Changelog

What changed

On 1 November one busy phone call switched AI off for a whole workspace. Three fixes make sure that can't happen again.

• One thing you say on a call counts once against your AI limit, however many steps it takes Pact to answer it. Before, a caller could hit the limit after about four sentences.
• A burst of rate-limited AI requests now raises an alert for Pact's team instead of switching AI off for everyone. Any workspace the old rule switched off was switched back on by this release.
• One ordinary sentence that happens to look like an instruction to the AI, such as "so you are now the owner of the Acme deal", is refused on its own and no longer switches AI off for the workspace. Repeated real attempts still do.

What changed

Pact's numbers now agree with what each person can see.

• A rep's pipeline forecast adds up their own deals, and a manager's adds up their team's. Before, a rep could see a forecast for the whole company above an empty board. Owners and admins see the same totals as before.
• Search shows a rep the accounts and deals in their own book.
• The contacts export includes every person on the Contacts page, not just a header row.
• A support case past its due time with no first response shows as SLA-breached straight away, in lists, filters and reports.
• Consent Today lists overdue privacy requests first and says how many are overdue.

What changed

Asking for a Pact workspace is quicker to review and safer to send.

• Your request starts with a sign-in link to your inbox, so we know the address works before anyone reviews it.
• The form asks a few short questions about your company: website, size, industry, country, the CRM you use today and what you want Pact for. Your workspace can then open set up for your industry.
• The confirmation email is branded, reads well in dark mode and in Outlook, and can't be used up by a company's link scanner before you click it.

What changed

Sharing a demo sandbox was meant to tell you when the prospect opened it. That notification never arrived. It does now.

• The first time someone opens a demo sandbox link you shared, you get a notification, so you can follow up while the demo is fresh.
• Nothing changes for the prospect: the link opens the same demo as before.

What changed

Someone can try to slip instructions to Pact's AI inside an email, a lead, a call transcript or a document you upload. Pact now catches more of those attempts.

• Instructions disguised with invisible characters, look-alike letters, wide characters or quoting are checked the same way as plain text. In Pact's own test suite of 120 planted instructions, 36 used to get past the check because of how they were spelled; each is now checked the way the AI would read it.
• Text hidden inside structured data is unpacked and checked before the AI reads it.
• When the AI reads an email for you during a call and that email carries a hidden instruction, the email is withheld and the call carries on.

What changed

@mentions used to work only in Pact's demo workspace. They now work in every workspace: type @ in a comment, pick a teammate, and they see it on Home and in the notification bell.

• Home's Mentions & comments card shows only mentions and comments. Alerts stay in the bell.
• Every row names who wrote it and what they did, such as "replied to you" or "reacted to your comment".
• A row opens the record, scrolled to the comment. A row with nowhere to go says why instead of opening a missing page.
• Notifications in the bell, on Home, in email, in push and in Slack open the right record and name the person who acted. Eight kinds that used to open a missing page now open the right one.

What changed

Home's cards read like a list of people and deals again, not identifiers.

• The deals, signals, tasks and recently viewed cards name each record and the person behind it, and selecting a row opens that record.
• A person always shows as a name, or "A teammate" when the name can't be read, never as an email address.
• The customer success and marketing Today pages no longer show account numbers or invented zeros. An account with no score reads "No score".
• After someone else signs in on the same browser, What's new no longer flashes the previous person's unread count, and a release you haven't seen always shows as unread.

What changed

An account whose renewal had closed won could still read "In pipeline" because a new expansion or renewal was open. That's fixed.

• Once an account has a closed-won deal, it is a customer until it's marked lost or churned. An open renewal or expansion shows as "renewal in progress", never as a step back to pipeline.
• A renewal deal that closes won moves the account to Renewed.
• The lifecycle strip, the accounts filter, the report builder, the account page and Do next now agree on every account's stage.
• Do next shows a health score as the number with its band, such as "9 (critical)".
• Deal boards with more than 200 deals now load every deal instead of stopping at the first 200.

What changed

The next best action card used to sit empty for several seconds while the AI worked. It now shows something useful straight away.

• The card opens with the last AI suggestion and how old it is, or with the top rule-based suggestion, labelled Rules.
• A fresh AI suggestion fills in as it is written, then its buttons appear, without the card jumping.
• Opening an unchanged account again keeps the AI suggestion it already has instead of falling back to rules.
• A workspace that has reached its AI limit gets the rule-based suggestion instead of a broken card.

What changed

Questions on your Pact phone line now get answers, and fewer answers get lost.

• A question is answered, never treated as a change. "How many deals have we lost on Acme?" used to be read as "mark Acme as lost"; now you hear the count.
• If an answer is cut off and you say "what?", the line gives you the rest of it.
• New questions: which reps drove a change, how accurate your forecast was, what actually moved this quarter, and whether your sales cycle is getting longer.
• A second, different question about the same name keeps the account you already picked.
• "How is my team doing?" now says how many reps it covers, for example "56 of 108 reps with deals", instead of counting only the reps with deals.

What changed

Picking a new Pro or Premium call voice now opens a confirm step with two priced choices.

• Warm the new voice now records your call lines and quick replies in the new voice, shows its progress, then shows the actual cost beside the estimate.
• Skip saves without recording anything. It shows what recording the same replies during calls will cost, and how long your first line currently takes to start.
• If some lines fail to record, the card now says how many are missing and offers a retry, instead of saying the voice is ready.

What changed

A handful of limits were getting in the way of ordinary work. They now match how Pact is used.

• The import wizard keeps your uploaded file from one step to the next, so a preview never asks you to upload a file you just uploaded.
• A save that's retried after a dropped connection is applied once, not twice.
• A failed import no longer counts against the one-import-per-hour limit, so you can fix it and run it again straight away.
• A workspace gets its own plan's daily limits even before billing is set up, instead of the free plan's.
• Call recordings up to 120 MB can be uploaded, so an hour-long call fits.
• Busy pages like search no longer share one rate limit, so heavy use of one doesn't block another.
• If removing a deleted workspace's data fails, it is retried at least twice before day 30, so a deletion still finishes within the 30 days Pact promises.

What changed

Switching from HubSpot or Salesforce now brings every deal onto your board with its real owner and stage, so your pipeline looks the way it did in your old system.

• Activities and notes arrive with their text, attached to the right record.
• Consent comes across only where your old system recorded it.
• The import ends with a report of exactly what came across and, for anything that didn't, why.

What changed

Each row on Home's Awaiting your approval card now says what is being asked, on which deal, who asked, and how long it has waited. Selecting a row opens the approval.

• The card lists the requests you can decide. If you can't decide any, it shows the status of your own requests under a caption that says so.
• A request whose deal is no longer available shows a plain reason instead of a broken link.

What changed

Your Pact phone line can now make these changes for you, read each one back in words, and save it only after you confirm.

• Reassign a deal or account owner.
• Move a close date or change a deal amount.
• Add a task, schedule a follow-up, or mark a task done.

What changed

A deploy no longer ends a phone call to your Pact line. A call in progress stays up while Pact updates.

• If the line drops for any other reason, the call reopens with its context and the caller hears "Sorry, I lost you for a second." followed by the question they were answering.
• A change the caller already confirmed is not made a second time after the call resumes.

What changed

The tasks page and the hot leads list now load every time, instead of showing "Something went wrong".

• Completing a task from the list works the same way.
• When Home or the module switcher is slow to answer, it keeps its placeholder, says it is still loading, and asks once more. An error appears only when a request really failed, and it says what failed.

What changed

When you ask your Pact line about an account by name, for example "what's been going on with Acme Corp?", it now reads that account first and answers in one step instead of two.

• In our timed replay, the first spoken word at the median moved from about 6.0 seconds to 3.8 seconds.
• Questions that name no account, or two, behave as before.

One form, everywhere you work. Log call opens the same short form from an account, a contact, a deal or Today. The outcome is required and never preselected, a no-answer takes two taps, minutes are asked only for a connected call, and the start time can be changed for end-of-day logging. The form previews the exact line your call will add to the timeline.

It lands where people look. A logged call is written to the account's timeline, which every record's Timeline tab reads. A contact or deal from a different account is refused rather than filed in the wrong place, and a contact with no account still gets its call, with a note saying why there is no timeline line.

The call page says what a call did. "What this call did" links each record a voice call changed and names the action that changed it, every action is listed with its outcome (Done, Refused or Failed), and the lookups it ran are listed too. The call is titled by the person caller ID matched, with the number beneath.

Recordings on a phone. Call recordings now play on phones, and you can reveal a caller's full number when you need it. Each reveal is logged.

Every deal is reachable. Each pipeline column shows its first 50 deals, says how many of its deals are shown out of the exact total, and loads the next 50 when you ask. A "Show more" that fails says so on its own line.

Stage moves everyone can see. On a deal page, Stage is now a choice of that pipeline's stages and moves the deal through the same checks as the board. The move appears on the deal's Timeline tab beside its calls and notes, and in the manager's activity feed, which now opens on work and leaves sign-ins behind a labeled toggle.

At-risk deals stay visible. Today's at-risk list keeps an open deal whose stage happens to share its name with another pipeline's won or lost stage.

Imports that finish the job. An import with no owner column gives its deals and accounts to the person who ran it, open deals past their close date reach that rep's Today, undoing an import also removes the accounts it created (and says which it kept and why), and a run that stopped making progress reads as failed instead of running forever.

Contacts on their account. A contact added by hand is linked to its account, so it shows on the account page, its roster and in Ask Pact.

Short answers first. The line answers the question you asked in a sentence or two and offers the rest only when there is more. Repeating yourself is treated as a correction, never answered with the same sentence twice, and when your workspace has used its AI allowance the line tells you plainly.

Your names, heard right. The line looks among your own accounts first, matches a misheard name by how it sounds, and asks one clear question instead of guessing between two similar accounts. It only ever chooses among records that exist.

Spoken like a person. People are named, never read out as email addresses, an account's industry is said once rather than repeated after a name that already says it, and "the contacts at" replaces an awkward possessive.

Fewer interruptions. A rep calling from their own number can make 30 calls an hour, blocked attempts no longer count toward the limit, and the line never offers a follow-up while it is still waiting on your answer.

The screen keeps up. A live call's view in the browser updates as the call happens, whichever of Pact's servers handled the moment, instead of waiting for the next reconnect.

Status that follows the thread. A customer's reply and your answer each move the case, so the queue shows who is waiting on whom. A case that arrives by email opens on the sender's contact and account, and replies thread back into the same case.

Chat visitors are recognized. A chat visitor who gives their email address is matched to their contact.

A reply that was not sent says so. When a reply cannot be delivered, the inbox shows a warning with the reason and an Open settings button instead of a success message. Admins can set the address replies come from in Support settings, under Outbound.

Times you can trust. Every support time, from the SLA countdown to triage, participants and the renewals board, is sent as an exact moment, so it reads correctly in every time zone and the triage time says it is UTC.

Off until you turn it on. On the Saves page, an admin switches on the Renewal at risk play and first sees how many accounts would have started it today.

What it does. When an account's health band drops and it has an open renewal due within 90 days, or already overdue, the play starts for the account owner: one task per step, each due by the renewal date, and one in-app notification saying why. It emails no one, and it never starts a second copy of a play already running.

CSAT counts on its own. Account health gains a CSAT signal from the 1 to 5 ratings an account gave in the last 180 days. An account nobody has rated is left out of that signal rather than scored as neutral, so turning it on moves no unrated account.

Support is part of the picture. Open support cases count as open tickets in account health, and support activity counts as activity on the account.

Consent on the lead. A Consent card on each lead says whether you may send them marketing email: granted, pending, withdrawn, expired or none, with the form, the date and the boxes they ticked. It is the first card on a phone, and the lead's header carries a badge. A consent record that could not be read says so instead of showing none.

Converted leads land on the board. Converting a lead puts the new deal on your default pipeline's first open stage, or the stage you choose, instead of a stage no pipeline has.

Embed anywhere. Hosted forms can now be embedded on any website.

A checklist that checks. For each sending domain, email settings now read SPF, DKIM, DMARC and alignment live and show the exact record to publish for anything missing.

Honest placement. Inbox placement shows "Not measured" until it has been measured, instead of an estimate.

Nothing lost on the way in. Bounces and complaints from your email provider are verified the way each provider signs them, and if saving one fails the provider is asked to send it again. Text-message delivery receipts and STOP replies work the same way, and each is recorded once.

Ready to run. A Ready to run panel on the Modules page lists, for each module, the background jobs, settings and keys it depends on and whether each is in place, by name only. A check that could not be read says unknown, with the reason.

A module reaches its own pages. Sales seats open the win/loss deal feed behind Sales, and CS seats open the win/loss reports behind Customer Success, so neither page refuses the people who bought it.

Re-activate a member. The Users page offers Re-activate on a suspended member, on desktop and on a phone card. It takes back a plan seat and each module seat, and it refuses members managed by your identity provider.

Company sign-in from the login page. A workspace that uses OIDC single sign-on can start sign-in from Pact's login page, and admins configure it with one redirect address.

Status you can believe. Each component on the status page is either measured, with how recently, or marked unknown. Uptime is shown over real checks only, with the number of days behind it, and a summary says how many components are monitored right now.

One sub-processor list. The trust page, the data processing agreement and the admin list read from one register. Each vendor says when it is engaged, and vendors Pact does not use are listed as not sub-processors.

Erasure keeps proof, not the person. A completed erasure keeps a record that the request was fulfilled, without a copy of the person's data.

Privacy requests that cannot fail quietly. If any step of an access or erasure request cannot be read, it is named on the result and the request stays open, and the impact preview says Not counted instead of zero.

One place to start. A new seat lands on a single Start here card that asks what they do and points to three places worth their first ten minutes.

Nothing loud before they have done anything. No tours open by themselves, there is no role picker, there are no points before any work, and What's new starts at zero.

Owners set up once. Workspace owners get the setup wizard once, not twice.

A real health number. "Avg account health" on Home now reads your accounts' real health.

Connections that stay alive. Pact refreshes each connected calendar's and mailbox's sign-in before it expires, and an Outlook connection's update subscription is renewed a day ahead.

When one breaks, it says why. A connection the provider has rejected is marked as needing a reconnect, and the calendar page, Home and each record's email tab say what went wrong.

Reconnect your own. Connect and Reconnect take you to your own calendar page, not an admin screen.

Missing is not zero. Marketing Today counts your active journeys again, and a count it cannot read is marked as missing rather than shown as 0. Account-health and engagement key results read the right figures and say so when a read fails.

Whole windows. NPS averages and the tracking, social and data snapshots on Today count everything in their window, including its first day and the hours before midnight UTC.

Duplicates found again. Data-quality scans detect duplicate contacts that share an email address.

AI text ends cleanly. Every AI sentence is kept within its space on a word boundary, so none stops mid-word, and the next-best-action card shows its whole sentence and names the record it is about.

Quick at size. The activity feed reads its newest items first, the support queue ranks cases with one read instead of one per case, and the dashboard funnel reads deals once. Each stays quick as a workspace grows.

Fair background work. Background jobs are served workspace by workspace, so one workspace's large import or backlog no longer delays everyone else's jobs or webhooks.

How sure, in words. Each answer shows a confidence band with what it means (never a bare percentage), leads with the weakest reason, and adds a "how I know" line. A question Pact declined or redirected says it is not an answer, and one that could not be answered says "Not answered" instead of guessing. On a phone you see the band and one line, with the reasons a tap away.

The same numbers as your lists. Counts and lists of accounts, deals, contacts and cases now match what you see when you open the matching list, and every answer says whose book it covers: yours, your team's or the whole workspace. When the daily question limit is reached or something fails, Ask explains what happened rather than showing an error.

More of your workspace. Ask can now answer about tasks, quotes, contracts, portal tickets, NPS, onboarding, win/loss, field visits and identified website visitors. Filters you name, such as an industry, state, country or region, are applied using your workspace's own values, and "how many" questions come back as a number.

Sharper routing. Questions about invoices, recent consent changes, lead counts, why you lose and to whom, and quiet deals over a named window each reach the right answer. "How many reps hit quota" is counted for the period you name, and a forecast explanation uses the period you asked about and says whether it came in above or below plan.

Deal questions, answered from your records. Asking which deals are at risk, or "which are my largest open deals?", answers from your deal records even in a workspace with no AI model connected, with open deals listed largest first. When Ask names the "largest" at-risk accounts, they are the three with the most ARR, largest first.

It learns from your calls. After every finished call, the line picks up the names you correct ("no, I meant …"), and uses a name once two calls agree on it. Learned names belong to your workspace. It also tunes how much it says: more detail when you often ask it to repeat, shorter answers when you often cut it off.

You can see and undo all of it. Settings › Voice › What Pact learned shows each change, the calls that caused it by date and time (linked to each call's page) and when it happened. Undo or delete anything, or switch learning off.

Admins can review the whole workspace. Owners and admins get a Workspace names page listing every learned name: what the line heard, the account it maps to, who taught it and the calls that confirmed it. Removing a name is logged under the admin's name, and erasing a contact's data removes learned names that match them.

Better conversations. Ask two questions in one breath ("What accounts do I have? Which are at risk?") and both are answered, in order. When the line talks with a caller in another supported language, its greeting says it is an AI in that language. The first call after Pact restarts answers as quickly as every call after it.

More you can do by phone. "Tell me about" an account includes its deals. Log a call and correct the account mid-sentence ("no, I meant …"), or give the account and the summary in one breath; the note lands on the account you meant, with its time, in the activity timeline. Saying goodbye simply ends the call.

