sign in on a laptop — had lost its transport hints and its ceremony timeout, so the browser often never offered the option. A credential identifier longer than 32 characters hit a column that could not hold it, and every passkey login turned into a 500 because the failure was caught by code whose own docstring promised it was harmless, leaving the transaction aborted for whatever ran next.

The third is the rule rather than the bug: no control in the sign-in flow is inert now. Every ceremony either completes or tells you exactly what happened — cancelled, timed out, no credential on this device, wrong domain — instead of failing silently and leaving you to guess which.

Issuing a login challenge is a state change, so it writes an audit row. It did not before, which meant the most security-relevant moment in the product was the one with no record of it.

Separately, sign-in stopped sharing its connection pool with everything else. The isolated pool exists so that a busy workspace can never make sign-in slow; collaboration and the two live-update transports were sitting in it and have been moved out. SAML assertion replay protection now survives across processes, so a replayed assertion is rejected by any server that sees it, not only by the one that saw the original.

Every module — Sales, SE, Analytics, Data, Consent and the rest — now opens on a Today page assembled from that module's own declared lifecycle, rather than from a layout copied between them.

The lane was proven on one module first and nine more now declare their own, which is the part that matters for what comes next: a module gets its home by describing its lifecycle, not by someone hand-building another page.

The phone half was a genuine defect, not a polish item. Eight module homes rendered nothing at 390px — the lifecycle lane was a desktop grid with no mobile expression, so the page loaded, occupied the viewport, and showed no content. Both widths are now designed deliberately: at desktop the lane is scanned across, at phone width it is read down, and what earns a row differs between them because the reading differs.

A Home card that is empty and a Home card that could not load are no longer the same picture — the second one now says which read failed.

The Sales module home also stopped inventing a pipeline. It previously rendered plausible-looking rows whenever the API returned anything short of a server error, which included a permission refusal — so a workspace without the module could see a convincing pipeline that was not theirs. It now performs the cross-module read it was always missing, and renders a labelled gap when that read fails.

A zero is an answer. "I could not read this" is a different answer. For a long time Pact rendered the second as the first, across a lot of surfaces at once.

The general fix is a contract: a metric whose read failed renders as a labelled gap naming what failed — never as a number, never as an empty row that looks like "you have none of these".

Where it bit hardest: one broken widget was aborting the transaction it shared with five others, so a single failure made the whole dashboard invent reasons. A swallowed query was reporting 0 open deals against 350. The tenant AI spend line was reading a column that does not exist and showing the result as $0. Cost dimensions with no ledger behind them were rendering as though they had measured zero.

KPI tiles got the same treatment from the other direction: a tile with no honest history now says so, and a flat line drawn from a single point is no longer presented as a trend.

Metrics now declare themselves — what they measure, from where — so that when one of them does report zero, the zero can be trusted. There is a health surface that will not print a number it did not measure.

Lists learned the same manners. A result that was silently cut off now carries a visible banner saying it was cut off, and the entity picker says what its eight rows are eight *of*.

Twenty-five separate repairs, all of them about the same thing: what it is like to be on the other end of the call.

Menus are questions now, not recitations. "First, X. Second, Y. Third, Z" was interrupted by the caller in roughly three quarters of the cases where it was used; "X, Y, or Z?" almost never is. Four renderers were still counting options off and have been converted.

Silence has been removed from the long path. "Got it —" followed by twelve seconds of nothing was the worst version. Pact now says what it is doing rather than that it is still doing it, at every cue, and a briefing starts speaking while it is still being composed instead of after. A question with a constant answer — "top deals" — no longer pays a model to work it out.

Repeating yourself gets a different reply. Saying it again used to get the same sentence back, word for word.

A declined request says which condition declined it. A briefing that will not run names the reason rather than failing into a generic apology, and a request Pact cannot complete no longer promises a callback that was never going to be sent.

An offer Pact makes, it can accept. Several replies ended with an offer that nothing downstream could act on; where two offers appeared in one reply, the answer bound to the wrong one. The layer that makes an offer now records what it offered, and the deal list closes on a question that actually narrows — and can then answer it.

A confirmation left pending no longer swallows the rest of the call.

Pact scopes every query to the workspace that asked, in the application. Five places where that scoping was missing or wrong were found and closed: the accounts list and its count were running without a workspace filter; stage history resolved its company reference across workspaces; an automatic merge could read and overwrite another workspace's row; customer-health had four cross-workspace reads; and pipeline reads were re-bound after the deals migration.

Underneath that, the rule is being moved down into the database itself, so a query that forgets is refused rather than answered. Isolation policies now cover every workspace-scoped table — 783 of 783 — with the workspace identity bound on every transaction rather than on a connection a pooler might hand to someone else, a row with no workspace on it no longer readable by every workspace, and three background jobs that were bypassing the policy on the serving connection routed onto their own.

The switch that makes those policies bind is staged and has not been thrown. It went live once on 14 September and was reverted the same afternoon after it locked every device out for 2 h 20 m; the app therefore still connects as a role the policies do not apply to. We would rather say that than let a policy count be read as a guarantee, and this entry will change on the day it changes.

Separately, an unauthenticated live ticker that could return data across workspaces was deleted rather than fixed. It had no owner and no customer depending on it, and the safest version of that endpoint is the one that does not exist.

Outbound traffic got the same treatment from the other side: SMS, voice, calendar, Slack, webhooks, social posting and CRM write-back now transmit only through the egress guard, so there is one place that decides whether Pact is allowed to talk to the outside world on your behalf.

A perfect transcription can still reach the wrong record, and that was the largest single class of voice failure.

Recognition is now biased toward the name a caller says, rather than the string the CRM stores — "three am" resolving to nothing appeared nine times in the corpus and is now understood as 3M. Being polite was another one: a courteous phrasing wrapped around an account name made the account unreachable.

Thirty ways a rep describes their own work — the vocabulary of the job, not of a customer — were being read as company names and searched for. They are now swept out of account search before it runs. So is the caller's own filler.

Where a name is genuinely ambiguous, the fix was to narrow the ask, not the book: Pact asks a question that distinguishes the candidates instead of quietly picking one or widening the search until something matches. The deal menu was labelling accounts while speaking deal names, which is why it never trimmed correctly.

Two things a voice product must never get wrong: who it is, and who it is talking to.

Disclosure. Pact identifies itself as an AI assistant before it asks anyone a question with legal weight. That was compliant before this batch and sounded like a warranty notice, because the disclaimer was prepended as a separate sentence — "Hi, this is Pact, an AI assistant. Hey Dean, what's up?", two introductions where one is a disclaimer. The clause now rides inside the identification each greeting already made, in Pact's own register, and it is present on every call Pact places, not only on the authenticated ones.

Identity. A recognized caller ID is a hint, not a credential. Pact now steps up to a real check exactly where the caller ID is not enough, rather than trusting it everywhere or challenging everyone.

Writes. A command that was misheard must not execute a write. Confirmation is now by consequence — Pact repeats what it is about to change, not the words it thinks it heard.

Register. On a call Pact was on, it may not describe itself as a person. That had to be enforced rather than requested.

An unknown caller also gets a better first impression rather than a deliberately equal one: the greeting no longer offers two words that reached nothing, and no longer asks for a term that nothing on the other side handles. If you need one, "get me a human" now reaches an escalation hotline — which is off until a workspace configures a number, so it says so rather than pretending to transfer.

What Pact can do out loud is no longer maintained as a list somebody has to remember to update.

Two failure shapes were behind most of the "it just didn't understand me" reports. The first: a tool you can say and cannot run is worse than one you cannot say, because the failure looks exactly like not being understood. Those are now either bound properly or declined with a spoken reason. Binding them also surfaced a mis-mapping that had been shipped and was invisible while the tool was unreachable.

The second: the feature flags that gate voice capabilities could not be read from the table they lived in, so they evaluated against a default rather than against the workspace's actual configuration. They are evaluated now.

Discoverability is on for everyone, honestly — the capability menu used to take 42 seconds to speak, which is the right taxonomy delivered the wrong way. It is now a short menu that leads somewhere, and the number of things you can actually say and have happen went up rather than the number of things it claims.

Follow-ups work across turns: ask Pact to make a battle card and then say "read it to me", and it finds the one it just made. Asking about risk gets a risk answer rather than an account search.

Four separate things were competing for the bottom of a phone screen, and the content lost.

There is now one floating affordance and one notice at phone width, with everything else moved into the flow. Chrome — bars, headers, banners — had grown to about 40% of the screen on the dashboard; it now has a budget, and the budget is enforced rather than reviewed.

The deal board had a touch bug worth naming on its own: a tap was only registered if it was short enough, so a deliberate press read as nothing, and a drag also fired as a swipe. A tap is a tap at any duration now, and a drag is only a drag.

Open a call and four panels used to be blank. All four blanks meant "we found nothing", and none of them were true — the extraction had never run at all.

The post-call pipeline now runs as a pipeline, with a stage ledger, and every empty state on the call record says which empty it is: not started, ran and found nothing, or failed with the reason. Those are three different answers and they were rendering as one.

Two rendering faults went with it. A stored recap containing a placeholder was being displayed as six single-character bullets. The insights card opened on whichever tab came first, which was frequently an empty one, and its chips wrapped onto a second row that pushed the content out of view — it now opens on a tab that has something in it.

Exports keep their promise: the call export contains what its own description says it contains, and the timeline's total is a total rather than the count of the page you are looking at.

The compliance surfaces are the ones where a wrong number is not a cosmetic problem, and several of them were confidently wrong.

The DSAR clock. A request that had been fulfilled 21 days early was displayed as *"Overdue by 107 days"*. The service-level calculation ran against the wrong pair of dates.

The consent preview. The read-only preview looked its subject up by the wrong subject type, so it reported nothing for people who had a full consent history.

The export. A data-subject export could never have completed — six separate bugs, found by the simple expedient of running it rather than reading it.

The audit log. Ninety-six rows claimed a digest had been sent when none ever was. Audit rows are not editable by design; these were corrected through a recorded migration, with the correction itself in the record.

The proof-of-capture text that sits under a consent record was on the wire and never rendered, so the evidence existed and no one could see it. The insight tabs on the same card were left in a state where no panel was active — a 143-pixel empty shell sitting on top of the data it was supposed to show.

Pact had opportunities and it had deals, and different parts of the product read different ones. The forecast read two tables, not one. Customer health read the older. Pipeline read the newer. The numbers disagreed, quietly, for anyone who compared two screens.

Deals is the target, the decision is recorded, and the readers have been moved across a tranche at a time with the value compared on both sides of each move rather than assumed.

Two specific wrong numbers fell out of it. A decorated stage name was hiding a closed deal inside open pipeline. And the forecast bucket named "pipeline" was not the pipeline — it was a different slice with the same label.

The reconciliation that was supposed to prove the two tables agreed was copying zero rows, and the check on it was written so that it could not fail. Both were replaced; the remaining rows without a workspace were assigned where that was provable and refused where it was not, rather than written as null.

Duplicate review is legible at laptop resolution now and shows survivorship — which record won each field, and why. The demo-data purge no longer destroys the source records of a merge.

A sample account used to be a name and a logo. Evaluating anything against it meant imagining the rest.

Seeded data now carries a history: eleven more tables joined the purgeable cohort, so a sample account arrives with the contacts, activity and past that make a pipeline view, a forecast or a call record worth looking at.

The constraint that makes this safe is unchanged and was re-proved rather than assumed: purge still takes nothing but the seeded rows. Every seeded row is marked as seeded, the purge selects on that mark alone, and the test asserts that a workspace's real records survive it untouched.

The contact book behind it was repaired at the same time: every demo contact has a reachable address, contacts link to a real company rather than to a name that happened to match, six duplicate accounts were converged, and the tombstones left by an earlier convergence run were cleaned up. Name-based joins are a debt rather than a mechanism now, and the remaining count says which debt it is.

The signup chain ended in silence in both directions. A request for a workspace notified nobody, and the person who made it heard nothing back.

