What's New

2026.10.30October 26, 2026

• Nothing changes on screen in this release.  When we check how many records a company has, the check now has to show that it was allowed to see all of them before the number counts.  A check that cannot show that says so and stops, instead of reporting a number that might only be part of the picture.

2026.10.29October 25, 2026

• Nothing changes on screen in this release.  Your data is fenced inside the database itself, so a request can only reach the company it was made for.  That fence read a connection saying nothing about who it was for as a connection allowed to see everything.  The product never left one in that state, and the people who use the site were never reaching past their own company; a connection opened by hand, outside the site, was the gap.  A connection that says nothing is now shown nothing, which is the other way round.

2026.10.28October 23, 2026

• Nothing changes on screen in this release.  When somebody connects an AI assistant to Savi Schedule, the assistant works with that person's own access, and the record of what it did named the person without saying that a connection was what carried it.  The record now names the connection as well, so the history of a change says which one it came through.  Nothing you can see or do in the product works differently, and no new information about anybody is collected.

2026.10.27October 22, 2026

• Erase has its own place on the Team panel.  It was the third button in the Actions row, beside Data and Remove, and the second on somebody who had never signed in, because the Reset sign-in button next to it only appears once a person has.  A control that erases a person for good was sitting at a different spot depending on whose panel you had open.  Erase now stands alone at the bottom of the panel, in the same place every time, under a line saying what it destroys.

2026.10.26October 22, 2026

• The Team list comes back in order.  On a site where names and addresses are encrypted in the database, the list of people on the Team page was sorted by the stored form of the address rather than the address itself, so the order it came back in meant nothing.  Everybody was there and every row was right; only the order was noise.  It sorts by the address now.

2026.10.25October 22, 2026

• Nothing changes on screen in this release.  As each site starts, it writes down a few facts about its own database so we can read them without going near your data.  That note described whichever database the site was pointed at when it was built rather than the one it had just prepared, and on a live site the two are always the same, so nothing you do in the product worked differently.  It now describes the database it prepared.

2026.10.24October 22, 2026

• Nothing changes on screen in this release.  One of the open-source libraries the product is built on had a security problem published against it, and this release moves to the repaired version of that library.  No data was reached through it and nothing you do in the product works differently.
• A release that changes a library now has to say so.  The check that stops a change shipping without a note on this page did not watch the file naming those libraries, so the fix above could have gone out unannounced.  It watches it now.

2026.10.23October 22, 2026

• Nothing changes on screen in this release.  It carries one piece of plumbing:  each site now records, as it starts, whether the database protection that keeps one company's data away from another is switched on.  The protection itself is unchanged.  Recording it means a later question about whether it was on has an answer from the day itself rather than from somebody's memory.

2026.10.22October 21, 2026

• An erased person's email address is free again.  Erase replaced the address on the record but kept the hidden key the product uses to match an address, so the erased record still answered to it:  inviting that address again said the person already existed, and a Google sign-in with it was refused.  Erase now clears that key, and every record erased before today is cleared the same way as this release installs.
• Erased records leave the Team page.  They were listed under Not yet placed as if they were people, each with a Reset sign-in button that meant nothing on a record with no sign-in.  They are counted in the toolbar instead.

2026.10.21October 21, 2026

• A refused sign-in now explains itself on the sign-in page.  Before, the reason arrived as a line of raw text on a black screen, which on a phone reads like the site is broken.  It now returns you to the sign-in page with the reason written above the buttons.
• Administrators can reset how a person signs in.  Someone whose account was first proven by a Microsoft sign-in could never switch to Google:  Google was refused, by design, from taking over an account on a matching email alone, and nothing offered a way back.  Open the person on the Team page and choose Reset sign-in.  Their next sign-in, with Microsoft or Google, claims the same account with the same roles;  any session they had open ends.  You cannot reset your own.
• The refusal itself now says what to do:  sign in with Microsoft, or ask your administrator to reset your sign-in.

2026.10.20October 21, 2026

• A whole-book read now ends when it finishes, instead of staying open for the rest of that session.  A few parts of the product read across every book at once:  the engine that works out capacity, and the pages that total up a portfolio.  That wider reach was meant to last only for the one calculation and then close.  It closed in one place and not in another, so anything the same session went on to do kept the wider reach rather than dropping back to the book the person asked from.  It now drops back the moment the calculation ends.  You will not see a difference on any page:  who can open what has not changed, and the ordinary checks on every page were doing their job throughout.  This is the backstop underneath them, put back the way it was meant to work.
• A note in the code that had gone out of date.  Nothing a user meets changes.