Honest when a source is missing. If a deal timeline cannot read one of its sources, such as calls, the line says so out loud instead of implying nobody called. The weekly review counts the deals that moved stage from the full activity history, and says so when every one of those moves comes from imported history.

Every insight on the call page. A call's page now shows every insight Pact extracted. Workspaces that use MEDDPICC get a tab for each MEDDPICC area with findings, anything else collects under Other, and the page opens on the first tab with content.

One stage line. The account page shows one stage: the one Pact derives from your records, or a stage someone set by hand when it is further along, with who set it, when and why. Changing it asks for a reason, and the change is kept in the account's history.

The same stage everywhere. The Accounts list filter (now with a Customer option covering every customer stage), segments, custom reports, plain-language reports, playbooks, search, Ask and voice all read that one stage. A stage your pipeline marks as won counts as won whatever it is called, and saved views and old links keep working.

Where accounts stall. Analytics › Funnels opens with conversion and time spent in each lifecycle stage. Stage history is recorded as accounts are opened and worked, so counts are shown as minimums and the page says so.

Customer Success, from day one. A just-won customer appears on the CS boards and accounts list straight away, marked Not scored yet, with a Stage column and a Not scored filter. The CS Journey board's columns are real customer stages (Just won, Onboarding, Supported, Renewed) with risk on each card and an At risk only filter. The CS home shows each CSM their own book, and managers their team's.

Reasons in sentences. The reason beside each customer-health score now reads as a plain sentence instead of a raw count.

Marketing and phone homes. The Marketing home shows the lifecycle lane for the accounts your campaigns and journeys reached, and how many records could not be matched to an account. On a phone, a module home's lifecycle lane opens on its top three next actions, each with its reason. Converting a lead now carries its source, owner and notes onto the new account, contact and deal.

Commit means Commit. Analytics › Forecasts adds up the open deals your reps called Commit, the same figure the sales Forecast page shows, and says how many deals it covers.

One forecast strip. The pipeline's forecast strip folds different spellings of a category into one ("COMMIT" and "Commit"), and its total is Open, weighted: open deals only, each at its own probability, so it matches the dashboard. Workspaces with closed-won deals will see this total come down, because won deals no longer count in it.

The day the rep picked. Close dates on the board, the deals list and the deal page show the date that was chosen, west of UTC too, so a January 1 close stays in its quarter.

At-risk lists you can act on. Each deal's risk level comes from its current score, and won or lost deals drop out of the at-risk lists on Today, the dashboard and the risk feed.

Every stage move, recorded the same way. Whether a deal moves on its page, by voice, from chat or through the API, it records the same stage history, close date and forecast update, with who or what moved it. A stage that does not exist in that deal's pipeline is refused with the list of valid stages.

Cycle time and coverage. Average sales cycle measures won deals from creation to close, and says so when no won deal has a close date yet rather than showing 0. The pipeline-coverage figure that the API and connected AI assistants read counts only the period's won deals toward its goal.

The team's board, first. A manager with direct reports opens the pipeline board on the team's deals, titled Team pipeline, and can switch between Team and Mine. Opening a report's board shows that person's deals. Reps still open on their own book, and a new workspace's sample deals belong to its real people. Manager Today and the manager forecast show each rep's real open deals and pipeline value, including deals created in the app.

Leader homes that hold together. Sales manager and director Today pages have a title in every state, the lifecycle lane for the team's book, waiting chips and a Try again that reloads. On desktop, the "whose data" picker sits in the page header, and a link to a CSM's Today opens that CSM's book.

A rep's pages. When no deal value has been typed in, the account header shows the account's open pipeline. Open forecast on Today opens the forecast. Members no longer see admin-only setup links on AI cards, and at-risk deals scored on deal records appear in Today and open the deal's own page.

Radar names the record. Each Radar suggestion names the account, contact or deal it is about, filter chips show how many of each kind are waiting, and Do it on a deal card opens that deal on the board. A reply draft without a connected mailbox says Connect your Gmail and links to your own connection page.

Your next seven days. The calendar page lays out your week: each meeting with its account, and its open deal when there is exactly one. Free time in working hours is marked as unverified when Pact cannot see your calendar, and your connection state sits on the page with the step that fixes it.

For managers. The team view shows each rep's calendar connection, read-only, and coverage counts only the reps whose calendar Pact can see.

Attendees by name. When scheduling or editing a meeting, pick attendees from your workspace's people and the account's contacts, or type an email.

Connect from where you are. Connect calendar, Reconnect and Check calendar settings open your own connection page, as does Connect Gmail on a reply draft. Last synced always reads as a past time.

Schedule meeting says what it needs. On an account or contact, the dialog tells apart a calendar that is not connected (with a one-click Add a task to schedule it), a calendar with no booking links yet, and a read that failed (with Try again).

Forms that win deals get the credit. Attribution now follows a won deal back to the lead it was converted from and the form touches on that lead. Web visits and lead touches are ordered by time, so first-touch, last-touch and U-shaped models weigh them correctly, and a deal converted without a company is credited too.

Sends count right away. Each campaign send is linked to its account as it goes out, so the Marketing home's account lane includes it immediately.

Alerts that explain themselves. When reading from an account surges on your website, the owner's alert says why in plain words, names the pricing page when that is what drew the visits, and links to the account. An account with no earlier activity is described as new interest.

A code after your password. Once you add an authenticator app under Settings › MFA, sign-in asks for its 6-digit code, or one of your recovery codes. Passkey and single sign-on sign-ins rely on the passkey or your identity provider instead.

MFA by role. Admins can require multi-factor sign-in for any role on the IAM policies page, which explains who a rule will affect. When the grace period ends, someone who has not enrolled gets a setup-only sign-in that lets them add an authenticator and save recovery codes before going any further.

Rules that apply to open sessions. Turning on MFA required for a role first lists everyone it would sign out, people with no passkey or authenticator, and signs them out only after you confirm. You cannot sign yourself out this way, and nobody is signed out during a grace window.

Groups decide roles. When your identity provider grants a role through a group, removing someone from that group, unmapping it or deleting it returns them to their own role in Pact and refreshes their session. A role set by hand on the Team page counts as their own.

Immediate. Signing out, ending a session, deactivating someone or changing their role takes effect on the very next request.

Every setting says what it does. Organization settings shows, for each field, whether it is enforced, applied, report-only or stored only, with this workspace's actual thresholds and AI spend, in plain words.

AI spending caps are enforced. The monthly caps for the whole workspace and for each person now refuse further AI requests once reached, with a message pointing to the setting. Unless an owner changes them, the caps are $5,000 a month for the workspace and $200 a month per person, so a heavy user can reach theirs. Spend on your own model key is shown as not enforced.

More in the audit log. Role changes made by an identity-provider group sync, every change to the AI spending cap, and team role changes, invites and removals all appear in the audit log with who made them.

Webhooks you can de-duplicate. Each event reaches a subscription once, with the same event ID on every retry, and re-enabling a paused subscription no longer replays everything it missed. Website events identify the account by its public ID, as documented.

Schema exports. The schema explorer exports your data model as a Prisma schema, an OpenAPI fragment or the migration history, with tables above your access level redacted.

A trail you can audit. AI governance gains the Ask trail: every question asked of your workspace's data, with personal details redacted before anything is stored, how sure each answer was, and totals for the period. Members never see colleagues' questions.

Kept briefly, erased with the person. Questions are kept for 90 days by default, and a question that cites a person is deleted when that person's data is erased.

Limits stated, and checked first. Ask estimates what an answer will cost before calling a model and declines, with the reason, if it is over the per-answer limit of 5¢. The AI budget page's Ask limits card states the daily question limit, where it comes from, today's use and the per-person-per-minute ceiling.

Build it once, get it on your schedule. Choose what to export (accounts, contacts, deals and more) and filter it, then schedule it to recur or press Run now. Each run produces a signed download link, sent by email, that expires after seven days.

A receipt for every run. Each schedule shows the last run's result, whether the email went out (and, if it was held, the reason in plain words), how often the link was opened, when it expires and when the next run is due.

What left, on the record. Export history lists the fields that left your workspace in each run. Sending to an address outside your workspace follows your email safety settings.

The real deadline, everywhere. Due times and SLA countdowns on the case page, the case list and its events, the at-risk board and the support queue count down from the actual deadline, whether you work east or west of UTC, so a case never looks safer or later than it is.

Open cases count toward health. An account's health score now includes its open support cases, and its health card shows how many there are. Accounts with open cases may score lower once their health is recalculated, which is the point: the score now reflects them.

The Support workspace is part of enterprise plans.

Last visited, at a glance. Each account in a territory reads "Visited" with the day of its last visit, or "Not visited yet", and an account untouched for 30 days or more is flagged with how long it has been. If visits cannot be read, the page says so rather than showing "Not visited yet".

A scorecard that adds up. The Visits card shows done, skipped, no-show and still-open visits, and the four add up to the visits planned. New opportunities count deals opened within a week of a completed visit.

The same Today. Field's home now uses the standard Today layout, leading with the next stop.

Field is part of enterprise plans.

Plain words, details on request. Error messages and notices across Pact say what happened in a sentence. The request, status and a support reference sit behind Details with a Copy button, on dashboard charts, Analytics, data profiles and sources, consent rules, billing usage and voice setup.

One panel, not the page. On the Analytics home, Win/Loss and Support analytics, a section that cannot load shows its own Couldn't load with Try again while the rest of the page works. Win/Loss leaves its totals blank rather than undercounting when some reasons cannot be read, and the dashboard's consent mix no longer reports "no records" when it simply failed to load.

The same Today for Analytics. The Analytics home uses the standard Today layout: alarms and moves first, the range picker above every panel, and full-width charts. The alarm panel waits for its comparison before saying anything is calm.

Pages that load again. The at-risk cases list, perks, the admin transparency snapshot, the list of installed OAuth apps and the related-records panel on account pages load as they should, and the cards on a contact's page find the contact they belong to.

Past tense for the past. Times for things that already happened, such as updated or last run, always read in the past tense, and voice diagnostics name each call by its date and time.

Room at the bottom. The tab bar's labels sit above the iPhone home indicator, the end of every page scrolls fully clear of the bar, and the voice dock, floating buttons and sheets line up with it. Pages no longer end in a band of blank space.

Labels stay whole. Buttons on phones and tablets are never squeezed below their own label, and crowded rows of actions wrap instead of cutting words.

What you saved, right away. Something you just saved appears in the list you are looking at, such as a task added on an account's Tasks tab.

One comment box. Coaching reviews, support resolution and close notes, and field-visit notes use the same comment box as the rest of Pact, and a draft you come back to is restored in the box.

Help on every screen. The Help panel now covers every screen in the navigation: what it is for, what people do there and where its data comes from. 71 screens gained an entry, and five admin entries were corrected to say exactly what their screen does.

Your language, all the way down. 49 sidebar and mobile navigation labels, such as Calls, Voice and Dialer, are translated in all 14 supported languages besides English.

Tours that open the page. Each role's tour includes the new screen that matters to it, every step describes what the product does, and seven Try it links open the page the step is about.

A first day that fits. Accepting an invitation lands you on your own module's home, shaped by the role your inviter chose. Someone who opens an admin page without admin rights is told who the page is for and offered a way back, and the Pick your role prompt opens on its own only on the home page.

Migrations that arrive whole. Deals brought over from your previous CRM appear on the deals page, the account page, Today and in Ask. The first-run tip no longer covers the setup wizard's buttons, and the docs helper in the navigation is now called Help & how-to, so it is never mistaken for Ask Pact, which answers from your data.

Notifications from the start. In a new workspace, the bell and the Notifications page show your notifications. An empty page explains what will arrive there and links to notification settings, and a failed load offers a retry.

Watch it anywhere. Mute the narration and follow the captions. A labeled exit is always in view, and focus returns to where you were when a moment closes.

Moments that fit. On desktop and iPad, every hands-on moment fits under the film with no inner scrolling. On a phone, the first screen holds the instruction, the control and Close, and a More below cue appears when there is more.

Chapters at a glance. Chapter pills are never cut mid-word, and the field moment says what to do.

The tour opens after a quick request for access.

One line, and a live check. The Install page under Tracking gives your workspace the line to paste into your site, and shows the first visit the moment it arrives. Owners and admins create and rotate site keys. A new workspace's setup wizard ends on this page.

Consent decides what is collected. A browser that sends Global Privacy Control is never tracked. Outside the US, and wherever the country is unknown, nothing is stored until the visitor accepts; US visitors get notice and a way to opt out, unless your banner is set to opt-in everywhere. Raw IP addresses are never stored.

Companies, never guesses about people. Each visit is labeled as a home, mobile or company network. Visits from a company network are matched to your accounts, and a company you don't have yet can be added as an account in one step. Pact never names a person from an IP address.

Where it shows up. Accounts on your site lists each company with what it read and how interested it looks; Visitors lists the people Pact has recognized and how it knows them. Every account page gets an On your site card, the first visit becomes the first entry on its timeline, and the Sales and Marketing Today pages show the top five.

Tracking is a module: its pages need Tracking switched on, and the accounts list also works with Sales or Marketing.

Interest you can read. Each account visiting your site carries an interest level with page-by-page reasons, refreshed every six hours.

Alerts that reach someone. The account owner is notified the day an ideal-fit account reads your pricing page or its interest surges. An account with no owner, or whose owner has left the workspace, alerts the workspace owner instead, with a note saying why.

Journeys that start from a visit. Write a trigger in plain words, such as "when an ideal-fit account reads your pricing page twice in a week", and it starts a journey or alerts the owner, once per event. Every send still goes through consent and your workspace's email safety settings.

History that follows the person. When a visitor signs in, submits a form that matches a contact, clicks a link in an email you sent them, or a teammate attaches their chat to a contact, their earlier visits join that contact's record. A shared browser never hands one person's history to the next, and erasing a contact erases their visits with them. Converting a lead links the new contact to its company.

Webhooks and the activity feed. Six website events (visits, page views, forms started, visitors recognized, accounts recognized and interest surges) are available to webhooks, without IP addresses, and read as plain sentences in the activity feed.

One list for every voice conversation. Calls on your Pact line and from the dialer, voicemails, meetings, voice notes and in-app voice all land in Voice. Save a view, export it, or open a row to play the recording beside its transcript. A teammate's private conversation stays private.

It says what happened. Each conversation shows how it went (answered, partial, or ended by Pact), and when Pact ended a call, why. A conversation that was not recorded says why not, in plain words.

Read it in English. On a conversation in another language, Show in English translates the whole call at once and marks any line it could not translate.

Where it lives. Voice is in the main navigation, and the old call log and voice hub links open it. Voice comes with the Sales module; turning recording on is for admins.

Twelve languages. English, Spanish, French, German, Portuguese, Italian, Dutch, Japanese, Chinese (Simplified and Traditional), Korean, Arabic and Hindi, in sixteen regional versions. All are on by default, and an admin can narrow the list under Conversation language.

On the phone. The Pact line answers callers in their language and changes language only when the caller does, never on a single stray word; a caller can also just ask ("en español, por favor"). A caller whose contact record names a preferred language is asked for recording consent in that language.

In what Pact writes. Voicemail reply drafts, call and meeting summaries, voice-note summaries, email reply drafts, case reply suggestions, survey summaries and social inbox drafts are written in the customer's language.

Remembered, and erasable. A contact's preferred language is saved on their record, and erasing a contact erases their saved translations too.

On when you say so. Recording stays off until an owner or admin turns it on. From then on every call on your Pact line is recorded from the first word, whichever way it reached you.

One consent question. The caller is asked once, in any of twelve languages. A "no" carries on with the call, unrecorded.

A page that tells you. The recording page says whether the next call will record and, if it won't, the one thing in the way, with counts for the last 24 hours.

One recap per call. When the phone carrier reports the end of a call twice, the call still gets exactly one recap, one CRM update and one team alert, and keeps its real length.

It holds, then answers. A question that takes longer gets "one moment" and then the answer. Answers arrive without long silences, and the line is yours again as soon as Pact finishes speaking.

It finds what you meant. When one account is clearly the one you meant, it asks one quick question instead of reading out a menu of names. "Who owns Acme?" gets the owner's name. A command like "tell me about my risks" is heard as a command, not as a company.

It checks before it changes. Before the line creates, edits or closes a record, it asks the caller to verify, and a code from your authenticator app works. On a line set not to ask for a code, changes are made in the app instead.

Calls end well. A call where the caller has gone silent is ended rather than left open, and the per-call spending limit counts the carrier's minutes. A caller who is abusive gets one polite boundary and then a polite close; admins can set how strict that is.

One header on every record. Each record page opens with who the customer is, a standing line in words (for example "In pipeline — Health 43 · at risk"), and links to the same customer in your other modules. Every record type has one tab row and the same four quick actions: Note, Task, Timeline and Files.

Edits that say what happened. An inline edit says Saved, or Didn't save with a Retry. If a colleague changed the same field first, you see both values and pick one, so nobody's edit is silently overwritten.

Rates that add up. Open and delivery rates on accounts, contacts and sequences always sit between 0 and 100%, show the counts behind them ("3 of 4 delivered"), and change in points. A window that sent nothing says so.

An activity feed that reads like notes. The activity page and every account's Activity tab show who did what to which record, in plain words, grouped by day, and a filtered feed can be shared as a link.

Whole-book answers. Contacts, Deals, Leads, Cases and Campaigns search, sort, filter and count across your whole book, and the count is the real total.

Your view, kept. The view stays in the link so you can share it. Pick and order your columns, and export the current view, up to 10,000 rows. On Deals you can change the amount, close date and owner right in the table.

At a keyboard, and on a phone. j and k move, x selects, Enter opens and / searches. On a phone each list becomes cards with a filter sheet, and filter rows scroll on one line. A cut-off name or amount shows in full on hover.