It notifies now, loudly, and the approver can see what they are approving. The applicant is told — the response that carries the notification was being swallowed, so the email never sent even though everything upstream of it worked.

A newly approved workspace is seeded before its first sign-in, so the first screen has something in it. The fast path had also been skipping the revenue-leader setup entirely, and a seed that failed did so invisibly.

Background work was running behind a single point of failure that nobody had noticed, because the symptom was slowness rather than an error.

One dead webhook endpoint was stalling every background tick. A subscriber that stopped answering held the queue for everything else. It no longer does.

Sequence delivery stopped lying about itself. The drain was marking a message as delivered before it had been sent, so a send that failed afterwards still read as delivered.

Background work has one leader. Scheduled jobs elect a leader at the seam the scheduler already named, rather than relying on there being exactly one worker.

The email digest counts its own failures. It now tracks a run of failed deliveries and records what would unblock them, instead of failing weekly in a way that looked identical to having nothing to send.

Spoken output had two distinct ways of coming out wrong, and one of them was self-inflicted.

Ordering is enforced now. Playback order used to be a property of how the pieces happened to arrive rather than of anything guaranteeing it, and an attempt to improve throughput made it worse — a sentence would play two words, jump to the end, and come back to the middle. That attempt was reverted the same day, and the speech channel is now serialized by construction: each piece is scheduled at a time that can only advance, so two pieces cannot swap.

A clause boundary on a digit is provisional. Pact was ending a phrase at the decimal point, so "$310.1M" was spoken as "$310" and then a fragment. Numbers are now held until it is clear the number has ended.

Hold music no longer sounds haunted. The default is a warm, telephony-safe synth that survives the codec, replacing something that a caller on hold experienced as unsettling rather than neutral.

A deploy landing in the middle of a live call used to end it. From the caller's side that is indistinguishable from Pact hanging up on them, and from ours it left nothing behind to find.

The caller is told now, in the call, rather than being dropped into silence. And the call record carries the reason — a deploy-dropped call says so on the record, not only in a log file nobody reads after the fact.

Underneath, each relay connection has exactly one writer. Six senders were sharing a socket with no lock between them, which is the kind of thing that works until it does not. The single-utterance failure class — a call where the caller says one thing and never hears back — was hunted down to a second inbound connection and a counter that was being incremented into nothing.

The public site was measured on a 320×568 viewport — the smallest phone still in meaningful use — and it did not fit.

The hero's primary call to action sat below the fold by a margin that took several attempts to close honestly: the first two moved it with margins, which a centered grid absorbs, and only the third — padding rather than margins — actually moved it. It clears the fold outright now, and the fold got 36px back on top of that.

The mobile navigation's primary item scrolled to a section that was hidden, so the most prominent control on a phone did nothing.

Display type had no chosen line height on any route. It was inheriting whatever the cascade produced, which is why large headings touched each other at some widths and not others. Three components carried it, not one.

Two smaller honesty repairs went with it: no named reference on the site points at something that does not exist, no bracket is left unfilled, and the outcome statistics on the role pages are sized like the claims they are rather than like measured results.

Radar ranks what deserves your attention. Two things were missing from that: why, and what it could not see.

Every finding now carries the reason it is first — the signal that put it there, not merely a score. A ranking you cannot interrogate is a ranking you have to take on faith, and the first time it is wrong you stop using it.

The second is the more serious one. When a detector failed to run, Radar reported "all caught up" — the same message it shows when it ran everything and found nothing. Those are opposite states. A detector that could not run now says so, by name, and the health of the checks themselves is visible next to their output.

Planning has been the thing that happens in a spreadsheet beside the CRM, and then stops matching it within a fortnight.

Objectives, key results, workstreams and tasks are now first-class: they can be created, measured and worked from the page itself. A key result reads its own measure rather than waiting for someone to type the current number in, and the work that moves it hangs off it directly.

The point is not the artifact. It is that the plan and the pipeline are the same data, so the plan cannot quietly go stale while the numbers move.

A cost surface that shows a number for everything is more dangerous than one that admits a gap, because you plan against it.

The cost-to-serve view now carries three things: the scale economics — what a workspace costs as it grows — the bindability of each spending cap, meaning whether the cap can actually stop the spend it names, and an explicit blind-spot list of the dimensions that have no ledger behind them and therefore cannot be measured at all.

The dimensions that cannot measure render as such rather than as a confident zero, which was the previous behavior and the reason a cap could look enforced while enforcing nothing.

Underneath, a set of metrics that the code appeared to collect were never actually written anywhere. Those are wired up, and the code paths that had never once executed were deleted rather than left to look like coverage.

Six numbers on the Data module were string literals in the page source: 14,231 profiles, an 89% match rate and 42 pending merges on the profiles page; 2.3M records across 14 tables, 365-day retention and AES-256 per-tenant encryption on the vault page. They were identical for every workspace, including ones that had connected nothing.

The vault tiles were the worse of the two. A fabricated volume misleads; a fabricated security guarantee is the kind of sentence that gets copied into a customer's security questionnaire. And the page's own description — an append-only raw store for every event and record — described a system that does not exist here. The vault is reverse-ETL and change-data-capture: destinations, signed export manifests, subscriptions with measured lag. Twenty-two endpoints, of which the page exposed none.

Every tile is now a read with its formula shown, and a real zero, a gap and a refused read are three different pictures. The identity graph reports its own health instead of a literal.

The customer-health refresher selected every company that either belonged to the workspace being refreshed or belonged to no workspace at all. That second clause is the wildcard this codebase has closed several times in read paths; this loop wrote. Every workspace with health scoring on picked up the same ownerless company and stored it a health snapshot, a churn prediction and possibly a follow-up task, each stamped with that workspace's id — one company, many workspaces, each claiming it, with the signal context read under a workspace that did not own the account.

The refresh loop now never picks up a company no workspace owns, a failed refresh is logged with its exception class and the tick still completes, and the at-risk queue cannot render another workspace's company name. A test fails if the wildcard is reintroduced anywhere in the package.

The as-of time has been on the lifecycle payload since the dimension was written, and no consumer rendered it. A health snapshot computed in March and one computed this morning arrived on a rep's phone as the identical chip.

The age is now part of the number. Health and churn risk carry an age in whole days and a stale flag computed on the server, with the threshold declared once and named in the payload's own formula so a reader can check it. The chip prints the age when it changes the reading and always in the accessible name; a stale number never keeps a confident warning tone and never loses its value. An unreadable timestamp is reported as unknown age, never as fresh.

Contacts already carried both ends of the bridge: a salted hash of the email, indexed, and the company they belong to. A marketing subject reaches an account in two hops with no schema change and no plaintext column. What was missing was not a join but a single place that performs it and says why when it cannot.

One canonical resolver now takes a workspace and a subject — email, phone, contact id or company name — and returns the contact and the account, or a named reason it could not, in the same gap shape the surfaces already read. The answer is materialized on the three marketing ledgers so the read is per page rather than per workspace, with a dry-run by default and a reversal receipt, and it is maintained on the write path.

The lifecycle lane's nurtured rung, which used to be the void, fills with a real count — and still renders the honest hole where the backfill has not been run.

The mention pipeline was healthy. Three independent layers were each dropping one of the four things a notification owes its reader, and the row that reached a phone was the sum of all three.

Who did it was stored on every row and never selected by the list route, so it read "Someone". What happened had no copy template for 28 of the kinds producers actually emit, so it read "sent you a notification". Which record was routed for ten kinds while producers emit quotes, calls, notes, meetings, workflows and approvals whose pages all exist. Where to go was written by 23 producers into a field no reader ever looked at.

All four now reach the list, on the phone and on the desktop, and the link a notification already carried is the link it opens.

Eleven optional database reads across the consent and solutions-engineering surfaces caught every exception and substituted a zero or an empty list, with no log line anywhere. Both pages render those empties with reassuring copy, so a database the server could not read was answered with "Audit log clean — no high-severity events to review", "Consent rates steady", "Suppression list quiet", "No sends blocked today", and — for the scorecard — advice to run a report that could not have worked.

The consent hero narrated the same fabricated zeros in prose, and in its AI-written variant a model turned them into fluent, confident good news. On the most regulator-facing surface in the product, that is the wrong direction to fail.

Each read now runs inside its own savepoint so one failure is not eleven, records the failure on the result so the page can say which read did not run, and logs at error with the exception class.

Measured inside the module shell rather than full-bleed, the cross-module table's scroll container had 750 px at a 1440 window and wanted 899 — 149 px, the entire Moved (30d) column, past the right edge behind a scrollbar a reader has no reason to look for. At 1280 it was 256 px. At 768 it was 421 px, and four elements inside the lane's stage columns spilled out of their own boxes. That was nine module homes, not one, because the same composition sits on every non-sales Today page.

The page never scrolls sideways now at any of seven widths from 1920 down to 390. When the table does scroll it says so and keeps the account column fixed, so a row never loses its identity. The phone is its own design: a lifecycle lane built for 390 px rather than the desktop table narrowed.

Three pages in the sales module — contacts, calls and win/loss — told a rep things that were not true. A failed read rendered as "nothing here yet". A page headed My contacts listed the workspace's accounts. A page headed My calls listed everyone's calls. The win/loss page fetched three outcomes and rendered two.

The reason they survived is the more useful finding: the repo already had a lint rule against exactly this, on these very files, and it could not see the shape the code was written in. The rule now catches the React form of the swallow, no failed read on these pages renders as an empty list, each page's scope claim matches the query it sends, and every number traces to a handle or says it is not established.

A 64 px icon rail cannot hold a text field, and it still does not. What it can do is open one: the filter's own keyboard chord had been silently dead when collapsed, because the input it looked for was never rendered. The command palette is a real page-finder, but the rail is not always the main navigation — under admin it swaps for the admin rail — and "where is the thing in this rail" and "every page in the product" are different questions.

Collapsed, the rail now opens a filter on demand that searches the rail you are looking at. On a phone, where the drawer had no filter at all, the same control is at the top of the drawer.

On a compliance surface the direction of a wrong statement matters. The consent overview said CASL email required opt-in; the send gate requires double opt-in, so the page stated a bar lower than the one enforced. It listed four jurisdictions; the engine evaluates eight, and UK GDPR, PIPEDA, LGPD and PIPL were invisible. Its posture tiles folded expired and unknown consent into pending so the cards would sum cleanly — lapsed consent read as not yet asked.

On the tracking tab, three switches including "Honour Global Privacy Control" and a Save button were local state; nothing was stored, while the endpoint that stores it had existed the whole time. Two header buttons, export audit log and import suppression list, had no handler.

The overview now reads its defaults from the same rules the send gate enforces, lists every jurisdiction the engine evaluates, keeps expired and unknown as their own states, and the tracking switches read and write the real cookie-consent configuration. On the Data module's Today page, an identity-graph tile that printed two string literals now reads its own health.

What voice could do was governed by an allowlist of seven tool names. Anything not on that list was unreachable out loud, however well it worked everywhere else, and adding a capability meant remembering to add its name in a second place. Mostly nobody did.

The allowlist is gone. A tool is now offered by voice when it qualifies on its own properties — it returns quickly enough to hold a conversation, it needs few enough details to ask for out loud, it describes itself well enough to be matched, and it is not a heavyweight generation job. Tools that should never be spoken are excluded by name, with the reason recorded next to the exclusion.

Fifty-two actions are reachable by voice today, counted from the running catalog, up from seven. Generating a competitor battle card is one of them — previously it existed, worked, and simply could not be asked for.

Because eligibility is derived rather than listed, a new tool that qualifies is reachable the day it ships, without anyone remembering a second file.

Three separate ways a spoken conversation used to go wrong, all repaired in this batch.

It cut you off mid-word. The endpointer decided you had stopped talking on timing alone, without reading what had been said, so roughly half of all turn-ends landed inside a word. The agent then answered a sentence you were still in the middle of.

"Yes" was not treated as an answer. Asked a direct question, a bare "yes" was read as a filler noise rather than a reply, and the agent asked again.

A menu it read aloud could not be answered. When it offered three candidates, saying which one you wanted did not select it — the options were spoken but not bindable, so the only way through was to start over.