2026.10.19October 20, 2026

• An AI project manager can stand up and revoke agent tokens.  A platform admin can issue a PM agent token with the mint flag.  That token can then mint worker tokens for AI resources in its own book, and PM tokens carrying its own scope, through the connector, and revoke what it minted.  It cannot mint a read-only or support-read token, which read the whole instance and stay a person's click, and it cannot mint another minter.  Every token it stands up records which token minted it, and lives only while that minter does:  revoking one minter revokes everything it minted.  Every mint and revoke is an audited connector call.
• The flag is off for every existing token.  Nothing changes for a token already issued, and an instance where no admin sets the flag has no minter.

2026.10.18October 19, 2026

• When a task will not move, the page now says why.  It used to say only that the move could not be saved, and named no reason.  The reason the save was turned down now appears in the same message, so you can see whether the page is out of step with the project, whether the task belongs somewhere else, or whether a group has gone.  Reloading the page is still the first thing to try.  Nothing about moving a task has changed;  only what you are told when it fails.

2026.10.17October 19, 2026

• Moving a task on the Tasks page works again in every project that has something in its staging area.  Dragging a task by its grip, or moving it with the up and down arrows, was refused and the page said only that the order could not be saved.  The save sends the project's whole running order and is accepted only when it accounts for every task in the project, and since the staging area arrived on October 12 the page had been leaving the staged tasks out of that list, so the save was turned down every time and reloading the page could not help.  The order now carries the staged tasks along with the rest.  Nothing about what the page shows has changed:  staged tasks stay in their own collapsed section, nothing can be dropped onto them, and they keep their own order.

2026.10.16October 18, 2026

• The facts a deployment writes about its own database now say what a support login's memberships are worth, rather than only that it holds them.  A membership carries three separate settings:  whether the holder can grant it to somebody else, whether borrowing the wider access is permitted, and whether that access applies automatically.  The count written so far read the first and nothing else, so the two settings that decide whether the access can be used at all stayed unread, and the question rested on an argument about what the holder could arrange rather than on a reading.  All three are now read for each membership, along with who granted it.  A setting an older database does not report comes back marked unread rather than as a restriction, so a missing answer is never mistaken for a safe one.

2026.10.15October 16, 2026

• A deployment now reports which objects are holding a support login in place, so it can be retired safely.  A support login exists on both databases, and an attempt to remove it was refused because objects on the database still depend on it.  The database says it is blocked and does not say by what, and the count written so far could not tell either:  it reported only what that login owns, and a login granted permission on somebody else's table owns nothing while still blocking the removal.  The new count reads the list the database itself refuses from, and separates the two cases that need different handling, something owned against a permission granted.  Names of database roles and catalogues with counts, never a table name and never the contents of any row, so it runs the same way on a dedicated deployment as on the shared one.

2026.10.14October 16, 2026

• Two of the facts each deployment writes about its own database were never answering, and now do.  The release described in 2026.10.9 has every deployment write a short set of counts about its own database to the log when it starts.  One of those counts asked for a column that does not exist on the table it was reading, so on both databases it had returned an error instead of a number from the day it shipped.  Nothing broke, because each fact is written so that a problem inside it is caught and printed rather than allowed to stop the site from serving, and that is also why nobody noticed:  the error line was the only sign.  That count now reads a company off the project a task belongs to, which is the same route the product itself uses to decide who may see that task.  It also reports separately how many tasks were visible whose project was not, which is the thing the count exists to catch and which the simpler version of the question would have hidden.
• A second fact was added so one open question about database access can be answered rather than assumed.  A support login exists on both databases and owns nothing on either, and the facts written so far could not show whether it also holds a membership that would let it borrow wider access.  An absence of ownership and an absence of evidence read the same way, so the question was recorded as unproven rather than clear.  The new fact reads that membership directly and returns a row either way, so a login that is not on a database is told apart from one that is there and a member of nothing.  Counts and names of roles only, never anybody's data.

2026.10.13October 13, 2026

• A read-only connection is now shown only the things it can actually do.  A connection set up to look but not touch was still being offered the full list of actions, including the thirty-two it would refuse.  Nothing was ever at risk, because those actions were always refused when tried.  The list now matches what the connection is allowed to do, so an assistant reading it plans work it can finish instead of running into a wall partway through.