Today, in order. Waiting on you comes first, as chips with counts, then Start here with your top three actions, then context you can collapse or reorder. Your layout is saved for you, and on a desktop Today uses two columns.

Find your way back. Every page has breadcrumbs. Pin any page, filters included, to the command palette (⌘K), the sidebar and the phone's More menu; your recent records show there too. Press m and a letter to switch module, or g then i for the inbox.

Pages that open the same way. Title first, then filters, then content, starting at the same height on every page, with one back control on record pages. Loading, error and not-found pages say what happened, and dashboard tiles in a row are the same height.

Faster. Charts load as you reach them, and the Ask panel starts loading as your finger reaches the button. On a slow connection a thin line shows the page is still arriving, and a page an update has replaced reloads itself once.

Sized for a thumb. On a touch screen every button and row is at least 44 pixels, and a button is never squeezed narrower than its label. Toasts sit at the bottom, and the inbox shows each conversation on two clean lines.

Calls from your pocket. On a phone the dialer goes one step at a time: pick from your queue or search for a person, call, log, back. Placing calls needs a connected phone provider. Sales account, deliverability and forecast tables become cards, and KPI tiles read "up from 16", or "No quota set" where there is none.

Notifications. Settings, Notifications has a control to turn on browser notifications, and you choose which kinds of notification may use it.

Who can see this. On any dashboard its owner or an admin opens Who can see this and picks one of four audiences: Everyone in the workspace (the default), Managers and above, Admins only, or Only me and admins. It opens as a side sheet at a desk and a bottom sheet on a phone, and each card on the dashboards list shows its audience.

Who can change it. Only a dashboard's owner and workspace admins can edit, share or delete it, and sharing never gives anyone edit rights. Everyone else sees a View only badge.

Each book is its own. A record you create without naming an owner is yours. A rep's deal list and pipeline board show the deals they own, a manager's show the team's, and owners and admins see everything. If your reps worked from one shared board, each of them now sees their own deals.

Forecasts and reviews. Reps and managers submit their own forecast commit, and only their own; admins can still submit for a rep. Managers can add deals to the deal review queue.

Empty, and honest about it. A new workspace names what it lacks and the first step, such as "No leads yet — Leads arrive from forms…", rather than calling empty data healthy. The welcome banner is a short toast.

A wizard that keeps its word. The modules you choose are switched on, sample data loads only when you ask for it, and the last step reports what actually happened. Only owners and admins run setup; invited teammates land on the page they opened. A product tour you finish stays finished on every device.

Imports that keep going. In a CSV import a bad cell fails only its own row and the rest import. A country written out in full is stored correctly, deals without a currency take your workspace default, and imported contacts are linked to their account.

Contact details, everywhere. The browser extension recognizes your contacts, the duplicate warning appears when you create one, audiences carry addresses and {{first_name}} fields fill in, logged calls and WhatsApp messages find their contact, and the customer portal finds the right person.

Every workspace has these today, with nothing to switch on:

• Every Pact page and API response carries standard browser security headers.
• Repeated failed sign-in, step-up and sign-up attempts are limited, and the link that returns you after signing in always stays on Pact.
• Common passwords are refused at sign-up, invite and reset, and the form says why. A password reset reaches every workspace you belong to, in one email.
• A passkey counts when Pact asks you to confirm it's you, and someone who signs in only with a passkey can add an authenticator app.
• Single sign-on by email domain routes only to a workspace that has verified that domain in DNS, and a domain belongs to one workspace. The SSO page shows how each of your domains routes.
• Deactivating someone in Microsoft Entra ID ends their Pact sessions and stops their API keys.
• Only owners and admins can export the whole workspace, create API keys or make someone an owner, and nobody can change their own role. Everyone can still export their own data from Settings, Privacy.
• A workflow's database step, an OKR custom query and a rollup read only your own workspace; a step that does not say so is refused, with the table named.
• Connecting an AI tool to Pact over MCP lands on Pact's own consent page.

A working day, narrated. One narrator takes you through a day in Pact, chapter by chapter, following one fictional client from deal to quote, invoice, call and consent. Pause anywhere and resume exactly where you left off, jump by chapter, or present it with speaker notes. Nothing plays until you press Play.

Try it yourself. Nine hands-on moments run on the real Pact screens with no network: ask Pact a question, drag a deal into Commit, turn a consent preference off, build a website alert in three taps, plan a field rep's day on a map, and more. Each opens under the film with Close and Skip in view, and on a phone it gets most of the screen.

It waits for you. Start using a moment and the tour says "Take your time. The tour waits for you." Every timer stops while you type, drag or play a call, and only your Continue, on screen from the first frame, moves it on. When you've finished and gone quiet, it says "Moving on shortly…" before it does.

Share it, keep it. Send a colleague one exact moment, print a one-page recap of what you watched, put a click-to-play poster on your own page, or download the whole tour as one file that plays offline. Buttons and captions come in English, Spanish, Brazilian Portuguese, French, German and Japanese, and the narration is in English; switch language mid-step and you keep your place.

The tour opens after a quick request for access.

Three panels. Who on your team has no customer meeting in the window, each rep's meeting load against the team median, and the week ahead for each of your reports.

Private by default. An event that is not linked to a customer record shows only as busy, and the page says how many are hidden.

Your team, and only your team. The view covers your own reporting line. Someone with no reports sees a plain "no reports" state, and the team calendar needs connected calendars to fill.

One look. pact.place always opens in its light aurora look, even on a computer set to dark mode; only someone who chose dark inside Pact sees it dark.

Phones and tablets. On a notched iPhone the menu sits right under the announcement bar. Public pages show no install sheet and send no visitor through a sign-in redirect.

Links that land, and a clean badge. Links from the product guides, the MCP marketplace and the comparison pages go where they say, and the Most popular badge on pricing is solid, with the card's border running around it.

Values computed for your workspace. The SAML setup step shows the four values your identity provider asks for — the sign-in (ACS) URL that ends in your workspace's ID, the entity ID, the single logout URL and the metadata URL — each with a note on what it is for, so the usual mix-ups ("reply URL does not match", a wrong audience) are hard to make. If your provider was configured with a different sign-in URL, update it to the one shown on the page.

A status that says what happened. Each connection reads Verified, Not yet verified, Unknown or Disabled, with the last sign-in (when, and who) and the last refusal with its reason in plain words. If the sign-in history cannot be read, the page says Unknown — "not the same as never" — rather than guessing. One line shows provisioning from your identity provider: its last call, and how many provisioned people are active.

Offboarding ends access everywhere at once. Whether someone is deactivated from your identity provider through SCIM or in Settings → Team, their signed-in sessions end and the API keys they created stop working in the same step, and your audit log records how many of each. Re-enabling the person restores their keys, so create integration keys under an account that stays.

Sign-out at your identity provider reaches Pact. A signed sign-out request from Okta or Entra ID ends the Pact session, including over the redirect binding both use by default. Sign-in assertions that are replayed, altered, unsigned, expired or issued for a different workspace are refused, recorded, and never create a user.

On a phone the status is one card per connection, state first; on a desktop it is a grid you can compare at a glance.

One export, the whole chain. Each of the 61 Trust Services criteria lists its owner, its governing policies and whether they are current, its evidence source, the steps for any evidence collected by hand, its last test and when the next is due. Anything missing is written into a gaps column rather than left blank.

The policies travel with the evidence. The package carries every governing policy word for word, each with its fingerprint in an index, a record of who acknowledged which policy, and an index of every evidence source with its own last result. The bundled verifier re-checks each of them against the package's signed digest.

No green that has not been earned. Evidence from a source that could not be reached is marked "Source unreachable" and does not count toward readiness. A policy past its review date is a finding that names the date. A policy acknowledged only by its owner is reported as an exception, not as communicated. When coverage cannot be read, the control sheet says "Policy coverage unknown" — never "no policy".

Where Pact stands, in plain words. The SOC 2 Type II audit has not started. The Trust Center lists it as "In preparation · not yet audited", and the security documentation says no independent audit has started. Customers who need the evidence package for their own vendor review can request it under NDA.

Admins collect evidence and download the package from Admin → SOC 2 Type II.

How to report, and what you get back. The new disclosure page lists what to include in a report, then the commitments: acknowledgement within 2 business days, updates through triage, fix and release, and a 90-day window before publication unless agreed otherwise. It sets out what is in scope and out of scope, and the safe harbor for research done in good faith.

One set of terms, everywhere. The disclosure page, the security page, the Trust Center and the machine-readable security.txt state the same contact and the same commitments, and security.txt now points to the full policy.

The penetration test, stated exactly. The external test is being scheduled: an independent firm will test the application and API by hand, signed in, across roles and across workspaces. What is ready now is listed beside it — the scope and rules of engagement, an inventory of every API route and how it authenticates generated from the code, and one-command test workspaces that hold sample data only.

No external test has run yet. Once the test and its fixes are complete, a summary and the firm's attestation letter will be published on the security page, and enterprise customers will be able to request the full report under NDA.

A won deal starts onboarding. Winning a deal on the board, on the deal page or through a paid order opens the onboarding plan and hands the kickoff task to the engagement manager, with the deal and its amount. Nothing is retyped.

Escalations and site follow-ups land with an owner. Manual and SLA escalations reach the engagement manager as a task, a notification and an entry on the account timeline. A consultant on site can send confirmed follow-ups as assigned tasks with one tap, and the card names who will receive them.

What a call agreed becomes a task. After a call is analyzed, its agreed next step becomes a task for the person who ran the call and is added to the account timeline. The due date comes only from the call's own words — "by Thursday", "within 3 days", "next week" — counted from the day of the call. Pact never invents one.

Leads and expansions reach their owner. A lead routed by a rule, assigned by a teammate or arriving through a form notifies its new owner with the source and why it is theirs. Promoting an expansion signal or play opens a deal owned by the account owner and tells both the owner and the engagement manager.

Every hand-off says why you. A "Handed to you" panel leads CS Today, and each account's Overview now has "Hand-offs on this account": what was handed over, from which team, to whom, and why that person — "owns the onboarding plan", for example. When nobody owns the account yet it says "nobody yet" instead of guessing.

Renewals read the latest health. At-risk on the renewals board follows the most recent health score, and a renewal with no score yet says "No health score yet · stage only". Solutions engineers can also pin evidence to a deal room; a customer quote without consent is refused.

Hand-off notices arrive in-app, and by email or push for people who have turned those on in Settings → Notifications.

One customer, seven steps, on every page that shows them. Lead, nurtured, in pipeline, won, onboarded, supported and renewed are always drawn, with the current step highlighted. The same view appears from the account, from any of its contacts and from any of its cases, and each step says what feeds it and links to the area that owns it.

A stage never reads as good news when the customer is at risk. "Supported", "Onboarding", "Just won", "In pipeline" and "Renewed" now carry health or churn risk in the same sentence, a critical score shows in red, and risk leads the account's highlight ahead of an expansion suggestion. A renewal set to cancel says so on its row. When risk cannot be determined, the page says "risk not established" rather than implying all is well.

Contradictions are shown, not resolved by hiding one. A customer that renewed and is also set to cancel shows both facts. A step you do not have access to is labeled as such, and a step that could not be loaded is named as a gap — never shown as an empty or a zero.

Lifecycle views count every account. The lifecycle lane on module homes now reads your whole book in pages, so its stage counts are your true totals rather than the first 50. A progress line shows while the rest load, and if a later page fails, what was read stays on screen with Try again.

The account page, the lifecycle lane and the CS journey board use the same risk rules, so they agree. On a phone, name, stage and next step sit on one row.

Every move says why. Each change names its reason — a deal opened, a deal was won, onboarding started, a case opened, a subscription renewed — and which team's activity caused it. Moves backward and skipped stages are labeled as such.

Time in stage, measured. Each stage shows how long the customer stayed there, drawn as a bar against the longest stay, so a slow stretch stands out at a glance.

Dates you can trust. A date comes from the record itself where one exists, such as the day a deal closed, and is otherwise marked as the day the change was seen. History begins the first time an account is opened after this release: that view records a starting point, and the card ends with "Not recorded before …". Pact never fills in or backdates what it did not see.

Readable from every seat. Sales, Customer Success and Support all see the same history. Deal names, amounts and health scores stay visible only to seats that have the area that owns them; everyone else sees that the move happened and where to find the detail.

It works on desktop and on phones, and a compact version sits beside the case on case pages.

A source under every reply. The call record labels each AI reply with where it came from — "From your CRM · deals", "Computed from pipeline totals", or "Not established" when nothing backed it.

A verdict at the top. One line answers whether the agent told the caller anything untrue, with the counts beside it: replies traced, confirmed, stopped, unconfirmed and unrecorded.

Claims are checked before they are spoken. When the agent tries to say something was sent, booked or saved and no action backs it up, those words are stopped and the caller never hears them; the record shows what was stopped. Answers that read no data cannot speak a figure, and answers from your data name their source out loud.

No added cost or delay. The checks are rule-based, run on every turn, and make no extra AI call.

Calls recorded before this release show a note in place of per-reply sources.

What-ifs, worked out. "What would a 10% discount do to our pipeline?" returns the arithmetic plus your own quote acceptance with and without a discount, labeled as an observation from your history rather than a prediction.

Questions that span modules. Ask for "accounts with an open case and an open deal", or "accounts with an open P1 case, a renewal this quarter and no nurture touch in 30 days", and you get the accounts that match every condition — answered from your records directly, without an AI model call.

A straight answer to a broad question. "How are we doing?" now gives a direct reading of your team's open pipeline, with one-tap follow-ups.

Declines are rare, and explained. Ask declines only a small set of requests — classifying people by health or faith, for example, or exporting everything — and each decline says why and offers questions it can answer, ready to tap.

Faster, and honest about confidence on the phone. Answers drawn from your records start arriving about a quarter of a second sooner. On a call, an answer the agent is unsure of ends with "I'm not confident in that one." AI assistants connected through Pact's MCP server receive a confidence level and its reasons with every workspace answer.

Your promises come first. Overdue follow-ups from your calls, the ones due today or tomorrow, and recent undated ones now lead "Deals waiting on you" on Sales Today. Dates come only from what was said on the call; Pact never makes one up.

Open prep opens a brief. On Sales Today, "Open prep" now lands on the account's meeting-prep card. With a meeting on your calendar you get talking points, watch-outs and Join, Reschedule or Draft follow-up. With nothing scheduled, prep on demand draws on the account, its open deal and the last 14 days of activity. If your calendar could not be read, the card says so rather than claiming nothing is scheduled, and it only ever shows your own meetings.

Recaps travel. Every call recap has "Copy recap" and "Share to deal room", and the shared text says whether AI wrote it. Both fit on a phone.

Managers land on their desk. Sales managers now open on the manager's Today when they sign in, and the first-run tour follows your role instead of asking you to pick one.

You know what was sent. Sending a quote shows the outcome in the confirmation and on the quote's activity: sent, blocked with the reason, or email not set up. Quote emails carry a full link that opens from any mail client.

Invoices start as drafts. A new invoice has Send invoice and Mark as sent, and becomes Sent only when the email is accepted or a person records delivery. Existing invoices are unchanged.

PDFs open. Preview PDF on a quote and the PDF button on an invoice open the document in a new tab, popup blockers included. Quotes created from a deal download under their real name, accents and other non-English characters intact, and if a PDF cannot be produced the page says why instead of opening a blank tab.

Ownership follows the deal. A quote created from a deal is owned by the deal's owner, and conversion reporting credits that person.

An audit trail that names the client. The audit log records a client's accept, decline and signature — credited to the client, with one consistent identifier you can filter on — along with the order it creates and each privacy request opened and evidenced. Invitation entries name who invited and no longer show the invitee's full address.

A chat window for your website. Only the launcher button loads with your page; nothing is fetched or stored until a visitor opens the chat. It follows your cookie-banner rules, does no page tracking, works under a strict website security policy with two allow-list entries, and becomes a full-height sheet on phones.

Built for the queue, not the inbox. Visitor chats arrive as chat cases. Agent replies appear in the visitor's window and internal notes never do. Visitor-given names are labeled unverified and never matched to a contact. Per-visitor and per-workspace limits, a per-site allow-list and bot traps keep spam out, and the settings page shows the real limits. Each visitor message is triaged by AI and counts toward your workspace's AI budget.

A co-pilot that always shows up. Reply drafts, escalation risk, similar cases and deflection each load and retry on their own, so one slow panel no longer hides the rest, and a missing signal is named inside its panel. "Escalation not computed" replaces a misleading 0%.

From resolved case to article. "Draft article from this case" saves a review-pending knowledge-base draft with a Review draft link, or says why it cannot — the case isn't resolved, or the knowledge base already covers it.

Macros, filled in. Insert macro fills a saved macro for the open case, and a customer reply cannot go out while a field is still unfilled. Case pages use a single column on phones.

Media where your audience is. The composer has an Attachments field. X posts can carry up to four images, a GIF or a video, uploaded before the post is created so a failed upload never leaves a half-made post. YouTube posts upload the video, and the composer says up front that uploads from unaudited Google projects stay private and how much upload quota each one uses.

Bluesky, properly. Up to four images, clickable links and correctly threaded replies. Mentions, replies and quotes arrive in the Social inbox, and Delete really deletes.

Refused before scheduling, not after. A per-channel check shows what each network will accept before you schedule, and the server checks every file again. X posts over 280 characters are refused rather than cut off, and the inbox reply box counts down for X (280) and Bluesky (300).

One library for the team. Templates, snippets and hashtag bundles are saved for the workspace, so teammates and your other devices see the same library. Every item shows who added it, use counts are workspace-wide, only the author or an admin can edit or delete, and anything saved in a browser before can be moved up with one click.

