Changelog

What changed

Pact Data's profile and vault pages now show your workspace's own numbers — and say plainly when a figure could not be read, instead of showing a zero.

What changed

Fixed a defect where customer-health scores could be computed and stored for accounts that belong to no workspace, under every workspace's identity.

What changed

Health scores and churn predictions now show how old they are. A score nobody has recomputed in months no longer looks like this morning's.

What changed

The join everyone documented as impossible is one hash away

What changed

The bounded wait for a persisted relay turn could not wait where it was called

What changed

A notification names who, what and where — and the link it already carried gets used

What changed

A failed read told a DPO the audit log was clean

What changed

The portfolio verdict was a document nobody could recompute — make it a command, then break it

What changed

The cross-module table was cut off on the right at every window narrower than 1920

What changed

Three pages said 'nothing here yet' when the read failed, the scope was wrong, or the endpoint returned accounts

What changed

The collapsed rail can be searched, and the phone's rail gets a filter at all

What changed

Two surfaces that were telling the operator things that were not true

What changed

Two module homes stop printing numbers nobody read, and the grid stops leaving a hole

An assistant that answers in one confident voice makes you trust the weakest sentence as much as the strongest. Ask Pact no longer does that.

Every element of an answer now carries a provenance tier. A number read straight out of your workspace is marked as measured. A number computed from those is marked as derived. A model's judgement is marked as such. And when a piece of the answer could not be obtained at all, that is its own tier — a labelled gap that names what failed, rather than a zero, a blank, or a plausible-sounding sentence covering the hole.

The answer also arrives differently. It decomposes first: you see the question broken into the parts it will answer, then each part fills in, with live progress and an honest estimate of what is left. The spinner that used to run forever when a step died now resolves into the gap that killed it.

Asking about something your workspace has no row for used to produce a confident answer about nothing. Now the premise is corrected first — "there is no account by that name; here are the three closest" — and then the question is answered against what does exist. Pivots to the adjacent question sit one tap away.

The same ladder is spoken. Ask over the phone on 1-424-PACT-MCP or through Hey Pact and you get the reading first, the gap as an answer rather than as silence, and consent enforced fail-closed on every path.

Underneath it is a catalog, a planner and an executor over a measured cube — exercised against a 151-question breadth corpus with zero refusals.

Passkeys were the sign-in path most likely to leave you stuck with a button that did nothing.

Three separate faults are fixed. Cross-device sign-in — scan the QR code with your phone to sign in on a laptop — had lost its transport hints and its ceremony timeout, so the browser often never offered the option. A credential identifier longer than 32 characters hit a column that could not hold it, and every passkey login turned into a 500 because the failure was caught by code whose own docstring promised it was harmless, leaving the transaction aborted for whatever ran next.

The third is the rule rather than the bug: no control in the sign-in flow is inert now. Every ceremony either completes or tells you exactly what happened — cancelled, timed out, no credential on this device, wrong domain — instead of failing silently and leaving you to guess which.

Issuing a login challenge is a state change, so it writes an audit row. It did not before, which meant the most security-relevant moment in the product was the one with no record of it.

Separately, sign-in stopped sharing its connection pool with everything else. The isolated pool exists so that a busy workspace can never make sign-in slow; collaboration and the two live-update transports were sitting in it and have been moved out. SAML assertion replay protection now survives across processes, so a replayed assertion is rejected by any server that sees it, not only by the one that saw the original.

Every module — Sales, SE, Analytics, Data, Consent and the rest — now opens on a Today page assembled from that module's own declared lifecycle, rather than from a layout copied between them.

The lane was proven on one module first and nine more now declare their own, which is the part that matters for what comes next: a module gets its home by describing its lifecycle, not by someone hand-building another page.

The phone half was a genuine defect, not a polish item. Eight module homes rendered nothing at 390px — the lifecycle lane was a desktop grid with no mobile expression, so the page loaded, occupied the viewport, and showed no content. Both widths are now designed deliberately: at desktop the lane is scanned across, at phone width it is read down, and what earns a row differs between them because the reading differs.

A Home card that is empty and a Home card that could not load are no longer the same picture — the second one now says which read failed.

The Sales module home also stopped inventing a pipeline. It previously rendered plausible-looking rows whenever the API returned anything short of a server error, which included a permission refusal — so a workspace without the module could see a convincing pipeline that was not theirs. It now performs the cross-module read it was always missing, and renders a labelled gap when that read fails.

A zero is an answer. "I could not read this" is a different answer. For a long time Pact rendered the second as the first, across a lot of surfaces at once.

The general fix is a contract: a metric whose read failed renders as a labelled gap naming what failed — never as a number, never as an empty row that looks like "you have none of these".

Where it bit hardest: one broken widget was aborting the transaction it shared with five others, so a single failure made the whole dashboard invent reasons. A swallowed query was reporting 0 open deals against 350. The tenant AI spend line was reading a column that does not exist and showing the result as $0. Cost dimensions with no ledger behind them were rendering as though they had measured zero.

KPI tiles got the same treatment from the other direction: a tile with no honest history now says so, and a flat line drawn from a single point is no longer presented as a trend.

Metrics now declare themselves — what they measure, from where — so that when one of them does report zero, the zero can be trusted. There is a health surface that will not print a number it did not measure.

Lists learned the same manners. A result that was silently cut off now carries a visible banner saying it was cut off, and the entity picker says what its eight rows are eight *of*.

Twenty-five separate repairs, all of them about the same thing: what it is like to be on the other end of the call.

Menus are questions now, not recitations. "First, X. Second, Y. Third, Z" was interrupted by the caller in roughly three quarters of the cases where it was used; "X, Y, or Z?" almost never is. Four renderers were still counting options off and have been converted.

Silence has been removed from the long path. "Got it —" followed by twelve seconds of nothing was the worst version. Pact now says what it is doing rather than that it is still doing it, at every cue, and a briefing starts speaking while it is still being composed instead of after. A question with a constant answer — "top deals" — no longer pays a model to work it out.

Repeating yourself gets a different reply. Saying it again used to get the same sentence back, word for word.

A declined request says which condition declined it. A briefing that will not run names the reason rather than failing into a generic apology, and a request Pact cannot complete no longer promises a callback that was never going to be sent.

An offer Pact makes, it can accept. Several replies ended with an offer that nothing downstream could act on; where two offers appeared in one reply, the answer bound to the wrong one. The layer that makes an offer now records what it offered, and the deal list closes on a question that actually narrows — and can then answer it.

A confirmation left pending no longer swallows the rest of the call.

Pact scopes every query to the workspace that asked, in the application. Five places where that scoping was missing or wrong were found and closed: the accounts list and its count were running without a workspace filter; stage history resolved its company reference across workspaces; an automatic merge could read and overwrite another workspace's row; customer-health had four cross-workspace reads; and pipeline reads were re-bound after the deals migration.

Underneath that, the rule is being moved down into the database itself, so a query that forgets is refused rather than answered. Isolation policies now cover every workspace-scoped table — 783 of 783 — with the workspace identity bound on every transaction rather than on a connection a pooler might hand to someone else, a row with no workspace on it no longer readable by every workspace, and three background jobs that were bypassing the policy on the serving connection routed onto their own.

The switch that makes those policies bind is staged and has not been thrown. It went live once on 14 September and was reverted the same afternoon after it locked every device out for 2 h 20 m; the app therefore still connects as a role the policies do not apply to. We would rather say that than let a policy count be read as a guarantee, and this entry will change on the day it changes.

Separately, an unauthenticated live ticker that could return data across workspaces was deleted rather than fixed. It had no owner and no customer depending on it, and the safest version of that endpoint is the one that does not exist.

Outbound traffic got the same treatment from the other side: SMS, voice, calendar, Slack, webhooks, social posting and CRM write-back now transmit only through the egress guard, so there is one place that decides whether Pact is allowed to talk to the outside world on your behalf.

A perfect transcription can still reach the wrong record, and that was the largest single class of voice failure.

Recognition is now biased toward the name a caller says, rather than the string the CRM stores — "three am" resolving to nothing appeared nine times in the corpus and is now understood as 3M. Being polite was another one: a courteous phrasing wrapped around an account name made the account unreachable.

Thirty ways a rep describes their own work — the vocabulary of the job, not of a customer — were being read as company names and searched for. They are now swept out of account search before it runs. So is the caller's own filler.

Where a name is genuinely ambiguous, the fix was to narrow the ask, not the book: Pact asks a question that distinguishes the candidates instead of quietly picking one or widening the search until something matches. The deal menu was labelling accounts while speaking deal names, which is why it never trimmed correctly.

Two things a voice product must never get wrong: who it is, and who it is talking to.

Disclosure. Pact identifies itself as an AI assistant before it asks anyone a question with legal weight. That was compliant before this batch and sounded like a warranty notice, because the disclaimer was prepended as a separate sentence — "Hi, this is Pact, an AI assistant. Hey Dean, what's up?", two introductions where one is a disclaimer. The clause now rides inside the identification each greeting already made, in Pact's own register, and it is present on every call Pact places, not only on the authenticated ones.

Identity. A recognized caller ID is a hint, not a credential. Pact now steps up to a real check exactly where the caller ID is not enough, rather than trusting it everywhere or challenging everyone.

Writes. A command that was misheard must not execute a write. Confirmation is now by consequence — Pact repeats what it is about to change, not the words it thinks it heard.

Register. On a call Pact was on, it may not describe itself as a person. That had to be enforced rather than requested.

An unknown caller also gets a better first impression rather than a deliberately equal one: the greeting no longer offers two words that reached nothing, and no longer asks for a term that nothing on the other side handles. If you need one, "get me a human" now reaches an escalation hotline — which is off until a workspace configures a number, so it says so rather than pretending to transfer.

What Pact can do out loud is no longer maintained as a list somebody has to remember to update.

Two failure shapes were behind most of the "it just didn't understand me" reports. The first: a tool you can say and cannot run is worse than one you cannot say, because the failure looks exactly like not being understood. Those are now either bound properly or declined with a spoken reason. Binding them also surfaced a mis-mapping that had been shipped and was invisible while the tool was unreachable.

The second: the feature flags that gate voice capabilities could not be read from the table they lived in, so they evaluated against a default rather than against the workspace's actual configuration. They are evaluated now.

Discoverability is on for everyone, honestly — the capability menu used to take 42 seconds to speak, which is the right taxonomy delivered the wrong way. It is now a short menu that leads somewhere, and the number of things you can actually say and have happen went up rather than the number of things it claims.

Follow-ups work across turns: ask Pact to make a battle card and then say "read it to me", and it finds the one it just made. Asking about risk gets a risk answer rather than an account search.

Four separate things were competing for the bottom of a phone screen, and the content lost.

There is now one floating affordance and one notice at phone width, with everything else moved into the flow. Chrome — bars, headers, banners — had grown to about 40% of the screen on the dashboard; it now has a budget, and the budget is enforced rather than reviewed.

The deal board had a touch bug worth naming on its own: a tap was only registered if it was short enough, so a deliberate press read as nothing, and a drag also fired as a swipe. A tap is a tap at any duration now, and a drag is only a drag.

Open a call and four panels used to be blank. All four blanks meant "we found nothing", and none of them were true — the extraction had never run at all.

The post-call pipeline now runs as a pipeline, with a stage ledger, and every empty state on the call record says which empty it is: not started, ran and found nothing, or failed with the reason. Those are three different answers and they were rendering as one.

Two rendering faults went with it. A stored recap containing a placeholder was being displayed as six single-character bullets. The insights card opened on whichever tab came first, which was frequently an empty one, and its chips wrapped onto a second row that pushed the content out of view — it now opens on a tab that has something in it.

Exports keep their promise: the call export contains what its own description says it contains, and the timeline's total is a total rather than the count of the page you are looking at.

The compliance surfaces are the ones where a wrong number is not a cosmetic problem, and several of them were confidently wrong.

The DSAR clock. A request that had been fulfilled 21 days early was displayed as *"Overdue by 107 days"*. The service-level calculation ran against the wrong pair of dates.

The consent preview. The read-only preview looked its subject up by the wrong subject type, so it reported nothing for people who had a full consent history.

The export. A data-subject export could never have completed — six separate bugs, found by the simple expedient of running it rather than reading it.

The audit log. Ninety-six rows claimed a digest had been sent when none ever was. Audit rows are not editable by design; these were corrected through a recorded migration, with the correction itself in the record.

The proof-of-capture text that sits under a consent record was on the wire and never rendered, so the evidence existed and no one could see it. The insight tabs on the same card were left in a state where no panel was active — a 143-pixel empty shell sitting on top of the data it was supposed to show.

Pact had opportunities and it had deals, and different parts of the product read different ones. The forecast read two tables, not one. Customer health read the older. Pipeline read the newer. The numbers disagreed, quietly, for anyone who compared two screens.

Deals is the target, the decision is recorded, and the readers have been moved across a tranche at a time with the value compared on both sides of each move rather than assumed.

Two specific wrong numbers fell out of it. A decorated stage name was hiding a closed deal inside open pipeline. And the forecast bucket named "pipeline" was not the pipeline — it was a different slice with the same label.

The reconciliation that was supposed to prove the two tables agreed was copying zero rows, and the check on it was written so that it could not fail. Both were replaced; the remaining rows without a workspace were assigned where that was provable and refused where it was not, rather than written as null.

Duplicate review is legible at laptop resolution now and shows survivorship — which record won each field, and why. The demo-data purge no longer destroys the source records of a merge.

A sample account used to be a name and a logo. Evaluating anything against it meant imagining the rest.

Seeded data now carries a history: eleven more tables joined the purgeable cohort, so a sample account arrives with the contacts, activity and past that make a pipeline view, a forecast or a call record worth looking at.

The constraint that makes this safe is unchanged and was re-proved rather than assumed: purge still takes nothing but the seeded rows. Every seeded row is marked as seeded, the purge selects on that mark alone, and the test asserts that a workspace's real records survive it untouched.

The contact book behind it was repaired at the same time: every demo contact has a reachable address, contacts link to a real company rather than to a name that happened to match, six duplicate accounts were converged, and the tombstones left by an earlier convergence run were cleaned up. Name-based joins are a debt rather than a mechanism now, and the remaining count says which debt it is.

The signup chain ended in silence in both directions. A request for a workspace notified nobody, and the person who made it heard nothing back.

It notifies now, loudly, and the approver can see what they are approving. The applicant is told — the response that carries the notification was being swallowed, so the email never sent even though everything upstream of it worked.

A newly approved workspace is seeded before its first sign-in, so the first screen has something in it. The fast path had also been skipping the revenue-leader setup entirely, and a seed that failed did so invisibly.