When deals moved to public identifiers, the card surface kept matching on the old one. Deal cards became undockable, and because "Dismiss all" walked the same set, it stopped clearing anything — a button that looked live and did nothing.

Cards dock again and "Dismiss all" clears again. A card that fails to dock for any other reason now says so instead of vanishing, and a dismissal can be brought back rather than being final.

A sweep of every internal link and call to action found several that could not work.

Twelve pointed at hostnames that do not resolve. An anchor to the customer-stories section never matched anything on the page, so the link scrolled nowhere. And the contact-sales form accepted a submission and told the visitor to expect a reply, without a path that would deliver one.

All are repaired, and a gate now checks internal anchors and links on every change — the anchor case in particular had never been checked by anything.

Longer spoken answers carried a repeating artifact, regular enough to sound like a buzz rather than noise. It was a render quantum repeating: playback opened a new audio device for each batch of phrases within a single answer, and every open re-paid a small startup cost that landed inside the audio.

Playback now opens one device per answer. Long replies are noticeably cleaner.

This is one of two causes, and the other is still open. A thin opening buffer is also being paid once per phrase batch rather than once per answer. Until that lands, a residual artifact can remain on some replies — so this entry claims a reduction, not silence.

A recording row used to be a promise the product could not keep: it showed a

status and a transcript, and there was no way to hear the call.

Now there is a player. It streams the stored audio, draws a waveform you can

scrub, and offers a download. Playback is one authorization decision on the

server, scoped to your tenant, and every read is written to the audit log — so

"who listened to this call" is a question with an answer.

Each row tells the truth about itself. Recordings that carry stored audio

are the ones that offer playback; rows that only ever had a transcript say so

instead of handing you a dead play button. On a workspace seeded with demo

data, most rows are the second kind, and the list now shows that rather than

hiding it.

A separate repair stopped the upload-retention purge from deleting captured

call audio it was never meant to touch.

Every surface that answers a question — Hey Pact, search, the scorecard — used

to reply in prose, with the figures buried mid-sentence and the records named

but not linked. Formatting the model emitted was sometimes printed literally,

asterisks and all.

Answers now put structure first:

• Metric tiles for the numbers, so a figure is a figure and not a clause.
• Record chips for anything Pact named, each one a link to the record.
• An evidence row under the answer, so you can see what it was derived from.
• Markup is rendered, not dumped.

A "no" is now an answer with proof. When there is nothing matching what you

asked, Pact says what it looked at and why the result is empty, instead of

returning a blank panel that reads like a failure.

The spoken scorecard used to be generated in full, then read aloud. The wait

before the first word was the entire composition time, and on a phone that

silence is indistinguishable from a call that has dropped.

It now streams: narration begins as soon as there is a sentence to say and

continues while the rest is written. Two other repairs ride along — a

classifier that was being consulted and then ignored on every request is gone,

and an answer cut short by echo on the line resumes instead of ending there.

On the mobile pipeline board a touch-and-hold armed two different gestures on

two different timers — a drag at 250ms and a detail sheet at 500ms — so the

same finger movement could open a sheet you did not ask for, or start dragging

a card you meant to read.

The two are now separated by intent: **tap to open the deal, press and hold to

pick it up.** The board header, the floating action button's slot, the record

action rail and the inbox chip filters were straightened out in the same pass.

Two independent things were making Pact slower than it should have been:

• A leak in the web tier. Every server-rendered request armed a 30-minute

cleanup timer that outlived the request. Under steady traffic those

accumulated for hours, so the site got heavier the longer it went between

deploys. Server rendering now uses a per-request cache that is released with

the request.

• Uncompressed HTML at the edge. A caching rule let the CDN store and serve

the homepage without compression — roughly half a megabyte of HTML where

75 KB would do. Fixed, and verified on production.

The worst failure mode in a CRM is a panel that shows nothing and means four

different things. "You have no deals at risk" and "we could not reach the

service that computes deals at risk" looked identical, and the second one is

the one you need to know about.

Every data-backed surface now separates the four states and says which one it

is in — including "you do not have access to this", which previously rendered

as absence too.

Two related repairs to how a call sounds:

• No more mid-phrase cutoffs. On a live call, generated text finishes fast but keeps playing out loud for several seconds after. If a caller talked over that tail, the record of what they'd actually heard was sometimes wrong — occasionally chopping the agent's own reply short. The turn-tracking now arms before the reply starts playing, not after, and covers a cancelled-mid-generation turn the same way as one that already finished.
• Your chosen voice is the one that speaks. /settings/voice saved a selection that a lower-level relay setting silently overrode on every inbound call, so the picker looked like it worked but never took effect. It's wired through now — pick a voice, hear that voice.

Calendar and Gmail ingestion ride the same connection row, and any sync failure — even one caused by a momentary hiccup on Google's side — flipped that row to an error state that the recurring sync job then skipped forever. The only way back was reconnecting by hand, which is why "calendar and email are disconnected again" kept coming back. The sync job now gives a failed connection another chance instead of permanently benching it.

The voice agent used to be better at narrating work than doing it. This batch closes that gap:

• Actions execute. Ask it to log a note, create a follow-up task, or move a deal's stage and it performs the write — through the same consent check and audit trail as a write made by hand — then confirms what it did, instead of telling you what it would have done.
• A yes means the thing you said yes to. Accept the agent's offer to look at your high-risk deals and it reads the at-risk feed — those deals, not the whole pipeline.
• It knows when to give up. When the agent is failing a caller — repeated misunderstandings, or the app explicitly asks — it hands the call off to a human instead of looping.
• Voicemail comes back with the next action. Each voicemail is analyzed for what the caller actually needs — a callback, a document, a meeting — and high-confidence next actions are extracted and queued rather than left buried in a transcript.

Three changes to how a call feels:

• Answers start fast. The slow first-response path — routing before speaking — is now covered by an immediate spoken prefix, so the agent's reply begins in roughly a quarter of a second instead of over a second and a half of dead air.
• Delivery follows content. Bad news slows down, lists get list rhythm, numbers are spoken like a person says numbers — prosody is derived from what is being said rather than one flat voice for everything.
• Words, not markup. Display formatting (symbols, emphasis marks, layout characters) is normalized away at the text-to-speech boundary, so the agent can never read "asterisk asterisk" at you again. Voice selection was also consolidated into one canonical resolver, so every surface speaks with the voice you actually picked.

The audit trail grew three properties a security reviewer will actually ask about:

• Forensic context on every event — who acted, from where, through what — captured at write time, so an investigation doesn't have to reconstruct the request after the fact.
• Immutability the database enforces. Audit rows can no longer be updated or deleted by the application at all — the constraint lives in the database, not in code review.
• A live tail. Watch audit events stream in as they happen from the admin audit view, instead of refreshing a filtered list.

Most of this window was repair work driven by call-by-call audits of real conversations. The customer-visible fixes:

On calls

• Booking a meeting now understands spoken times ("Tuesday at three"), escapes a slot-fill that keeps failing instead of re-asking forever, and yields when you change the subject mid-flow.
• Deal counts agree across every voice path — one caller, one scope, whether you ask the simple way or the complex way.
• The agent hears *your* company's name correctly instead of rescuing it into a CRM record's name, and no longer overwrites fields with placeholder values.
• A call's final turn survives an immediate hangup, so the last thing you said still lands in the record.
• Inbound calls no longer risk a slow pickup: the heavy contact lookup was moved off the answer path.

In the app

• On an account page, one failing card now costs you that card — not the whole route. Two crash classes on account and health surfaces are fixed.
• Ten contact endpoints that could 500 on PII reads are repaired.
• The onboarding activation card no longer renders an error for a widget the workspace switched off.

Integrations and storage

• Twilio's connection status now reads the same on every surface — the verifier was fixed and the duplicated status rail removed.
• A misconfigured BYOK storage bucket can no longer fail every file write in the workspace; it fails only the tenant that misconfigured it, with a clear error.

Ask used to be a search box that handed back a list. It now works through a question:

• Multi-hop retrieval — a question that needs two or three lookups to answer gets them. "Which deals in my pipeline have gone quiet since the last QBR?" reads the pipeline, then the activity, then joins them, instead of pattern-matching the sentence against deal names.
• Real citations — every answer links the records it drew from, so you can click straight through and check the work.
• Session memory — the panel keeps the last few turns, so "what about the ones in EMEA?" resolves against the question you just asked.
• Clickable ambiguity — when a name matches more than one record, Ask asks which one you meant and gives you the choices as buttons rather than guessing.
• An empty result is an answer — if there genuinely is no activity to report, Ask says so and records why each lookup came back empty, instead of showing a failure.

Several sharp edges went with it: the panel no longer matches your whole question against deal names as a single LIKE, no longer returns cards with no content in them, and fits inside a 375px viewport.

Open Ask from the top bar on any page.

Compliance work in Pact was a spreadsheet exercise. It is now a console:

• The full controls catalog — all 61 AICPA Trust Services criteria, with the Common Criteria, Availability, Confidentiality, Processing Integrity, and Privacy series each broken out and tracked separately.
• Evidence that collects itself — a set of automated collectors replaced manual evidence gathering for a growing share of controls. Where a control is still manual or still deficient, the console says so rather than showing a green tick it has not earned.
• A real policy library — 17 auditor-grade policies, published, versioned, and acknowledgeable by staff, with acknowledgement state tracked per person.
• An auditor package that downloads — the export produces a control matrix, a remediation plan, and a signed archive. It previously 403'd with "could not generate package"; that is fixed.
• The sub-processor register is populated with the vendors that actually process data, rather than the handful it previously named.
• An honest vendor register — the attestations Pact does *not* yet hold are tracked as open requests rather than quietly omitted, so the gap is visible to you before it is visible to an auditor.
• Usable on a phone — the console, the gap tracker, and the timeline all work at 375px, so you can clear an acknowledgement away from your desk.

Admins: find it under Admin → SOC 2.

Two changes to how support work gets picked up:

• Consolidated AI triage — a new case arrives with one card that shows likely duplicates, the owner who has handled similar cases before, and a suggested category and route. Every suggestion is accept-or-override; nothing is applied to a case without a person agreeing to it.
• An SLA clock that stops for customer-wait — time spent waiting on a customer reply no longer counts against your response target, so the breach numbers reflect work you could actually have done. The clock also honors your configured holiday calendar.
• SLA reporting by owner and category — breach and attainment now break down by who owned the case and what kind of case it was, instead of a single tenant-wide number.
• Deflection before the ticket exists — the customer-side submit form now suggests relevant knowledge-base articles as someone types their problem, so the answerable questions get answered without becoming a case at all.

The triage card also got meaningfully lighter — dropping a heavy popover dependency cut the route's payload after it had grown 16.2%.

Three revenue surfaces got real depth:

• Deal health — each deal now carries a health score, a 30-day drop-risk read, and suggested next-best actions drawn from what actually moved comparable deals. The score shows its inputs, so you can disagree with it.
• Per-field enrichment routing — instead of one vendor per record, each field routes to the vendor that is strongest for that field, with a waterfall fallback when the first choice has nothing. A hard budget stop halts spend at your cap rather than running past it, and you can trigger a specific vendor from the record itself.
• RFP round-trip for sales engineers — export an RFP response, and the answers you wrote are kept as a searchable answer library with reuse tracking, so the next RFP starts from what you have already said. Architecture diagrams generate from the stack you actually recorded.

• Visual workflow builder — /workflows lists your automations, a canvas editor builds them, and each run is recorded so you can see what fired and what it did. Templates cover the common shapes so you are not starting from an empty canvas.
• View switcher across list surfaces — the same records, shown as a List, Cards, a Board, a Calendar, or a Table, switchable per surface and remembered.
• Duplicate management — a cluster review queue groups likely duplicates, merging rewires foreign keys properly rather than orphaning related records, and every merge has a 30-day undo.
• Multi-action swipe trays on mobile — swipe a row in any CRM list for its common actions, or long-press for the full action sheet.