X mentions arrive when your workspace's own X app is connected, and X accounts connected before this release need to be reconnected to attach media; text posts keep working.

Nothing switches on its own. A stored key serves AI only after an admin chooses it, and the confirmation says where your data will go and who will be billed.

Test before you trust. "Test" makes one real, tiny AI call through all the usual safeguards and reports the model, the latency and the cost — or a concrete next step if it fails.

Your region stays your region. With Bedrock, AI calls stay in the credential's region by default and never fall back to global routing; global is an explicit opt-in.

Fails closed. If Pact cannot confirm where an AI call will be routed, the call stops rather than quietly using a different provider. Usage on your own key is billed to your account and shown, at list prices, in your AI spend.

Risk, for the account you asked about. "What are my risks with" a named account is answered for that account only, and "nothing flagged" is said only after checking that account against the full risk list. A name said as words or digits, with or without punctuation, finds the same account, and a short name finds the full company name.

Misheard names are recovered. A short account name that speech recognition hears as a time is offered back as a "did you mean" from your own accounts, while real times still mean times when you are scheduling.

A specific reason, not a menu. When a turn cannot be answered, the agent names what went wrong and a next step instead of repeating the same generic help line.

Every suggestion works. Each phrase suggested in the voice hub, the "try saying" pill, the help panel and a first call's greeting is now checked automatically against what the agent actually handles; eight that went nowhere were removed and three quick-starts replaced. "What can you do?" now names six kinds of task in about 8 seconds, where it used to name three in about 17.

The work first. CS Today opens on its title with the action buckets straight after it; on a phone the first at-risk account now sits near the top of the screen. The day summary and the daily goal moved below the buckets, and the summary can be moved back up with one tap.

Arrange it your way. From Customize, minimize a bucket (it keeps its count), hide it, or reorder it. Your layout is saved, and CSMs and CS leads each keep their own.

Know where you are on a phone. Inside any of the ten modules, a row under the top bar names the section and module — "My accounts · Sales", for example. Tapping it opens the module's menu, which closes when you pick a page. It never names a section your role cannot open, and desktop is unchanged.

Links that land. Bookmarked and pasted room links open the right deal and update the address to the deal's permanent link. A link to a deal that doesn't exist says so instead of offering to set up a room, and the Voice Room tells "no deal matches this link" apart from "no room yet".

A QBR is a record, not a recalculation. A past quarter opens as a saved snapshot — "Saved snapshot · composed …" — offers Export only, and cannot be overwritten. A quarter with nothing saved says "No QBR was saved for" that period and links to the account.

Only ever your own. Deal rooms, voice rooms, renewal briefs and QBRs open only for records in your own workspace.

Staff access, in your own log. Each staff action that targets your workspace adds an entry attributed to Pact staff, including the reason given — for a suspension, or a sign-in on your behalf. When staff change a setting for someone in your workspace, that is recorded in your history too. Entries never include another workspace's users or the staff member's address, device or session, and timestamps carry an explicit time zone.

Sign-in and imports, tightened. Microsoft 365 add-in sign-in now relies only on a verified identity, and a workspace that is suspended or being closed cannot gain a new one. Imported files only ever add to your own workspace's records.

Entries begin with this release; earlier staff access is not back-filled.

Never stuck behind the sheet. When Pact asks you to confirm it's you before a sensitive action, Cancel and the password field work straight away; only Confirm waits, labeled "Starting…". The server still verifies every confirmation.

Authenticator status you can rely on. If Pact ever cannot check your authenticator app's codes, Settings says "Needs setup again" instead of "On", with "Remove to set up again" as the first action, and codes entered in that state never count toward a lockout. Recovery codes and your password keep working throughout, and the two-factor help page lists exactly the confirmation methods that work.

Sample data comes out on purpose. Removing sample data takes two separate actions: typing your workspace's name, then confirming it's you. A mistyped name removes nothing. Only records tagged as sample are removed — your own records are never touched — and the page now correctly says the removal can be undone for 30 days.

Straight to the thing. A parked call or a failed transfer opens that call. An alert from an automation rule opens Rules with that rule highlighted, and says so if the rule was deleted. Dashboard alerts open the dashboard, enrichment budget alerts open the budgets page, and enrichment job updates open the account.

People, too. Access requests and sign-in security alerts open the person's admin page.

Older ones work as well. Notifications already in your inbox open their item wherever the original link or record can still be found.

Usage checks that don't grow with usage. On a copy of real data, the monthly usage read went from about 130 milliseconds to under a tenth of a millisecond. When many requests arrive at once, one refresh serves them all: 20 simultaneous requests now cause one usage query instead of 40.

What is kept. Monthly usage totals are kept permanently. Per-request usage detail is rolled up into daily totals after 90 days, so older months still show their usage.

The API reference, ready on arrival. Right after an update, the API reference now opens immediately instead of taking up to about 18 seconds to build.

Measured, or marked. For a Salesforce, HubSpot or Pipedrive source, the pipeline page links straight to that source's Sync now, which reports measured counts. Run says plainly when nothing ran rather than recording a run.

Nothing deleted. Runs from earlier builds are kept, badged Not measured, and left out of the success rate. Sample pipelines stay labeled Sample.

Health trends you can trust. Health sparklines draw only scores that were recorded, and say so when there is no history yet.

Every claim cites its release. Each capability card on the homepage links to the feature's own page and to the changelog entry that made it true.

Try before you talk to anyone. Visitors can call the live voice agent with no signup, then request access to a narrated guided tour of a sample workspace.

Pricing in context. The price comparison sits side by side with what the same coverage costs elsewhere, with a pricing explainer.

Setup guides that open. The Setup docs button on each public integration page now opens a real setup guide, or does not appear when there is none. The homepage reads well in light and dark, from a phone to an ultrawide screen.

On a large book, Accounts loaded the first 6,000 records and searched only those, so a search could answer “0 of 18,311” for a name that matched thousands further down. Search, every filter and every sort now run over your whole book, and the count line shows true totals such as “2,289 matching of 18,311”. Filter counts in the side rail cover every account and say so when they could not be loaded, instead of showing zeros. The list loads more as you scroll, and phones load 200 cards at a time.

One customer record. An account's Overview now opens on the record itself. Each field sits beside where its value came from. A provider that disagrees is shown next to your value, never over it, stale values are marked, and you can see what was merged into the account and what each module holds for this customer. Support-only and CS-only seats can open the record too, and a section that fails to load says so rather than showing 0.

Merging duplicates moves the whole customer. Merging two accounts now moves the duplicate's contacts, opportunities and other linked records onto the surviving account, and a link to the merged-away account lands on the survivor and says so. Merges completed before this release are not re-run.

It remembers, with receipts. The agent can recall what you discussed on your own calls from the last 30 days, quoting your words and when you said them, or tell you plainly that it found nothing about that topic. It never paraphrases a memory, never draws on another user's calls, and never counts something you interrupted as discussed.

Meeting prep by voice. “Prep me for my three o'clock”, “prep me for my next meeting” or just “prep me” gives who and when first, then the attendees, the related deal, the last meeting and recent activity, one thing to watch for and a suggested opener. It works for in-person and dial-in meetings as well as video calls, and says what is missing rather than skipping it.

“Tell me about” an account is a real brief. You hear its open deals, contacts on file, any risk or slippage, the last 14 days of team activity and one recommended next step, all scoped to the account you named. Say yes to the offer that follows and it opens the battle card or meeting prep.

Your own mail and files. “Search my Gmail for the renewal” searches the caller's own connected Gmail, Outlook or Google Drive, never a colleague's, and merges the matches with CRM results, each with where it came from. A source that can't be searched gets its own reason: not connected, missing permission, expired or timed out. Nothing from your mailbox is copied into Pact. Drive search depends on your Google connection being current, and Slack, Teams and Notion aren't searchable yet; the agent says so when asked.

Five more requests get done. Over the phone you can now create an account, prep a one-on-one with a direct report, pull evidence from a deal, set up a demo sandbox and save a dictated playbook. Each is read back before it is committed, and “done” is said only after the result is confirmed. The agent also answers questions about Pact itself and your team, and opens a support ticket once you say yes.

Sales Today is the first page where every panel is yours to arrange. Customize, next to the page title, lists the page's panels; on a phone it opens as a bottom sheet with thumb-sized controls. Minimise a panel and it keeps a one-line summary, such as “Coaching tips · 6 tips”, so the signal stays on screen without the bulk. Hide one and a single line remains, “Day summary is hidden · Show”, so nothing disappears without a way back.

Reorder by touch, with the arrow buttons, or with Alt+↑ and Alt+↓ from the keyboard, and Reset returns the page to its default. The layout is saved to your account for that page, and if it can only be kept on this device the sheet says so. Sales Today also now opens with its own “Today” title.

Deals needing you. Manager Today now opens on your team's open deals that need you this morning, each with its reason: a next step promised on a call that is overdue or due soon, or a late-stage deal that has stalled or passed its close date. A stall is measured against your own team's usual time in that stage, as in “26 days in Negotiation · team usually 11 days”. The list covers your whole reporting line and can be narrowed to a sub-team. A read that failed says “Not checked”, never “Nothing needs you”.

The forecast follows the board. Moving a deal to a new stage, whether by dragging it, from the action palette or in a bulk move, now sets its forecast category to match, so a deal dragged to Closed Won counts as won and a reopened deal leaves Won. A category you set explicitly still wins, and deals moved before this release keep the category they had. When the quarter's quota is already made, Forecast says so and treats the rest as upside.

Each rep's real numbers. Manager Forecast now shows each rep's real Commit, Best case and Pipeline, where it had read $0 for every rep, and Gap analysis loads instead of spinning. The Team scorecard counts deals recorded under a rep's email as well as their name and dates wins and losses by their close date, so some managers will see corrected figures.

Charts with receipts. The pipeline funnel, velocity, open-rate and top-accounts charts on the dashboard each show their unit, how many records they read, when they loaded and a link to those records, with a table view and a CSV download that keeps raw numbers. On a phone, bar charts become a ranked list with full names and tappable rows, so no value needs a hover. A day with no sends is a gap rather than 0%, the current week is drawn dashed as “so far”, and a failed load names the request that failed instead of saying “No pipeline yet”.

Rates that are computed. A sequence's Open rate and Reply rate now show the evidence behind them, such as “212 of 501 email sends opened”, counting each email once and a click as an open, or “Not measured” with the reason when your email provider hasn't reported. Journey A/B variant reports count only messages the provider accepted and each open once. Some of these figures will read lower than before, because they now count only what happened.

One at-risk ARR. “What's our at-risk ARR?” gets one answer across Ask and CS Today, and it now covers every at-risk account in your book rather than the eight shown on cards. Ask says when it could not compute a number instead of calling it zero, the report builder offers Deals directly, and exported reports keep their report's name.

Zero only when it's zero. Attribution now counts consent violations and journey touches, which had never been computed, so those numbers may change. Attribution, Forecasts, the SE scorecard, Data pipelines and the Analytics Today sequence heatmap show “Couldn't load” with a retry when a read fails. Saved reports built on the older opportunities data now read deals, like every other surface.

Five connectors that sync. Connect a pipeline-first CRM or ActiveCampaign to bring in accounts, contacts and deals, or connect Mailchimp (every audience), Klaviyo or Kit to bring in contacts. Syncs are read-only and incremental: nothing is written back, a person on two audiences stays one contact, a blank vendor field never overwrites good data, and fields a rep has edited are kept. Each run shows “N in · N failed” with the first error, and a rejected key shows as a red run with a sentence on how to fix it. Runs start once you choose a schedule or press Sync now. Vendor unsubscribes are counted but not yet turned into Pact consent.

Migrate from Close and Apollo with the same wizard as the other supported CRMs: paste an API key, review the inventory and field mapping, preview a dry run, import, and roll back if you need to. Close brings accounts, contacts, deals and activity history, including notes, calls, meetings, texts and email subjects. From Apollo, contacts marked unsubscribed arrive as withdrawn and everyone else as consent unknown, never granted. Anything the source would not let Pact read is listed as a named gap, a run with gaps says “Imported — with gaps”, and re-running a migration never imports a record twice.

Counts that were measured. A data source now shows a record count only when a connector actually measured it. Salesforce and HubSpot sources run the real connector on Sync now and show what it imported, and a source type with no connector says sync isn't available yet and points to the import wizard. The integrations directory leads with “Credential storage only” for connectors that store a key but don't move data yet, and no longer undersells Resend, SendGrid, Zoom, Teams and Google Meet, which already work.

An authenticator app for sensitive changes. Settings now sets up an authenticator app from a QR code, and nothing turns on until one code checks out. You get ten one-time recovery codes, and the dialog can't be closed until you confirm you've saved them. Settings shows whether it's on, when it was last used and how many recovery codes remain, with a warning at three. After five wrong codes in a row it locks for a stated time, and you can still confirm with your password or a recovery code. It confirms sensitive changes; it is not asked for at sign-in.

Stricter confirmation. Confirming a sensitive action now always requires a real proof, such as your password or an authenticator code, and every confirmation attempt, successful or not, is recorded in the audit log. Passkey confirmation for sensitive actions is paused until a fully verified check is in place.

A texted code for phone callers. When a caller is recognized only by their number, Pact texts a six-digit code to the phone on that user's own profile before it sends an email or text, books a meeting, launches a campaign or merges records. It asks at most once per call and never for reads, and three wrong codes lock the check. If a code can't be sent, the action is refused and the reason is spoken. It's on by default, and admins can see exactly what it guards under Admin → Voice → Security.

Tighter workspace boundaries. Account, contact, related-record and consent views read only your own workspace's records, and a request whose sign-in can't be confirmed is refused rather than guessed. Customer-success figures, win/loss, the dashboard's win rate, closed-won and top-owner revenue, and per-rep closed-won count only your workspace's records, so some of those tiles may move to their true values. An IP allowlist is always checked against the workspace you're signed into, and background enrichment updates only companies in the workspace that asked for it.

Shared links that behave. Shared report links now open for the people you send them to, revoking one really revokes it, and a shared link no longer exposes internal identifiers. Links created before this release were never saved, so share the report again to get a working link.

Consent before the phone rings. Every outbound call Pact places, including campaigns, transfers, callbacks, briefings and alerts, calls started from Slack, deal rooms, conference and huddle calls, now checks your do-not-call and suppression list and withdrawn consent before dialing, plus prior express consent when your workspace requires it. Previously most of these paths skipped the check. A refused dial never rings and gives a one-sentence reason where you started it, and a blocked warm transfer takes the customer off hold. Queued callback requests now actually dial.

Consent state on every person. Contacts, the contact card, the Sales people list and the contact header now show consented, withdrawn, expired or no record, each badge saying when the answer was recorded and where it came from, where every person used to read “unknown”. “No record” is stated plainly as not permission, and a failed read shows “Unavailable”. Imports can carry an email-marketing consent column; a bare yes/no column is refused because it can't say which way it points, and an import never overturns a withdrawal. Records imported before this release are not re-evaluated.

Privacy requests that finish. A request can be verified and fulfilled from its page again, either by an emailed link the requester opens or by an ID hashed in your browser plus a reviewer's sign-off, and the email route shows the real delivery result. An erasure that could not remove all of a person's stored contact details is no longer marked complete; it stays open with the reason, and running it again finishes the job.

Clearer records. Preference-center purposes now show their names and legal basis, with a badge for those that need double opt-in, and account pages describe recent activity in plain words instead of system event codes.

No dead air. Some answers used to leave callers in 4 to 17 seconds of silence. There is now a firm limit: you hear the start of the answer within about five seconds, or “I couldn't pull that in time. Want me to try again?”, and “yes” retries. A save already in progress is never cut off, and a slow lookup is never reported as “nothing found”. “Can you hear me?” mid-answer gets “Yes, I can hear you” and the answer still arrives, and on speakerphone the agent ignores its own voice.

Instant everyday asks. “Tell me my top five”, “actually, never mind, cancel that”, “tell me about yourself” and “how did July go?” right after a scorecard now answer immediately. “How did I do in Q2?” is a short headline you can follow with “what about Q3?”, and a quarter that has ended is reported as finished, hit or missed and by how much, in your fiscal quarter if your year doesn't start in January.

The numbers you said. A deal update said in one breath reads back the stage, amount, probability and owner you gave: “seven fifty thousand” is $750,000 and “one point five million” is $1,500,000. An update that names both a stage and an amount saves both after you confirm. Amounts are spoken the way a person says them, as in “12 dollars and 50 cents”.

Answers about what you asked. Asking why a named account is stalled or at risk gets an answer about that account, with the reasons behind the flag, instead of the whole at-risk list, and a cause-and-effect question gets that question answered or a plain statement of what's missing. “Yes” and “hello?” are never taken as account names, picking from a “which one?” menu opens the one you picked, and replies are plain words, with no on-screen labels and no talk of tools.

Callers who aren't your team. An outside caller asking for a teammate is told they have reached an AI assistant and can leave a message, which lands in your voicemail inbox, addressed to that person when the name matches one teammate. Only an explicit goodbye ends a call. The recording question is now 13 words and never re-asks, and an unclear answer continues without recording.

Mail and mornings. “Read my email” says right away why it can't and how to fix it, such as reconnecting Gmail in Settings. The spoken morning standup reads your account signals as plain sentences and ends with the one account to reach out to first.