Background work was running behind a single point of failure that nobody had noticed, because the symptom was slowness rather than an error.

One dead webhook endpoint was stalling every background tick. A subscriber that stopped answering held the queue for everything else. It no longer does.

Sequence delivery stopped lying about itself. The drain was marking a message as delivered before it had been sent, so a send that failed afterwards still read as delivered.

Background work has one leader. Scheduled jobs elect a leader at the seam the scheduler already named, rather than relying on there being exactly one worker.

The email digest counts its own failures. It now tracks a run of failed deliveries and records what would unblock them, instead of failing weekly in a way that looked identical to having nothing to send.

Spoken output had two distinct ways of coming out wrong, and one of them was self-inflicted.

Ordering is enforced now. Playback order used to be a property of how the pieces happened to arrive rather than of anything guaranteeing it, and an attempt to improve throughput made it worse — a sentence would play two words, jump to the end, and come back to the middle. That attempt was reverted the same day, and the speech channel is now serialized by construction: each piece is scheduled at a time that can only advance, so two pieces cannot swap.

A clause boundary on a digit is provisional. Pact was ending a phrase at the decimal point, so "$310.1M" was spoken as "$310" and then a fragment. Numbers are now held until it is clear the number has ended.

Hold music no longer sounds haunted. The default is a warm, telephony-safe synth that survives the codec, replacing something that a caller on hold experienced as unsettling rather than neutral.

A deploy landing in the middle of a live call used to end it. From the caller's side that is indistinguishable from Pact hanging up on them, and from ours it left nothing behind to find.

The caller is told now, in the call, rather than being dropped into silence. And the call record carries the reason — a deploy-dropped call says so on the record, not only in a log file nobody reads after the fact.

Underneath, each relay connection has exactly one writer. Six senders were sharing a socket with no lock between them, which is the kind of thing that works until it does not. The single-utterance failure class — a call where the caller says one thing and never hears back — was hunted down to a second inbound connection and a counter that was being incremented into nothing.

The public site was measured on a 320×568 viewport — the smallest phone still in meaningful use — and it did not fit.

The hero's primary call to action sat below the fold by a margin that took several attempts to close honestly: the first two moved it with margins, which a centered grid absorbs, and only the third — padding rather than margins — actually moved it. It clears the fold outright now, and the fold got 36px back on top of that.

The mobile navigation's primary item scrolled to a section that was hidden, so the most prominent control on a phone did nothing.

Display type had no chosen line height on any route. It was inheriting whatever the cascade produced, which is why large headings touched each other at some widths and not others. Three components carried it, not one.

Two smaller honesty repairs went with it: no named reference on the site points at something that does not exist, no bracket is left unfilled, and the outcome statistics on the role pages are sized like the claims they are rather than like measured results.

Radar ranks what deserves your attention. Two things were missing from that: why, and what it could not see.

Every finding now carries the reason it is first — the signal that put it there, not merely a score. A ranking you cannot interrogate is a ranking you have to take on faith, and the first time it is wrong you stop using it.

The second is the more serious one. When a detector failed to run, Radar reported "all caught up" — the same message it shows when it ran everything and found nothing. Those are opposite states. A detector that could not run now says so, by name, and the health of the checks themselves is visible next to their output.

Planning has been the thing that happens in a spreadsheet beside the CRM, and then stops matching it within a fortnight.

Objectives, key results, workstreams and tasks are now first-class: they can be created, measured and worked from the page itself. A key result reads its own measure rather than waiting for someone to type the current number in, and the work that moves it hangs off it directly.

The point is not the artifact. It is that the plan and the pipeline are the same data, so the plan cannot quietly go stale while the numbers move.

A cost surface that shows a number for everything is more dangerous than one that admits a gap, because you plan against it.

The cost-to-serve view now carries three things: the scale economics — what a workspace costs as it grows — the bindability of each spending cap, meaning whether the cap can actually stop the spend it names, and an explicit blind-spot list of the dimensions that have no ledger behind them and therefore cannot be measured at all.

The dimensions that cannot measure render as such rather than as a confident zero, which was the previous behavior and the reason a cap could look enforced while enforcing nothing.

Underneath, a set of metrics that the code appeared to collect were never actually written anywhere. Those are wired up, and the code paths that had never once executed were deleted rather than left to look like coverage.

What voice could do was governed by an allowlist of seven tool names. Anything not on that list was unreachable out loud, however well it worked everywhere else, and adding a capability meant remembering to add its name in a second place. Mostly nobody did.

The allowlist is gone. A tool is now offered by voice when it qualifies on its own properties — it returns quickly enough to hold a conversation, it needs few enough details to ask for out loud, it describes itself well enough to be matched, and it is not a heavyweight generation job. Tools that should never be spoken are excluded by name, with the reason recorded next to the exclusion.

Fifty-two actions are reachable by voice today, counted from the running catalog, up from seven. Generating a competitor battle card is one of them — previously it existed, worked, and simply could not be asked for.

Because eligibility is derived rather than listed, a new tool that qualifies is reachable the day it ships, without anyone remembering a second file.

Three separate ways a spoken conversation used to go wrong, all repaired in this batch.

It cut you off mid-word. The endpointer decided you had stopped talking on timing alone, without reading what had been said, so roughly half of all turn-ends landed inside a word. The agent then answered a sentence you were still in the middle of.

"Yes" was not treated as an answer. Asked a direct question, a bare "yes" was read as a filler noise rather than a reply, and the agent asked again.

A menu it read aloud could not be answered. When it offered three candidates, saying which one you wanted did not select it — the options were spoken but not bindable, so the only way through was to start over.

When deals moved to public identifiers, the card surface kept matching on the old one. Deal cards became undockable, and because "Dismiss all" walked the same set, it stopped clearing anything — a button that looked live and did nothing.

Cards dock again and "Dismiss all" clears again. A card that fails to dock for any other reason now says so instead of vanishing, and a dismissal can be brought back rather than being final.

A sweep of every internal link and call to action found several that could not work.

Twelve pointed at hostnames that do not resolve. An anchor to the customer-stories section never matched anything on the page, so the link scrolled nowhere. And the contact-sales form accepted a submission and told the visitor to expect a reply, without a path that would deliver one.

All are repaired, and a gate now checks internal anchors and links on every change — the anchor case in particular had never been checked by anything.

Longer spoken answers carried a repeating artifact, regular enough to sound like a buzz rather than noise. It was a render quantum repeating: playback opened a new audio device for each batch of phrases within a single answer, and every open re-paid a small startup cost that landed inside the audio.

Playback now opens one device per answer. Long replies are noticeably cleaner.

This is one of two causes, and the other is still open. A thin opening buffer is also being paid once per phrase batch rather than once per answer. Until that lands, a residual artifact can remain on some replies — so this entry claims a reduction, not silence.

A recording row used to be a promise the product could not keep: it showed a

status and a transcript, and there was no way to hear the call.

Now there is a player. It streams the stored audio, draws a waveform you can

scrub, and offers a download. Playback is one authorization decision on the

server, scoped to your tenant, and every read is written to the audit log — so

"who listened to this call" is a question with an answer.

Each row tells the truth about itself. Recordings that carry stored audio

are the ones that offer playback; rows that only ever had a transcript say so

instead of handing you a dead play button. On a workspace seeded with demo

data, most rows are the second kind, and the list now shows that rather than

hiding it.

A separate repair stopped the upload-retention purge from deleting captured

call audio it was never meant to touch.

Every surface that answers a question — Hey Pact, search, the scorecard — used

to reply in prose, with the figures buried mid-sentence and the records named

but not linked. Formatting the model emitted was sometimes printed literally,

asterisks and all.

Answers now put structure first:

• Metric tiles for the numbers, so a figure is a figure and not a clause.
• Record chips for anything Pact named, each one a link to the record.
• An evidence row under the answer, so you can see what it was derived from.
• Markup is rendered, not dumped.

A "no" is now an answer with proof. When there is nothing matching what you

asked, Pact says what it looked at and why the result is empty, instead of

returning a blank panel that reads like a failure.

The spoken scorecard used to be generated in full, then read aloud. The wait

before the first word was the entire composition time, and on a phone that

silence is indistinguishable from a call that has dropped.

It now streams: narration begins as soon as there is a sentence to say and

continues while the rest is written. Two other repairs ride along — a

classifier that was being consulted and then ignored on every request is gone,

and an answer cut short by echo on the line resumes instead of ending there.

On the mobile pipeline board a touch-and-hold armed two different gestures on

two different timers — a drag at 250ms and a detail sheet at 500ms — so the

same finger movement could open a sheet you did not ask for, or start dragging

a card you meant to read.

The two are now separated by intent: **tap to open the deal, press and hold to

pick it up.** The board header, the floating action button's slot, the record

action rail and the inbox chip filters were straightened out in the same pass.

Two independent things were making Pact slower than it should have been:

• A leak in the web tier. Every server-rendered request armed a 30-minute

cleanup timer that outlived the request. Under steady traffic those

accumulated for hours, so the site got heavier the longer it went between

deploys. Server rendering now uses a per-request cache that is released with

the request.

• Uncompressed HTML at the edge. A caching rule let the CDN store and serve

the homepage without compression — roughly half a megabyte of HTML where

75 KB would do. Fixed, and verified on production.

The worst failure mode in a CRM is a panel that shows nothing and means four

different things. "You have no deals at risk" and "we could not reach the

service that computes deals at risk" looked identical, and the second one is

the one you need to know about.

Every data-backed surface now separates the four states and says which one it

is in — including "you do not have access to this", which previously rendered

as absence too.

Two related repairs to how a call sounds:

• No more mid-phrase cutoffs. On a live call, generated text finishes fast but keeps playing out loud for several seconds after. If a caller talked over that tail, the record of what they'd actually heard was sometimes wrong — occasionally chopping the agent's own reply short. The turn-tracking now arms before the reply starts playing, not after, and covers a cancelled-mid-generation turn the same way as one that already finished.
• Your chosen voice is the one that speaks. /settings/voice saved a selection that a lower-level relay setting silently overrode on every inbound call, so the picker looked like it worked but never took effect. It's wired through now — pick a voice, hear that voice.

Calendar and Gmail ingestion ride the same connection row, and any sync failure — even one caused by a momentary hiccup on Google's side — flipped that row to an error state that the recurring sync job then skipped forever. The only way back was reconnecting by hand, which is why "calendar and email are disconnected again" kept coming back. The sync job now gives a failed connection another chance instead of permanently benching it.

The voice agent used to be better at narrating work than doing it. This batch closes that gap:

• Actions execute. Ask it to log a note, create a follow-up task, or move a deal's stage and it performs the write — through the same consent check and audit trail as a write made by hand — then confirms what it did, instead of telling you what it would have done.
• A yes means the thing you said yes to. Accept the agent's offer to look at your high-risk deals and it reads the at-risk feed — those deals, not the whole pipeline.
• It knows when to give up. When the agent is failing a caller — repeated misunderstandings, or the app explicitly asks — it hands the call off to a human instead of looping.
• Voicemail comes back with the next action. Each voicemail is analyzed for what the caller actually needs — a callback, a document, a meeting — and high-confidence next actions are extracted and queued rather than left buried in a transcript.

Three changes to how a call feels:

• Answers start fast. The slow first-response path — routing before speaking — is now covered by an immediate spoken prefix, so the agent's reply begins in roughly a quarter of a second instead of over a second and a half of dead air.
• Delivery follows content. Bad news slows down, lists get list rhythm, numbers are spoken like a person says numbers — prosody is derived from what is being said rather than one flat voice for everything.
• Words, not markup. Display formatting (symbols, emphasis marks, layout characters) is normalized away at the text-to-speech boundary, so the agent can never read "asterisk asterisk" at you again. Voice selection was also consolidated into one canonical resolver, so every surface speaks with the voice you actually picked.

The audit trail grew three properties a security reviewer will actually ask about:

• Forensic context on every event — who acted, from where, through what — captured at write time, so an investigation doesn't have to reconstruct the request after the fact.
• Immutability the database enforces. Audit rows can no longer be updated or deleted by the application at all — the constraint lives in the database, not in code review.
• A live tail. Watch audit events stream in as they happen from the admin audit view, instead of refreshing a filtered list.

Most of this window was repair work driven by call-by-call audits of real conversations. The customer-visible fixes:

On calls

• Booking a meeting now understands spoken times ("Tuesday at three"), escapes a slot-fill that keeps failing instead of re-asking forever, and yields when you change the subject mid-flow.
• Deal counts agree across every voice path — one caller, one scope, whether you ask the simple way or the complex way.
• The agent hears *your* company's name correctly instead of rescuing it into a CRM record's name, and no longer overwrites fields with placeholder values.
• A call's final turn survives an immediate hangup, so the last thing you said still lands in the record.
• Inbound calls no longer risk a slow pickup: the heavy contact lookup was moved off the answer path.

In the app

• On an account page, one failing card now costs you that card — not the whole route. Two crash classes on account and health surfaces are fixed.
• Ten contact endpoints that could 500 on PII reads are repaired.
• The onboarding activation card no longer renders an error for a widget the workspace switched off.

Integrations and storage

• Twilio's connection status now reads the same on every surface — the verifier was fixed and the duplicated status rail removed.
• A misconfigured BYOK storage bucket can no longer fail every file write in the workspace; it fails only the tenant that misconfigured it, with a clear error.

Ask used to be a search box that handed back a list. It now works through a question:

• Multi-hop retrieval — a question that needs two or three lookups to answer gets them. "Which deals in my pipeline have gone quiet since the last QBR?" reads the pipeline, then the activity, then joins them, instead of pattern-matching the sentence against deal names.
• Real citations — every answer links the records it drew from, so you can click straight through and check the work.
• Session memory — the panel keeps the last few turns, so "what about the ones in EMEA?" resolves against the question you just asked.
• Clickable ambiguity — when a name matches more than one record, Ask asks which one you meant and gives you the choices as buttons rather than guessing.
• An empty result is an answer — if there genuinely is no activity to report, Ask says so and records why each lookup came back empty, instead of showing a failure.

Several sharp edges went with it: the panel no longer matches your whole question against deal names as a single LIKE, no longer returns cards with no content in them, and fits inside a 375px viewport.

Open Ask from the top bar on any page.