• A calls list worth opening — filters, search across call transcripts rather than just titles, bulk actions, and analytics over the set you have filtered to.
• A call page with context — per-call cost in the header, an AI recap, a waveform you can scrub, and the playbook the call matched.
• Spend dashboard 2.0 — anomaly detection on unusual spend, provider mix so you can see where the money goes, unit economics per call and per seat, a forecast, and a cap simulation that shows what a proposed cap would have done to last month.
• Proactive alerts — spend, coaching, and missed-call alerts, with quiet hours that are actually enforced rather than advisory.
• Mobile parity — the spend table scrolls properly at 375px instead of clipping its own columns.

A pass over the surfaces you look at all day:

• Cards read as surfaces — a defined edge and a lit top edge, so a card is distinguishable from the page behind it instead of reading as a flat square.
• Panel headers stop clipping — a sheet header no longer cuts off its own title. "Vonage" was rendering as "/onage".
• The account header keeps its title — when a record has several actions in the header, the actions no longer squeeze the record name down to nothing.
• A day spine on the record timeline — timeline events group under the day they happened, so a busy record reads as a sequence rather than a wall.
• Create and edit forms — consistent spacing, validation, and keyboard behavior across every create/edit form in the product.
• Record detail chrome — underline tabs, tag and territory chips, consistent padding, and clearance so the floating action button stops covering content.

Work you should not have to notice, but which matters:

• One email safety gate — every outbound email in the product now passes a single decision point before it is sent, and bulk sends go out one gated request per recipient rather than exposing the whole recipient list in a shared header. No email reaches someone who should not receive it because a code path forgot to check.
• Fifteen routes gained authorization guards, seven mutations gained audit records, and an unauthenticated call-diagnostics read was closed.
• One malformed flag row no longer takes down the product — a single bad metadata_json value used to return 500 from every flag-gated route in the app. It is now isolated to the flag that is broken.
• Fixed 500s — Account 360 on every account page, the contact dedupe scan against the encrypted contacts schema, and the tracking/calls signal reads.
• Faster pages — a repaired bundle-size gate cut nine oversized routes down to one and stopped the baseline drifting, and four N+1 query patterns were batched (coaching lists, spaces collaborators, per-contact tracking events, campaign send polling).

The daily-driver screens are now consistent, dense, and fast:

• One shared record layout — Account, Contact, and Deal detail pages were rebuilt on a single shell: a consistent header, tabbed sections, and a right-hand insight rail. The rail is now bounded, so long records stay a normal page instead of stretching three or four screens tall.
• Virtualized lists — /contacts and /deals render as tiled list views that stay smooth at thousands of rows.
• Accounts as a tiled grid — a card grid with compact / comfortable density modes, a filter rail, and saved view presets so you can jump straight to the slice you work from.
• A sharper pipeline board — the kanban view gained per-column WIP limits, average days-in-stage, spring-loaded drag, grouping, and full keyboard navigation.

Open any account, contact, or deal, or switch to the board on your pipeline, to see it.

Reports is now a full build-view-share loop instead of a set of canned charts:

• Build visually — start from an entity (accounts, contacts, opportunities, sequence activity, timeline, or consent), drag in the dimensions you want, and combine filters with nested AND/OR logic.
• View fast — results render in a sortable, virtualized table that stays responsive at thousands of rows, with a chart preview alongside.
• Export for real — download any report as CSV, Excel, or PDF.
• Schedule delivery — set a report to run on a recurring cadence and email itself to the people who need it.
• Share read-only — hand out a signed link to a live report without giving someone a seat.

Find it under Reports in the sidebar.

Everything that needs your attention now lands somewhere sensible:

• Notifications Center 2.0 — the /notifications page groups and filters your notifications, updates live over the existing stream, and drives a numeric badge in the sidebar so you can see what's waiting at a glance.
• A triage Inbox — a new /inbox/triage brings notifications together with call and voice action items in a single feed, each tagged by source, so a morning sweep clears calls, follow-ups, and alerts without hopping between screens.

Open the bell in the top bar, or head to your Inbox.

The dashboard reads like one considered analytics surface now:

• Better charts — velocity, open-rate, top-accounts, and consent charts share a single set of primitives: one tooltip with a title, colored series dots, and exact values.
• Empty states with a next step — a blank chart now shows a matched-shape placeholder and a clear call to action instead of an empty box.
• A real pipeline funnel — the pipeline block is a proper stepped funnel with duplicate stages removed and conversion math clamped so the numbers stay honest.
• Density toggle — switch between compact, comfortable, and spacious to scale chart heights to your screen.
• Reduced-motion aware — chart entrance animations respect the system reduced-motion setting.

It's the first thing you see after signing in.

Moving around Pact is quicker, on desktop and phone:

• ⌘K command palette — search across every entity from one box, preview a result before you open it, press ? for help, and use ⌘⏎ to open a match in a new tab.
• Collapsible sidebar — collapse the desktop sidebar to reclaim width; your choice is remembered per user.
• A navigable Settings hub — Settings is reorganized into a clear hub with a consistent page pattern across its sections.
• Mobile navigation polish — the bottom nav gained haptic feedback and an active-tab pill, and inputs stay visible above the on-screen keyboard instead of being covered by it.

Press ⌘K (or Ctrl+K) anywhere to try the palette.

For admins who need to know exactly what's going on:

• A live activity feed — the Activity page projects a curated slice of your workspace's events into one searchable, filterable timeline: who acted, on what, and when.
• A real audit trail — the feed is backed by the same audited event stream the platform records, so it's a record you can trust, not a best-effort log.
• Impersonation you can account for — admin “view as / impersonate” now writes dual-actor audit records with clear start and stop, closing the compliance gaps around acting on another user's behalf.

Open Activity from the sidebar.

The important fixes from this window:

• Meetings and Calls lists stay up — both stopped 500-ing when a contact record was missing columns the list expected.
• Calling connects on every domain — the softphone now reads CORS_ALLOWED_ORIGINS (not only the older variable), so in-app calling connects on all of a workspace's configured origins.
• Honest failures — a subject-line generation 500, a spin-off queue backlog, and a dead end when voice is turned off were all fixed, and now surface real, referenceable errors instead of failing silently.
• No double-fired commands — Ask Pact no longer runs a command twice when you both speak and click it.
• First admin never locked out — new workspaces create the owner's membership atomically, so provisioning can't leave the first admin without access.

The in-app dialer got a hardening pass so calling stays out of your way:

• Every call, not just the first — the softphone now keeps a persistent connection, so the “first call works, second call hangs” problem is gone.
• No more stuck “Connecting…” — a connect watchdog and clean teardown mean a call that can't go through fails fast and clearly instead of spinning forever.
• Audio on Android — fixed the error that left Android callers with a connected call but no sound, by unlocking audio inside the tap that starts the call.
• Always up to date — installed Pact apps now auto-update on deploy, and the dialer runs a microphone pre-check so a blocked mic tells you exactly what's wrong instead of failing silently mid-call.

This applies wherever your workspace has voice set up. Open the dialer from the bottom-right of the app to place a call.

Day one in Pact used to drop you into a set of empty screens. Now it guides you:

• An activation card on the dashboard — a short checklist of the highest-value first steps, right where you land after signing in.
• Empty states that do something — each blank list explains what belongs there and links straight to the action that fills it, instead of just showing “no data.”
• Load sample data in one click — from any empty state or the activation card, seed a realistic sample workspace so you can click around a full CRM before committing your real data. Clear it whenever you want.
• A first-run tour that lands on real anchors — the guided tour was repaired end-to-end and now covers import, calling, and voice, so it points at things that actually exist.

Sign in to a fresh workspace, or find the activation card on your dashboard.

Getting your data into Pact shouldn't be the hard part of switching. This pass makes import handle the real thing:

• Full corporate exports — the pipeline now ingests wide, multi-object exports (accounts, contacts, contracts and their links) rather than one clean object at a time.
• More resilient to messy files — better handling of the inconsistent columns, encodings, and partial rows that show up in exports from other systems.
• A clearer import screen — the admin import surface was reworked so you can see what mapped, what didn't, and what landed.

Try it under Settings → Admin → Import.

Dozens of everyday interactions got smoother:

• Create as you go — add a new account from any account picker without leaving the form you're in.
• Inline validation + a dirty-guard — forms flag problems as you type and warn before you discard unsaved edits.
• Loading you can trust — lists show skeletons shaped like the real content, and stage changes apply optimistically so the UI keeps up with you.
• Keyboard-first — lists are fully navigable from the keyboard, with a visible focus ring so you always know where you are.
• Honest error toasts — when something fails, you get a clear, recoverable toast instead of a dead end or a raw browser alert.
• Consistent empty states — Reports, Leads, and Journeys now use the same purposeful blank-state pattern as the rest of the app.

The important fixes from this window:

• No owner lockout — sign-in now resolves an account from its email deterministically, closing an edge case where a duplicate workspace row could lock the real owner out of their own workspace.
• Reachable close button on iPhone — the “X” on full-screen mobile sheets was slipping under the Dynamic Island; it now sits inside the safe area on every full-screen surface.
• Schema explorer on phones — the explorer's layout, filter, and lock controls are now reachable on mobile instead of being cut off, anchored to the top of the screen.

You no longer have to dial a number to hear what a voice-native CRM sounds like:

• Live, in the browser — the hero widget talks to a real Pact agent over the public demo endpoint, using a seeded sample workspace so you can ask about deals, accounts, and next steps.
• Guided, not a dead mic — a short scripted walkthrough introduces what to ask, narrates each answer, and signs off gracefully, so the demo works even with the microphone blocked.
• Its own experience on mobile — phones get a tap-first version tuned for portrait, below the hero.

Try it at the top of the homepage, or call the demo line at +1 (424) 722-8627.

Calling is now a first-class surface in the app:

• A dialer — a click-to-call softphone for placing calls without leaving Pact, on desktop and mobile.
• A call log — a feed of recent calls with a detail view for each one, so call history lives next to the records it belongs to.
• A live call canvas — a companion view that follows an in-progress call turn by turn.

This rolls out where a workspace has voice configured; the surfaces degrade cleanly and stay out of the way when calling isn't set up.

A set of backend performance fixes targeting the slowest common path — loading the dashboard:

• Less work per request — per-request logging, metering, and Redis I/O that used to block each API call now run off the event loop.
• Fewer repeated lookups — bearer-token-to-tenant resolution and negative API-key checks are cached instead of hitting the database every request, and the connection pool was enlarged.

Together these removed the redundant per-request database round-trips that were making the dashboard feel sluggish under load.

As Pact has grown, some modules accumulated a lot of pages. Now:

• Type to filter — a search box at the top of each module's nav rail filters that module's pages as you type.
• Scoped, not global — it filters the section you're in, so you stay oriented rather than jumping across the whole app.

It's on in every module rail — no setting to enable.

The demo experience got a real voice upgrade:

• A warmer, more natural voice — the demo line's streaming voice was moved to a higher-quality speech engine.
• A calmer pace — playback was slowed slightly so numbers and names are easier to catch on the first pass.
• No stray markup — pause and emphasis hints are handled internally instead of ever being read aloud.

This is the voice you'll hear on the homepage demo and the demo line today.

The phone homepage is now designed for the device, not squeezed to fit it:

• Built for portrait — sections, spacing, and type were reworked for a narrow screen.
• No wasted space — we removed the empty gaps above the headline and the space that used to be held open for a microphone prompt that wasn't coming.
• A tap-first voice moment — the mobile hero gets its own tap-to-talk demo beat instead of the desktop widget.

Dozens of small rough edges, smoothed:

• Keyboard focus you can see — focus rings on filter chips and interactive controls, so keyboard and screen-reader users can tell where they are.
• Clearer hover feedback — tabs, tooltips, and table rows now respond visibly to the pointer, with an opt-in sticky table header.
• Accessible charts and progress — chart gradients get unique IDs so they render correctly when several charts share a page, and progress bars carry accessible names.
• Toasts, not alerts — failed actions (like a Spaces invite) now surface a toast instead of a jarring browser alert.
• Faster, quieter navigation — the module rail no longer fires a burst of prefetch requests on load.