2026.10.12October 12, 2026

• A page that saves partway through no longer goes blank for the rest of the request.  A few screens save something and then carry on reading more data in the same request.  The limit that keeps each company seeing only its own work was being dropped at the moment of that save, and everything read afterwards came back empty.  It now travels with the request itself, so the save happens and the rest of the page loads normally.

2026.10.11October 12, 2026

• Shelve and stage.  A task, or a whole group, can be taken out of scope without being deleted.  A staged task leaves the timeline and every calculation as if it were not there, and keeps its estimate, assignee, baseline, dependencies and notes, so bringing it back is one click and nothing has to be retyped.  Shelve group stages every task in a group at once and Restore group brings exactly that set back.  A new task can be created staged, so the details can be worked out off the live timeline before anybody else sees the dates move.
• Where it lives.  The Tasks page shows each project's staged tasks in a collapsed section at the foot of the project, for anyone who can edit the book.  Nothing else shows them:  the Timeline, My Tasks, Priorities, reports, the decision queue, Loose ends, Delivered, the PDF and the connector all read the live book only.
• A task that waited on a staged task is scheduled without waiting, and says so.  Staging is a scope decision somebody meant, so the dependency is set aside rather than held, which is the opposite of what the Trash does on purpose.  The task carries a warning naming the staged work, and bringing that work back makes the task wait for it again.
• For an AI project manager.  pm_stage and pm_unstage on the PM connector, and list_tasks can ask for the staging area by name.

2026.10.10October 12, 2026

• A full-book read now hands its wider access back as soon as it finishes.  Reports and insights that read across every client need to see past the usual one-company limit while they run.  That wider access used to stay switched on for whatever the app did next in the same request.  It now closes the moment the report is done, so nothing after it inherits a view it was never meant to have.

2026.10.9October 11, 2026

• Each deployment now writes a short set of facts about its own database to the log when it starts.  Both production databases refuse every address outside their own network, which is what keeps them private and also meant nobody could answer plain questions about them from outside.  The deployment itself sits inside that network, so it now reads those facts where the database will answer and prints them where they can be read afterward.  Counts only, never the contents of any row.  The read runs after the database is already up to date, it cannot write anything, it gives up after five seconds, and any problem inside it is caught and printed rather than allowed to stop the site from serving.
• The migration step passes the database setting under its one proper name.  Each company's database is brought up to date in a separate step that is handed nothing except the one setting it needs, so it cannot reach the wrong company's data by inheriting something it was never given.  That setting was still being passed under the old short name.  It now uses the prefixed name the rest of the product uses, which finishes the clean-up described in 2026.10.7.
• Two safety limits on that new read are now tested through the code that applies them.  The limits are that it cannot write and that it gives up after five seconds.  The tests covering them set both limits themselves and then checked the database honoured them, so they passed whether or not the product applied either one.  Each test now drives the real code path, and each was checked by breaking the limit on purpose and confirming the test fails.

2026.10.8October 9, 2026

• Adding a person to your own firm's roster works on a deployment carrying more than one firm.  The add row on Resources now names the firm the new resource will belong to, and it offers each firm you administer.  Where a deployment held more than one firm, that row used to send no firm at all, and the server declined to guess rather than put somebody on the wrong roster, so the save failed whatever your role.  Anyone who administers no firm is offered none, and the message says why.  A deployment holding a single firm behaves as it did before.

2026.10.7October 8, 2026

• A password or connection string pasted into a production setting now stops the build and says which setting holds it.  Settings of this kind are meant to point at the secure store rather than carry the secret themselves.  A check already listed which settings did which, and the build went green either way, so a pasted credential looked the same as a healthy setting to anybody who did not read the log line by line.  The check now fails, and it names the setting and what to do about it.
• A release check that cannot use its own credential now stays quiet rather than guessing.  After a release, Savi Schedule asks a private company site to confirm which version it is serving, and it identifies itself with a shared value to get past the approved-address rule.  Where that value contains a character the request cannot carry, the check now treats itself as having no credential at all.  It could previously present a value that was certain to be refused, and a refusal reads like the release not having landed.
• The database setting has one name.  Every setting of ours carries the same prefix, which is what lets a check read the live sites and spot anything out of place.  One short, unprefixed name was still accepted, so a real connection string parked under it would have sat outside that check.  The short name is gone, and the one place inside the product that used it now uses the prefixed name.