My pipeline means yours. Owners, admins and managers opening My pipeline saw every deal in the workspace under a “My” title; it now shows the deals you own, and the whole team stays on Pipeline. A deal created from My pipeline now appears on it right away, through the same Add deal dialog as the main board. The New deal dialog no longer wipes what you typed while it finishes loading, and an untouched currency uses your workspace default. Sales Win/Loss shows the closed deals you recorded, rather than one teammate's for everyone. The API reference for creating opportunities now names the deals endpoint whose records appear on the board.

Quotes and decks for every rep. A rep's “Add from catalog” list was empty, so rep-built quotes carried only custom $0 lines. Reps now see your active, published products with list prices, while the catalog stays admin-edited, and members can generate, regenerate and edit decks; templates and deleting decks stay with admins. A quote whose title contains an em dash, an accent or a non-Latin character now exports its PDF, named after the quote.

Every deal links to its rooms. A deal page now has a strip linking to its Deal Room, Voice Room and call brief, plus a renewal brief for renewal deals, and each Customer Success account has a quarterly-review picker listing the quarters with a saved deck. Account links from My accounts, a deal page and Win/Loss open the account again. Deal rooms where someone reacted to a message load their messages and threads again.

Questions that cross the business. A question that spans marketing, sales, outbound, support and customer health is now answered as one filtered result, and the answer shows how the records were linked, flagging weaker links such as a match by email address. When two parts of the business aren't connected, the answer says so in one line, with what would close the gap, instead of returning a silently partial answer. “What happened to the leads from…” returns a status breakdown of those leads.

Everyday pipeline questions answer. “What is our win rate this quarter?”, “deals closing this quarter”, “overdue deals”, “trend of deals closing by month” and “accounts with a follow-up due this month” now return correct counts, where they had answered that the read failed.

Influence you can see. “Which pursuits did our events influence?” gets a real answer, using first-touch or any-touch logic over tracking events, form submissions and email clicks and replies, and says how many touches it could place on an account, or “not established” rather than 0. New website and form touches from a known contact now attach to that contact's account as they arrive; earlier touches are not back-filled.

Suggestions with context. Next-best-action suggestions and buyer-persona insights now draw on your actual deals, account details, recent activity, support tickets and notes, and if one piece can't be read the others still reach the AI.

Social posts on schedule. A scheduled post now publishes on its own at its time, exactly once, and links to the live post. The list shows each state: Scheduled, Publishing, Retrying with the attempt count, Published, or Failed with the network's reason and Try again. A post more than a day late is not published on its own; it fails and says how late it is. The composer marks channels that can't publish yet, such as TikTok and YouTube, as drafts only, refuses an X post over 280 characters instead of cutting it off, and shows scheduled times in your own time zone. Publishing to LinkedIn company pages isn't supported yet and is refused with a reason.

Campaigns reach their segment. A campaign sent to a contacts segment now reaches the segment's real members, and the pre-send check counts the same people the send reaches; consent and email-safety checks still decide every recipient. Re-routing a lead that matches no routing rule now keeps its current owner and says “No rule matched”.

Segments keep what you asked for. Describe a segment in plain language and every condition is either applied or refused by name on its chip, so a segment is never saved broader than you asked. New conditions include not-equal, between, is empty, starts or ends with, and “no activity in N days, including never”. Facebook Page, Instagram, Messenger and WhatsApp steps preview as the recipient will see them, with merge tags filled and any reason Meta would refuse the send. The Forms gallery shows each form's real submissions, and its Edit button opens the builder.

Saves that stick. In the CS workspace, “Create plan” could report success while the list still read “No active onboarding plans”, and the same was true of every CS write. All fifteen write actions, covering onboarding plans and milestones, save-play runs, expansion triage and promote, quotas, and QBR slide edits and reorders, now save before they confirm. Changes that did not save before this release are not recovered, so a plan that never appeared needs to be entered again.

QBR decks for every account. Opening a QBR deck failed on some accounts, a deck that did compose wasn't kept, and Export PPTX couldn't download. Decks now compose with seven slides, are saved, and export as a real PowerPoint file. Exported slides render bold and italic properly with no stray formatting symbols or internal source notes, including decks created earlier, and the editor previews each slide as your client will see it.

Cases and at-risk. Open a support case from the number customers quote, such as CASE-1014, and every co-pilot panel on the case loads, always within your own workspace. When churn predictions are off for a workspace, the At-risk page says so and points to CS Today instead of showing “Not Found”. The customer lifecycle panel now opens on SE Today, Support Today and every module home for anyone who can open that page.

Field Rep in the switcher. Field Rep now appears in the module switcher for workspaces whose plan includes it, and opens on Today at phone and desktop widths. “Plan a visit” on any account opens Today with the stop filled in and linked to that account, and a precise on-site check-in pins an account that has no location yet, never moving an existing pin.

Visits that survive the field. Field visit pages open again, with a pre-visit brief built from your open deals on that account. Losing signal keeps the visit on screen with a dated “No signal” notice and Retry, and your draft note survives a reload in that tab. “Add photo” opens the rear camera and attaches the picture to your note; photos need a signal, and the button says so. The main action, “I've arrived”, now sits above the phone's tab bar where a thumb can reach it, and the visit note can be saved while still on site. Consulting workspaces get consulting outcomes when they depart, such as Workshop held or Decision needed from client.

For solutions engineers. SE Today's calendar panel shows your meetings for today, where it had shown “Couldn't load” for everyone. Uploading an RFP now returns as soon as the file is saved; the page shows “Reading questions…” and updates itself when they're ready, or says it couldn't read them and asks for a re-upload. Battlecards and the RFP list tell “couldn't load” apart from “nothing here”, and a slow upload no longer shows a failure that invites a duplicate.

Reuse before you buy. Each enriched field now has a shelf life, such as 30 days for a job title, 90 for revenue and a year for headquarters. A repeat lookup inside it calls no vendor and costs nothing, so only missing or out-of-date fields are bought. The result leads with what you spent, then lists each field as New, Reused (“checked 2 days ago · good until Oct 22”) or Unknown with its reason. A value someone on your team entered is never re-bought, “Re-check current values too” forces a fresh lookup, and if your enrichment budget can't be read, nothing is bought and the dialog says so.

What can be filled, before you ask. The Enrich sheet on an account shows only the fields an account can actually get, with a line such as “9 of 23 fields can be filled now” and the provider connection that would unlock the rest. Person-only lookups are no longer run against an account, so you aren't charged for lookups that could never match. Data sources Pact can't sync yet, such as Stripe, Marketo and Mixpanel, appear under “Not built yet” with a request link and the CSV import path instead of asking for a secret key.

A key is checked before it's stored. Connecting Apollo, Cognism, Lusha, RocketReach or ZoomInfo with your own key now checks it with the provider first. A key the provider refuses is not saved, and the sheet says “Nothing was stored” with the provider's reason. Each provider card shows connected, needs attention or unverified, the published per-lookup price or “Not published”, and a Disconnect button.

A Finance role. A finance lead can now read revenue recognition without being a workspace admin, while running the sweep and closing a month stay with owners and admins. Anyone allowed can record a wire, ACH or check payment against an invoice, and recording never moves money. Partial payments add up and the invoice turns Paid only when the balance reaches zero. The dialog shows what's still owed, refuses an over-payment, a repeated bank reference or a closed invoice, and flags a reference that doesn't match the invoice's wire reference.

Invites say where people land. All three invite dialogs gain a “Works as” field with a line explaining what that role can do, the role picker accepts Compliance and Finance, and an invite can no longer grant more access than the person sending it has.

Your name on what clients see. Proposals, quote PDFs and invoice PDFs now carry the sender name set in your branding, or your workspace name, instead of “Pact”, and a custom domain in the quote PDF footer no longer loses its first letters. In the consent app, the privacy-request shortcut now shows where identity verification stands and links to the request page to finish it.

Branch in sequences. The sequence builder's Branch step is now a real step: draw a Yes and a No path, choose which engagement counts (replied, clicked a link or opened), and both paths save together. Opens are off by default, and the inspector explains why: mail-privacy proxies open messages automatically. The builder refuses routing it can't follow, such as a loop, and warns when a path ends the sequence. On a phone, the sequence reads as an outline with each path indented under Yes or No.

Branch in playbooks. A playbook Branch now has a structured condition, with field, operator and value including “is one of”, and saves both its Then and Else paths, where the builder used to keep only Then and drop the condition. The inspector says which path a record with a missing field takes, and a test run shows which path a given record would follow.

Workflows say what can't run. Six step types with nothing to run them yet, namely incoming email, cost cap hit, assign owner, voice call, generate RFP and run report, are marked unavailable with the reason, and a workflow that uses one won't save until it's removed. Existing workflows are not changed, and the dry run says how many steps would do nothing.

These are builder changes: what you design now saves exactly as drawn, and test runs show the path it takes.

A way in to every page. The Sales rail now includes Tasks, Meetings, AI Radar, Calls and Power calling, plus Approvals for managers; Support gains Cases, and Admin gains Workflows. Eight pages you could only reach by typing an address now have a link: My contacts and Win/Loss in the Sales rail, a Meetings card in Settings, Currency & FX in admin settings, inbound webhook receivers, 24-hour slow-query trends, and a Live monitor on sent campaigns. Support agents, sales engineers, field reps and compliance users now land in their own module when your plan includes it, and SSO groups such as “Customer Support” or “Field Sales” map to them.

A switch that sticks. After switching from Support to Sales, opening Inbox or Home used to bring Support back. The module you choose now stays chosen on phone and desktop, and tapping Home on your module's home scrolls to the top. In sections with their own tab strip, such as IAM and Social, the strip keeps its place as you move between pages.

Pages that start with themselves. Marketing, Analytics, Data, Consent, Settings, Home, onboarding and admin pages now open with their own title, and module homes put their own content above the customer lifecycle, which now reads in plain language with its sources behind “How we know”. Several “coming soon” notes became the working feature: an email draft sends straight into a new campaign, billing usage shows what you're billed and how much of each allowance you've used, and the HubSpot and Pipedrive cards connect through Data sources.

Errors that don't take the page. If a page inside a module hits an error, the module's navigation stays usable, with Try again and a Report that includes a reference for support. The “Watch the 90-second tour” button can now be dismissed, and every tour stays one click away under Help → Tours.

Nothing rests over content. The floating corner button that covered Dashboard activity rows is now a sixth tab, Actions, in the bottom bar, with its count badge. Stacked notices take a single row and disappear once dismissed. Dashboard Recent activity shows business activity with readable headlines such as “Email · Logged” and names instead of ids, and leaves out sign-ins and automated calls.

Your work sooner. On a phone, the Home greeting is one line instead of a large card, so today's deals are on the first screen, and dashboard KPI tiles drop their decorative icons. The Dashboard title is never cut to “Dash…” at any width from 320 to 1920 pixels; when the header is tight, the Sample label moves to a small line beneath it.

Hey Pact fits. The Hey Pact panel stays on screen with its close button and your question visible, only the conversation scrolls, the text box stays above the keyboard, and swiping to dismiss no longer fires while you scroll.

Readable details. Small labels, including phone tab names, sidebar badges and changelog tags, render at their designed size and color, so “Records” no longer truncates on a small phone. Warning notes on call recaps, deal decisions, the email composer, lead scoring, and support, customer success and admin pages were white on pale amber and are now readable in the light theme.

Releases you don't notice. When a new version rolls out, each server now finishes the requests it's handling before it stops, so pages that are loading, live updates and clicks keep working, and live views such as notifications and activity reconnect right away.

Lighter tabs. A page-preloading hint was chaining endlessly, so every open tab kept re-requesting pages for as long as it stayed open; a page load now preloads its few likely next pages once. App sounds load the first time they play, and never for someone with sound turned off.

Live again. The incoming-call overlay appears again when a call comes in, and the Pipeline and My pipeline boards update live when a teammate moves a deal. Snoozing the setup checklist now sticks across devices, and snoozing the daily goal works.

Things that now do what they say. A saved report's CSV and the audit-log export buttons download the file, with a reason if a download fails. Browser push registers your browser and says what will arrive, with a real test send; AI-agent calls with a recording play it; data sources list their full run history; contacts show when each person was last touched; and sequences and journeys can be shared by link. On SSO settings, Show SP metadata displays your service-provider metadata. Records created through the public booking page, forms, surveys, campaigns, segments, journeys and templates come back with their real identity, so a new booking links to its calendar event.

Held, not dropped. If a workspace is suspended, incoming email events, Slack messages and calls are kept and processed when it resumes; once a workspace is scheduled for deletion, new inbound data is refused.

ask_workspace answers like Ask. Agents connected over MCP that call ask_workspace used to get answers from a different engine with no confidence information. They now get the same answer a person gets in Ask: a counted answer arrives with its measured confidence, an unmeasured one says “not established” instead of giving a number, and conversation threads continue.

This changes the payload. The response now carries answer_tier, confidence, kpis, gaps and steps, and ai_powered, sources_searched and retrieval_unavailable are no longer top-level fields. An integration that read those keys should read gaps instead.

iOS SDK. The PactSDKCombine product the package listed now has code behind it: its publishers start on first demand, can be cancelled, and pass Pact errors through unchanged. The SDK builds under Swift 6 strict concurrency with no errors, and every Swift sample on the iOS SDK page compiles, including corrected quickstart and offline-queue samples.

The sample workspace is how most people first see Pact, and it used to be a set of disconnected rows. Account stages, deals, calls, health scores, deal rooms, buying committees, quotas, win/loss, battlecards, forms, templates and the activity feed now describe the same eight accounts, so a story you start on Sales Today continues on CS Today and in Analytics. Sample pipeline boards have their columns, Manager Today and Forecast show a real Commit instead of $0, and dates stay relative to today.

Every sample row is still labelled as sample, and removing it still takes two deliberate steps that leave your own records untouched.

The same release fixes two things for every workspace: Support's knowledge-base search returns articles again, and a WhatsApp or Messenger mention can no longer blank the unified inbox.

Every new workspace starts with sample data so the product is not empty on day one. Until now that data had no lifecycle: it looked like yours, it went out in your exports, and clearing it meant trusting a script.

Labeled. One rule decides what is sample — a seed marker, or a row older than the workspace's go-live moment on a table that carries a watermark. Nothing is inferred at render time. On the dashboard the label is now a compact ✦ Sample tag beside the title instead of a widget in the way of your own numbers; tap it to see the seeded record counts by entity.

Kept out of exports, with a count. A data-subject access answer, a GDPR export and a portability bundle all leave sample rows out and say how many were left out and why. Before this, a customer's "here is everything we hold about you" bundle silently mixed our demo rows into their evidence.

Purged without touching a real row. The go-live purge builds every statement on the same engine that deletes a whole workspace, so every delete carries a workspace predicate, and it proves real rows survived independently of its own predicate. Demo usage no longer counts toward a real meter, and seeded users no longer receive credentials that can be derived from the seed.

Deleting a whole workspace is now provable, too. A relation map of every table in the schema classifies each one — deleted by workspace id, deleted through a parent, retained with a written reason, anonymized, or rebuilt — and a statement guard fails if any emitted delete lacks a workspace predicate. Suppression and audit rows are never plain-deleted; an address becomes a hashed tombstone so a person who asked not to be contacted stays not-contacted after their data is gone. A customer who asks for their workspace to be deleted can be answered with evidence instead of a promise.

Of the four request types the DPO console offered, only delete did anything when a request was marked fulfilled. Access collected evidence nobody sent, rectify marked the request done and left the record unchanged, and portability produced nothing. There were no request types for restriction or objection, nothing checked that the requester was the data subject, and nothing chased a missed deadline.

Access now emails the subject a single-request download link, and the answer says what was searched and what was not. Portability produces a versioned bundle — profile, consent ledger, form submissions, identities. Rectification applies the requested changes, re-encrypts and re-hashes the record, and keeps a per-field before/after with identifiers masked. Restriction adds a suppression that every gate honors — sends, retrieval into a model's context, agent memory, enrichment — while storage is untouched. Objection lands as withdrawals on the consent ledger. Erasure worked before and is unchanged, plus a guard for shared addresses.

Identity is verified before fulfillment, and an overdue request is escalated hourly instead of aging quietly.

Underneath, a privacy drill against a copy of production found the paths that did not survive contact and fixed them: an erasure used to *unsuppress* a person by deleting their suppression row, so mail could resume; the retained list now keeps a hashed tombstone. A suspended, pending-deletion or deleted workspace is now refused on sessions, API keys, webhooks, scheduled jobs, AI jobs, billing, inbound voice and sequence sends — and an unreadable status fails closed.

A read can end three ways, and each needs its own answer. Ok, nothing there gets the page's own empty state, and a real zero is a zero. Failed gets one named failure with a request reference and a Try again. Refused gets a lock, the module named, whether the workspace or the seat lacks it, who can grant it, and a working link.

Before this, Analytics tiles printed $0 in pipeline over a 0% win rate while the read was in flight or after it failed — byte-identical to a workspace with no pipeline. Support Today printed "Inbox zero — nice" over a cases table the server could not read. The manager coaching page printed "the team is moving deals at expected dwell" over a query that had never once executed, beside a skill rubric that scored a rep 100 on discovery from an empty result. Two privacy-portal reads told a data subject they had no consent records when the read had raised.

The top bar had the same shape in the one place nobody checked: the notification bell disappeared entirely on any failed count — a 502 during a deploy looked like a workspace that had never bought notifications. It now stays, in the same footprint, and says what failed.

The primitive underneath was fixed as well. The read-isolation helper recorded a gap only when a read *raised*; a helper that swallowed its own failure and returned an empty list exited cleanly, and on Postgres left the shared transaction aborted for the next query. It now records the failure that does not raise, so the surfaces above cannot be lied to by the layer below them.

The standing rule is no shell pages: real data, no placeholders, no dead links. A code read and a sweep found the places still breaking it, and every one is now either real, honestly empty, or gone. Nothing unreal was made to look more real.