We started publishing:

• A blog at /blog — a home for product thinking and explainers.
• First up: “What is MCP?” — a plain-language introduction to the Model Context Protocol, the open standard Pact uses to connect the CRM to tools and assistants.

The important fixes from this window:

• Microphone restored app-wide — a permissions policy was blocking the microphone across the whole app; voice input works again.
• Inbound phone line kept up — a couple of database issues that could take the main phone line down (a type mismatch on caller lookup, a reserved word in a query) were fixed.
• Browser dialing unblocked — the security policy now allows the voice signaling the in-app softphone needs to place a call.
• No more accidental lockout — when usage limits are hit, Pact warns instead of walling off the app, and the client no longer retries a hard "limit reached" response in a storm.

Pact Voice is the fastest way into your CRM — your voice, no screen:

• Call the demo line — dial [+1 (424) 722-8627](tel:+14247228627) and start talking. Ask "what are my open deals?", "show me my accounts", "how's my pipeline looking?" and hear a short answer read back.
• Answers come from live workspace data — the agent routes each question to the same in-process MCP tools the app uses, so consent, cost, and audit apply exactly as they do everywhere else. It is not a scripted demo bot.
• Kept short on purpose — replies are capped so a phone call doesn't turn into a monologue.

The public demo line is live now. Turning Voice on for your own workspace is a guided setup step — pick a provider, get a number, set your compliance posture, and place a test call.

Voice can now act, not just answer — every action writes a durable ledger row and a call is capped at five actions:

• Text me the details — Pact sends an SMS to your own number on file through your connected messaging provider, respecting the opt-out list. This and note-taking are the verified-working pair.
• Add a note — "note on Acme that budget approved" logs against the account then and there.
• Email me / book a meeting / transfer me — each is wired to a real handler. When the mail provider or calendar isn't connected, Pact says so plainly instead of pretending; a transfer runs the compliance gate before it dials.
• Guardrails built in — a per-call action cap and a per-action cost ceiling stop an ASR mis-hear from fanning out texts or dials.

A pass over the voice router closed the "every question returns nothing" gap:

• "Opportunities" is a deal — reps say "opportunities" and "opps" far more than "deals". Those phrasings now route to your deals instead of dropping into the generic fallback.
• "My accounts" lists your accounts — "my accounts" / "show me my accounts" / a bare "accounts" now returns your account list rather than answering with segment analytics.
• Named look-ups land — asking for a specific account by name resolves to that record instead of a cold, contextless search.

The keyword router still runs first — it's free and instant. When it can't place an utterance, one small model call takes over instead of dumping to a generic search:

• Paraphrases resolve — "how's my pipeline looking?", "anything hot?", "who's about to close?" map to the right tool plus a filter/sort spec, so you don't have to hit a magic phrase.
• It asks when unsure — below a confidence threshold, Pact asks a short clarifying question rather than guessing wrong.
• It never breaks the call — if no model is configured or the call times out, the turn falls back to the previous behavior. The router is opt-in per tenant and only runs on the fall-through, so the cheap path stays cheap.

The cap is enforced on the server, not trusted to the caller:

• Per-tenant daily cap — a default daily ceiling per workspace, configurable, checked at call start and before each turn.
• A tighter cap on the demo line — the public number is clamped to a low daily budget so a runaway test can't bleed the budget.
• Graceful degradation — when the next turn would cross the cap, Pact says "I've hit your daily cap, let's continue via Pact's dashboard" and ends cleanly, rather than dropping the call or overspending.

The call and the app are two views of the same moment:

• Incoming ring — a routed inbound call fires a push to the assigned user's installed app so it rings and offers to open the call. This is strictly additive: it never changes how the call itself is handled.
• Live companion — open the call and the companion view follows it over a streaming (SSE) connection, with the transcript filling in as the conversation happens.
• Deep-linked — the ring opens straight to that specific call, not a generic inbox.

Voice actions went from "wired" to "runs on the call", and the record surface widened:

• Close a deal — "mark the Acme renewal closed won" updates the opportunity's stage on the call, with a spoken confirmation before the write.
• Create or update a contact or account — "add a contact named Jordan Lee at Acme" or "update Acme's website" writes the record then and there.
• It actually executes — the action executor is now wired into every turn, so a confirmed action is carried out rather than just acknowledged.
• Same guardrails — each call is capped at five actions, every write is confirmed first, and when a provider or calendar isn't connected Pact says so instead of pretending. Every action still writes a durable ledger row.

Voice is Pact's most expensive channel, so it comes with the visibility to run it:

• Every call, listed — see recent calls with duration and per-call cost in the admin console.
• Spend against the cap — today's voice spend and the remaining daily budget, so you know where you stand before the cap kicks in.
• Full transcripts — open any call to read exactly what was asked and answered, alongside the consent and audit trail.

Find it under Settings → Voice in the admin console at /admin/voice-mcp.

The compliance layer under Pact Voice — configured once, enforced on every call:

• Calling mode + TCPA gate — pick the calling posture for your tenant and let Pact refuse outbound attempts that fall outside permitted contact hours, instead of trusting a rep to check the clock.
• Do-not-call lists — maintained per tenant and checked before a number is dialed.
• Sensitive-data redaction — transcripts are scanned for personal, health, and card data and redacted automatically.
• Compliance vault — the unredacted originals are encrypted at rest for teams operating under a BAA, with access recorded on an audit trail.
• Recording consent — playback stays gated on the consent ledger, and state two-party-consent rules are applied from a maintained registry rather than a hand-copied list.

Set it up under /admin/voice-mcp.

Instead of assembling tools call by call, start from a recipe:

• Five starter recipes — SaaS renewal playbook, real-estate cold call, support escalation auto-route, RFP autofill from your won library, and post-call deal update.
• One-step install — a recipe lands in your workspace as an inspectable multi-step chain rather than a black box.
• Preview before you wire anything — steps whose provider isn't connected run as clearly-labeled emulated previews, so you can walk a whole recipe before committing an account.

Bring-your-own-key was spread across a dozen screens; it now has one home — at /admin/integrations:

• 51 providers in one catalog, spanning voice, language models, speech-to-text and text-to-speech, voice agents, messaging, CRM, warehouses, enrichment, and storage.
• One connect sheet — the same flow regardless of which provider you're wiring.
• Preview before you connect — see what a provider would do for you as a labeled emulated preview, so the decision to hand over a key is informed.

• Slack and Teams alerts — a post-call or missed-call summary arrives in the channel you choose, with buttons for View call, Book meeting, Mark won, and Escalate. Each button records who clicked it and opens the matching surface in Pact — the booking screen, the opportunity, the escalation inbox — so the click is a fast route to the work, not a silent state change.
• Mobile — the installed app rings on an incoming routed call and opens the live-call companion (transcript and running cost) while you talk. The audio itself stays on the carrier leg today; the app surfaces the call rather than accepting the audio, so the primary action is Open call. Browser-native answering is a tracked follow-up.
• Hardware handling, a live waveform, and the incoming ring are all in place on the mobile softphone.

Evaluating a feature used to mean wiring an account first. Now it doesn't:

• Full-fidelity previews — provider-backed surfaces render a realistic preview when the provider isn't connected, so you can judge the feature on its merits.
• Provenance you can see — a marker on the value and a banner on the surface state plainly that what you're looking at is emulated, not live. The rule is simple: an emulated value never appears without saying so.
• Real beats emulated, always — connect the provider and live data supersedes the preview.

This is deliberately conservative: it is a preview layer for provider-backed features, not a simulation of your data.

Inbound calls now behave like a phone system, not a single ringing endpoint:

• Routing per phone number — each number gets its own routing rules, so support and sales lines land with the right people.
• Queues with hold music — callers wait in an actual queue rather than hearing a busy tone.
• Press 1 for a callback — a caller can drop out of the queue and keep their place as a callback instead of holding.
• VIP priority — the accounts you flag jump the queue.

• Zero to a verified call — a step-by-step wizard covering provider choice, number, compliance posture, and a test call, with one canonical guide behind it.
• Multi-provider — the wizard works across the supported voice providers rather than assuming one.
• Preview instead of a dead end — if a step's provider isn't connected, it runs as an emulated preview marked with its provenance, so evaluating Pact Voice doesn't require wiring an account first. Previews are labeled as previews everywhere they appear.
• Compliance is part of setup, not an afterthought — the wizard walks you through the calling mode and consent posture before the first call.

• Multi-language transcripts — translate a call transcript using your own translation key, so a team reading in a different language than the customer spoke is no longer stuck.
• Weekly call topics — calls are clustered into topics each week with a trend chart and drill-down, so "what are customers calling about" has a real answer instead of an anecdote.
• Zoho CRM sync — call activity writes back to Zoho and syncs bidirectionally, joining the existing CRM connectors.

• Filter by module — the catalog groups by product area instead of presenting one long list.
• Deep-linkable tool pages — every tool has its own address you can send to a teammate.
• Corrected badges — the read-only / side effects badge was wrong for a set of tools. It now reflects what a tool actually does, which matters: that badge is how you decide whether to let an agent call something. This was a correctness fix, not cosmetics.
• The catalog is also the centerpiece of the homepage now, with a live tool count you can browse without signing in.

• Live diagrams render — the architecture designer's diagram was falling back to raw source; it now draws properly, using a bundled renderer that works under our content-security policy.
• SE team analytics — a dashboard for the solutions function, with real period-over-period deltas rather than placeholder numbers.
• Polish across the module — the RFP drafter, architecture designer, playbook library, win library, and analytics got a sweep: real KPI deltas, your-own-key embeddings for search, a Pact-branded PDF export, and honest empty states that tell you what to do next.

• Twenty role pages — the /for/ set now covers the whole go-to-market team, with dedicated Support, Sales Engineering, Voice, and Customer Marketing pages, grouped under a Solutions menu instead of a flat list.
• Explore first — the calls to action were reworked so you can look around the product before signing up, rather than every path funneling to a form.
• No stranding — a link that takes you into another module now carries a way back, so cross-module navigation doesn't dead-end.
• A feature registry underneath: one source of truth for what a workspace has access to, driving gating, navigation, and discovery consistently instead of each surface guessing.

• The sitewide accent moved to Pact's real indigo (#3A4690), retiring the purple placeholder that had been shipping in its place.
• Applied consistently across the marketing site and the app, along with the wax-seal motif, so the brand reads as one thing rather than two.
• Mobile pipeline views went full-bleed in the same pass.

• Microphone — the softphone was telling reps to grant a microphone permission they had already granted; it now reads the real permission state.
• SE demo pages — a canceled request could poison the page and leave it stuck; navigating quickly between demo pages now works.
• Compliance audit — the voice compliance audit view was querying the wrong columns and returning nothing useful; it now reads the real audit trail.

An outage is only useful if it changes the system. What changed:

• Restart contract — the process now restarts on failure by policy rather than by luck, and the watchdog's shutdown path is bounded so it can't hang on the way out.
• Health checks are back on, with the lag watchdog behind its own startup gate so a slow cold start can't trigger a recycle loop.
• Self-recycle on event-loop lag — if the app stops responding promptly it recycles itself instead of serving a hanging page, with concurrency limits set to what the machine can actually handle.
• An external uptime probe that watches from outside our own infrastructure, so we don't depend on the failing system to tell us it's failing.
• A documented rollback path, plus fleet checks before and after a deploy and a blocking login smoke test, so a bad release is caught and reversed quickly.

The demo environment was also moved to larger machines with a warm minimum, so it stops falling over under burst traffic.