2026.10.6October 8, 2026

• The RAID log has a screen.  Risks, assumptions, issues and dependencies, under Action beside Loose ends.  Tabs for the four kinds, each carrying its own open count.  Closing an entry asks what closing it means:  a risk was mitigated, or it occurred, or it was accepted;  a dependency was met or missed;  an assumption was validated or invalidated.  A single "closed" would lose the difference, which is most of why a log is kept.  Severity comes from probability and impact together, and an entry with only one of them says it is not rated rather than guessing.  Nothing in the log moves a projected date.  The engine does that, and keeping the two apart is what makes the log safe to keep beside a plan.
• Who sees it.  Whoever can edit a book can keep its RAID log, which is the reach Loose ends already has.  An entry about a project is visible to exactly the people that project is visible to, so a company sees its own entries and nobody else's.
• A tab is checked as four things agreeing.  The log reached the product on October 3 with its data, its rules and its tests, and no screen, because nothing checked that a button, a container, a registry entry and a render step all existed for it.  They are checked now, for every tab.

2026.10.5October 8, 2026

• The check that reports whether your data stays separated now repeats itself every hour.  Savi Schedule writes a line saying whether the database connection it is using enforces the rule that keeps one company's rows away from another's.  That line used to be written once, when the instance started, and a monitor watching for trouble looks only at recent lines.  So an instance that had been running for days showed nothing recent, and the monitor read that silence as the problem having gone away while it had not.  The line is now re-stated hourly, so what the monitor sees is the state as it is rather than the last time anyone said it out loud.
• Background housekeeping can be switched off for a test run without switching off the proof that it works.  The two quiet jobs, clearing personal data past its retention period and checking the audit log for tampering, are on in every deployment and nothing about a running instance changes here.  They can now be turned off for an automated test run, because one of them deletes across a whole table and was interfering with the tests measuring it.  The tests that exist to prove those jobs actually run turn them back on for themselves, so a build where housekeeping never starts fails instead of passing quietly.

2026.10.4October 7, 2026

• A private company site stays silent about itself, whatever a stranger sends it.  A company on its own dedicated site is reachable only from addresses it has approved, and anyone else gets a plain not-found page that says nothing about who lives there.  An unusual character in one part of a request used to make that page answer with a server error instead, and an error is itself an answer:  it tells the sender something is running here.  Those requests now get the same plain not-found as everyone else.
• A release now checks that the site is serving the new version before it is called done.  The check runs from outside, so on a private site it was being turned away by the same approved-address rule that protects the company, and a release that had landed correctly could read as a failure.  The check can now identify itself to the health page alone, and where it still cannot reach a site it says the leg is unverified rather than reporting the release as broken.

2026.10.3October 6, 2026

• Background housekeeping now stops when the instance running it stops.  Savi Schedule runs two jobs quietly behind the screens:  one clears personal data that has passed its retention period, and one checks the audit log for signs of tampering.  Those jobs used to keep running after the instance that started them had shut down.  They now end with it.  You meet this during a restart or an upgrade, where housekeeping no longer works against a database the instance has already released.

2026.10.2October 6, 2026

• Finished projects no longer clutter the dependency dropdown.  When you make one task wait on another, the list you pick from no longer offers tasks belonging to a project that is done or killed.  A project on hold is still offered, because it is paused rather than finished and work can still legitimately wait on it.  A dependency you recorded earlier against a finished project is left exactly where it is and still shows in the waits-on and holds-up lists, because that is a real constraint rather than clutter.
• A setting that has been emptied stops the product rather than quietly choosing for you.  Every on-and-off setting is now read in one place, and a value that is blank or unrecognised refuses to start the instance instead of falling back to off.  A switch that silently reads as off is indistinguishable from one deliberately turned off, and the ones here decide whether data is encrypted at rest and whether an instance serves a single company.
• A redacted audit entry keeps the evidence on everything redaction did not touch.  Removing content from an audit record used to set aside the tamper check for that whole record, so the fields a redaction never altered lost their protection to pay for the few it did.  Those fields now keep their own evidence, and a redacted record that was altered afterwards reads as altered.

2026.10.1October 3, 2026

• Release numbers name the month they ship in again.  Three releases went out on the 1st and 2nd of October numbered 2026.9.60, .61 and .62, which is September's number.  Each release was copied from the one before it and the last part incremented, and nothing ever compared the number with the date.  October restarts at 2026.10.1, as each month is supposed to.  The three misnumbered entries are left as they are:  2026.9.62 is what has been running, and renumbering a released version would leave the live instance reporting a version that appears in no release note.