Compliance work in Pact was a spreadsheet exercise. It is now a console:

• The full controls catalog — all 61 AICPA Trust Services criteria, with the Common Criteria, Availability, Confidentiality, Processing Integrity, and Privacy series each broken out and tracked separately.
• Evidence that collects itself — a set of automated collectors replaced manual evidence gathering for a growing share of controls. Where a control is still manual or still deficient, the console says so rather than showing a green tick it has not earned.
• A real policy library — 17 auditor-grade policies, published, versioned, and acknowledgeable by staff, with acknowledgement state tracked per person.
• An auditor package that downloads — the export produces a control matrix, a remediation plan, and a signed archive. It previously 403'd with "could not generate package"; that is fixed.
• The sub-processor register is populated with the vendors that actually process data, rather than the handful it previously named.
• An honest vendor register — the attestations Pact does *not* yet hold are tracked as open requests rather than quietly omitted, so the gap is visible to you before it is visible to an auditor.
• Usable on a phone — the console, the gap tracker, and the timeline all work at 375px, so you can clear an acknowledgement away from your desk.

Admins: find it under Admin → SOC 2.

Two changes to how support work gets picked up:

• Consolidated AI triage — a new case arrives with one card that shows likely duplicates, the owner who has handled similar cases before, and a suggested category and route. Every suggestion is accept-or-override; nothing is applied to a case without a person agreeing to it.
• An SLA clock that stops for customer-wait — time spent waiting on a customer reply no longer counts against your response target, so the breach numbers reflect work you could actually have done. The clock also honors your configured holiday calendar.
• SLA reporting by owner and category — breach and attainment now break down by who owned the case and what kind of case it was, instead of a single tenant-wide number.
• Deflection before the ticket exists — the customer-side submit form now suggests relevant knowledge-base articles as someone types their problem, so the answerable questions get answered without becoming a case at all.

The triage card also got meaningfully lighter — dropping a heavy popover dependency cut the route's payload after it had grown 16.2%.

Three revenue surfaces got real depth:

• Deal health — each deal now carries a health score, a 30-day drop-risk read, and suggested next-best actions drawn from what actually moved comparable deals. The score shows its inputs, so you can disagree with it.
• Per-field enrichment routing — instead of one vendor per record, each field routes to the vendor that is strongest for that field, with a waterfall fallback when the first choice has nothing. A hard budget stop halts spend at your cap rather than running past it, and you can trigger a specific vendor from the record itself.
• RFP round-trip for sales engineers — export an RFP response, and the answers you wrote are kept as a searchable answer library with reuse tracking, so the next RFP starts from what you have already said. Architecture diagrams generate from the stack you actually recorded.

• Visual workflow builder — /workflows lists your automations, a canvas editor builds them, and each run is recorded so you can see what fired and what it did. Templates cover the common shapes so you are not starting from an empty canvas.
• View switcher across list surfaces — the same records, shown as a List, Cards, a Board, a Calendar, or a Table, switchable per surface and remembered.
• Duplicate management — a cluster review queue groups likely duplicates, merging rewires foreign keys properly rather than orphaning related records, and every merge has a 30-day undo.
• Multi-action swipe trays on mobile — swipe a row in any CRM list for its common actions, or long-press for the full action sheet.

• A calls list worth opening — filters, search across call transcripts rather than just titles, bulk actions, and analytics over the set you have filtered to.
• A call page with context — per-call cost in the header, an AI recap, a waveform you can scrub, and the playbook the call matched.
• Spend dashboard 2.0 — anomaly detection on unusual spend, provider mix so you can see where the money goes, unit economics per call and per seat, a forecast, and a cap simulation that shows what a proposed cap would have done to last month.
• Proactive alerts — spend, coaching, and missed-call alerts, with quiet hours that are actually enforced rather than advisory.
• Mobile parity — the spend table scrolls properly at 375px instead of clipping its own columns.

A pass over the surfaces you look at all day:

• Cards read as surfaces — a defined edge and a lit top edge, so a card is distinguishable from the page behind it instead of reading as a flat square.
• Panel headers stop clipping — a sheet header no longer cuts off its own title. "Vonage" was rendering as "/onage".
• The account header keeps its title — when a record has several actions in the header, the actions no longer squeeze the record name down to nothing.
• A day spine on the record timeline — timeline events group under the day they happened, so a busy record reads as a sequence rather than a wall.
• Create and edit forms — consistent spacing, validation, and keyboard behavior across every create/edit form in the product.
• Record detail chrome — underline tabs, tag and territory chips, consistent padding, and clearance so the floating action button stops covering content.

Work you should not have to notice, but which matters:

• One email safety gate — every outbound email in the product now passes a single decision point before it is sent, and bulk sends go out one gated request per recipient rather than exposing the whole recipient list in a shared header. No email reaches someone who should not receive it because a code path forgot to check.
• Fifteen routes gained authorization guards, seven mutations gained audit records, and an unauthenticated call-diagnostics read was closed.
• One malformed flag row no longer takes down the product — a single bad metadata_json value used to return 500 from every flag-gated route in the app. It is now isolated to the flag that is broken.
• Fixed 500s — Account 360 on every account page, the contact dedupe scan against the encrypted contacts schema, and the tracking/calls signal reads.
• Faster pages — a repaired bundle-size gate cut nine oversized routes down to one and stopped the baseline drifting, and four N+1 query patterns were batched (coaching lists, spaces collaborators, per-contact tracking events, campaign send polling).

The daily-driver screens are now consistent, dense, and fast:

• One shared record layout — Account, Contact, and Deal detail pages were rebuilt on a single shell: a consistent header, tabbed sections, and a right-hand insight rail. The rail is now bounded, so long records stay a normal page instead of stretching three or four screens tall.
• Virtualized lists — /contacts and /deals render as tiled list views that stay smooth at thousands of rows.
• Accounts as a tiled grid — a card grid with compact / comfortable density modes, a filter rail, and saved view presets so you can jump straight to the slice you work from.
• A sharper pipeline board — the kanban view gained per-column WIP limits, average days-in-stage, spring-loaded drag, grouping, and full keyboard navigation.

Open any account, contact, or deal, or switch to the board on your pipeline, to see it.

Reports is now a full build-view-share loop instead of a set of canned charts:

• Build visually — start from an entity (accounts, contacts, opportunities, sequence activity, timeline, or consent), drag in the dimensions you want, and combine filters with nested AND/OR logic.
• View fast — results render in a sortable, virtualized table that stays responsive at thousands of rows, with a chart preview alongside.
• Export for real — download any report as CSV, Excel, or PDF.
• Schedule delivery — set a report to run on a recurring cadence and email itself to the people who need it.
• Share read-only — hand out a signed link to a live report without giving someone a seat.

Find it under Reports in the sidebar.

Everything that needs your attention now lands somewhere sensible:

• Notifications Center 2.0 — the /notifications page groups and filters your notifications, updates live over the existing stream, and drives a numeric badge in the sidebar so you can see what's waiting at a glance.
• A triage Inbox — a new /inbox/triage brings notifications together with call and voice action items in a single feed, each tagged by source, so a morning sweep clears calls, follow-ups, and alerts without hopping between screens.

Open the bell in the top bar, or head to your Inbox.

The dashboard reads like one considered analytics surface now:

• Better charts — velocity, open-rate, top-accounts, and consent charts share a single set of primitives: one tooltip with a title, colored series dots, and exact values.
• Empty states with a next step — a blank chart now shows a matched-shape placeholder and a clear call to action instead of an empty box.
• A real pipeline funnel — the pipeline block is a proper stepped funnel with duplicate stages removed and conversion math clamped so the numbers stay honest.
• Density toggle — switch between compact, comfortable, and spacious to scale chart heights to your screen.
• Reduced-motion aware — chart entrance animations respect the system reduced-motion setting.

It's the first thing you see after signing in.

Moving around Pact is quicker, on desktop and phone:

• ⌘K command palette — search across every entity from one box, preview a result before you open it, press ? for help, and use ⌘⏎ to open a match in a new tab.
• Collapsible sidebar — collapse the desktop sidebar to reclaim width; your choice is remembered per user.
• A navigable Settings hub — Settings is reorganized into a clear hub with a consistent page pattern across its sections.
• Mobile navigation polish — the bottom nav gained haptic feedback and an active-tab pill, and inputs stay visible above the on-screen keyboard instead of being covered by it.

Press ⌘K (or Ctrl+K) anywhere to try the palette.

For admins who need to know exactly what's going on:

• A live activity feed — the Activity page projects a curated slice of your workspace's events into one searchable, filterable timeline: who acted, on what, and when.
• A real audit trail — the feed is backed by the same audited event stream the platform records, so it's a record you can trust, not a best-effort log.
• Impersonation you can account for — admin “view as / impersonate” now writes dual-actor audit records with clear start and stop, closing the compliance gaps around acting on another user's behalf.

Open Activity from the sidebar.

The important fixes from this window:

• Meetings and Calls lists stay up — both stopped 500-ing when a contact record was missing columns the list expected.
• Calling connects on every domain — the softphone now reads CORS_ALLOWED_ORIGINS (not only the older variable), so in-app calling connects on all of a workspace's configured origins.
• Honest failures — a subject-line generation 500, a spin-off queue backlog, and a dead end when voice is turned off were all fixed, and now surface real, referenceable errors instead of failing silently.
• No double-fired commands — Ask Pact no longer runs a command twice when you both speak and click it.
• First admin never locked out — new workspaces create the owner's membership atomically, so provisioning can't leave the first admin without access.

The in-app dialer got a hardening pass so calling stays out of your way:

• Every call, not just the first — the softphone now keeps a persistent connection, so the “first call works, second call hangs” problem is gone.
• No more stuck “Connecting…” — a connect watchdog and clean teardown mean a call that can't go through fails fast and clearly instead of spinning forever.
• Audio on Android — fixed the error that left Android callers with a connected call but no sound, by unlocking audio inside the tap that starts the call.
• Always up to date — installed Pact apps now auto-update on deploy, and the dialer runs a microphone pre-check so a blocked mic tells you exactly what's wrong instead of failing silently mid-call.

This applies wherever your workspace has voice set up. Open the dialer from the bottom-right of the app to place a call.

Day one in Pact used to drop you into a set of empty screens. Now it guides you:

• An activation card on the dashboard — a short checklist of the highest-value first steps, right where you land after signing in.
• Empty states that do something — each blank list explains what belongs there and links straight to the action that fills it, instead of just showing “no data.”
• Load sample data in one click — from any empty state or the activation card, seed a realistic sample workspace so you can click around a full CRM before committing your real data. Clear it whenever you want.
• A first-run tour that lands on real anchors — the guided tour was repaired end-to-end and now covers import, calling, and voice, so it points at things that actually exist.

Sign in to a fresh workspace, or find the activation card on your dashboard.

Getting your data into Pact shouldn't be the hard part of switching. This pass makes import handle the real thing:

• Full corporate exports — the pipeline now ingests wide, multi-object exports (accounts, contacts, contracts and their links) rather than one clean object at a time.
• More resilient to messy files — better handling of the inconsistent columns, encodings, and partial rows that show up in exports from other systems.
• A clearer import screen — the admin import surface was reworked so you can see what mapped, what didn't, and what landed.

Try it under Settings → Admin → Import.

Dozens of everyday interactions got smoother:

• Create as you go — add a new account from any account picker without leaving the form you're in.
• Inline validation + a dirty-guard — forms flag problems as you type and warn before you discard unsaved edits.
• Loading you can trust — lists show skeletons shaped like the real content, and stage changes apply optimistically so the UI keeps up with you.
• Keyboard-first — lists are fully navigable from the keyboard, with a visible focus ring so you always know where you are.
• Honest error toasts — when something fails, you get a clear, recoverable toast instead of a dead end or a raw browser alert.
• Consistent empty states — Reports, Leads, and Journeys now use the same purposeful blank-state pattern as the rest of the app.

The important fixes from this window:

• No owner lockout — sign-in now resolves an account from its email deterministically, closing an edge case where a duplicate workspace row could lock the real owner out of their own workspace.
• Reachable close button on iPhone — the “X” on full-screen mobile sheets was slipping under the Dynamic Island; it now sits inside the safe area on every full-screen surface.
• Schema explorer on phones — the explorer's layout, filter, and lock controls are now reachable on mobile instead of being cut off, anchored to the top of the screen.

You no longer have to dial a number to hear what a voice-native CRM sounds like:

• Live, in the browser — the hero widget talks to a real Pact agent over the public demo endpoint, using a seeded sample workspace so you can ask about deals, accounts, and next steps.
• Guided, not a dead mic — a short scripted walkthrough introduces what to ask, narrates each answer, and signs off gracefully, so the demo works even with the microphone blocked.
• Its own experience on mobile — phones get a tap-first version tuned for portrait, below the hero.

Try it at the top of the homepage, or call the demo line at +1 (424) 722-8627.

Calling is now a first-class surface in the app:

• A dialer — a click-to-call softphone for placing calls without leaving Pact, on desktop and mobile.
• A call log — a feed of recent calls with a detail view for each one, so call history lives next to the records it belongs to.
• A live call canvas — a companion view that follows an in-progress call turn by turn.

This rolls out where a workspace has voice configured; the surfaces degrade cleanly and stay out of the way when calling isn't set up.

A set of backend performance fixes targeting the slowest common path — loading the dashboard:

• Less work per request — per-request logging, metering, and Redis I/O that used to block each API call now run off the event loop.
• Fewer repeated lookups — bearer-token-to-tenant resolution and negative API-key checks are cached instead of hitting the database every request, and the connection pool was enlarged.

Together these removed the redundant per-request database round-trips that were making the dashboard feel sluggish under load.

As Pact has grown, some modules accumulated a lot of pages. Now:

• Type to filter — a search box at the top of each module's nav rail filters that module's pages as you type.
• Scoped, not global — it filters the section you're in, so you stay oriented rather than jumping across the whole app.

It's on in every module rail — no setting to enable.

The demo experience got a real voice upgrade:

• A warmer, more natural voice — the demo line's streaming voice was moved to a higher-quality speech engine.
• A calmer pace — playback was slowed slightly so numbers and names are easier to catch on the first pass.
• No stray markup — pause and emphasis hints are handled internally instead of ever being read aloud.

This is the voice you'll hear on the homepage demo and the demo line today.

The phone homepage is now designed for the device, not squeezed to fit it:

• Built for portrait — sections, spacing, and type were reworked for a narrow screen.
• No wasted space — we removed the empty gaps above the headline and the space that used to be held open for a microphone prompt that wasn't coming.
• A tap-first voice moment — the mobile hero gets its own tap-to-talk demo beat instead of the desktop widget.