Calling is now a first-class surface, not a bolt-on:

• In-app softphone — place and receive calls in the browser over WebRTC, with numbers auto-provisioned so you can dial on day one.
• Outbound call campaigns — sequenced dialing with voicemail drop and automatic retries, so a call list works itself instead of living on a sticky note.
• Voicemail intelligence — missed voicemails are captured, transcribed with your own transcription key, and come back with a drafted reply you can send or edit.
• Recording, retention, and consent — record calls with per-tenant retention windows and legal hold, and playback is gated on the same consent ledger the rest of Pact enforces.
• Post-call action items — every call can extract its own action items into a review inbox afterward.
• Missed-call auto-triage — an unknown inbound number can auto-create a contact and a follow-up task and drop a card in your inbox, so nothing slips.
• AI voice agents — configure a bot to handle a call flow and rehearse it with a simulated test call before it ever talks to a customer.
• Your provider — connect SignalWire, Plivo, or Vonage, or bring your own SIP trunk, behind one voice interface.

Voicemail lives at /inbox/voicemail; number, agent, recording, and provider settings are under /admin/voice-mcp.

Support is now its own module, not a repurposed CRM view — at /support:

• Unified inbox — email, chat, Slack, WhatsApp, and voice land in one thread per customer, so the conversation follows the person across channels.
• AI ticket triage — incoming tickets are classified, routed to the right queue, and the right people are notified, without a human sorting the pile first.
• Ticket sentiment — a rolling sentiment score per ticket auto-escalates the ones turning sour and floats them onto an at-risk dashboard.
• SLA management — set response and resolution policies, watch live countdowns, get an 80%-of-budget warning before a breach, and read a weekly SLA report.
• Support analytics + CSAT — a completed satisfaction loop: send a survey, collect the score, and see volume, resolution time, and satisfaction trends on one dashboard.
• Knowledge-base suggestions — as an agent drafts a reply, relevant KB articles surface right in the composer; helpfulness votes (anonymous for customers) boost the best articles in search, and the KB stays readable offline.

The pre-sales side of the house gets its own module — at /se:

• RFP drafter — upload an RFP, extract the questions, and get draft answers pulled from your win library, each with a confidence level and citations back to the source.
• Architecture proposal designer — compose a proposal with cost bands and a live Mermaid diagram, then export it to PDF for the customer.
• Demo sandboxes — provision a demo environment from a vertical seed template and share a prospect link, with a lifecycle so stale sandboxes clean themselves up.
• Playbook library — curated playbooks with hybrid search, versioning, and usage analytics, so what works gets reused.
• Win library — extract reusable evidence from won deals (consent-gated), so the next proposal starts from proof, not a blank page.

Enrichment now runs on your terms — at /enrichment:

• Bring your own providers — a provider-adapter framework runs your enrichment sources in a waterfall (fall through to the next source when one comes up empty), with a consent gate on every lookup.
• Budget guardrails — set per-team budgets and choose what happens at the threshold: alert, throttle, or block. See a cost preview before a run and a threshold alert when you're close.
• Live signal detection — define rules that watch for buying signals and fire an action when one lands, so a change in an account becomes a task instead of a missed moment.

Get Pact's data into your warehouse without a fragile export script — at /admin/warehouse:

• Analytics entity registry — pick exactly which entities sync, so you own the shape of what lands downstream.
• Budget auto-pause — the sync pauses itself before it blows a spend budget instead of running up a surprise bill.
• MCP tools — configure and inspect the sync from an AI client over MCP, alongside the admin surface.

• One canonical Edit button now sits on contact, account, lead, case, and campaign detail pages.
• No more guessing whether a field is editable inline or which overflow menu hides the edit action — the affordance is where you expect it.

• The MCP tool sandbox now shows results as type-aware tables and charts, so you can read what a tool returned at a glance.
• Guardrail states — consent-filtered rows, rate-limit and cost signals — render inline instead of hiding in the payload.

• No more prefetch storm — the sidebar was firing hundreds of prefetch requests in the first few seconds after load; links now prefetch on hover, which cut the request burst dramatically and made navigation feel immediate.
• One call for unread counts — the separate badge pollers across the shell were consolidated into a single request and the background polling that piled up behind them was removed.

• Widgets now report the real reason they couldn't load, so a failure is diagnosable instead of a shrug.
• Calendar and seat-cap actions (on /meetings and module assignment) show what went wrong — a full seat pool, a disconnected calendar — instead of a silent no-op.
• The cap nudge banner is guarded against a malformed limits payload, so bad data can't blank the upgrade prompt.

• Module switcher — it no longer vanishes when a fetch fails; it now shows an honest zero-state, a retry, a search box, and a Cmd+Shift+M shortcut, and caches the module list so it stops flickering. A ghost-module bug that shrank owners' and admins' module coverage is also fixed.
• Journeys — an enrollment that reaches a terminal wait step now completes instead of looping indefinitely.
• Seats — seat counts reflect only live users, orphaned seat assignments are purged with a proper cascade, and Pact-internal tenants are exempt from seat caps and metering.
• Postgres 500s — a batch of database-only errors is fixed across case and routing-rule creation, meeting contact resolution, the SE scorecard and /se/today, and module assignment, so the new Support and SE modules behave the same on production as in test.

Internal work you feel as a more durable, steadier platform:

• Object storage — the blob layer moved behind an object-store seam with the writer cut over and a backfill worker, so files and attachments no longer depend on a single machine's disk.
• Steadier web tier — the reliability watchdog was tuned and clamped below the memory cliff it guards, sibling instances are prevented from recycling at the same moment, and both machines stay warm so you don't hit a cold "try again" load.
• Honest cost reporting — the internal cost rollup retired a stale line item and now stamps the source of every figure, so the numbers we run the business on are trustworthy.

The MCP server grew from a read-only window into a working surface:

• Entity write tools — create and update accounts, contacts, and deals, and add notes, from Claude, Cursor, or any MCP client, alongside the existing read tools. The catalog now spans 115 tools. Writes require explicit write:* scopes, run on a tighter rate limit, and the consent gate refuses contact writes targeting suppressed or withdrawn subjects.
• A prompt library and pact:// resources — reusable, parameterized prompts and addressable records, so a client can pull the exact context it needs instead of pasting.
• Per-client MCP-only keys — issue a key that works over MCP and nowhere else, scoped by plan tier, with per-key limits.
• Call audit — every tool call is logged with who, what, and when, visible in admin.
• Tool sandbox + client guides — try any tool with synthetic data before pointing it at real records, and follow per-client setup guides for the popular MCP clients.

Why it matters: your AI assistant stops being a reporter and starts being an operator — under keys, limits, and an audit trail you control.

• One search box, the whole workspace: tasks, notes, logged emails, and custom-object groups now come back from the same query as accounts, contacts, and deals.
• Results stay tenant-scoped and permission-checked per entity type.

Why it matters: "I know it's in here somewhere" now has one answer box instead of four.

• Seven new locales — Arabic, Hebrew, Hindi, Indonesian, Turkish, Polish, and Dutch — bringing the app to 14 languages including English.
• Real right-to-left layouts for Arabic and Hebrew: mirrored navigation, correctly-ordered controls, and RTL-aware components, not just translated strings.
• Locale-aware date, number, and currency formatting extends to every new locale.

Three upgrades to the surfaces sales teams live in:

• Pipeline board controls — collapse the stages you're not working (folded stages stay drop targets, so drag-to-move still works) and pick a card density — comfortable, compact, or spacious. The board remembers both per device.
• Deal detail, two-rail — the deal page now puts activity and detail side by side under an inline header, so updating a deal doesn't mean pogo-sticking between tabs.
• Favorite dashboards — star the boards you check daily and they float to the top of the dashboards hub.

• Desktop — a two-column liquid-glass hero, a problem → solution → proof arc, and an interactive tour of the live product as the centerpiece. Claims on the page are limited to what's actually shipped.
• Mobile — a dedicated six-beat story tree: the scroll dropped from ~34 phone screens to ~13, and the primary calls to action sit in the thumb zone.
• Both trees share one live product demo — touch it, no login.

• Contact reads now resolve feature flags and decryption keys once per request instead of once per row.
• On workspaces with tens of thousands of contacts, the people list went from tens of seconds to under a second.
• The same fix applies to every surface that reads contacts in bulk — lists, search results, and exports.

• Per-widget error states — each dashboard widget renders its own readable error with a retry button; the rest of the page keeps working.
• Section boundaries — an error in one dashboard section is contained there instead of taking down the route.
• The AI "What's happening" summary moved off the request path: the dashboard renders immediately and the summary streams in when ready, instead of blocking or showing "Couldn't generate a summary."

• Empty and loading states across the app now use the same primitives — no more mystery blank panels while data loads.
• Destructive actions (delete, revoke, disconnect) use a proper in-app confirmation dialog with a typed danger zone where it matters — the raw browser confirm() popup is gone.
• Motion polish — hover-lift and focus-ring behavior is consistent everywhere, and toasts arrive top-right with a spring instead of jumping.

• Reports automatically include the error ID, build ID, and timestamp of what you hit, plus your user and workspace identifiers.
• A Copy diagnostics button puts the same bundle on your clipboard for tickets filed elsewhere.
• No more "can you tell us roughly when it happened?" round-trips.

We ship many times a day, and the installed (PWA) app could get caught mid-update:

• The app now detects a stale-build load failure and reloads itself once, automatically — no more error screen where retrying just re-broke the same way.
• Edge caching was tightened so a cached page can no longer reference files a newer deploy removed, and the service worker itself is never cached by the CDN.

If you saw "something didn't work" right after opening the installed app, this was it.

A batch of fixes that make the language switcher behave like it should:

• The picker is hidden on pages that aren't translated yet instead of offering a switch that half-works.
• Your language survives sign-in — it no longer snaps back to English after the post-login navigation.
• The UI flips immediately when you switch; saving the preference happens in the background, so a cold backend can't make the switch look dead.
• Saving your language no longer errors for workspace accounts, and the menu closes on select instead of blocking clicks.

• Schema explorer — the desktop entity diagram is back (the growing schema had tripped a clustering threshold and turned it into thumbnails), mobile gets a legible module grid, and pinch-zoom on iOS no longer crashes the page.
• Real-time notifications — the live notification stream reconnected for all sessions; it had been failing authentication since a recent auth change.
• Offline banner — the "you're offline" banner now confirms connectivity with a real probe before showing, instead of sticking on-screen while you're clearly online.
• Contact detail rail — side panels no longer wrap awkwardly at narrow widths.
• AI status checks — availability probes from dashboards no longer count as AI agent calls, which had made AI features look rate-limited or erroring when they weren't.

• Enrichment lookups now carry explicit tenant scoping at the query layer, closing a class of cross-tenant read risk before it could be reached.
• The migration-safety gate in CI was raised to cover every migration through the current head, so schema changes keep getting checked against the same bar.

Your data is yours, and getting it out is never a paid feature:

• Full export of accounts, contacts, opportunities, activity, sequences, and the consent ledger, with inline attachments and a signed manifest so the archive is verifiable end to end.
• Import a previously-exported archive back into a tenant. The format is versioned (v1.1), and minor version bumps are accepted under a family rule so an export never expires the moment we ship an improvement.
• One-shot download tokens with a short audit window, so a link you hand to your data team can't be replayed later.
• Available on every plan, including Free — data portability is a right, not an add-on.

Why it matters: there's no lock-in tax. You can leave with everything, or move a workspace between environments, whenever you want.

Bring Pact to the tab you're already on:

• Cross-browser (Chrome, Edge, Firefox) on Manifest V3, with a shared polyfill so behavior matches across engines.
• PKCE sign-in — the OAuth flow never exposes a client secret in the extension.
• Cmd+K everywhere — the same command palette you use in the app, on any page.
• Calendar context for the account or contact in view, so you walk into a meeting already briefed.

Why it matters: the CRM meets you where the work happens instead of asking you to switch tabs.

Global by default, not as a bolt-on:

• Six locales — Spanish, French, German, Portuguese, Japanese, and Simplified Chinese — across the app and the marketing pages.
• Locale-aware formatters for dates, numbers, and currency, plus localized system email templates.
• A coverage dashboard at /pact-admin/i18n/coverage with a freshness analyzer, so a stale string shows up as a gap instead of shipping silently in English.

Why it matters: international teams see Pact in their own language, down to how a date or an amount is written.