The live voice page played a timer-driven scripted call with invented tools and sentiment; it now opens the real Live tab over your actual calls, and the scripted view is deleted. A campaign's A/B tab split untagged sends into variants by the parity of their id and spread opens across them; untagged sends are now counted as untagged and never bucketed, rates are null unless opens are variant-tagged, and a campaign with no variants says it is not a test. The send-time tab printed a hardcoded "9:30–11:00, +18% open"; it now shows the optimizer's recommendation for the campaign's segment, or the reason there is none. Customer-success playbooks listed five invented auto-enroll plays with activity counts and outcome claims; they are removed and the real expansion plays kept. The marketing settings page printed a made-up mail domain, caps and DMARC status; it is now an index of the real configuration pages that says what is not configurable.

Alongside them, toast-only controls that confirmed actions they never performed, test harnesses reachable from production, and links to pages that did not exist were removed or wired to the thing they named.

Asked out loud on a phone, "What caused the 3M stall?" arrived as "What caused the three m stall?" and Pact replied that it could not find anything matching that in the workspace — about a workspace that holds an account named 3M. The spoken form now resolves to the record, and it resolves on the structured branches too, so a question about one account is answered about that account rather than tenant-wide. A near miss never narrows the answer, and an ambiguous name is left ambiguous and logged.

When there is genuinely no match, the suggestions under the answer are the closest records on file instead of the three most recently added — and the gap sentence no longer points at "the suggestions below" on a surface, or a phone line, that has none.

A retrieval that could not run is no longer rendered as a workspace that holds nothing. The engine learned the difference two weeks ago; every consumer dropped the flag on the floor. It now reaches all six — the panel, the thread, the phone, the widget, the API payload and the extractive fallback — and a seventh engine the review never named. On screen, retrieval failed, matched nothing, not entitled and has results are four distinct states.

Time is bounded and accounted for. The interactive path inherited a batch retry policy that could take 92 seconds to give up; it now spends a 15-second wall-clock budget and, when that expires, degrades to the record list and says so. Every answer carries a request total and a per-stage ledger, so a slow answer can say where the seconds went instead of leaving a mystery. Time nothing names is reported as unaccounted, never dropped.

In the AI usage ledger, an error is now filed under its exception class instead of "unknown", and three ordinary words containing "rate" no longer file a failure as a rate limit.

The bell said 285 unread over a dropdown holding roughly forty items, because 140 of those rows were one unfinished passkey enrollment reported 140 times and forty more were one usage threshold reported forty times. The twenty mentions and nine access requests that actually needed a person were underneath them.

A burst of one standing condition now renders as one item and counts as one. Two mentions two hours apart still count as two, and two different threshold conditions never collapse into one line — the earlier grouping key was coarser than the condition it named, so an abandoned enrollment and a failed one shared a row and could re-raise each other's payload. Muting a kind moves the badge. Clicking a collapsed row clears the whole group, and a row with no destination can still be dismissed.

The unified inbox — the one surface built to be "everything that needs you, triaged" — asked for the uncollapsed feed and was the last place still rendering a condition as 140 rows. It now asks for groups, dismissing a grouped row archives every id it stands for, opening one marks them all read, and a standing condition is badged as a volume while an event kind is badged as updates.

The notification test-send in settings answered 200 and sent nothing; it now either produces a notification or says why it could not.

The lifecycle lane stopped at Won and resumed at Supported. The stretch between the signature and the second invoice — implementation, and the renewal decision — was drawn as the absence of anything, and that is where customers are actually lost. It was never a data problem: onboarding plans, subscriptions and expansion signals have carried an account id for months. The lane simply never reached them.

The lane now has seven rungs, each with a written map of what it can and cannot count. Onboarded and renewed are real counts from real ledgers, scoped to your workspace. A rung whose ledger did not answer is a named reason, never a zero.

The view itself was rebuilt at both widths, replacing a rung strip over a table that named the same accounts twice. Journey draws one account on a vertical, dated line, newest at the bottom, a today marker, and the future below it — an SLA ceiling in five days, a renewal decision in nineteen. Portfolio is five columns — account, lifecycle, needs attention, health, open — with one attention cell per row on three levels, the rung strip folded into the row as a seven-segment bar, sorted by urgency.

Open cases and expansion signals were undated on the wire, which is why a timeline was not possible before. Both now carry the dates their tables have always held, so the line can show causality: an expansion converted on the 2nd, four P1 cases on the 8th, health down 22 points, a ceiling in five days, a decision in nineteen — readable in one screen on a phone.

Dashboards now show open pipeline from the deals ledger, with an explicit stage predicate on every money aggregate. The match is by substring, so a stage such as "Renewal — Lost" is closed and excluded, not counted as a live renewal.

Five figures that were never right went with it. The pipeline-value total on every stored snapshot summed a column that did not exist, so it had been 0.0 on every snapshot ever taken. The My Day widget returned a server error on Postgres. Two readers filtered on a status column that was not there. A customer-success renewal read was not scoped to the workspace. And the inbound caller's open pipeline — the number that decides whether a known caller is bumped up the queue — had read $0 on every call because the query raised and the failure was swallowed.

A voice-agent call's turns were in the database and already served by two working endpoints, but the call page only knew how to resolve a call-log id or a recording id and dead-ended on everything else. Measured on one workspace: calls a person could open from Calls went from 167 of 551 to 551 of 551. Another workspace's call is refused with the same answer as a missing one, so an id cannot be probed.

The inbound screen-pop — the card that appears when a known contact calls in — returned a server error for every caller it matched, and the transfer whisper went silent with it. It is fixed, and it now serves a caller context pack: who is calling, their open deals and cases, and the last conversation. A transfer carries a handoff evidence pack so the next person is not starting from nothing.

The relay could also lose a turn the caller had already heard answered, or store it twice stamped as an interruption that never happened, when the socket tore down at the wrong instant. Exactly one row per answered turn is now written whatever the teardown does, and no interruption is fabricated — which also stops those phantom rows polluting the cut-rate analysis.

The custom media transport's admit gate had imported a module deleted two weeks earlier, so every call that reached it raised a server error instead of speaking its refusal; the import is fixed and the whole admit path now fails closed with spoken TwiML.

Every fix here was measured on real calls, not on a fixture. Say "update that" followed by a stage and Pact applies it; it no longer asks "anything for the deal amount? … anything for the close date? … you can say skip" for every optional field before doing what you asked.

A filtered search that returned zero used to be spoken as "you have no open deals right now" — on a call that had just counted 27. The call now remembers what it resolved, and a zero from a filter is spoken as a zero from that filter. When the workspace holds the account you named, "tell me about three m" reaches 3M instead of an invented account built from a filler word.

A voice-CRM write that ran past the turn's timeout was narrated backwards: "sorry, that took too long," followed by an invitation to retry — while the deal was updated anyway. The write is idempotent and its receipt is durable, so after a timeout Pact reads the receipt and tells you what actually happened.

"Of course —" and "No problem —" no longer open a sentence that goes on to report a miss. Amounts are spoken in full — "four hundred and eighty thousand dollars", not "$480k". A capability menu is no longer recited on every failure.

The recognizer's vocabulary bias — the list of your accounts and contacts that helps speech-to-text hear them — was built and cached on every call and then never sent on the transport that serves most of them. It is sent now, under a byte bound that is raised one rung at a time only after a real call connects on the rung below. A misheard tool phrase is recovered by sound against phrases already seen, with zero wrong claims on 522 real turns. Chained requests — "open a deal with 3M and progress it to prospecting" — are split where they should be and left whole where splitting would be harmful.

This is the batch's security work, stated plainly. Everything below is live; nothing here is a switch waiting to be thrown.

Reads across workspaces. A link-unfurl endpoint took its workspace from a request header and carried no authentication, so an anonymous request could read any workspace's deals, accounts and contacts by naming the workspace and guessing an id. A workspace's AI-cost overview grouped by workspace with no predicate, so any customer's admin saw the platform's five biggest workspaces and their exact spend. A company that belonged to no workspace was readable by every workspace across eight routes. Event and collaboration WebSockets authenticated only when a variable production never set was set, and a signed-in user could stream another workspace's events by naming it. All closed, and a static gate now runs in CI so a new one-sided join fails the build.

Writes across workspaces. Feature flags are global — one row per flag for the whole fleet — and every route that could create, retarget or delete one was gated on a workspace-level permission, so any workspace admin could remove the gate governing everyone else. Those routes are now Pact-staff surfaces; the per-workspace path is untouched. An erasure in one workspace deleted matching notifications in every workspace. A suspended workspace could un-suspend itself and any owner could self-upgrade their plan. A share link for a report never wrote its expiry, so every share link ever issued was permanent; they expire now.

Callbacks. Twelve inbound webhook routes accepted an unsigned POST from outside. Email-provider webhooks, e-signature callbacks, calendar and social callbacks, and the Twilio voice-room routes now verify a signature or refuse in production, and a signature-bypass flag is ignored when the app runs as production. An unauthenticated media socket is closed after fifteen seconds instead of being held open for half an hour. The bounce-and-complaint webhook that verified nothing — so an anonymous caller could suppress any workspace's mail to any address — verifies now.

Underneath. Every production transaction now runs bound to its workspace or on an explicitly elevated, named path, and the isolation checks in CI evaluate each table's policy as a non-bypass role rather than only checking that a policy exists. The database role switch that makes Postgres enforce those policies is still staged, as the runbook records; this batch makes the day it is thrown a smaller one.

Every mobile defect reported in the week to the 15th was found by a person looking at their own phone, while six mobile gates ran green every night. The gates measured boxes; none of them put a finger on anything. Three things changed.

Drag handles. One grip — 44 by 44 pixels below the laptop breakpoint, with touch-action none — replaced seven hand-rolled ones. Six of the eight reorderable lists in the product could not be moved by a thumb; they can now, and a gate drives real touch events at 390 by 844 and fails if the list does not move.

The top bar at 1024–1279 px. The sidebar takes 260 px and the right-hand cluster could not shrink, so on 31 routes the bell and account menu ran 50–230 px past the edge. In that band the view-as label goes icon-only, the tier and Hey Pact pills wait for a wider screen, and the account name hides. Every control stays reachable.

The analytics range rail at 390 px. The rail's port was 138 px against 315 px of chips, so four of seven ranges were off-screen with nothing saying so — and on the year-to-date range the active chip sat entirely out of view, so the page rendered "7d 14d 30d" with nothing highlighted above figures scoped by that selection. The rail now scrolls the active chip into view and says when more is hidden. The same page also took its whole route into its error boundary whenever the summary arrived without KPIs; it degrades per-tile now.

Tracking on a phone is its own design rather than the desktop table narrowed, with a paging count that no longer lies while the browser-side source filter is on, and an empty table that says which kind of empty it is. And an announcement banner that overflowed both edges at 360 px — the one real defect behind eleven of the layout backlog's failures — is fixed.

Today, Route, Territory, Scorecard and Visit all opened on an error for every rep. The module's client was the only one in the product on a raw fetch with no API prefix and no authorization header, and the browser proxies only the prefixed paths. It now uses the standard client, and a contract test covers every request it can make.

Once the pages were reachable, reading them turned up three more defects. A visit or territory belonging to another rep in the same workspace was open to any rep; it now answers not-found, identical to a missing record, on all seven visit routes and on territory read and archive. An outcome, objective or check-in method wider than its database column crashed the save with a server error; each now gets a validation error naming the field. And the offline outbox never actually worked offline — a queued visit is now kept with no signal and replayed, in its own savepoint, when the connection returns, and each queued action can only touch the queuing rep's own visit.

Every module root now lands on that module's Today.

The account list is the page a rep opens most, often on a phone, and it had sat on its script budget through three bumps. Its first load now carries 46 kB less JavaScript to download, parse and run before the list is interactive — 279 kB to 233 kB, exact gzip sums, with the budget left where it was.

Nothing looks different. The bulk-action bar loads on the first row selection, the guided tour on the first "Take the tour" click, the right-click Ask Pact dialog and its voice stack on the first open, and a base64 fallback that no browser takes is no longer bundled at all. Each deferred surface is fixed-position or absent until opened, so nothing shifts, and a guard test fails if any of the four static imports comes back.

The sidebar is the one component every page mounts, and it rendered 239 rows with nothing that could be put away: 11.5 screens of scrolling in the expanded desktop rail, 17.5 in the phone drawer. Measured in a real browser off the real component.

Nav groups are now collapsible. The state is persisted per user and per rail scope, so what you closed on the main rail stays closed there and the admin rail keeps its own. The default is every group open except the thirteen admin groups, which hold 123 of the 239 items and are visible to owners and admins only — who already have a focused admin rail for the same territory. With that default the expanded rail drops to 116 rows and 6.3 screens on a desktop, 9.6 on a phone. Nothing is reordered and nothing is removed.

The video-meetings integration's route matched any provider segment, so the app answered "unknown provider" for fifteen endpoints across five other integrations before the router that owned them was ever reached — and the settings pages rendered that as Not connected or Not configured for integrations that were wired correctly. The route now declines anything that is not a video provider and lets the request fall through, whatever the router order.

Journey attribution joined enrolled subjects to contacts on a plaintext email column that a migration dropped months ago. The query failed on every database, the failure was swallowed, and every journey showed $0 attributed pipeline on the list and on detail. Enrolled subjects are now matched through the workspace-salted email hash, the same way segments already match, and opportunities are filtered to the workspace rather than matched by company name across all of them.

For anyone integrating against the API, /health now returns the deployed commit, so a support conversation can start from what is actually running.

An assistant that answers in one confident voice makes you trust the weakest sentence as much as the strongest. Ask Pact no longer does that.

Every element of an answer now carries a provenance tier. A number read straight out of your workspace is marked as measured. A number computed from those is marked as derived. A model's judgement is marked as such. And when a piece of the answer could not be obtained at all, that is its own tier — a labelled gap that names what failed, rather than a zero, a blank, or a plausible-sounding sentence covering the hole.

The answer also arrives differently. It decomposes first: you see the question broken into the parts it will answer, then each part fills in, with live progress and an honest estimate of what is left. The spinner that used to run forever when a step died now resolves into the gap that killed it.

Asking about something your workspace has no row for used to produce a confident answer about nothing. Now the premise is corrected first — "there is no account by that name; here are the three closest" — and then the question is answered against what does exist. Pivots to the adjacent question sit one tap away.

The same ladder is spoken. Ask over the phone on 1-424-PACT-MCP or through Hey Pact and you get the reading first, the gap as an answer rather than as silence, and consent enforced fail-closed on every path.

Underneath it is a catalog, a planner and an executor over a measured cube — exercised against a 151-question breadth corpus with zero refusals.

Passkeys were the sign-in path most likely to leave you stuck with a button that did nothing.

Three separate faults are fixed. Cross-device sign-in — scan the QR code with your phone to sign in on a laptop — had lost its transport hints and its ceremony timeout, so the browser often never offered the option. A credential identifier longer than 32 characters hit a column that could not hold it, and every passkey login turned into a 500 because the failure was caught by code whose own docstring promised it was harmless, leaving the transaction aborted for whatever ran next.

The third is the rule rather than the bug: no control in the sign-in flow is inert now. Every ceremony either completes or tells you exactly what happened — cancelled, timed out, no credential on this device, wrong domain — instead of failing silently and leaving you to guess which.

Issuing a login challenge is a state change, so it writes an audit row. It did not before, which meant the most security-relevant moment in the product was the one with no record of it.

Separately, sign-in stopped sharing its connection pool with everything else. The isolated pool exists so that a busy workspace can never make sign-in slow; collaboration and the two live-update transports were sitting in it and have been moved out. SAML assertion replay protection now survives across processes, so a replayed assertion is rejected by any server that sees it, not only by the one that saw the original.

Every module — Sales, SE, Analytics, Data, Consent and the rest — now opens on a Today page assembled from that module's own declared lifecycle, rather than from a layout copied between them.

The lane was proven on one module first and nine more now declare their own, which is the part that matters for what comes next: a module gets its home by describing its lifecycle, not by someone hand-building another page.

The phone half was a genuine defect, not a polish item. Eight module homes rendered nothing at 390px — the lifecycle lane was a desktop grid with no mobile expression, so the page loaded, occupied the viewport, and showed no content. Both widths are now designed deliberately: at desktop the lane is scanned across, at phone width it is read down, and what earns a row differs between them because the reading differs.

A Home card that is empty and a Home card that could not load are no longer the same picture — the second one now says which read failed.

The Sales module home also stopped inventing a pipeline. It previously rendered plausible-looking rows whenever the API returned anything short of a server error, which included a permission refusal — so a workspace without the module could see a convincing pipeline that was not theirs. It now performs the cross-module read it was always missing, and renders a labelled gap when that read fails.

A zero is an answer. "I could not read this" is a different answer. For a long time Pact rendered the second as the first, across a lot of surfaces at once.

The general fix is a contract: a metric whose read failed renders as a labelled gap naming what failed — never as a number, never as an empty row that looks like "you have none of these".

Where it bit hardest: one broken widget was aborting the transaction it shared with five others, so a single failure made the whole dashboard invent reasons. A swallowed query was reporting 0 open deals against 350. The tenant AI spend line was reading a column that does not exist and showing the result as $0. Cost dimensions with no ledger behind them were rendering as though they had measured zero.

KPI tiles got the same treatment from the other direction: a tile with no honest history now says so, and a flat line drawn from a single point is no longer presented as a trend.

Metrics now declare themselves — what they measure, from where — so that when one of them does report zero, the zero can be trusted. There is a health surface that will not print a number it did not measure.