Dozens of small rough edges, smoothed:

• Keyboard focus you can see — focus rings on filter chips and interactive controls, so keyboard and screen-reader users can tell where they are.
• Clearer hover feedback — tabs, tooltips, and table rows now respond visibly to the pointer, with an opt-in sticky table header.
• Accessible charts and progress — chart gradients get unique IDs so they render correctly when several charts share a page, and progress bars carry accessible names.
• Toasts, not alerts — failed actions (like a Spaces invite) now surface a toast instead of a jarring browser alert.
• Faster, quieter navigation — the module rail no longer fires a burst of prefetch requests on load.

We started publishing:

• A blog at /blog — a home for product thinking and explainers.
• First up: “What is MCP?” — a plain-language introduction to the Model Context Protocol, the open standard Pact uses to connect the CRM to tools and assistants.

The important fixes from this window:

• Microphone restored app-wide — a permissions policy was blocking the microphone across the whole app; voice input works again.
• Inbound phone line kept up — a couple of database issues that could take the main phone line down (a type mismatch on caller lookup, a reserved word in a query) were fixed.
• Browser dialing unblocked — the security policy now allows the voice signaling the in-app softphone needs to place a call.
• No more accidental lockout — when usage limits are hit, Pact warns instead of walling off the app, and the client no longer retries a hard "limit reached" response in a storm.

Pact Voice is the fastest way into your CRM — your voice, no screen:

• Call the demo line — dial [+1 (424) 722-8627](tel:+14247228627) and start talking. Ask "what are my open deals?", "show me my accounts", "how's my pipeline looking?" and hear a short answer read back.
• Answers come from live workspace data — the agent routes each question to the same in-process MCP tools the app uses, so consent, cost, and audit apply exactly as they do everywhere else. It is not a scripted demo bot.
• Kept short on purpose — replies are capped so a phone call doesn't turn into a monologue.

The public demo line is live now. Turning Voice on for your own workspace is a guided setup step — pick a provider, get a number, set your compliance posture, and place a test call.

Voice can now act, not just answer — every action writes a durable ledger row and a call is capped at five actions:

• Text me the details — Pact sends an SMS to your own number on file through your connected messaging provider, respecting the opt-out list. This and note-taking are the verified-working pair.
• Add a note — "note on Acme that budget approved" logs against the account then and there.
• Email me / book a meeting / transfer me — each is wired to a real handler. When the mail provider or calendar isn't connected, Pact says so plainly instead of pretending; a transfer runs the compliance gate before it dials.
• Guardrails built in — a per-call action cap and a per-action cost ceiling stop an ASR mis-hear from fanning out texts or dials.

A pass over the voice router closed the "every question returns nothing" gap:

• "Opportunities" is a deal — reps say "opportunities" and "opps" far more than "deals". Those phrasings now route to your deals instead of dropping into the generic fallback.
• "My accounts" lists your accounts — "my accounts" / "show me my accounts" / a bare "accounts" now returns your account list rather than answering with segment analytics.
• Named look-ups land — asking for a specific account by name resolves to that record instead of a cold, contextless search.

The keyword router still runs first — it's free and instant. When it can't place an utterance, one small model call takes over instead of dumping to a generic search:

• Paraphrases resolve — "how's my pipeline looking?", "anything hot?", "who's about to close?" map to the right tool plus a filter/sort spec, so you don't have to hit a magic phrase.
• It asks when unsure — below a confidence threshold, Pact asks a short clarifying question rather than guessing wrong.
• It never breaks the call — if no model is configured or the call times out, the turn falls back to the previous behavior. The router is opt-in per tenant and only runs on the fall-through, so the cheap path stays cheap.

The cap is enforced on the server, not trusted to the caller:

• Per-tenant daily cap — a default daily ceiling per workspace, configurable, checked at call start and before each turn.
• A tighter cap on the demo line — the public number is clamped to a low daily budget so a runaway test can't bleed the budget.
• Graceful degradation — when the next turn would cross the cap, Pact says "I've hit your daily cap, let's continue via Pact's dashboard" and ends cleanly, rather than dropping the call or overspending.

The call and the app are two views of the same moment:

• Incoming ring — a routed inbound call fires a push to the assigned user's installed app so it rings and offers to open the call. This is strictly additive: it never changes how the call itself is handled.
• Live companion — open the call and the companion view follows it over a streaming (SSE) connection, with the transcript filling in as the conversation happens.
• Deep-linked — the ring opens straight to that specific call, not a generic inbox.

Voice actions went from "wired" to "runs on the call", and the record surface widened:

• Close a deal — "mark the Acme renewal closed won" updates the opportunity's stage on the call, with a spoken confirmation before the write.
• Create or update a contact or account — "add a contact named Jordan Lee at Acme" or "update Acme's website" writes the record then and there.
• It actually executes — the action executor is now wired into every turn, so a confirmed action is carried out rather than just acknowledged.
• Same guardrails — each call is capped at five actions, every write is confirmed first, and when a provider or calendar isn't connected Pact says so instead of pretending. Every action still writes a durable ledger row.

Voice is Pact's most expensive channel, so it comes with the visibility to run it:

• Every call, listed — see recent calls with duration and per-call cost in the admin console.
• Spend against the cap — today's voice spend and the remaining daily budget, so you know where you stand before the cap kicks in.
• Full transcripts — open any call to read exactly what was asked and answered, alongside the consent and audit trail.

Find it under Settings → Voice in the admin console at /admin/voice-mcp.

The compliance layer under Pact Voice — configured once, enforced on every call:

• Calling mode + TCPA gate — pick the calling posture for your tenant and let Pact refuse outbound attempts that fall outside permitted contact hours, instead of trusting a rep to check the clock.
• Do-not-call lists — maintained per tenant and checked before a number is dialed.
• Sensitive-data redaction — transcripts are scanned for personal, health, and card data and redacted automatically.
• Compliance vault — the unredacted originals are encrypted at rest for teams operating under a BAA, with access recorded on an audit trail.
• Recording consent — playback stays gated on the consent ledger, and state two-party-consent rules are applied from a maintained registry rather than a hand-copied list.

Set it up under /admin/voice-mcp.

Instead of assembling tools call by call, start from a recipe:

• Five starter recipes — SaaS renewal playbook, real-estate cold call, support escalation auto-route, RFP autofill from your won library, and post-call deal update.
• One-step install — a recipe lands in your workspace as an inspectable multi-step chain rather than a black box.
• Preview before you wire anything — steps whose provider isn't connected run as clearly-labeled emulated previews, so you can walk a whole recipe before committing an account.

Bring-your-own-key was spread across a dozen screens; it now has one home — at /admin/integrations:

• 51 providers in one catalog, spanning voice, language models, speech-to-text and text-to-speech, voice agents, messaging, CRM, warehouses, enrichment, and storage.
• One connect sheet — the same flow regardless of which provider you're wiring.
• Preview before you connect — see what a provider would do for you as a labeled emulated preview, so the decision to hand over a key is informed.

• Slack and Teams alerts — a post-call or missed-call summary arrives in the channel you choose, with buttons for View call, Book meeting, Mark won, and Escalate. Each button records who clicked it and opens the matching surface in Pact — the booking screen, the opportunity, the escalation inbox — so the click is a fast route to the work, not a silent state change.
• Mobile — the installed app rings on an incoming routed call and opens the live-call companion (transcript and running cost) while you talk. The audio itself stays on the carrier leg today; the app surfaces the call rather than accepting the audio, so the primary action is Open call. Browser-native answering is a tracked follow-up.
• Hardware handling, a live waveform, and the incoming ring are all in place on the mobile softphone.

Evaluating a feature used to mean wiring an account first. Now it doesn't:

• Full-fidelity previews — provider-backed surfaces render a realistic preview when the provider isn't connected, so you can judge the feature on its merits.
• Provenance you can see — a marker on the value and a banner on the surface state plainly that what you're looking at is emulated, not live. The rule is simple: an emulated value never appears without saying so.
• Real beats emulated, always — connect the provider and live data supersedes the preview.

This is deliberately conservative: it is a preview layer for provider-backed features, not a simulation of your data.

Inbound calls now behave like a phone system, not a single ringing endpoint:

• Routing per phone number — each number gets its own routing rules, so support and sales lines land with the right people.
• Queues with hold music — callers wait in an actual queue rather than hearing a busy tone.
• Press 1 for a callback — a caller can drop out of the queue and keep their place as a callback instead of holding.
• VIP priority — the accounts you flag jump the queue.

• Zero to a verified call — a step-by-step wizard covering provider choice, number, compliance posture, and a test call, with one canonical guide behind it.
• Multi-provider — the wizard works across the supported voice providers rather than assuming one.
• Preview instead of a dead end — if a step's provider isn't connected, it runs as an emulated preview marked with its provenance, so evaluating Pact Voice doesn't require wiring an account first. Previews are labeled as previews everywhere they appear.
• Compliance is part of setup, not an afterthought — the wizard walks you through the calling mode and consent posture before the first call.

• Multi-language transcripts — translate a call transcript using your own translation key, so a team reading in a different language than the customer spoke is no longer stuck.
• Weekly call topics — calls are clustered into topics each week with a trend chart and drill-down, so "what are customers calling about" has a real answer instead of an anecdote.
• Zoho CRM sync — call activity writes back to Zoho and syncs bidirectionally, joining the existing CRM connectors.

• Filter by module — the catalog groups by product area instead of presenting one long list.
• Deep-linkable tool pages — every tool has its own address you can send to a teammate.
• Corrected badges — the read-only / side effects badge was wrong for a set of tools. It now reflects what a tool actually does, which matters: that badge is how you decide whether to let an agent call something. This was a correctness fix, not cosmetics.
• The catalog is also the centerpiece of the homepage now, with a live tool count you can browse without signing in.

• Live diagrams render — the architecture designer's diagram was falling back to raw source; it now draws properly, using a bundled renderer that works under our content-security policy.
• SE team analytics — a dashboard for the solutions function, with real period-over-period deltas rather than placeholder numbers.
• Polish across the module — the RFP drafter, architecture designer, playbook library, win library, and analytics got a sweep: real KPI deltas, your-own-key embeddings for search, a Pact-branded PDF export, and honest empty states that tell you what to do next.

• Twenty role pages — the /for/ set now covers the whole go-to-market team, with dedicated Support, Sales Engineering, Voice, and Customer Marketing pages, grouped under a Solutions menu instead of a flat list.
• Explore first — the calls to action were reworked so you can look around the product before signing up, rather than every path funneling to a form.
• No stranding — a link that takes you into another module now carries a way back, so cross-module navigation doesn't dead-end.
• A feature registry underneath: one source of truth for what a workspace has access to, driving gating, navigation, and discovery consistently instead of each surface guessing.

• The sitewide accent moved to Pact's real indigo (#3A4690), retiring the purple placeholder that had been shipping in its place.
• Applied consistently across the marketing site and the app, along with the wax-seal motif, so the brand reads as one thing rather than two.
• Mobile pipeline views went full-bleed in the same pass.

• Microphone — the softphone was telling reps to grant a microphone permission they had already granted; it now reads the real permission state.
• SE demo pages — a canceled request could poison the page and leave it stuck; navigating quickly between demo pages now works.
• Compliance audit — the voice compliance audit view was querying the wrong columns and returning nothing useful; it now reads the real audit trail.

An outage is only useful if it changes the system. What changed:

• Restart contract — the process now restarts on failure by policy rather than by luck, and the watchdog's shutdown path is bounded so it can't hang on the way out.
• Health checks are back on, with the lag watchdog behind its own startup gate so a slow cold start can't trigger a recycle loop.
• Self-recycle on event-loop lag — if the app stops responding promptly it recycles itself instead of serving a hanging page, with concurrency limits set to what the machine can actually handle.
• An external uptime probe that watches from outside our own infrastructure, so we don't depend on the failing system to tell us it's failing.
• A documented rollback path, plus fleet checks before and after a deploy and a blocking login smoke test, so a bad release is caught and reversed quickly.

The demo environment was also moved to larger machines with a warm minimum, so it stops falling over under burst traffic.

Calling is now a first-class surface, not a bolt-on:

• In-app softphone — place and receive calls in the browser over WebRTC, with numbers auto-provisioned so you can dial on day one.
• Outbound call campaigns — sequenced dialing with voicemail drop and automatic retries, so a call list works itself instead of living on a sticky note.
• Voicemail intelligence — missed voicemails are captured, transcribed with your own transcription key, and come back with a drafted reply you can send or edit.
• Recording, retention, and consent — record calls with per-tenant retention windows and legal hold, and playback is gated on the same consent ledger the rest of Pact enforces.
• Post-call action items — every call can extract its own action items into a review inbox afterward.
• Missed-call auto-triage — an unknown inbound number can auto-create a contact and a follow-up task and drop a card in your inbox, so nothing slips.
• AI voice agents — configure a bot to handle a call flow and rehearse it with a simulated test call before it ever talks to a customer.
• Your provider — connect SignalWire, Plivo, or Vonage, or bring your own SIP trunk, behind one voice interface.

Voicemail lives at /inbox/voicemail; number, agent, recording, and provider settings are under /admin/voice-mcp.

Support is now its own module, not a repurposed CRM view — at /support:

• Unified inbox — email, chat, Slack, WhatsApp, and voice land in one thread per customer, so the conversation follows the person across channels.
• AI ticket triage — incoming tickets are classified, routed to the right queue, and the right people are notified, without a human sorting the pile first.
• Ticket sentiment — a rolling sentiment score per ticket auto-escalates the ones turning sour and floats them onto an at-risk dashboard.
• SLA management — set response and resolution policies, watch live countdowns, get an 80%-of-budget warning before a breach, and read a weekly SLA report.
• Support analytics + CSAT — a completed satisfaction loop: send a survey, collect the score, and see volume, resolution time, and satisfaction trends on one dashboard.
• Knowledge-base suggestions — as an agent drafts a reply, relevant KB articles surface right in the composer; helpfulness votes (anonymous for customers) boost the best articles in search, and the KB stays readable offline.

The pre-sales side of the house gets its own module — at /se:

• RFP drafter — upload an RFP, extract the questions, and get draft answers pulled from your win library, each with a confidence level and citations back to the source.
• Architecture proposal designer — compose a proposal with cost bands and a live Mermaid diagram, then export it to PDF for the customer.
• Demo sandboxes — provision a demo environment from a vertical seed template and share a prospect link, with a lifecycle so stale sandboxes clean themselves up.
• Playbook library — curated playbooks with hybrid search, versioning, and usage analytics, so what works gets reused.
• Win library — extract reusable evidence from won deals (consent-gated), so the next proposal starts from proof, not a blank page.