Everything you need to go from Free to paid without talking to sales:

• Stripe Checkout + Customer Portal — start, change, or cancel a subscription and manage payment methods yourself.
• Reverse trial — new workspaces begin on the full paid experience and settle onto the right plan when the trial ends, so you evaluate the real thing.
• Cap-aware upgrade — when a workspace reaches a plan limit, the upgrade is one click, with the affected limit named plainly and no manufactured urgency.
• Usage metering + a usage dashboard so you can see consumption ahead of any usage-based line item.
• Admin surfaces show a clear "configure Stripe keys" banner and disable checkout CTAs until the keys are in place — no half-wired states.

Why it matters: buying and managing Pact is self-serve and honest, with the limits and prices stated plainly.

The evidence a security reviewer asks for, without a sales call:

• Security log and a bug-bounty page, so the security posture and how to report an issue are public.
• Uptime gates wired into the homepage and PWA, so status is honest and visible.
• Self-serve export from the same surface — see the always-free portability above.
• security.txt (RFC 9116) at the apex for coordinated disclosure.

Why it matters: a prospect's security team can self-serve most of their diligence from one place.

Health that shows its work:

• A held-out evaluation on the churn model, plus deal-lifecycle sentiment folded into the score, on a real scheduler.
• A HealthScoreWidget that frames the raw score as a grade, a severity, a trend, and the per-signal (SHAP) contributions behind it.
• Health and risk cards stacked in the account rail, so "why is this account red" has an answer on the call, not in a notebook.

Why it matters: a CSM can defend a renewal number with the specific signals that moved it.

Two AI surfaces grounded in your own records:

• Natural-language search on more lists — opt in and narrow a list by typing what you want instead of building a query.
• AI deal-room brief — a per-deal summary with the sentiment delta, a competitor rollup, and any decision-maker changes, so you catch a shift before it costs you the deal.

Both cite the records behind their claims and run on the same consent-filtered, cost-attributed loop as the rest of Pact's AI.

More ways in, and more places to work:

• HubSpot + Pipedrive importers with schema discovery, field-history handling, and an editable mapping step — so a switch keeps your structure instead of flattening it.
• Native Discord app with chat actions and deal rooms — turn a channel into a CRM record and advance a deal without leaving the conversation.

Why it matters: moving to Pact is guided, and the team keeps collaborating where it already does.

• Automation gap-fill — event triggers, a delete-record action, and save-as-template, so a workflow you tuned once becomes a starting point for the next.
• Real-time editing safety net — an opt-in conflict-and-undo banner and an offline retry queue, so two people on the same record (or a dropped connection) never silently lose an edit.

• Warm auth surfaces — a gentle mesh-and-grain backdrop on sign-in and sign-up.
• In-app surface atmosphere — an opt-in toggle in Settings → Appearance layers subtle depth beneath the glass surfaces across the app. Off by default, per-browser, and it honors reduced-motion, reduced-transparency, and forced-colors.

The system is CSS-only where it counts and composes with the existing ambient theme, so it stays within the homepage performance budget.

Platform depth for teams building on Pact:

• Per-call API metering with tier enforcement, so usage is measured and limits are honest.
• Webhook replay window — re-deliver events a consumer missed instead of losing them.
• Deep-link association files at the web apex so links open the native apps.
• Vertical custom fields seeded per industry template, so a new workspace starts with the fields its vertical actually uses.

• Activation funnel — a 30-second signup-to-first-action path, so a new user does something real fast.
• Role demos at /for/sales, /for/marketing, and /for/cs — touch the product for your role, no login, with an honest "what's illustrative" footer.
• The pricing page moved to a clean four-tier structure with plain-language limits.

Defense in depth on the thing that matters most — your data staying yours:

• Row-level security hardening across the data plane, with CI gates that fail a PR lacking isolation coverage and Postgres regression tests that assert cross-tenant reads are denied.
• Staff-bypass audit — any support access is logged and visible on an admin surface.
• Step-up policy — sensitive operations can require re-verification. It ships off by default, so nothing changes until an admin opts in.

• Static marketing render + route-aware CSP — public pages serve from the edge cache instead of re-rendering per request.
• Per-route perf budgets with a dashboard at /pact-admin/observability/perf, plus an interaction-responsiveness (INP) gate, so a regression fails CI instead of reaching users.
• Design tokens moved to 11-stop, WCAG-verified color scales with status, elevation, type, and surface tokens — one source of truth for contrast.

A batch of correctness and access fixes:

• Analytics — an error boundary surfaces a readable state instead of an unhandled crash, and an owner leaderboard renders an em-dash for a null win rate instead of a broken cell.
• i18n — the language selector no longer 401s silently in production, and it now works across all marketing pages.
• Marketing — a stale pricing slug that crashed server rendering on the landing page is fixed.
• Accessibility — real headings, skip links, correct input types, and labeled controls on sign-up, sign-in, and the pricing calculator, plus a sweep of route aliases and redirects so old links resolve.

Internal work customers feel as a faster, steadier platform:

• Managed CI runner — the heaviest build/deploy jobs run on a native (no-emulation) runner, so releases are faster and less likely to stall in a queue.
• Runtime self-healing — auto-restart and rollback, circuit breakers, tenant-throttling, and a SHA-rollout gate that verifies a deploy actually reached the running app before calling it done.
• Declarative alerting and additional smoke gates (signup flow, chunk-404, auth non-5xx) so a regression pages on-call before it reaches you.

Your AI assistant can now work your CRM directly — at https://api.pact.place/mcp/:

• Nine tools, live today — query_accounts, query_contacts, query_deals, query_pipeline_health, get_metric_explanation, ask_workspace, list_agents, fire_agent, and read_briefing.
• Consent-native — every record passes the same consent gate the product enforces; suppressed or withdrawn subjects are filtered out and the hidden count is reported back to the agent.
• BYOK-respecting — contact PII is read through your tenant's encryption keys, never around them.
• An audit row per call — tool, client, argument digest, latency, result count, and what the consent gate hid.
• Cost-attributed and rate-limited — AI tool spend lands in your usage ledger and is echoed in the response; per-tenant and per-tool limits stop runaway agent loops.
• Native OAuth — standard discovery metadata plus Dynamic Client Registration, so MCP-native clients connect with no pre-shared keys. Scoped pact_live_* API keys work too.

Setup guides for Claude, Cursor, and custom clients: [/integrations/mcp](/integrations/mcp).

One agent is useful; a chain of them is a process — at /admin/agents → Orchestrator:

• Five prebuilt orchestrations — lead → qualified, stalled-deal rescue, account 360 brief, inbox → action (with branched routing), and inbound funnel health.
• Explicit handoff contracts — each step declares exactly which fields of the previous agent's output it consumes; no prompt-soup between agents.
• Gates and forks — a qualification gate stops the chain on a non-fit; a fork routes an inbox item to support or sales by intent.
• Three new roster agents — account qualification (ICP fit from firmographics + engagement), site optimization (first-party tracking stream), and data validation (a measured SQL profile of your data — null rates, duplicates, out-of-range values — not guesses).
• Yours to edit — installing an orchestration materializes a normal workflow, fully editable in the visual builder. Every step stays consent-gated, cost-attributed, and audit-trailed.

Pact's dashboards can now live anywhere you need them:

• Signed-token embeds — each embed is authorized by a short-lived signed JWT minted by your backend; no Pact accounts for your viewers.
• White-label — your branding on the embedded surface, not ours.
• The guarantees travel with the data — rows are consent-filtered and every view is audited and metered, exactly as in-app.
• Five starter templates and an in-app configurator at /admin/embed to compose, brand, and preview an embed before you ship it.

• Layout shift on the dashboard is gone — the welcome hero and KPI strip no longer jump as data arrives; cumulative layout shift on the home and dashboard routes dropped from 0.62 to 0.02 in production measurement.
• Steadier under load — fixed a server-side memory growth pattern that could slow the web app during long sessions, plus a structural watchdog so it can't recur silently.

Zapier-class automation, native to your CRM data — at /admin/workflows:

• Visual canvas with real branching — conditions actually fork execution paths, not just filter a list.
• 4 trigger types and 12 actions spanning records, sequences, notifications, and webhooks.
• Test-run mode — execute a workflow against a sample record and read every step's outcome before you arm it.
• Versioning — published workflows are immutable snapshots; edit a draft, compare, then promote.
• Consent-gated by construction — any step that touches a contact checks the consent ledger at execution time and records a consent_blocked outcome instead of silently sending. Automation a DPO can sign off on.

Switching CRMs is the moment vendors fear and we optimize for — at /admin/migrate:

• Schema-aware mapping — Salesforce Accounts, Contacts, and Opportunities map to Pact's model with owner assignment and field history preserved.
• Dry-run first — a full reconciliation report (counts, collisions, unmapped fields) before a single record is written.
• Consent state carries over — opt-in/opt-out status lands in the consent ledger with provenance, so day-one sends are as compliant as day-100 sends.
• Deduplication built in — existing records match on identity, not blind inserts.

HubSpot, Pipedrive, Close, and Apollo importers are next on the roadmap; the CSV importer covers them today.

Procurement teams shouldn't have to take a marketing page's word for it — /trust renders from the same compliance registry the product enforces:

• Code-backed status — each framework's state (compliant / in progress / available) comes from the live trust-center payload, not hand-edited copy.
• ISO 27001:2022 program — 93 Annex-A controls tracked in-product with a risk register and Statement of Applicability.
• SIG-Lite auto-fill — generate vendor-questionnaire answers from the same control data.
• DSAR, BAA, and sub-processor documentation linked from one place.

Conversational answers over your own CRM data, built the Pact way:

• Citations on every answer — each claim links back to the source records it was derived from; no unsourced assertions.
• Consent-filtered retrieval — records you're not permitted to use never enter the context window.
• Resistant to prompt injection in your data — retrieved content is treated as data, not instructions.
• Audited — every question, answer, and citation set lands in the audit trail.
• Threads: ask a follow-up and the engine keeps the conversation's context.

The transparent weighted health score now has an ML sibling:

• Churn-risk model with per-signal explanations — every score ships with the contribution of each input signal, so "why did this account turn red" has a real answer.
• Risk gauge on account pages and the CS at-risk view — the explanation renders next to the number, not in a data team's notebook.
• The weighted baseline stays — weights you can see and tune live — and both layers are auditable back to source events.

Two ways to type less and capture more:

• Voice notes — tap the mic on any contact, company, or deal, talk, and Pact transcribes the audio, tidies the filler words, and attaches a clean note to the timeline. Works hands-free in the field on the mobile app.
• Magic Compose — an Apple-Intelligence-style menu on any text field: rewrite, shorten, expand, or change the tone, always in your tenant's brand voice. Changes land as a side-by-side diff you approve or reject — nothing is auto-saved.

Both run on a live model call and respect your AI cost controls.

The nine-agent framework now closes the loop:

• Override-and-learn — every agent suggestion can be accepted, edited, or rejected, and that feedback is stored per tenant so the agent's next pass reflects how your team actually works.
• Agent browser at /agents — a directory of every available agent with a detail page showing recent runs, accept/override/reject rates, and where each agent plugs into your workflow.
• Admins get an aggregate trust view to spot which agents are pulling their weight and which need tuning.

No black boxes: you can always see what an agent proposed and why before it touches a record.

Connect Pact to the rest of your stack without a services engagement:

• Public marketplace at /integrations — browse 73 connectors across CRM, marketing, data, billing, and support, each with what it syncs and how to set it up.
• Connection platform at /admin/integrations/connections — configure each connection's field mapping, sync schedule, and direction, and watch its health from one place.
• Custom webhooks with HMAC-signed delivery for anything not in the catalogue, reusing the same encrypted credential store as the first-party connectors.

The quote-to-cash chain now runs all the way through the books:

• Invoices — a first-class invoice object with a branded PDF, a hosted /p/invoice pay page, and a /sales/invoices board. Pay routes to Stripe; Pact never auto-debits.
• Refunds & chargebacks — issue a refund with contra-revenue and deferred-revenue reversal handled correctly.
• ASC 606 revenue recognition — point-in-time vs. ratable schedules, a CFO month-close, and a balanced double-entry journal CSV your accounting team can import.