Lists learned the same manners. A result that was silently cut off now carries a visible banner saying it was cut off, and the entity picker says what its eight rows are eight *of*.

Twenty-five separate repairs, all of them about the same thing: what it is like to be on the other end of the call.

Menus are questions now, not recitations. "First, X. Second, Y. Third, Z" was interrupted by the caller in roughly three quarters of the cases where it was used; "X, Y, or Z?" almost never is. Four renderers were still counting options off and have been converted.

Silence has been removed from the long path. "Got it —" followed by twelve seconds of nothing was the worst version. Pact now says what it is doing rather than that it is still doing it, at every cue, and a briefing starts speaking while it is still being composed instead of after. A question with a constant answer — "top deals" — no longer pays a model to work it out.

Repeating yourself gets a different reply. Saying it again used to get the same sentence back, word for word.

A declined request says which condition declined it. A briefing that will not run names the reason rather than failing into a generic apology, and a request Pact cannot complete no longer promises a callback that was never going to be sent.

An offer Pact makes, it can accept. Several replies ended with an offer that nothing downstream could act on; where two offers appeared in one reply, the answer bound to the wrong one. The layer that makes an offer now records what it offered, and the deal list closes on a question that actually narrows — and can then answer it.

A confirmation left pending no longer swallows the rest of the call.

Pact scopes every query to the workspace that asked, in the application. Five places where that scoping was missing or wrong were found and closed: the accounts list and its count were running without a workspace filter; stage history resolved its company reference across workspaces; an automatic merge could read and overwrite another workspace's row; customer-health had four cross-workspace reads; and pipeline reads were re-bound after the deals migration.

Underneath that, the rule is being moved down into the database itself, so a query that forgets is refused rather than answered. Isolation policies now cover every workspace-scoped table — 783 of 783 — with the workspace identity bound on every transaction rather than on a connection a pooler might hand to someone else, a row with no workspace on it no longer readable by every workspace, and three background jobs that were bypassing the policy on the serving connection routed onto their own.

The switch that makes those policies bind is staged and has not been thrown. It went live once on 14 September and was reverted the same afternoon after it locked every device out for 2 h 20 m; the app therefore still connects as a role the policies do not apply to. We would rather say that than let a policy count be read as a guarantee, and this entry will change on the day it changes.

Separately, an unauthenticated live ticker that could return data across workspaces was deleted rather than fixed. It had no owner and no customer depending on it, and the safest version of that endpoint is the one that does not exist.

Outbound traffic got the same treatment from the other side: SMS, voice, calendar, Slack, webhooks, social posting and CRM write-back now transmit only through the egress guard, so there is one place that decides whether Pact is allowed to talk to the outside world on your behalf.

A perfect transcription can still reach the wrong record, and that was the largest single class of voice failure.

Recognition is now biased toward the name a caller says, rather than the string the CRM stores — "three am" resolving to nothing appeared nine times in the corpus and is now understood as 3M. Being polite was another one: a courteous phrasing wrapped around an account name made the account unreachable.

Thirty ways a rep describes their own work — the vocabulary of the job, not of a customer — were being read as company names and searched for. They are now swept out of account search before it runs. So is the caller's own filler.

Where a name is genuinely ambiguous, the fix was to narrow the ask, not the book: Pact asks a question that distinguishes the candidates instead of quietly picking one or widening the search until something matches. The deal menu was labelling accounts while speaking deal names, which is why it never trimmed correctly.

Two things a voice product must never get wrong: who it is, and who it is talking to.

Disclosure. Pact identifies itself as an AI assistant before it asks anyone a question with legal weight. That was compliant before this batch and sounded like a warranty notice, because the disclaimer was prepended as a separate sentence — "Hi, this is Pact, an AI assistant. Hey Dean, what's up?", two introductions where one is a disclaimer. The clause now rides inside the identification each greeting already made, in Pact's own register, and it is present on every call Pact places, not only on the authenticated ones.

Identity. A recognized caller ID is a hint, not a credential. Pact now steps up to a real check exactly where the caller ID is not enough, rather than trusting it everywhere or challenging everyone.

Writes. A command that was misheard must not execute a write. Confirmation is now by consequence — Pact repeats what it is about to change, not the words it thinks it heard.

Register. On a call Pact was on, it may not describe itself as a person. That had to be enforced rather than requested.

An unknown caller also gets a better first impression rather than a deliberately equal one: the greeting no longer offers two words that reached nothing, and no longer asks for a term that nothing on the other side handles. If you need one, "get me a human" now reaches an escalation hotline — which is off until a workspace configures a number, so it says so rather than pretending to transfer.

What Pact can do out loud is no longer maintained as a list somebody has to remember to update.

Two failure shapes were behind most of the "it just didn't understand me" reports. The first: a tool you can say and cannot run is worse than one you cannot say, because the failure looks exactly like not being understood. Those are now either bound properly or declined with a spoken reason. Binding them also surfaced a mis-mapping that had been shipped and was invisible while the tool was unreachable.

The second: the feature flags that gate voice capabilities could not be read from the table they lived in, so they evaluated against a default rather than against the workspace's actual configuration. They are evaluated now.

Discoverability is on for everyone, honestly — the capability menu used to take 42 seconds to speak, which is the right taxonomy delivered the wrong way. It is now a short menu that leads somewhere, and the number of things you can actually say and have happen went up rather than the number of things it claims.

Follow-ups work across turns: ask Pact to make a battle card and then say "read it to me", and it finds the one it just made. Asking about risk gets a risk answer rather than an account search.

Four separate things were competing for the bottom of a phone screen, and the content lost.

There is now one floating affordance and one notice at phone width, with everything else moved into the flow. Chrome — bars, headers, banners — had grown to about 40% of the screen on the dashboard; it now has a budget, and the budget is enforced rather than reviewed.

The deal board had a touch bug worth naming on its own: a tap was only registered if it was short enough, so a deliberate press read as nothing, and a drag also fired as a swipe. A tap is a tap at any duration now, and a drag is only a drag.

Open a call and four panels used to be blank. All four blanks meant "we found nothing", and none of them were true — the extraction had never run at all.

The post-call pipeline now runs as a pipeline, with a stage ledger, and every empty state on the call record says which empty it is: not started, ran and found nothing, or failed with the reason. Those are three different answers and they were rendering as one.

Two rendering faults went with it. A stored recap containing a placeholder was being displayed as six single-character bullets. The insights card opened on whichever tab came first, which was frequently an empty one, and its chips wrapped onto a second row that pushed the content out of view — it now opens on a tab that has something in it.

Exports keep their promise: the call export contains what its own description says it contains, and the timeline's total is a total rather than the count of the page you are looking at.

The compliance surfaces are the ones where a wrong number is not a cosmetic problem, and several of them were confidently wrong.

The DSAR clock. A request that had been fulfilled 21 days early was displayed as *"Overdue by 107 days"*. The service-level calculation ran against the wrong pair of dates.

The consent preview. The read-only preview looked its subject up by the wrong subject type, so it reported nothing for people who had a full consent history.

The export. A data-subject export could never have completed — six separate bugs, found by the simple expedient of running it rather than reading it.

The audit log. Ninety-six rows claimed a digest had been sent when none ever was. Audit rows are not editable by design; these were corrected through a recorded migration, with the correction itself in the record.

The proof-of-capture text that sits under a consent record was on the wire and never rendered, so the evidence existed and no one could see it. The insight tabs on the same card were left in a state where no panel was active — a 143-pixel empty shell sitting on top of the data it was supposed to show.

Pact had opportunities and it had deals, and different parts of the product read different ones. The forecast read two tables, not one. Customer health read the older. Pipeline read the newer. The numbers disagreed, quietly, for anyone who compared two screens.

Deals is the target, the decision is recorded, and the readers have been moved across a tranche at a time with the value compared on both sides of each move rather than assumed.

Two specific wrong numbers fell out of it. A decorated stage name was hiding a closed deal inside open pipeline. And the forecast bucket named "pipeline" was not the pipeline — it was a different slice with the same label.

The reconciliation that was supposed to prove the two tables agreed was copying zero rows, and the check on it was written so that it could not fail. Both were replaced; the remaining rows without a workspace were assigned where that was provable and refused where it was not, rather than written as null.

Duplicate review is legible at laptop resolution now and shows survivorship — which record won each field, and why. The demo-data purge no longer destroys the source records of a merge.

A sample account used to be a name and a logo. Evaluating anything against it meant imagining the rest.

Seeded data now carries a history: eleven more tables joined the purgeable cohort, so a sample account arrives with the contacts, activity and past that make a pipeline view, a forecast or a call record worth looking at.

The constraint that makes this safe is unchanged and was re-proved rather than assumed: purge still takes nothing but the seeded rows. Every seeded row is marked as seeded, the purge selects on that mark alone, and the test asserts that a workspace's real records survive it untouched.

The contact book behind it was repaired at the same time: every demo contact has a reachable address, contacts link to a real company rather than to a name that happened to match, six duplicate accounts were converged, and the tombstones left by an earlier convergence run were cleaned up. Name-based joins are a debt rather than a mechanism now, and the remaining count says which debt it is.

The signup chain ended in silence in both directions. A request for a workspace notified nobody, and the person who made it heard nothing back.

It notifies now, loudly, and the approver can see what they are approving. The applicant is told — the response that carries the notification was being swallowed, so the email never sent even though everything upstream of it worked.

A newly approved workspace is seeded before its first sign-in, so the first screen has something in it. The fast path had also been skipping the revenue-leader setup entirely, and a seed that failed did so invisibly.

Background work was running behind a single point of failure that nobody had noticed, because the symptom was slowness rather than an error.

One dead webhook endpoint was stalling every background tick. A subscriber that stopped answering held the queue for everything else. It no longer does.

Sequence delivery stopped lying about itself. The drain was marking a message as delivered before it had been sent, so a send that failed afterwards still read as delivered.

Background work has one leader. Scheduled jobs elect a leader at the seam the scheduler already named, rather than relying on there being exactly one worker.

The email digest counts its own failures. It now tracks a run of failed deliveries and records what would unblock them, instead of failing weekly in a way that looked identical to having nothing to send.

Spoken output had two distinct ways of coming out wrong, and one of them was self-inflicted.

Ordering is enforced now. Playback order used to be a property of how the pieces happened to arrive rather than of anything guaranteeing it, and an attempt to improve throughput made it worse — a sentence would play two words, jump to the end, and come back to the middle. That attempt was reverted the same day, and the speech channel is now serialized by construction: each piece is scheduled at a time that can only advance, so two pieces cannot swap.

A clause boundary on a digit is provisional. Pact was ending a phrase at the decimal point, so "$310.1M" was spoken as "$310" and then a fragment. Numbers are now held until it is clear the number has ended.

Hold music no longer sounds haunted. The default is a warm, telephony-safe synth that survives the codec, replacing something that a caller on hold experienced as unsettling rather than neutral.

A deploy landing in the middle of a live call used to end it. From the caller's side that is indistinguishable from Pact hanging up on them, and from ours it left nothing behind to find.

The caller is told now, in the call, rather than being dropped into silence. And the call record carries the reason — a deploy-dropped call says so on the record, not only in a log file nobody reads after the fact.

Underneath, each relay connection has exactly one writer. Six senders were sharing a socket with no lock between them, which is the kind of thing that works until it does not. The single-utterance failure class — a call where the caller says one thing and never hears back — was hunted down to a second inbound connection and a counter that was being incremented into nothing.

The public site was measured on a 320×568 viewport — the smallest phone still in meaningful use — and it did not fit.

The hero's primary call to action sat below the fold by a margin that took several attempts to close honestly: the first two moved it with margins, which a centered grid absorbs, and only the third — padding rather than margins — actually moved it. It clears the fold outright now, and the fold got 36px back on top of that.

The mobile navigation's primary item scrolled to a section that was hidden, so the most prominent control on a phone did nothing.

Display type had no chosen line height on any route. It was inheriting whatever the cascade produced, which is why large headings touched each other at some widths and not others. Three components carried it, not one.

Two smaller honesty repairs went with it: no named reference on the site points at something that does not exist, no bracket is left unfilled, and the outcome statistics on the role pages are sized like the claims they are rather than like measured results.

Radar ranks what deserves your attention. Two things were missing from that: why, and what it could not see.

Every finding now carries the reason it is first — the signal that put it there, not merely a score. A ranking you cannot interrogate is a ranking you have to take on faith, and the first time it is wrong you stop using it.

The second is the more serious one. When a detector failed to run, Radar reported "all caught up" — the same message it shows when it ran everything and found nothing. Those are opposite states. A detector that could not run now says so, by name, and the health of the checks themselves is visible next to their output.

Planning has been the thing that happens in a spreadsheet beside the CRM, and then stops matching it within a fortnight.

Objectives, key results, workstreams and tasks are now first-class: they can be created, measured and worked from the page itself. A key result reads its own measure rather than waiting for someone to type the current number in, and the work that moves it hangs off it directly.

The point is not the artifact. It is that the plan and the pipeline are the same data, so the plan cannot quietly go stale while the numbers move.

A cost surface that shows a number for everything is more dangerous than one that admits a gap, because you plan against it.

The cost-to-serve view now carries three things: the scale economics — what a workspace costs as it grows — the bindability of each spending cap, meaning whether the cap can actually stop the spend it names, and an explicit blind-spot list of the dimensions that have no ledger behind them and therefore cannot be measured at all.

The dimensions that cannot measure render as such rather than as a confident zero, which was the previous behavior and the reason a cap could look enforced while enforcing nothing.

Underneath, a set of metrics that the code appeared to collect were never actually written anywhere. Those are wired up, and the code paths that had never once executed were deleted rather than left to look like coverage.

Six numbers on the Data module were string literals in the page source: 14,231 profiles, an 89% match rate and 42 pending merges on the profiles page; 2.3M records across 14 tables, 365-day retention and AES-256 per-tenant encryption on the vault page. They were identical for every workspace, including ones that had connected nothing.

The vault tiles were the worse of the two. A fabricated volume misleads; a fabricated security guarantee is the kind of sentence that gets copied into a customer's security questionnaire. And the page's own description — an append-only raw store for every event and record — described a system that does not exist here. The vault is reverse-ETL and change-data-capture: destinations, signed export manifests, subscriptions with measured lag. Twenty-two endpoints, of which the page exposed none.

Every tile is now a read with its formula shown, and a real zero, a gap and a refused read are three different pictures. The identity graph reports its own health instead of a literal.

The customer-health refresher selected every company that either belonged to the workspace being refreshed or belonged to no workspace at all. That second clause is the wildcard this codebase has closed several times in read paths; this loop wrote. Every workspace with health scoring on picked up the same ownerless company and stored it a health snapshot, a churn prediction and possibly a follow-up task, each stamped with that workspace's id — one company, many workspaces, each claiming it, with the signal context read under a workspace that did not own the account.

The refresh loop now never picks up a company no workspace owns, a failed refresh is logged with its exception class and the tick still completes, and the at-risk queue cannot render another workspace's company name. A test fails if the wildcard is reintroduced anywhere in the package.

The as-of time has been on the lifecycle payload since the dimension was written, and no consumer rendered it. A health snapshot computed in March and one computed this morning arrived on a rep's phone as the identical chip.

The age is now part of the number. Health and churn risk carry an age in whole days and a stale flag computed on the server, with the threshold declared once and named in the payload's own formula so a reader can check it. The chip prints the age when it changes the reading and always in the accessible name; a stale number never keeps a confident warning tone and never loses its value. An unreadable timestamp is reported as unknown age, never as fresh.

Contacts already carried both ends of the bridge: a salted hash of the email, indexed, and the company they belong to. A marketing subject reaches an account in two hops with no schema change and no plaintext column. What was missing was not a join but a single place that performs it and says why when it cannot.

One canonical resolver now takes a workspace and a subject — email, phone, contact id or company name — and returns the contact and the account, or a named reason it could not, in the same gap shape the surfaces already read. The answer is materialized on the three marketing ledgers so the read is per page rather than per workspace, with a dry-run by default and a reversal receipt, and it is maintained on the write path.

The lifecycle lane's nurtured rung, which used to be the void, fills with a real count — and still renders the honest hole where the backfill has not been run.

The mention pipeline was healthy. Three independent layers were each dropping one of the four things a notification owes its reader, and the row that reached a phone was the sum of all three.

Who did it was stored on every row and never selected by the list route, so it read "Someone". What happened had no copy template for 28 of the kinds producers actually emit, so it read "sent you a notification". Which record was routed for ten kinds while producers emit quotes, calls, notes, meetings, workflows and approvals whose pages all exist. Where to go was written by 23 producers into a field no reader ever looked at.

All four now reach the list, on the phone and on the desktop, and the link a notification already carried is the link it opens.

Eleven optional database reads across the consent and solutions-engineering surfaces caught every exception and substituted a zero or an empty list, with no log line anywhere. Both pages render those empties with reassuring copy, so a database the server could not read was answered with "Audit log clean — no high-severity events to review", "Consent rates steady", "Suppression list quiet", "No sends blocked today", and — for the scorecard — advice to run a report that could not have worked.

The consent hero narrated the same fabricated zeros in prose, and in its AI-written variant a model turned them into fluent, confident good news. On the most regulator-facing surface in the product, that is the wrong direction to fail.

Each read now runs inside its own savepoint so one failure is not eleven, records the failure on the result so the page can say which read did not run, and logs at error with the exception class.

Measured inside the module shell rather than full-bleed, the cross-module table's scroll container had 750 px at a 1440 window and wanted 899 — 149 px, the entire Moved (30d) column, past the right edge behind a scrollbar a reader has no reason to look for. At 1280 it was 256 px. At 768 it was 421 px, and four elements inside the lane's stage columns spilled out of their own boxes. That was nine module homes, not one, because the same composition sits on every non-sales Today page.