Enrichment now runs on your terms — at /enrichment:

• Bring your own providers — a provider-adapter framework runs your enrichment sources in a waterfall (fall through to the next source when one comes up empty), with a consent gate on every lookup.
• Budget guardrails — set per-team budgets and choose what happens at the threshold: alert, throttle, or block. See a cost preview before a run and a threshold alert when you're close.
• Live signal detection — define rules that watch for buying signals and fire an action when one lands, so a change in an account becomes a task instead of a missed moment.

Get Pact's data into your warehouse without a fragile export script — at /admin/warehouse:

• Analytics entity registry — pick exactly which entities sync, so you own the shape of what lands downstream.
• Budget auto-pause — the sync pauses itself before it blows a spend budget instead of running up a surprise bill.
• MCP tools — configure and inspect the sync from an AI client over MCP, alongside the admin surface.

• One canonical Edit button now sits on contact, account, lead, case, and campaign detail pages.
• No more guessing whether a field is editable inline or which overflow menu hides the edit action — the affordance is where you expect it.

• The MCP tool sandbox now shows results as type-aware tables and charts, so you can read what a tool returned at a glance.
• Guardrail states — consent-filtered rows, rate-limit and cost signals — render inline instead of hiding in the payload.

• No more prefetch storm — the sidebar was firing hundreds of prefetch requests in the first few seconds after load; links now prefetch on hover, which cut the request burst dramatically and made navigation feel immediate.
• One call for unread counts — the separate badge pollers across the shell were consolidated into a single request and the background polling that piled up behind them was removed.

• Widgets now report the real reason they couldn't load, so a failure is diagnosable instead of a shrug.
• Calendar and seat-cap actions (on /meetings and module assignment) show what went wrong — a full seat pool, a disconnected calendar — instead of a silent no-op.
• The cap nudge banner is guarded against a malformed limits payload, so bad data can't blank the upgrade prompt.

• Module switcher — it no longer vanishes when a fetch fails; it now shows an honest zero-state, a retry, a search box, and a Cmd+Shift+M shortcut, and caches the module list so it stops flickering. A ghost-module bug that shrank owners' and admins' module coverage is also fixed.
• Journeys — an enrollment that reaches a terminal wait step now completes instead of looping indefinitely.
• Seats — seat counts reflect only live users, orphaned seat assignments are purged with a proper cascade, and Pact-internal tenants are exempt from seat caps and metering.
• Postgres 500s — a batch of database-only errors is fixed across case and routing-rule creation, meeting contact resolution, the SE scorecard and /se/today, and module assignment, so the new Support and SE modules behave the same on production as in test.

Internal work you feel as a more durable, steadier platform:

• Object storage — the blob layer moved behind an object-store seam with the writer cut over and a backfill worker, so files and attachments no longer depend on a single machine's disk.
• Steadier web tier — the reliability watchdog was tuned and clamped below the memory cliff it guards, sibling instances are prevented from recycling at the same moment, and both machines stay warm so you don't hit a cold "try again" load.
• Honest cost reporting — the internal cost rollup retired a stale line item and now stamps the source of every figure, so the numbers we run the business on are trustworthy.

The MCP server grew from a read-only window into a working surface:

• Entity write tools — create and update accounts, contacts, and deals, and add notes, from Claude, Cursor, or any MCP client, alongside the existing read tools. The catalog now spans 115 tools. Writes require explicit write:* scopes, run on a tighter rate limit, and the consent gate refuses contact writes targeting suppressed or withdrawn subjects.
• A prompt library and pact:// resources — reusable, parameterized prompts and addressable records, so a client can pull the exact context it needs instead of pasting.
• Per-client MCP-only keys — issue a key that works over MCP and nowhere else, scoped by plan tier, with per-key limits.
• Call audit — every tool call is logged with who, what, and when, visible in admin.
• Tool sandbox + client guides — try any tool with synthetic data before pointing it at real records, and follow per-client setup guides for the popular MCP clients.

Why it matters: your AI assistant stops being a reporter and starts being an operator — under keys, limits, and an audit trail you control.

• One search box, the whole workspace: tasks, notes, logged emails, and custom-object groups now come back from the same query as accounts, contacts, and deals.
• Results stay tenant-scoped and permission-checked per entity type.

Why it matters: "I know it's in here somewhere" now has one answer box instead of four.

• Seven new locales — Arabic, Hebrew, Hindi, Indonesian, Turkish, Polish, and Dutch — bringing the app to 14 languages including English.
• Real right-to-left layouts for Arabic and Hebrew: mirrored navigation, correctly-ordered controls, and RTL-aware components, not just translated strings.
• Locale-aware date, number, and currency formatting extends to every new locale.

Three upgrades to the surfaces sales teams live in:

• Pipeline board controls — collapse the stages you're not working (folded stages stay drop targets, so drag-to-move still works) and pick a card density — comfortable, compact, or spacious. The board remembers both per device.
• Deal detail, two-rail — the deal page now puts activity and detail side by side under an inline header, so updating a deal doesn't mean pogo-sticking between tabs.
• Favorite dashboards — star the boards you check daily and they float to the top of the dashboards hub.

• Desktop — a two-column liquid-glass hero, a problem → solution → proof arc, and an interactive tour of the live product as the centerpiece. Claims on the page are limited to what's actually shipped.
• Mobile — a dedicated six-beat story tree: the scroll dropped from ~34 phone screens to ~13, and the primary calls to action sit in the thumb zone.
• Both trees share one live product demo — touch it, no login.

• Contact reads now resolve feature flags and decryption keys once per request instead of once per row.
• On workspaces with tens of thousands of contacts, the people list went from tens of seconds to under a second.
• The same fix applies to every surface that reads contacts in bulk — lists, search results, and exports.

• Per-widget error states — each dashboard widget renders its own readable error with a retry button; the rest of the page keeps working.
• Section boundaries — an error in one dashboard section is contained there instead of taking down the route.
• The AI "What's happening" summary moved off the request path: the dashboard renders immediately and the summary streams in when ready, instead of blocking or showing "Couldn't generate a summary."

• Empty and loading states across the app now use the same primitives — no more mystery blank panels while data loads.
• Destructive actions (delete, revoke, disconnect) use a proper in-app confirmation dialog with a typed danger zone where it matters — the raw browser confirm() popup is gone.
• Motion polish — hover-lift and focus-ring behavior is consistent everywhere, and toasts arrive top-right with a spring instead of jumping.

• Reports automatically include the error ID, build ID, and timestamp of what you hit, plus your user and workspace identifiers.
• A Copy diagnostics button puts the same bundle on your clipboard for tickets filed elsewhere.
• No more "can you tell us roughly when it happened?" round-trips.

We ship many times a day, and the installed (PWA) app could get caught mid-update:

• The app now detects a stale-build load failure and reloads itself once, automatically — no more error screen where retrying just re-broke the same way.
• Edge caching was tightened so a cached page can no longer reference files a newer deploy removed, and the service worker itself is never cached by the CDN.

If you saw "something didn't work" right after opening the installed app, this was it.

A batch of fixes that make the language switcher behave like it should:

• The picker is hidden on pages that aren't translated yet instead of offering a switch that half-works.
• Your language survives sign-in — it no longer snaps back to English after the post-login navigation.
• The UI flips immediately when you switch; saving the preference happens in the background, so a cold backend can't make the switch look dead.
• Saving your language no longer errors for workspace accounts, and the menu closes on select instead of blocking clicks.

• Schema explorer — the desktop entity diagram is back (the growing schema had tripped a clustering threshold and turned it into thumbnails), mobile gets a legible module grid, and pinch-zoom on iOS no longer crashes the page.
• Real-time notifications — the live notification stream reconnected for all sessions; it had been failing authentication since a recent auth change.
• Offline banner — the "you're offline" banner now confirms connectivity with a real probe before showing, instead of sticking on-screen while you're clearly online.
• Contact detail rail — side panels no longer wrap awkwardly at narrow widths.
• AI status checks — availability probes from dashboards no longer count as AI agent calls, which had made AI features look rate-limited or erroring when they weren't.

• Enrichment lookups now carry explicit tenant scoping at the query layer, closing a class of cross-tenant read risk before it could be reached.
• The migration-safety gate in CI was raised to cover every migration through the current head, so schema changes keep getting checked against the same bar.

Your data is yours, and getting it out is never a paid feature:

• Full export of accounts, contacts, opportunities, activity, sequences, and the consent ledger, with inline attachments and a signed manifest so the archive is verifiable end to end.
• Import a previously-exported archive back into a tenant. The format is versioned (v1.1), and minor version bumps are accepted under a family rule so an export never expires the moment we ship an improvement.
• One-shot download tokens with a short audit window, so a link you hand to your data team can't be replayed later.
• Available on every plan, including Free — data portability is a right, not an add-on.

Why it matters: there's no lock-in tax. You can leave with everything, or move a workspace between environments, whenever you want.

Bring Pact to the tab you're already on:

• Cross-browser (Chrome, Edge, Firefox) on Manifest V3, with a shared polyfill so behavior matches across engines.
• PKCE sign-in — the OAuth flow never exposes a client secret in the extension.
• Cmd+K everywhere — the same command palette you use in the app, on any page.
• Calendar context for the account or contact in view, so you walk into a meeting already briefed.

Why it matters: the CRM meets you where the work happens instead of asking you to switch tabs.

Global by default, not as a bolt-on:

• Six locales — Spanish, French, German, Portuguese, Japanese, and Simplified Chinese — across the app and the marketing pages.
• Locale-aware formatters for dates, numbers, and currency, plus localized system email templates.
• A coverage dashboard at /pact-admin/i18n/coverage with a freshness analyzer, so a stale string shows up as a gap instead of shipping silently in English.

Why it matters: international teams see Pact in their own language, down to how a date or an amount is written.

Everything you need to go from Free to paid without talking to sales:

• Stripe Checkout + Customer Portal — start, change, or cancel a subscription and manage payment methods yourself.
• Reverse trial — new workspaces begin on the full paid experience and settle onto the right plan when the trial ends, so you evaluate the real thing.
• Cap-aware upgrade — when a workspace reaches a plan limit, the upgrade is one click, with the affected limit named plainly and no manufactured urgency.
• Usage metering + a usage dashboard so you can see consumption ahead of any usage-based line item.
• Admin surfaces show a clear "configure Stripe keys" banner and disable checkout CTAs until the keys are in place — no half-wired states.

Why it matters: buying and managing Pact is self-serve and honest, with the limits and prices stated plainly.

The evidence a security reviewer asks for, without a sales call:

• Security log and a bug-bounty page, so the security posture and how to report an issue are public.
• Uptime gates wired into the homepage and PWA, so status is honest and visible.
• Self-serve export from the same surface — see the always-free portability above.
• security.txt (RFC 9116) at the apex for coordinated disclosure.

Why it matters: a prospect's security team can self-serve most of their diligence from one place.

Health that shows its work:

• A held-out evaluation on the churn model, plus deal-lifecycle sentiment folded into the score, on a real scheduler.
• A HealthScoreWidget that frames the raw score as a grade, a severity, a trend, and the per-signal (SHAP) contributions behind it.
• Health and risk cards stacked in the account rail, so "why is this account red" has an answer on the call, not in a notebook.

Why it matters: a CSM can defend a renewal number with the specific signals that moved it.

Two AI surfaces grounded in your own records:

• Natural-language search on more lists — opt in and narrow a list by typing what you want instead of building a query.
• AI deal-room brief — a per-deal summary with the sentiment delta, a competitor rollup, and any decision-maker changes, so you catch a shift before it costs you the deal.

Both cite the records behind their claims and run on the same consent-filtered, cost-attributed loop as the rest of Pact's AI.

More ways in, and more places to work:

• HubSpot + Pipedrive importers with schema discovery, field-history handling, and an editable mapping step — so a switch keeps your structure instead of flattening it.
• Native Discord app with chat actions and deal rooms — turn a channel into a CRM record and advance a deal without leaving the conversation.

Why it matters: moving to Pact is guided, and the team keeps collaborating where it already does.

• Automation gap-fill — event triggers, a delete-record action, and save-as-template, so a workflow you tuned once becomes a starting point for the next.
• Real-time editing safety net — an opt-in conflict-and-undo banner and an offline retry queue, so two people on the same record (or a dropped connection) never silently lose an edit.

• Warm auth surfaces — a gentle mesh-and-grain backdrop on sign-in and sign-up.
• In-app surface atmosphere — an opt-in toggle in Settings → Appearance layers subtle depth beneath the glass surfaces across the app. Off by default, per-browser, and it honors reduced-motion, reduced-transparency, and forced-colors.

The system is CSS-only where it counts and composes with the existing ambient theme, so it stays within the homepage performance budget.

Platform depth for teams building on Pact:

• Per-call API metering with tier enforcement, so usage is measured and limits are honest.
• Webhook replay window — re-deliver events a consumer missed instead of losing them.
• Deep-link association files at the web apex so links open the native apps.
• Vertical custom fields seeded per industry template, so a new workspace starts with the fields its vertical actually uses.

• Activation funnel — a 30-second signup-to-first-action path, so a new user does something real fast.
• Role demos at /for/sales, /for/marketing, and /for/cs — touch the product for your role, no login, with an honest "what's illustrative" footer.
• The pricing page moved to a clean four-tier structure with plain-language limits.

Defense in depth on the thing that matters most — your data staying yours:

• Row-level security hardening across the data plane, with CI gates that fail a PR lacking isolation coverage and Postgres regression tests that assert cross-tenant reads are denied.
• Staff-bypass audit — any support access is logged and visible on an admin surface.
• Step-up policy — sensitive operations can require re-verification. It ships off by default, so nothing changes until an admin opts in.

• Static marketing render + route-aware CSP — public pages serve from the edge cache instead of re-rendering per request.
• Per-route perf budgets with a dashboard at /pact-admin/observability/perf, plus an interaction-responsiveness (INP) gate, so a regression fails CI instead of reaching users.
• Design tokens moved to 11-stop, WCAG-verified color scales with status, elevation, type, and surface tokens — one source of truth for contrast.

A batch of correctness and access fixes:

• Analytics — an error boundary surfaces a readable state instead of an unhandled crash, and an owner leaderboard renders an em-dash for a null win rate instead of a broken cell.
• i18n — the language selector no longer 401s silently in production, and it now works across all marketing pages.
• Marketing — a stale pricing slug that crashed server rendering on the landing page is fixed.
• Accessibility — real headings, skip links, correct input types, and labeled controls on sign-up, sign-in, and the pricing calculator, plus a sweep of route aliases and redirects so old links resolve.