Built on the existing CPQ and order lifecycle — order fulfillment is decoupled from financial status, with an append-only order-events ledger.

Every piece is live and tenant-scoped:

• Leads at /leads — a first-class Lead object with lifecycle states, scoring, conversion to account + contact, web-form capture, and round-robin / weighted routing.
• Multi-pipeline at /pipeline — deals are no longer single-pipeline. Define your own pipelines with configurable stages, mandatory entry / exit criteria, gated advance with explicit override audit, per-stage automations, and multi-currency forecast rollup.
• Cases (support tickets) at /cases — case lifecycle with SLAs, auto-routing rules, knowledge-base deflection, and conversion to deal.
• Multi-step approvals at /admin/approvals — branching, multi-step approval processes for discounts, refunds, and any custom object. Builds on the existing single-step framework.
• Team selling, compensation, and sharing rules — multi-rep deal participation with per-rep splits, compensation plans (quota and commission), and record-level sharing layered on top of RBAC.
• Forecast command center at /forecasting — rollup, commit / most-likely / best-case overrides, quota and commission, accuracy tracking, cohort trends, and velocity.
• Visual behavioral segment builder at /segments — live count preview, behavioral predicates (page view, form submit) correlated by contact ID, and campaign A/B tests scored with a real chi-square test (p-value, lift, confidence — tri-state, not a thumbs-up).
• Contact 360 — Relationship Strength — a per-contact score on /accounts/[id] summarizing interaction frequency, recency, and reciprocation across email, calls, meetings, and replies.

Why it matters: the full sales motion now lives in one product — from first lead through close, approvals, support handoff, and forecast — without bolt-on tools.

• E-invoice formats — Peppol BIS 3.0, UBL 2.1, and CFDI 4.0 generation with a validation oracle. Submission to AP and PAC providers is human-gated.
• Automated tax — pluggable engine with Avalara and TaxJar adapters, exemption support, and a flat-rate fallback when no provider is configured.
• Plaid ACH and wire reconciliation — encrypted Plaid token storage, an exact-match wire matcher on reference + amount (auto-reconcile when both match, manual queue otherwise), and buyer-initiated Stripe ACH.
• Polished quote PDF — branded header, repeat thead on long quotes, signature block, accept / draft watermark, page numbering, archivable filename, and a print stylesheet that matches the on-screen surface.

• Today / Coach summary on real Claude — the daily summary on /home is a live model call grounded in your own data, not a templated string. Three features that were misclassified as Hybrid were corrected on the public catalogue at /ai-features, which now shows 37 Real, 22 Hybrid, and 0 Not yet AI.
• Magic Compose brand-voice retrieval — hoisted into a leaf module so the brand-voice path that was silently dead in Magic Compose is now wired end-to-end. Existing Magic Compose flows benefit automatically.
• Campaign Builder agent — drafts a multi-step campaign (subject lines, body, sends, follow-ups) from a brief and lets you optimize before sending. Lives in /admin/automations and on the campaign editor.

Why it matters: every AI feature classified as "Real" actually runs a live model call on every request — and the catalogue is the same registry that powers the in-app honesty badges and a CI gate that blocks any feature shipped as "AI" without a real model call.

• Break-glass admin recovery — a sealed, audit-logged path back into your tenant when SSO is misconfigured, so you can never lock yourself out.
• SAML group → role JIT — first-time sign-in maps SAML groups to Pact roles automatically.
• SP-side request signing — Pact signs its SAML AuthnRequests so identity providers can verify them.
• SCIM enterprise extension — supports employee number, department, manager, and cost center.
• Metadata-URL setup + Workday-tested guide — paste your IdP's metadata URL and Pact configures the rest. End-to-end tested with Workday.
• HMAC-signed webhooks with rotation — every outbound webhook carries a signature; admins can rotate the signing secret with a grace window so subscribers never miss a beat.
• Per-tenant inbound credentials and quota usage — see exactly which integration is sending what, with rate-limit headroom at a glance.

Why it matters: enterprise admins can stand up SSO, SCIM, and signed webhooks without filing a support ticket, and have full visibility into who's authenticated and what's hitting their tenant.

• Contact detail page — grid columns constrained so long identifiers no longer overflow at 320 px; the What's-happening card body no longer goes blank after refresh; $5,000k currency rollup formats correctly.
• Pipeline kanban virtualization — measureElement is wired correctly, so deal cards no longer overlap on tall stages.
• Visual builder drag-from-palette — every visual builder (sequences, journeys, workflows, custom workflows) now accepts a drag without crashing the canvas. Hardened against WebKit, mobile gestures, agent-built canvases, and empty canvases.
• Buyer Lens — pill wrap and a properly responsive 4-column channel grid that no longer cramps at 320 px.
• Pull-to-refresh — gated on scroll position so accidental pulls during reading don't trigger a refetch.

Internal improvements that customers don't see directly but feel as fewer deploy delays and tighter release safety:

• Vercel build headroom — Node heap and twitter-image runtime literals tuned so Vercel builds don't run out of memory partway through.
• Deploy guards — our deploy.sh wrapper refuses to deploy unmerged HEAD and pre-flights every pending Postgres migration before the cutover, so a botched release is caught before any user-visible change.
• ~~Tighter security CI — the auth-hygiene scanner now recognizes require_module as a valid authorization guard, so the gate flags real issues without false positives that previously blocked unrelated PRs.~~

> Correction — 2026-08-23. The struck-through claim above was wrong, and we are leaving it visible rather than deleting it.

>

> require_module is not an authorization guard. It returns early for owner, admin and api callers before any check; it no-ops when a tenant's MODULES_ENABLED flag is false; and it fails open on any flag-store error. That flag has zero rows in production, so in practice it admitted every caller on every tenant.

>

> Teaching the scanner to accept it did not remove false positives — it credited 717 routes as authorization-guarded when they had no authorization check at all, and hid them behind a green summary that has been cited as access-control evidence.

>

> The scanner has since been reworked to classify require_module as fail-open rather than as a guard, and to separate "authenticated" from "authorized" instead of collapsing both into one boolean. Nothing about the product's actual access control changed on 2026-06-04 in either direction; only the reporting was wrong.

A new help layer that sits on top of the existing help bubble:

• Hover, click, or keyboard-focus the ⓘ icon to open a glass tooltip with a short description and a deep link to the relevant docs.
• Ask AI inline — the answer streams back in under two seconds, grounded in the specific control you asked about. If the AI doesn't have enough context, it says so instead of guessing.
• Wired into ten real controls today across API keys, notifications, appearance, and the dashboard, and rolling out to more surfaces every week.
• Touch devices get a full-width bottom sheet so the content never clips a screen edge; the controls without a help entry stay clean — no clutter where there's nothing to say.

Two surfaces, one source of truth:

• Public catalogue at /ai-features — every AI feature Pact ships, classified as REAL (a live model call on every request), HYBRID (model plus deterministic logic), or NOT YET AI, with the provider, surfaces, and what it does. No marketing fluff; the same registry powers the in-app honesty badges and a CI gate that blocks any feature shipped as "AI" without a live model call.
• Admin browser at /admin/ai/features — card grid with classification chips, search, filters, and sorts; a tenant-wide 30-day spend hero; and a cost-optimization panel with concrete recommendations (model efficiency, large-context warnings, low-usage flags, cache health).
• Per-feature detail page with a curated sample input/output, the last 20 anonymized runs, the system-prompt overlay (and whether you've overridden it), where the feature is used in the product, and tailored recommendations for that feature only.

Why it matters: admins can see exactly what every AI feature does, what it costs, and where to tune it — without filing a ticket or reading code.

A new gallery at /dashboards/new with eight category-grouped templates, each composed over real tenant-scoped data and clonable with one tap:

• Sales velocity — weighted pipeline, win rate, time-to-close trend, win rate by source, forecast by category.
• Deal aging — stale deals (>30 days idle), slipped close dates, aging buckets, average age by stage.
• Win rate by source — by source, industry, deal size, rep, and quarter.
• Rep ramp — deals and activity per rep, win rate by rep, tenure.
• Activity intelligence — activity mix, daily volume, per-rep load, sequence engagement.
• Customer success scorecard — health distribution, NPS trend, at-risk accounts, renewals.
• Marketing attribution — first-touch source pipeline and revenue, channel mix, engagement.
• Executive scorecard — ARR, bookings QTD, win rate, coverage, health, NPS plus trends.

Every template inherits the existing dashboard builder's anomaly badges, AI insight summaries, and threshold alerts.

Turns Pact's existing controls — tenant isolation, RBAC, append-only audit log, GDPR deletion, sub-processor management, encryption — into systematic, auditor-ingestible evidence:

• SOC 2 readiness scorecard at /admin/compliance/soc2 — per-criterion coverage across all five SOC 2 Trust Services Criteria, with per-evidence-type freshness.
• Automated nightly evidence collection for six evidence types (access review, audit-log retention, vendor/sub-processor schedule, customer data deletion, encryption posture, processing-integrity controls). Manual evidence (change management, vulnerability scans, backup-restore test, incident response, tenant-isolation CI gate) is surfaced as an honest gap list with collection instructions — never fabricated.
• Tamper-evident bundles — SHA-256 hashes over every artifact's exact bytes, a manifest hash over the sorted set, and an optional HMAC-SHA256 signature. Verifiable end-to-end; any byte-level edit is detected.
• One-click monthly bundle + multi-period auditor package, each with an auditor-facing index PDF.
• Self-serve HIPAA BAA at /admin/compliance/baa — preview the addendum with your covered-entity name pre-filled, download a signed PDF with a matching document hash.

Why it matters: enterprise prospects' auditors can be handed a polished evidence ZIP covering every SOC 2 criterion on the spot — and HIPAA-covered customers can self-serve a BAA without going through legal back-and-forth.

Every seeded record now carries an is_seed_data flag, and the Admin → Data management surface gained a "Seeded emails" card with a DEMO badge and a one-click purge button (with a type-DELETE confirm and an audit-log entry). Use it as part of your go-live checklist to clear the demo emails the workspace shipped with — your real, customer-entered contact emails are never touched.

Two internal improvements that customers don't see directly but feel as a faster, more reliable platform:

• Recurring preview-environment cleanup — a unified engine reaps closed-PR preview databases, branches, and deploys on a nightly schedule and after every release, with safety rails that never touch open PRs, protected branches, or anything labeled keep-preview.
• Daily branch-hygiene sweep — automated audit of long-stale branches with a rolling tracking issue, so engineering work stays focused and the deploy surface stays clean.

Each persona gets its own walk-through of the surfaces it uses daily, anchored to real screens:

• CRM — accounts, contacts, deals, follow-ups, pipeline.
• Customer Success — health, at-risk accounts, playbooks, workload.
• Marketing — sequences, templates, AI steps, forms, attribution.
• Admin — users, integrations, audit log, AI usage, health.

Tours auto-start on first sign-in, resume if you leave mid-way, and can be replayed any time.

• Hybrid search — results are ranked across all entities using keyword and semantic matching together, so the right account, contact, or deal surfaces first.
• Graceful calendar links — calendar URLs redirect sensibly instead of dead-ending in a 404.
• Cross-module navigation — jumping from one module to another preserves your context, with a breadcrumb back to where you came from.

• Inbox triage — sorts and prioritizes incoming messages.
• Deal coach — suggests the next best move on an open deal.
• Customer-success save — flags at-risk accounts and drafts a save play.
• Sequence personalizer — tailors outbound steps to each recipient.

Trigger an agent yourself, or schedule it to run on its own.

• AI features return an honest "not enough information" rather than inventing details when context is thin.
• Untrusted input (record content, email bodies, uploads) is fenced from instructions across every AI surface, hardening against prompt injection.

• SSO required is now enforced at sign-in — closing a real gap where password login still worked when SSO was mandated.
• Audit log retention prunes on a schedule per your policy.
• Downloadable DPA — generate and download your Data Processing Addendum as a PDF.
• Cookie consent banner for public surfaces.
• Sub-processor list is tenant-aware and kept current.