The page never scrolls sideways now at any of seven widths from 1920 down to 390. When the table does scroll it says so and keeps the account column fixed, so a row never loses its identity. The phone is its own design: a lifecycle lane built for 390 px rather than the desktop table narrowed.

Three pages in the sales module — contacts, calls and win/loss — told a rep things that were not true. A failed read rendered as "nothing here yet". A page headed My contacts listed the workspace's accounts. A page headed My calls listed everyone's calls. The win/loss page fetched three outcomes and rendered two.

The reason they survived is the more useful finding: the repo already had a lint rule against exactly this, on these very files, and it could not see the shape the code was written in. The rule now catches the React form of the swallow, no failed read on these pages renders as an empty list, each page's scope claim matches the query it sends, and every number traces to a handle or says it is not established.

A 64 px icon rail cannot hold a text field, and it still does not. What it can do is open one: the filter's own keyboard chord had been silently dead when collapsed, because the input it looked for was never rendered. The command palette is a real page-finder, but the rail is not always the main navigation — under admin it swaps for the admin rail — and "where is the thing in this rail" and "every page in the product" are different questions.

Collapsed, the rail now opens a filter on demand that searches the rail you are looking at. On a phone, where the drawer had no filter at all, the same control is at the top of the drawer.

On a compliance surface the direction of a wrong statement matters. The consent overview said CASL email required opt-in; the send gate requires double opt-in, so the page stated a bar lower than the one enforced. It listed four jurisdictions; the engine evaluates eight, and UK GDPR, PIPEDA, LGPD and PIPL were invisible. Its posture tiles folded expired and unknown consent into pending so the cards would sum cleanly — lapsed consent read as not yet asked.

On the tracking tab, three switches including "Honour Global Privacy Control" and a Save button were local state; nothing was stored, while the endpoint that stores it had existed the whole time. Two header buttons, export audit log and import suppression list, had no handler.

The overview now reads its defaults from the same rules the send gate enforces, lists every jurisdiction the engine evaluates, keeps expired and unknown as their own states, and the tracking switches read and write the real cookie-consent configuration. On the Data module's Today page, an identity-graph tile that printed two string literals now reads its own health.

What voice could do was governed by an allowlist of seven tool names. Anything not on that list was unreachable out loud, however well it worked everywhere else, and adding a capability meant remembering to add its name in a second place. Mostly nobody did.

The allowlist is gone. A tool is now offered by voice when it qualifies on its own properties — it returns quickly enough to hold a conversation, it needs few enough details to ask for out loud, it describes itself well enough to be matched, and it is not a heavyweight generation job. Tools that should never be spoken are excluded by name, with the reason recorded next to the exclusion.

Fifty-two actions are reachable by voice today, counted from the running catalog, up from seven. Generating a competitor battle card is one of them — previously it existed, worked, and simply could not be asked for.

Because eligibility is derived rather than listed, a new tool that qualifies is reachable the day it ships, without anyone remembering a second file.

Three separate ways a spoken conversation used to go wrong, all repaired in this batch.

It cut you off mid-word. The endpointer decided you had stopped talking on timing alone, without reading what had been said, so roughly half of all turn-ends landed inside a word. The agent then answered a sentence you were still in the middle of.

"Yes" was not treated as an answer. Asked a direct question, a bare "yes" was read as a filler noise rather than a reply, and the agent asked again.

A menu it read aloud could not be answered. When it offered three candidates, saying which one you wanted did not select it — the options were spoken but not bindable, so the only way through was to start over.

When deals moved to public identifiers, the card surface kept matching on the old one. Deal cards became undockable, and because "Dismiss all" walked the same set, it stopped clearing anything — a button that looked live and did nothing.

Cards dock again and "Dismiss all" clears again. A card that fails to dock for any other reason now says so instead of vanishing, and a dismissal can be brought back rather than being final.

A sweep of every internal link and call to action found several that could not work.

Twelve pointed at hostnames that do not resolve. An anchor to the customer-stories section never matched anything on the page, so the link scrolled nowhere. And the contact-sales form accepted a submission and told the visitor to expect a reply, without a path that would deliver one.

All are repaired, and a gate now checks internal anchors and links on every change — the anchor case in particular had never been checked by anything.

Longer spoken answers carried a repeating artifact, regular enough to sound like a buzz rather than noise. It was a render quantum repeating: playback opened a new audio device for each batch of phrases within a single answer, and every open re-paid a small startup cost that landed inside the audio.

Playback now opens one device per answer. Long replies are noticeably cleaner.

This is one of two causes, and the other is still open. A thin opening buffer is also being paid once per phrase batch rather than once per answer. Until that lands, a residual artifact can remain on some replies — so this entry claims a reduction, not silence.

A recording row used to be a promise the product could not keep: it showed a

status and a transcript, and there was no way to hear the call.

Now there is a player. It streams the stored audio, draws a waveform you can

scrub, and offers a download. Playback is one authorization decision on the

server, scoped to your tenant, and every read is written to the audit log — so

"who listened to this call" is a question with an answer.

Each row tells the truth about itself. Recordings that carry stored audio

are the ones that offer playback; rows that only ever had a transcript say so

instead of handing you a dead play button. On a workspace seeded with demo

data, most rows are the second kind, and the list now shows that rather than

hiding it.

A separate repair stopped the upload-retention purge from deleting captured

call audio it was never meant to touch.

Every surface that answers a question — Hey Pact, search, the scorecard — used

to reply in prose, with the figures buried mid-sentence and the records named

but not linked. Formatting the model emitted was sometimes printed literally,

asterisks and all.

Answers now put structure first:

• Metric tiles for the numbers, so a figure is a figure and not a clause.
• Record chips for anything Pact named, each one a link to the record.
• An evidence row under the answer, so you can see what it was derived from.
• Markup is rendered, not dumped.

A "no" is now an answer with proof. When there is nothing matching what you

asked, Pact says what it looked at and why the result is empty, instead of

returning a blank panel that reads like a failure.

The spoken scorecard used to be generated in full, then read aloud. The wait

before the first word was the entire composition time, and on a phone that

silence is indistinguishable from a call that has dropped.

It now streams: narration begins as soon as there is a sentence to say and

continues while the rest is written. Two other repairs ride along — a

classifier that was being consulted and then ignored on every request is gone,

and an answer cut short by echo on the line resumes instead of ending there.

On the mobile pipeline board a touch-and-hold armed two different gestures on

two different timers — a drag at 250ms and a detail sheet at 500ms — so the

same finger movement could open a sheet you did not ask for, or start dragging

a card you meant to read.

The two are now separated by intent: **tap to open the deal, press and hold to

pick it up.** The board header, the floating action button's slot, the record

action rail and the inbox chip filters were straightened out in the same pass.

Two independent things were making Pact slower than it should have been:

• A leak in the web tier. Every server-rendered request armed a 30-minute

cleanup timer that outlived the request. Under steady traffic those

accumulated for hours, so the site got heavier the longer it went between

deploys. Server rendering now uses a per-request cache that is released with

the request.

• Uncompressed HTML at the edge. A caching rule let the CDN store and serve

the homepage without compression — roughly half a megabyte of HTML where

75 KB would do. Fixed, and verified on production.

The worst failure mode in a CRM is a panel that shows nothing and means four

different things. "You have no deals at risk" and "we could not reach the

service that computes deals at risk" looked identical, and the second one is

the one you need to know about.

Every data-backed surface now separates the four states and says which one it

is in — including "you do not have access to this", which previously rendered

as absence too.

Two related repairs to how a call sounds:

• No more mid-phrase cutoffs. On a live call, generated text finishes fast but keeps playing out loud for several seconds after. If a caller talked over that tail, the record of what they'd actually heard was sometimes wrong — occasionally chopping the agent's own reply short. The turn-tracking now arms before the reply starts playing, not after, and covers a cancelled-mid-generation turn the same way as one that already finished.
• Your chosen voice is the one that speaks. /settings/voice saved a selection that a lower-level relay setting silently overrode on every inbound call, so the picker looked like it worked but never took effect. It's wired through now — pick a voice, hear that voice.

Calendar and Gmail ingestion ride the same connection row, and any sync failure — even one caused by a momentary hiccup on Google's side — flipped that row to an error state that the recurring sync job then skipped forever. The only way back was reconnecting by hand, which is why "calendar and email are disconnected again" kept coming back. The sync job now gives a failed connection another chance instead of permanently benching it.

The voice agent used to be better at narrating work than doing it. This batch closes that gap:

• Actions execute. Ask it to log a note, create a follow-up task, or move a deal's stage and it performs the write — through the same consent check and audit trail as a write made by hand — then confirms what it did, instead of telling you what it would have done.
• A yes means the thing you said yes to. Accept the agent's offer to look at your high-risk deals and it reads the at-risk feed — those deals, not the whole pipeline.
• It knows when to give up. When the agent is failing a caller — repeated misunderstandings, or the app explicitly asks — it hands the call off to a human instead of looping.
• Voicemail comes back with the next action. Each voicemail is analyzed for what the caller actually needs — a callback, a document, a meeting — and high-confidence next actions are extracted and queued rather than left buried in a transcript.

Three changes to how a call feels:

• Answers start fast. The slow first-response path — routing before speaking — is now covered by an immediate spoken prefix, so the agent's reply begins in roughly a quarter of a second instead of over a second and a half of dead air.
• Delivery follows content. Bad news slows down, lists get list rhythm, numbers are spoken like a person says numbers — prosody is derived from what is being said rather than one flat voice for everything.
• Words, not markup. Display formatting (symbols, emphasis marks, layout characters) is normalized away at the text-to-speech boundary, so the agent can never read "asterisk asterisk" at you again. Voice selection was also consolidated into one canonical resolver, so every surface speaks with the voice you actually picked.

The audit trail grew three properties a security reviewer will actually ask about:

• Forensic context on every event — who acted, from where, through what — captured at write time, so an investigation doesn't have to reconstruct the request after the fact.
• Immutability the database enforces. Audit rows can no longer be updated or deleted by the application at all — the constraint lives in the database, not in code review.
• A live tail. Watch audit events stream in as they happen from the admin audit view, instead of refreshing a filtered list.

Most of this window was repair work driven by call-by-call audits of real conversations. The customer-visible fixes:

On calls

• Booking a meeting now understands spoken times ("Tuesday at three"), escapes a slot-fill that keeps failing instead of re-asking forever, and yields when you change the subject mid-flow.
• Deal counts agree across every voice path — one caller, one scope, whether you ask the simple way or the complex way.
• The agent hears *your* company's name correctly instead of rescuing it into a CRM record's name, and no longer overwrites fields with placeholder values.
• A call's final turn survives an immediate hangup, so the last thing you said still lands in the record.
• Inbound calls no longer risk a slow pickup: the heavy contact lookup was moved off the answer path.

In the app

• On an account page, one failing card now costs you that card — not the whole route. Two crash classes on account and health surfaces are fixed.
• Ten contact endpoints that could 500 on PII reads are repaired.
• The onboarding activation card no longer renders an error for a widget the workspace switched off.

Integrations and storage

• Twilio's connection status now reads the same on every surface — the verifier was fixed and the duplicated status rail removed.
• A misconfigured BYOK storage bucket can no longer fail every file write in the workspace; it fails only the tenant that misconfigured it, with a clear error.

Ask used to be a search box that handed back a list. It now works through a question:

• Multi-hop retrieval — a question that needs two or three lookups to answer gets them. "Which deals in my pipeline have gone quiet since the last QBR?" reads the pipeline, then the activity, then joins them, instead of pattern-matching the sentence against deal names.
• Real citations — every answer links the records it drew from, so you can click straight through and check the work.
• Session memory — the panel keeps the last few turns, so "what about the ones in EMEA?" resolves against the question you just asked.
• Clickable ambiguity — when a name matches more than one record, Ask asks which one you meant and gives you the choices as buttons rather than guessing.
• An empty result is an answer — if there genuinely is no activity to report, Ask says so and records why each lookup came back empty, instead of showing a failure.

Several sharp edges went with it: the panel no longer matches your whole question against deal names as a single LIKE, no longer returns cards with no content in them, and fits inside a 375px viewport.

Open Ask from the top bar on any page.

Compliance work in Pact was a spreadsheet exercise. It is now a console:

• The full controls catalog — all 61 AICPA Trust Services criteria, with the Common Criteria, Availability, Confidentiality, Processing Integrity, and Privacy series each broken out and tracked separately.
• Evidence that collects itself — a set of automated collectors replaced manual evidence gathering for a growing share of controls. Where a control is still manual or still deficient, the console says so rather than showing a green tick it has not earned.
• A real policy library — 17 auditor-grade policies, published, versioned, and acknowledgeable by staff, with acknowledgement state tracked per person.
• An auditor package that downloads — the export produces a control matrix, a remediation plan, and a signed archive. It previously 403'd with "could not generate package"; that is fixed.
• The sub-processor register is populated with the vendors that actually process data, rather than the handful it previously named.
• An honest vendor register — the attestations Pact does *not* yet hold are tracked as open requests rather than quietly omitted, so the gap is visible to you before it is visible to an auditor.
• Usable on a phone — the console, the gap tracker, and the timeline all work at 375px, so you can clear an acknowledgement away from your desk.

Admins: find it under Admin → SOC 2.

Two changes to how support work gets picked up:

• Consolidated AI triage — a new case arrives with one card that shows likely duplicates, the owner who has handled similar cases before, and a suggested category and route. Every suggestion is accept-or-override; nothing is applied to a case without a person agreeing to it.
• An SLA clock that stops for customer-wait — time spent waiting on a customer reply no longer counts against your response target, so the breach numbers reflect work you could actually have done. The clock also honors your configured holiday calendar.
• SLA reporting by owner and category — breach and attainment now break down by who owned the case and what kind of case it was, instead of a single tenant-wide number.
• Deflection before the ticket exists — the customer-side submit form now suggests relevant knowledge-base articles as someone types their problem, so the answerable questions get answered without becoming a case at all.

The triage card also got meaningfully lighter — dropping a heavy popover dependency cut the route's payload after it had grown 16.2%.

Three revenue surfaces got real depth:

• Deal health — each deal now carries a health score, a 30-day drop-risk read, and suggested next-best actions drawn from what actually moved comparable deals. The score shows its inputs, so you can disagree with it.
• Per-field enrichment routing — instead of one vendor per record, each field routes to the vendor that is strongest for that field, with a waterfall fallback when the first choice has nothing. A hard budget stop halts spend at your cap rather than running past it, and you can trigger a specific vendor from the record itself.
• RFP round-trip for sales engineers — export an RFP response, and the answers you wrote are kept as a searchable answer library with reuse tracking, so the next RFP starts from what you have already said. Architecture diagrams generate from the stack you actually recorded.

• Visual workflow builder — /workflows lists your automations, a canvas editor builds them, and each run is recorded so you can see what fired and what it did. Templates cover the common shapes so you are not starting from an empty canvas.
• View switcher across list surfaces — the same records, shown as a List, Cards, a Board, a Calendar, or a Table, switchable per surface and remembered.
• Duplicate management — a cluster review queue groups likely duplicates, merging rewires foreign keys properly rather than orphaning related records, and every merge has a 30-day undo.
• Multi-action swipe trays on mobile — swipe a row in any CRM list for its common actions, or long-press for the full action sheet.

• A calls list worth opening — filters, search across call transcripts rather than just titles, bulk actions, and analytics over the set you have filtered to.
• A call page with context — per-call cost in the header, an AI recap, a waveform you can scrub, and the playbook the call matched.
• Spend dashboard 2.0 — anomaly detection on unusual spend, provider mix so you can see where the money goes, unit economics per call and per seat, a forecast, and a cap simulation that shows what a proposed cap would have done to last month.
• Proactive alerts — spend, coaching, and missed-call alerts, with quiet hours that are actually enforced rather than advisory.
• Mobile parity — the spend table scrolls properly at 375px instead of clipping its own columns.

A pass over the surfaces you look at all day:

• Cards read as surfaces — a defined edge and a lit top edge, so a card is distinguishable from the page behind it instead of reading as a flat square.
• Panel headers stop clipping — a sheet header no longer cuts off its own title. "Vonage" was rendering as "/onage".
• The account header keeps its title — when a record has several actions in the header, the actions no longer squeeze the record name down to nothing.
• A day spine on the record timeline — timeline events group under the day they happened, so a busy record reads as a sequence rather than a wall.
• Create and edit forms — consistent spacing, validation, and keyboard behavior across every create/edit form in the product.
• Record detail chrome — underline tabs, tag and territory chips, consistent padding, and clearance so the floating action button stops covering content.

Work you should not have to notice, but which matters:

• One email safety gate — every outbound email in the product now passes a single decision point before it is sent, and bulk sends go out one gated request per recipient rather than exposing the whole recipient list in a shared header. No email reaches someone who should not receive it because a code path forgot to check.
• Fifteen routes gained authorization guards, seven mutations gained audit records, and an unauthenticated call-diagnostics read was closed.
• One malformed flag row no longer takes down the product — a single bad metadata_json value used to return 500 from every flag-gated route in the app. It is now isolated to the flag that is broken.
• Fixed 500s — Account 360 on every account page, the contact dedupe scan against the encrypted contacts schema, and the tracking/calls signal reads.
• Faster pages — a repaired bundle-size gate cut nine oversized routes down to one and stopped the baseline drifting, and four N+1 query patterns were batched (coaching lists, spaces collaborators, per-contact tracking events, campaign send polling).