Internal work customers feel as a faster, steadier platform:

• Managed CI runner — the heaviest build/deploy jobs run on a native (no-emulation) runner, so releases are faster and less likely to stall in a queue.
• Runtime self-healing — auto-restart and rollback, circuit breakers, tenant-throttling, and a SHA-rollout gate that verifies a deploy actually reached the running app before calling it done.
• Declarative alerting and additional smoke gates (signup flow, chunk-404, auth non-5xx) so a regression pages on-call before it reaches you.

Your AI assistant can now work your CRM directly — at https://api.pact.place/mcp/:

• Nine tools, live today — query_accounts, query_contacts, query_deals, query_pipeline_health, get_metric_explanation, ask_workspace, list_agents, fire_agent, and read_briefing.
• Consent-native — every record passes the same consent gate the product enforces; suppressed or withdrawn subjects are filtered out and the hidden count is reported back to the agent.
• BYOK-respecting — contact PII is read through your tenant's encryption keys, never around them.
• An audit row per call — tool, client, argument digest, latency, result count, and what the consent gate hid.
• Cost-attributed and rate-limited — AI tool spend lands in your usage ledger and is echoed in the response; per-tenant and per-tool limits stop runaway agent loops.
• Native OAuth — standard discovery metadata plus Dynamic Client Registration, so MCP-native clients connect with no pre-shared keys. Scoped pact_live_* API keys work too.

Setup guides for Claude, Cursor, and custom clients: [/integrations/mcp](/integrations/mcp).

One agent is useful; a chain of them is a process — at /admin/agents → Orchestrator:

• Five prebuilt orchestrations — lead → qualified, stalled-deal rescue, account 360 brief, inbox → action (with branched routing), and inbound funnel health.
• Explicit handoff contracts — each step declares exactly which fields of the previous agent's output it consumes; no prompt-soup between agents.
• Gates and forks — a qualification gate stops the chain on a non-fit; a fork routes an inbox item to support or sales by intent.
• Three new roster agents — account qualification (ICP fit from firmographics + engagement), site optimization (first-party tracking stream), and data validation (a measured SQL profile of your data — null rates, duplicates, out-of-range values — not guesses).
• Yours to edit — installing an orchestration materializes a normal workflow, fully editable in the visual builder. Every step stays consent-gated, cost-attributed, and audit-trailed.

Pact's dashboards can now live anywhere you need them:

• Signed-token embeds — each embed is authorized by a short-lived signed JWT minted by your backend; no Pact accounts for your viewers.
• White-label — your branding on the embedded surface, not ours.
• The guarantees travel with the data — rows are consent-filtered and every view is audited and metered, exactly as in-app.
• Five starter templates and an in-app configurator at /admin/embed to compose, brand, and preview an embed before you ship it.

• Layout shift on the dashboard is gone — the welcome hero and KPI strip no longer jump as data arrives; cumulative layout shift on the home and dashboard routes dropped from 0.62 to 0.02 in production measurement.
• Steadier under load — fixed a server-side memory growth pattern that could slow the web app during long sessions, plus a structural watchdog so it can't recur silently.

Zapier-class automation, native to your CRM data — at /admin/workflows:

• Visual canvas with real branching — conditions actually fork execution paths, not just filter a list.
• 4 trigger types and 12 actions spanning records, sequences, notifications, and webhooks.
• Test-run mode — execute a workflow against a sample record and read every step's outcome before you arm it.
• Versioning — published workflows are immutable snapshots; edit a draft, compare, then promote.
• Consent-gated by construction — any step that touches a contact checks the consent ledger at execution time and records a consent_blocked outcome instead of silently sending. Automation a DPO can sign off on.

Switching CRMs is the moment vendors fear and we optimize for — at /admin/migrate:

• Schema-aware mapping — Salesforce Accounts, Contacts, and Opportunities map to Pact's model with owner assignment and field history preserved.
• Dry-run first — a full reconciliation report (counts, collisions, unmapped fields) before a single record is written.
• Consent state carries over — opt-in/opt-out status lands in the consent ledger with provenance, so day-one sends are as compliant as day-100 sends.
• Deduplication built in — existing records match on identity, not blind inserts.

HubSpot, Pipedrive, Close, and Apollo importers are next on the roadmap; the CSV importer covers them today.

Procurement teams shouldn't have to take a marketing page's word for it — /trust renders from the same compliance registry the product enforces:

• Code-backed status — each framework's state (compliant / in progress / available) comes from the live trust-center payload, not hand-edited copy.
• ISO 27001:2022 program — 93 Annex-A controls tracked in-product with a risk register and Statement of Applicability.
• SIG-Lite auto-fill — generate vendor-questionnaire answers from the same control data.
• DSAR, BAA, and sub-processor documentation linked from one place.

Conversational answers over your own CRM data, built the Pact way:

• Citations on every answer — each claim links back to the source records it was derived from; no unsourced assertions.
• Consent-filtered retrieval — records you're not permitted to use never enter the context window.
• Resistant to prompt injection in your data — retrieved content is treated as data, not instructions.
• Audited — every question, answer, and citation set lands in the audit trail.
• Threads: ask a follow-up and the engine keeps the conversation's context.

The transparent weighted health score now has an ML sibling:

• Churn-risk model with per-signal explanations — every score ships with the contribution of each input signal, so "why did this account turn red" has a real answer.
• Risk gauge on account pages and the CS at-risk view — the explanation renders next to the number, not in a data team's notebook.
• The weighted baseline stays — weights you can see and tune live — and both layers are auditable back to source events.

Two ways to type less and capture more:

• Voice notes — tap the mic on any contact, company, or deal, talk, and Pact transcribes the audio, tidies the filler words, and attaches a clean note to the timeline. Works hands-free in the field on the mobile app.
• Magic Compose — an Apple-Intelligence-style menu on any text field: rewrite, shorten, expand, or change the tone, always in your tenant's brand voice. Changes land as a side-by-side diff you approve or reject — nothing is auto-saved.

Both run on a live model call and respect your AI cost controls.

The nine-agent framework now closes the loop:

• Override-and-learn — every agent suggestion can be accepted, edited, or rejected, and that feedback is stored per tenant so the agent's next pass reflects how your team actually works.
• Agent browser at /agents — a directory of every available agent with a detail page showing recent runs, accept/override/reject rates, and where each agent plugs into your workflow.
• Admins get an aggregate trust view to spot which agents are pulling their weight and which need tuning.

No black boxes: you can always see what an agent proposed and why before it touches a record.

Connect Pact to the rest of your stack without a services engagement:

• Public marketplace at /integrations — browse 73 connectors across CRM, marketing, data, billing, and support, each with what it syncs and how to set it up.
• Connection platform at /admin/integrations/connections — configure each connection's field mapping, sync schedule, and direction, and watch its health from one place.
• Custom webhooks with HMAC-signed delivery for anything not in the catalogue, reusing the same encrypted credential store as the first-party connectors.

The quote-to-cash chain now runs all the way through the books:

• Invoices — a first-class invoice object with a branded PDF, a hosted /p/invoice pay page, and a /sales/invoices board. Pay routes to Stripe; Pact never auto-debits.
• Refunds & chargebacks — issue a refund with contra-revenue and deferred-revenue reversal handled correctly.
• ASC 606 revenue recognition — point-in-time vs. ratable schedules, a CFO month-close, and a balanced double-entry journal CSV your accounting team can import.

Built on the existing CPQ and order lifecycle — order fulfillment is decoupled from financial status, with an append-only order-events ledger.

Every piece is live and tenant-scoped:

• Leads at /leads — a first-class Lead object with lifecycle states, scoring, conversion to account + contact, web-form capture, and round-robin / weighted routing.
• Multi-pipeline at /pipeline — deals are no longer single-pipeline. Define your own pipelines with configurable stages, mandatory entry / exit criteria, gated advance with explicit override audit, per-stage automations, and multi-currency forecast rollup.
• Cases (support tickets) at /cases — case lifecycle with SLAs, auto-routing rules, knowledge-base deflection, and conversion to deal.
• Multi-step approvals at /admin/approvals — branching, multi-step approval processes for discounts, refunds, and any custom object. Builds on the existing single-step framework.
• Team selling, compensation, and sharing rules — multi-rep deal participation with per-rep splits, compensation plans (quota and commission), and record-level sharing layered on top of RBAC.
• Forecast command center at /forecasting — rollup, commit / most-likely / best-case overrides, quota and commission, accuracy tracking, cohort trends, and velocity.
• Visual behavioral segment builder at /segments — live count preview, behavioral predicates (page view, form submit) correlated by contact ID, and campaign A/B tests scored with a real chi-square test (p-value, lift, confidence — tri-state, not a thumbs-up).
• Contact 360 — Relationship Strength — a per-contact score on /accounts/[id] summarizing interaction frequency, recency, and reciprocation across email, calls, meetings, and replies.

Why it matters: the full sales motion now lives in one product — from first lead through close, approvals, support handoff, and forecast — without bolt-on tools.

• E-invoice formats — Peppol BIS 3.0, UBL 2.1, and CFDI 4.0 generation with a validation oracle. Submission to AP and PAC providers is human-gated.
• Automated tax — pluggable engine with Avalara and TaxJar adapters, exemption support, and a flat-rate fallback when no provider is configured.
• Plaid ACH and wire reconciliation — encrypted Plaid token storage, an exact-match wire matcher on reference + amount (auto-reconcile when both match, manual queue otherwise), and buyer-initiated Stripe ACH.
• Polished quote PDF — branded header, repeat thead on long quotes, signature block, accept / draft watermark, page numbering, archivable filename, and a print stylesheet that matches the on-screen surface.

• Today / Coach summary on real Claude — the daily summary on /home is a live model call grounded in your own data, not a templated string. Three features that were misclassified as Hybrid were corrected on the public catalogue at /ai-features, which now shows 37 Real, 22 Hybrid, and 0 Not yet AI.
• Magic Compose brand-voice retrieval — hoisted into a leaf module so the brand-voice path that was silently dead in Magic Compose is now wired end-to-end. Existing Magic Compose flows benefit automatically.
• Campaign Builder agent — drafts a multi-step campaign (subject lines, body, sends, follow-ups) from a brief and lets you optimize before sending. Lives in /admin/automations and on the campaign editor.

Why it matters: every AI feature classified as "Real" actually runs a live model call on every request — and the catalogue is the same registry that powers the in-app honesty badges and a CI gate that blocks any feature shipped as "AI" without a real model call.

• Break-glass admin recovery — a sealed, audit-logged path back into your tenant when SSO is misconfigured, so you can never lock yourself out.
• SAML group → role JIT — first-time sign-in maps SAML groups to Pact roles automatically.
• SP-side request signing — Pact signs its SAML AuthnRequests so identity providers can verify them.
• SCIM enterprise extension — supports employee number, department, manager, and cost center.
• Metadata-URL setup + Workday-tested guide — paste your IdP's metadata URL and Pact configures the rest. End-to-end tested with Workday.
• HMAC-signed webhooks with rotation — every outbound webhook carries a signature; admins can rotate the signing secret with a grace window so subscribers never miss a beat.
• Per-tenant inbound credentials and quota usage — see exactly which integration is sending what, with rate-limit headroom at a glance.

Why it matters: enterprise admins can stand up SSO, SCIM, and signed webhooks without filing a support ticket, and have full visibility into who's authenticated and what's hitting their tenant.

• Contact detail page — grid columns constrained so long identifiers no longer overflow at 320 px; the What's-happening card body no longer goes blank after refresh; $5,000k currency rollup formats correctly.
• Pipeline kanban virtualization — measureElement is wired correctly, so deal cards no longer overlap on tall stages.
• Visual builder drag-from-palette — every visual builder (sequences, journeys, workflows, custom workflows) now accepts a drag without crashing the canvas. Hardened against WebKit, mobile gestures, agent-built canvases, and empty canvases.
• Buyer Lens — pill wrap and a properly responsive 4-column channel grid that no longer cramps at 320 px.
• Pull-to-refresh — gated on scroll position so accidental pulls during reading don't trigger a refetch.

Internal improvements that customers don't see directly but feel as fewer deploy delays and tighter release safety:

• Vercel build headroom — Node heap and twitter-image runtime literals tuned so Vercel builds don't run out of memory partway through.
• Deploy guards — our deploy.sh wrapper refuses to deploy unmerged HEAD and pre-flights every pending Postgres migration before the cutover, so a botched release is caught before any user-visible change.
• ~~Tighter security CI — the auth-hygiene scanner now recognizes require_module as a valid authorization guard, so the gate flags real issues without false positives that previously blocked unrelated PRs.~~

> Correction — 2026-08-23. The struck-through claim above was wrong, and we are leaving it visible rather than deleting it.

>

> require_module is not an authorization guard. It returns early for owner, admin and api callers before any check; it no-ops when a tenant's MODULES_ENABLED flag is false; and it fails open on any flag-store error. That flag has zero rows in production, so in practice it admitted every caller on every tenant.

>

> Teaching the scanner to accept it did not remove false positives — it credited 717 routes as authorization-guarded when they had no authorization check at all, and hid them behind a green summary that has been cited as access-control evidence.

>

> The scanner has since been reworked to classify require_module as fail-open rather than as a guard, and to separate "authenticated" from "authorized" instead of collapsing both into one boolean. Nothing about the product's actual access control changed on 2026-06-04 in either direction; only the reporting was wrong.

A new help layer that sits on top of the existing help bubble:

• Hover, click, or keyboard-focus the ⓘ icon to open a glass tooltip with a short description and a deep link to the relevant docs.
• Ask AI inline — the answer streams back in under two seconds, grounded in the specific control you asked about. If the AI doesn't have enough context, it says so instead of guessing.
• Wired into ten real controls today across API keys, notifications, appearance, and the dashboard, and rolling out to more surfaces every week.
• Touch devices get a full-width bottom sheet so the content never clips a screen edge; the controls without a help entry stay clean — no clutter where there's nothing to say.

Two surfaces, one source of truth:

• Public catalogue at /ai-features — every AI feature Pact ships, classified as REAL (a live model call on every request), HYBRID (model plus deterministic logic), or NOT YET AI, with the provider, surfaces, and what it does. No marketing fluff; the same registry powers the in-app honesty badges and a CI gate that blocks any feature shipped as "AI" without a live model call.
• Admin browser at /admin/ai/features — card grid with classification chips, search, filters, and sorts; a tenant-wide 30-day spend hero; and a cost-optimization panel with concrete recommendations (model efficiency, large-context warnings, low-usage flags, cache health).
• Per-feature detail page with a curated sample input/output, the last 20 anonymized runs, the system-prompt overlay (and whether you've overridden it), where the feature is used in the product, and tailored recommendations for that feature only.

Why it matters: admins can see exactly what every AI feature does, what it costs, and where to tune it — without filing a ticket or reading code.

A new gallery at /dashboards/new with eight category-grouped templates, each composed over real tenant-scoped data and clonable with one tap:

• Sales velocity — weighted pipeline, win rate, time-to-close trend, win rate by source, forecast by category.
• Deal aging — stale deals (>30 days idle), slipped close dates, aging buckets, average age by stage.
• Win rate by source — by source, industry, deal size, rep, and quarter.
• Rep ramp — deals and activity per rep, win rate by rep, tenure.
• Activity intelligence — activity mix, daily volume, per-rep load, sequence engagement.
• Customer success scorecard — health distribution, NPS trend, at-risk accounts, renewals.
• Marketing attribution — first-touch source pipeline and revenue, channel mix, engagement.
• Executive scorecard — ARR, bookings QTD, win rate, coverage, health, NPS plus trends.

Every template inherits the existing dashboard builder's anomaly badges, AI insight summaries, and threshold alerts.

Turns Pact's existing controls — tenant isolation, RBAC, append-only audit log, GDPR deletion, sub-processor management, encryption — into systematic, auditor-ingestible evidence:

• SOC 2 readiness scorecard at /admin/compliance/soc2 — per-criterion coverage across all five SOC 2 Trust Services Criteria, with per-evidence-type freshness.
• Automated nightly evidence collection for six evidence types (access review, audit-log retention, vendor/sub-processor schedule, customer data deletion, encryption posture, processing-integrity controls). Manual evidence (change management, vulnerability scans, backup-restore test, incident response, tenant-isolation CI gate) is surfaced as an honest gap list with collection instructions — never fabricated.
• Tamper-evident bundles — SHA-256 hashes over every artifact's exact bytes, a manifest hash over the sorted set, and an optional HMAC-SHA256 signature. Verifiable end-to-end; any byte-level edit is detected.
• One-click monthly bundle + multi-period auditor package, each with an auditor-facing index PDF.
• Self-serve HIPAA BAA at /admin/compliance/baa — preview the addendum with your covered-entity name pre-filled, download a signed PDF with a matching document hash.

Why it matters: enterprise prospects' auditors can be handed a polished evidence ZIP covering every SOC 2 criterion on the spot — and HIPAA-covered customers can self-serve a BAA without going through legal back-and-forth.

Every seeded record now carries an is_seed_data flag, and the Admin → Data management surface gained a "Seeded emails" card with a DEMO badge and a one-click purge button (with a type-DELETE confirm and an audit-log entry). Use it as part of your go-live checklist to clear the demo emails the workspace shipped with — your real, customer-entered contact emails are never touched.

Two internal improvements that customers don't see directly but feel as a faster, more reliable platform:

• Recurring preview-environment cleanup — a unified engine reaps closed-PR preview databases, branches, and deploys on a nightly schedule and after every release, with safety rails that never touch open PRs, protected branches, or anything labeled keep-preview.
• Daily branch-hygiene sweep — automated audit of long-stale branches with a rolling tracking issue, so engineering work stays focused and the deploy surface stays clean.

Each persona gets its own walk-through of the surfaces it uses daily, anchored to real screens:

• CRM — accounts, contacts, deals, follow-ups, pipeline.
• Customer Success — health, at-risk accounts, playbooks, workload.
• Marketing — sequences, templates, AI steps, forms, attribution.
• Admin — users, integrations, audit log, AI usage, health.

Tours auto-start on first sign-in, resume if you leave mid-way, and can be replayed any time.

• Hybrid search — results are ranked across all entities using keyword and semantic matching together, so the right account, contact, or deal surfaces first.
• Graceful calendar links — calendar URLs redirect sensibly instead of dead-ending in a 404.
• Cross-module navigation — jumping from one module to another preserves your context, with a breadcrumb back to where you came from.

• Inbox triage — sorts and prioritizes incoming messages.
• Deal coach — suggests the next best move on an open deal.
• Customer-success save — flags at-risk accounts and drafts a save play.
• Sequence personalizer — tailors outbound steps to each recipient.

Trigger an agent yourself, or schedule it to run on its own.

• AI features return an honest "not enough information" rather than inventing details when context is thin.
• Untrusted input (record content, email bodies, uploads) is fenced from instructions across every AI surface, hardening against prompt injection.

• SSO required is now enforced at sign-in — closing a real gap where password login still worked when SSO was mandated.
• Audit log retention prunes on a schedule per your policy.
• Downloadable DPA — generate and download your Data Processing Addendum as a PDF.
• Cookie consent banner for public surfaces.
• Sub-processor list is tenant-aware and kept current.

• Three CRITICAL and three HIGH severity fixes shipped, including cross-tenant access paths.
• A new tenant-isolation gate runs in the test suite, so a route that derives a record from a request body instead of the auth context fails the build.

Read-heavy analytics and dashboard queries are served from a separate database replica. The result is faster reports and a snappier app everywhere, because reporting load no longer contends with interactive reads and writes.

The new /developers hub gathers everything you need to build on Pact:

• Quick-starts for API keys, your first call, OAuth, and webhooks.
• Copy-paste SDK examples in curl, TypeScript, and Python.
• An integration cookbook with end-to-end recipes.
• A redesigned webhook console with delivery health and per-subscription stats.

Connect Microsoft 365 calendars through a guided admin wizard — the same step-by-step flow already used for Google, so there's one consistent way to set up either provider.

Calendar OAuth credentials now resolve from your workspace's integration credentials, fixing a dead end where setup pointed at a platform store you couldn't reach.

• Two-way sync with Google and Microsoft calendars.
• Public booking pages at /book/<your-slug> so anyone can grab time with you.
• Round-robin team booking distributes meetings across a team.
• Confirmation emails are sent automatically on booking.

Set the mood of your workspace from Settings → Appearance. Eight ambient themes — Aurora, Ocean, Rainfall, Fireplace, Forest, Snowfall, Cosmos, and Minimal — each tuned for performance, with a mobile override that actually takes effect on phones.

Every ambient theme now has a proper light and dark variant. Previously some were eye-searing in light mode or blank in dark mode; each is now tuned for both.

• A consistent liquid-glass surface system across the app's panels and sheets.
• Fixed a build step that was dropping the -webkit- blur prefix, so iOS Safari 17 and earlier now get true frosted blur rather than a flat fallback.

• Tinted glass cards and a gaussian veil keep content legible over ambient backgrounds.
• The floating action buttons (Help and AI) are now coordinated into one stack instead of colliding.

Inputs no longer steal focus on page load on touch devices, so the keyboard stays down until you actually tap a field. The command palette still opens the keyboard, because there you asked for it.

• Dashboards animate on load — staggered cards, count-up metrics, an anomaly pulse, and a fade-in for insights.
• New workspaces get pre-populated demo dashboards so the product looks alive on day one.
• Admins can wipe demo data from Admin → Data management whenever they like.

• Lead routing assigns inbound leads to the right rep.
• Click-to-call and a power dialer for working a list fast.
• Threaded SMS keeps text conversations in one place.
• AI call transcripts capture and summarize calls.
• A mobile dialer for selling on the go.

/admin/ai/inventory

A sortable, color-coded table of all 32 audited AI features Pact ships. For each feature: the feature ID, display name, classification (REAL 14 · HYBRID 17 · NOT YET AI 1), provider, endpoint, and the UI surfaces it appears on. The same registry powers the public "Powered by Claude" honesty badges and a CI gate that fails any PR which lets a feature ship as "AI" without a live model call.

/admin/ai/cost-breakdown

Per-feature AI spend with a nested per-user drill-down. Filter by user and by time window — last 1, 7, 30, 90 days, or all-time. The view reads the raw AI usage ledger directly, so feature totals reconcile exactly with their per-user rows; no rounding, no double counting.

Why it matters: admins can answer two questions on the spot — *"which of my users is driving AI cost?"* and *"how real is each of the AI features we're paying for?"* Both pages are admin-only and recover work from two earlier chips that died mid-merge.

What's now in admin

This release closes the last small gaps in three enterprise controls that already shipped most of their functionality earlier in the quarter:

• Audit log at /admin/audit-log and /admin/security/audit-log — searchable, cursor-paginated, with before/after diffs on edited rows, source IP, and CSV / JSONL / XLSX export. A watch subscription will notify you when a row matching your filter lands.
• GDPR self-service export — your end users can request a copy of their data from /v1/me/privacy/export; admins manage requests at /admin/privacy. Each export is delivered as a signed-URL ZIP. Deletions carry a 30-day grace period with an email cancellation token, so a tap of a wrong button doesn't permanently lose someone's data.
• Rate-limit visibility at /admin/security/rate-limits — per-tenant policies, per-API-key sliding-window counters, and the choice of block, log_only, or throttle mode per route, with sampled audit events. Plan-tier defaults are pre-loaded.

Why it matters: customers on enterprise plans now have one admin surface that answers *"who did what?"*, *"can my users get their data?"*, and *"what's hitting my API right now?"* — without needing to file a support ticket.

What changed

A new admin surface — /admin/forms — replaces the old "embed this iframe and pray" workflow.

• Drag-and-drop builder — every field type you'd expect (text, email, phone, dropdown, radio, multi-select, consent checkbox, hidden tracking fields) drags onto a live preview. Reorder, duplicate, or delete with a single click.
• Custom-field mapping — fields you've defined under Admin → Custom fields show up directly in the builder. A new lead-capture field can be wired into the form, mapped to the contact column, and live within the same minute.
• Starter templates — common shapes (Contact us, Demo request, Newsletter signup, Event RSVP, Beta access) come pre-built so you don't draw from a blank page.
• Hosted form sites — every form gets a public URL on pact.place, mobile-first, your branding, no iframe required. Embed it as a link, drop it in a marketing email, or share it on social.

Why it matters

Forms are where customers tell you they want to talk to you. Until this PR, you needed an engineer to ship a form change. Now any marketer can build, publish, and edit a form without leaving Pact — and every submission lands as a contact with consent recorded, so the marketing engine can take it from there.

What changed

The Pact Internal Ops console (/pact-admin, gated to is_pact_staff) was a feature-complete but rough surface. This change makes it usable on the phone and honest in its empty states.

• Tenants page (/pact-admin/tenants) — switched from a too-wide table to a mobile-first card layout. Each tenant card shows the things ops actually scans for (plan, status, last activity, support flag) without horizontal scrolling at 375px.
• Visible actions — "Impersonate", "Suspend", and "Open billing" used to hide behind a triple-dot menu that nobody discovered. Primary actions are now buttons; the rare ones stay in the menu.
• Meaningful empty states — Trials, Backups, and Health used to render a blank panel when the underlying list was empty. Each now says what the panel is for and how to add something to it.
• Relative-time fix — the "Last active 2 hours ago" string was misreading the timestamp on /pact-admin/tenants and /pact-admin/trials, making every row look stale. The shared fmtRelative / formatRelative helper has been fixed and the call sites unified.

Why it matters

The Internal Ops console is the surface our team reaches for during an incident — usually from a phone, away from a desk. A console that requires a laptop is a console that nobody uses.

What changed

The dashboard now follows a layout owned by you, not Pact.

• Editor at `/admin/page-layouts` — pick the page, pick the scope (default, role, group, user), drag the blocks into the order you want, then save.
• Cascading scopes — when Pact renders the dashboard it walks user > group > role > tenant > default and uses the first layout it finds. Power users can override the org-wide default for themselves; everyone else inherits the layout admins set for them.
• Graceful fallback — if your custom layout points at a block that no longer ships (e.g. a removed module), the renderer silently falls back to the next layer instead of throwing.
• Audit log — every layout change is recorded with who, when, and what changed. Roll back from the audit trail without losing other in-flight edits.

What's editable today

Dashboard v1 is the first page on the cascade. More pages (account detail, pipeline, inbox) will follow as we extend the block registry. The contract for adding a new editable page is one entry in web/src/lib/page-layouts/registry.tsx.

Why it matters

Sales leaders, customer-success leads, and product marketers each want a different dashboard. Until now they all looked at the same one and complained. Page layouts ship a real answer instead of "we'll add a toggle eventually."

What happened on 2026-05-28

Our Upstash Redis instance hit its monthly request quota at 03:34 UTC. Every Redis command started returning a quota error. The rate-limit dependency propagated that error to FastAPI — which meant every authenticated request, including /v1/auth/login, returned an HTTP 500. Users were locked out of the app for about fifteen minutes until we switched the counter to an in-memory backend.

Fail-open rate limiting

The rate-limit code now wraps every backend call in a guard. If the counter backend errors for any reason — quota, network, missing instance — the request is allowed through (rather than 500-ing), and a degraded-counter metric increments. A WARN line is logged with the error class, count, and route; Sentry tags the request rate_limit.degraded=true. The next time the counter is unhealthy, on-call gets a notification at the alarm threshold, not an outage at the quota.

Normal behavior is unchanged: when Redis is healthy, no warning fires and the counter stays at zero. When the backend genuinely denies a request, callers still get an honest 429.

Loud errors on the API reference

During the outage, the staff and authenticated tier tabs on /api-reference showed an infinite loading spinner instead of an error, because the spec-fetch effect had no timeout or error UI. The fix:

• 15-second timeout on the fetch, then a structured error state.
• Four error kinds — timeout, auth, network, http — each with the right call to action and a "Try again" button that re-runs the fetch without a page refresh.
• 401 / 403 prompts you to re-authenticate instead of looking like the docs are broken.

Why it matters: the next time a downstream dependency hiccups, auth stays up and the docs don't lie about it. A full postmortem lives at docs/incidents/2026-05-28-auth-outage.md.

What changed

/admin/schema-explorer is a new interactive map of the entire Pact data model.

• Auto-layout ERD — every ORM table renders as a card, every foreign key as an edge. The graph (185 nodes, 241 edges in the current snapshot) is computed server-side from Base.metadata.tables and served by GET /v1/admin/system/schema-graph.
• Side drawer per table — click a node to see its columns, their types, nullability, and the foreign keys leaving and entering the table.
• Tier filtering — toggle the tier chips to focus on just the public surface, the authenticated tier, or the staff/internal tables. Makes it tractable to answer "what does a customer actually see?" in one screen.
• Mobile pinch-zoom — the canvas pans and zooms on touch, so on-call engineers can reason about the model from a phone during an incident.

Why it matters

Until now the schema lived in models/*.py and a couple of out-of-date diagrams. Onboarding engineers and customer-facing teams now have a single, always-current ground truth for "what data does Pact actually store, and how is it connected."

What changed

/admin/schema-explorer now ships a unified intelligent toolbar in place of the previous corner-button grid.

• One pill, every control — search (with ranked dropdown), layout (Tree / Force / Grid), filter (tier + multi-select modules with count badges), minimap toggle, zoom cluster, saved views, and export (PNG / SVG / Mermaid / JSON) all sit in a single ≤56 px pill on desktop.
• Search dropdown — fuzzy matcher ranks exact > prefix > fuzzy > column matches, surfaces the module dot and column count next to each hit, and arrow-keys + Enter let you jump-to-node without ever touching the mouse.
• Saved views — name a filter + layout combo ("Sales schema", "Internal admin") and recall it with one click; per-tenant in localStorage with URL deep-linking for shareable views.
• Color-coded modules + edges — each module group gets a stable hue from a deterministic palette so CRM / Marketing / Integrations are visually distinct, and edges color by relation kind (FK = blue, M2M = purple, soft-link = grey).
• PII badge — node cards flag tables whose columns name-match common PII (email, phone, SSN, address) so compliance triage is one glance away.
• Mobile bottom-sheet — the toolbar collapses to a thin bottom pill above the iOS safe-area; tap to expand the full controls in a Sheet that auto-hides the minimap so the controls have room.
• Pinned nodes — long-press / right-click a node to pin it; pinned tables stay visible even when filters would otherwise hide them.
• Visited-node breadcrumb — top-left chip remembers the last three tables you opened so a "where did I come from?" tap is one click.

Why it matters

The corner-grid toolbar from PR #947 was functional but cramped — six controls fighting for space, no search dropdown, no module multi-select, no saved views, no edge color cues. The polish pass aligns the surface with Linear's graph view and Hex lineage — tight on desktop, native on mobile, and intelligent enough that "find a table" or "save my Sales view" is one obvious gesture instead of a workflow.

Public /status

The new /status page shows, for everyone, with no sign-in required:

• An overall status banner — operational, degraded, or major outage.
• Seven component health rows (API, Web app, Auth, Marketing engine, Sequence engine, Webhooks, Background workers), each with a 90-day uptime sparkline.
• A live list of active incidents and the rolling 90-day incident history.
• A one-field email subscription, plus an RSS feed for IT or status-monitoring tools.

A background health probe runs every minute, records a row per component, and feeds the sparklines without sitting on a shared web connection.

Admin /admin/status

Pact admins and owners get an incident-management console at /admin/status:

• Report a new incident — name, impact, affected components, opening update.
• Post updates as the incident progresses; mark it resolved when it's over.
• Every mutation writes an audit log entry, and the page is gated by the same role checks the rest of /admin uses.

Why it matters: customers can stop pinging support to ask "is it just me?" — they can see the truth on /status. And the next incident gets a clean public timeline instead of a Slack thread no one outside Pact can read.

One place for the API surface

We had three different ways to browse the API — anonymous /docs/api, an authenticated /dev page with a staff toggle, and a staff-only /internal-docs/api. Customers had no idea which was which.

The new `/api-reference` page lives inside the signed-in shell, replaces all three, and:

• Detects the highest tier your role is cleared for from your session and renders that by default.
• Shows a pill toggle for Public / Authenticated / Pact staff. Pills you can't access stay visible but disabled, with a lock icon and a tooltip explaining what would unlock them — so customers can see that a higher tier exists without being able to peek.
• Honors a ?tier= URL parameter for deep-linking, silently clamped to what your role is allowed to see.
• Is wired into the existing Developer nav group: API Reference, API keys, Webhooks.

The old /dev and /internal-docs paths now redirect to the unified surface. The authoritative gate is still server-side: even if someone fabricates the tier param, the OpenAPI proxy returns 401/403 unless the caller is actually cleared for that tier.

Why it matters: discoverability. The API reference is now reachable from the in-app sidebar like every other Pact surface, and it always opens at the right depth of detail for who's looking at it.

You should know what's actually AI

Three label variants, driven by a single feature registry on the backend:

• Powered by Claude (green) — always calls Claude; errors loudly if the model isn't configured.
• Hybrid: Claude + rules (blue) — calls Claude when configured, falls back to rule-based logic otherwise.
• Not yet AI (red) — surfaces marketed as AI that don't yet make a model call. We're calling that out as honesty debt instead of hiding it.

Each badge has a tooltip with the provider and endpoint, plus a link to "How AI works in Pact" for the longer explanation.

Why it matters: when a screen says "AI", you can now confirm — without reading a docs page — whether that's a real model call or a smart-looking heuristic. No AI feature can over-claim how real it is, because the badge is generated from the same registry the backend uses to enforce live model calls.

Two blank-panel bugs, one solved surface

The /docs/api reference is rendered by Redoc inside a CSP-strict iframe. Two bugs were making it disappear:

1. Cross-origin spec fetch. The page tried to load its OpenAPI spec from app.pact.place while sitting on www.pact.place. The strict connect-src 'self' blocked the request and Redoc rendered an empty pane.

2. Stale Content Security Policy nonce on client-side navigation. When you reached /docs/api via an in-app link (rather than a hard refresh), the iframe inherited a CSP nonce minted at the parent's original load — different from the one stamped on the freshly rendered Redoc script. The script was blocked and the panel went blank until you hit refresh.

What changed

• The OpenAPI spec is now proxied same-origin from /api/openapi-public, so the fetch is matched by connect-src 'self' and triggers no CORS preflight.
• The Redoc iframe now lives at /docs/api/redoc, a dedicated route that mints a fresh per-request nonce on every load — hard refresh and SPA navigation alike.

Why it matters: the API reference is now load-stable. You can click into it from the docs sidebar, refresh, or open it cold from a bookmark — it renders every time, no white pages.

What was happening

When a tenant didn't yet have enough sends or audience signal, the API correctly returned an empty body — and two shared layout components, the module-permissions provider and the "viewing as" header, tried to read array properties off that empty object. The exception bubbled into a render crash that looked like an outage on the Personalize and Send-time windows surfaces.

What changed

Both components now treat an empty payload as "no data yet" instead of dereferencing into it. The genuinely empty states the marketing surfaces already shipped (No audience yet, Add more sends before we can recommend a window) now render cleanly instead of being masked by a runtime error.

Why it matters: new tenants and any segment lacking signal will see the intended empty state from now on, not a blank screen. Existing tenants with data are unaffected.

The combined symptom

Reported as: *"tapping a segment in the iOS PWA logs me out."* It was two separate bugs stacked together.

Bug 1 — dead in-app link

The segments list linked each row to /segments/[id] — a route that never existed. Tapping a segment landed on a 404. (The correct path is /marketing/segments/[id].) Every segment row now links to the right place.

Bug 2 — 404 looked like a logout

There was no dedicated "not found" page inside the signed-in shell. Any 404 fell through to the root, marketing-shell "not found" — which has no sidebar, no top bar, and a "Home" button pointing at the signed-out landing page. The session was never actually cleared, but the chrome vanished, so it read as "I just got logged out."

A new not-found page now lives inside the signed-in shell. A 404 keeps the sidebar, top bar, and your session visible, and shows a friendly back-to-dashboard link instead of dumping you at marketing.

Why it matters: in the installed PWA, the navigation feels coherent again. A typo in a URL won't masquerade as a session expiry. End-to-end tests for both the segment-builder and journey-builder paths landed alongside the fix so this regression doesn't recur.

/login: actually centered now

The sign-in form used min-h-screen (which resolves to 100vh) for vertical centering. On mobile, 100vh is the height with the address bar hidden — so when the URL bar is showing, a "centered" card sits noticeably below the visible middle of the screen, and its bottom can clip off-screen. Swapped to 100dvh (dynamic viewport height), which tracks the current visible viewport and re-centers as the URL bar shows or hides. Verified on a Pixel 7 (Chromium) and an iPhone 14 Pro (WebKit) emulator.

Landing page: Sign in is now discoverable

In the installed iOS PWA, the marketing landing's "Sign in" was rendered as a faint ghost link, crammed against the system status icons because the header had no safe-area inset. Two changes:

• The header now respects the device's top safe area, so the logo and the Sign in button clear the notch and Dynamic Island.
• "Sign in" is now a solid primary button — high contrast, clearly tappable, harder to lose against the status bar.

Why it matters: if someone has the PWA installed and lands on the marketing page, getting back into the app is now an obvious one-tap action. And the sign-in form itself is correctly positioned the first time on every device profile we tested.

Why this matters

Until this week, the auto-generated FastAPI spec was served anonymously and exposed every internal route — admin, impersonation, replay-cost — alongside the genuinely public endpoints. The MDX guides on /docs had the same problem: a single sidebar listed staff-only Self-hosting pages next to the public quickstart.

This release closes that gap end to end. Every API route and every docs page is now classified into one of three tiers:

• Public — what anyone on the internet can see.
• Authenticated — what a signed-in customer of your tier sees.
• Pact staff — internal surfaces, only visible to Pact employees.

What you'll notice

• The full /openapi.json and /docs//redoc endpoints on the API origin are gone. Three filtered specs replace them: /api/openapi-public, /api/openapi-authenticated, /api/openapi-staff.
• /docs only renders public articles to anonymous visitors. Signing in unlocks the authenticated tier; staff additionally see the Administration section.
• Search is tier-aware — anonymous search never returns titles or excerpts from gated pages.
• A CI guard blocks any PR that would publish a staff or authenticated MDX snippet through a public surface.

For customers building integrations: if a route disappeared from your reference, it was never meant to be public. Use the in-app API Reference (/api-reference) to see the routes your role actually has access to.

One fix, two symptoms

The top navigation bar handled the device "safe area" (the strip behind the notch, Dynamic Island, and status bar) inconsistently across layouts. That produced two opposite problems on phones:

• On iPhone, the docs header sat *under* the status bar, so the "Menu" label was partly hidden behind the clock.
• On Android, the installed app reserved iOS-only spacing it never needed, leaving a large white gutter above the icon bar.

Both are now resolved with a single rule applied to every sticky top bar — the in-app bar and the docs header alike. The safe-area reservation only kicks in on Apple touch devices that actually need it, so iPhone and iPad PWAs get the right padding while Android and desktop are left untouched.

Why it matters: if you use Pact installed to your home screen, the top bar now lines up correctly on every device — nothing clipped behind the status bar on iOS, no wasted space on Android.

Real AI, or nothing

Two marketing surfaces used to show stand-in content: Personalization was a "ships next" placeholder, and Send-time windows quietly fell back to a hardcoded "9:30–11am Tue/Wed/Thu" when a segment didn't have much send history. Both are now wired to the same production AI optimizers the rest of Pact uses.

Personalization

Enter a base subject line and Claude rewrites it for each audience segment's dominant role and industry — the exact optimizer that already runs inside journeys. Each suggestion is generated live, and segments that don't change are clearly marked "No change" rather than padded with invented variants.

Send-time windows

Every segment is now routed through the real send-time optimizer (engagement history → tenant default → AI inference). Recommendations are labeled Engagement-backed or AI-inferred so you can see where each window came from. Applying a window rewrites the hour-of-day on every scheduled campaign for that segment.

Honest empty states

When a segment lacks the signal to ground a recommendation — no audience yet, or fewer than 100 delivered emails — you'll see a clear "add more data" prompt instead of a confident-looking number that isn't real.

Why it matters: you can trust what these screens tell you. Every subject line and send-time window is now produced by the same AI that powers the rest of your workspace, and when the data isn't there yet, Pact says so plainly instead of guessing.

AI agents

The Ask AI panel (⌘K → "Ask AI", or the ✨ button in the top bar) now supports agentic tasks that go beyond simple Q&A.

Try asking:

• *"Research Acme Corp and summarize their recent news"* — pulls public data and returns a brief
• *"Draft a follow-up email for my last call with Jordan Smith"* — uses call notes and contact history
• *"Which accounts in my book are most likely to churn?"* — scores your pipeline using engagement signals

How it works:

Agents run in the background and stream results token by token. You can keep working while they run. Results are copied to the clipboard or inserted into the editor.

All agent activity is logged in Activity → AI for audit purposes.

Bulk operations

List views now support row-level multi-select. Use the checkbox in the table header to select all visible rows, or click individual rows to build a selection.

Available bulk actions:

• Tag — apply one or more tags to all selected records
• Add to sequence — enroll the selection into any active sequence
• Update field — set owner, status, lifecycle stage, or any custom field
• Export — download as CSV in the background; a toast links to the file when ready
• Delete — moves records to the trash (restoreable for 30 days)

Actions run server-side in batches of 100. A progress banner keeps you updated.

Public REST API

Your Pact account now has a stable public REST API, secured with per-tenant API keys.

Get started:

1. Go to Settings → Integrations → API Keys

2. Generate a key and store it securely (shown only once)

3. Pass Authorization: Bearer <key> on every request

Full reference docs at /docs/api. The same OpenAPI spec powers the built-in API explorer.

What's available

• Accounts and contacts — read, create, patch
• Sequences — list, trigger, pause
• Segments and tags — read
• Webhook events for real-time push

Rate limit: 1 000 req/min per key. Raise limits from the API Keys page.

What shipped

Plan picker & checkout (/billing/upgrade)

Choose from Starter, Pro, or Enterprise tiers. Clicking "Start Starter" or "Start Pro" opens a Stripe-hosted checkout session and returns you to the billing admin page on success. Enterprise routes to the sales team.

Stripe Customer Portal (/billing/portal)

Tenants can now update their card, download invoices, or cancel their subscription directly from the Pact billing admin page. Clicking "Manage billing" launches the Stripe Customer Portal in-tab.

Operator billing panel (/pact-admin/billing)

Pact staff get a live view of:

• Stripe mode — live / test / unconfigured / no-op
• MRR & ARR — summed from active + trialing subscriptions
• Subscription counts by status (active, trialing, past_due, canceled…)
• Failed-payment queue — tenants in past_due / grace_period / soft_lock with links to their tenant detail page

Anti-abuse guards

Tenants with a hard_lock dunning state receive HTTP 402 on checkout. Attempting to start a second active subscription for the same plan returns HTTP 409.

Go-live runbook

Full step-by-step instructions in docs/ops/stripe-go-live.md. Set Stripe keys via Admin → Platform secrets — never via fly secrets set.

White-label branding

Agency tenants on the Agency plan can now configure a fully custom brand identity applied across all client-facing surfaces.

Configurable in Settings → Brand:

• App name shown in the browser tab and email footers
• Primary logo (SVG or PNG, shown in the top bar and sidebar)
• Favicon
• Custom sender domain for outbound sequences (requires DNS verification)
• Accent color for the UI

Branding changes take effect immediately for all sub-tenants managed under your agency account.

Contact your account manager to enable the Agency plan.