2026.9.62October 2, 2026

• Resource names and disciplines are encrypted in the database.  A person's name and the discipline they work in are now stored encrypted at rest rather than in plain text.  Sorting a resource list by name and searching for one still behave exactly as before, because the application does the ordering and the matching instead of the database.  Nothing you type changes and no screen moves.
• Loose ends answers a read-only connector.  The loose-ends list, which gathers the work that has drifted out of a plan, can now be read by a connector that only reads.  A project-manager connector asking for it is refused, because that list crosses the whole portfolio rather than one manager's book.
• A dedicated instance shows holidays that belong to the whole company.  On an instance serving one company, a holiday recorded without a company against it applies to everybody and is now visible to everybody there.  On the shared instance a holiday with no company attached is still hidden, because on a shared host a row belonging to nobody is a mistake rather than a company-wide day.  Holidays feed the working calendar, so this is the difference between a plan computing on the right dates and the wrong ones.

2026.9.61October 2, 2026

• The product can say whether its own row-security backstop is standing.  A platform admin can now ask any instance, including a dedicated one on a private network, whether row-level security is switched on and forced on every table it covers and how many policies are attached.  It reads the database's own view rather than what the code intended, and it reports a gap when a policy is missing or a switch is off.  Table names, two switches and a count;  no business data.

2026.9.60October 1, 2026

• Priority is defined where every other number is.  The rank the engine schedules on had no entry in "How numbers are computed", so anyone ordering work had to infer from behaviour which direction it ran.  It now says it:  1 is highest, a new project starts at 10, and where two share a number the older one goes first.

2026.9.59September 28, 2026

• A project an AI starts is judged from its first hour.  A project used to report no SPI and no verdict until eight hours had been earned or planned, because a person books time in lumps and a sliver of plan makes the number noise.  An AI resource reports the hours it spent as it spends them, so there is nothing to wait out.  Where the task that starts a project is assigned to an AI, that floor is now zero, and the decision queue counts the band as evidence on the same terms.  A project a person starts is unchanged, and so is a project whose starting task nobody has been assigned to yet.

2026.9.58September 27, 2026

• The application says at startup whether its own database login enforces row-level security.  The backstop only works on a login that cannot bypass it, and until now nothing reported which kind of login the running process had.  One line in the startup log answers it.  Nothing about it is exposed to a caller.

2026.9.57September 27, 2026

• Every table is on the row-level security map, or says why it is not.  Six tables that carried no scope column sat outside the backstop and outside the test that would have noticed.  Each is now either scoped or named with its reason, and the test reads every table rather than only the ones already scoped.

2026.9.56September 26, 2026

• Project templates.  A project can be saved as a template, and new projects can start from it.  A template keeps the project's groups, tasks, estimates, disciplines, notes and dependencies.  Every task in a new project starts fresh, with nobody assigned and no dates.
• Who saves them.  Firm staff can save templates for the whole firm.  A client's admins and PMs can save templates for their own company.  Deleting a template never touches the projects made from it.
• AI project managers can use them.  They can list templates, save one, and start a project from one, all within their own scope.

2026.9.55September 23, 2026

• A task replanned past its baseline is no longer painted as late today.  When a committed window closes and the work moves to a date after it, the bar used to keep the grossly-delayed red while being drawn weeks in the future, which reads as "this is late right now" when it is not.  Those bars now carry their own colour and say the window closed and the task needs a new baseline.  A task still projected to land inside its window keeps the red, because that one really is running late.
• Planned % says what it measures.  It reaches 100% when every baselined task's window has closed, which is a fact about the baseline being spent rather than about the work being finished.  The glossary now says so.

2026.9.54September 23, 2026

• Priorities and Intake are in the PDF.  The report now carries the ranking for each company, with target value, demand date, projected completion and how much of the open work is baselined, and a planned cutover shown under its project.  After it comes the intake funnel:  how many are open, how many concluded, the conversion rate and the median days to a decision, then every item by stage with its owner, value, size and door.
• Export PDF on the pages you are reading.  The button is now on Priorities and Intake as well as the Timeline.  All three export the same report, scoped the same way:  a company lock wins, then the company filter on the page.
• The report works on a single-company site.  A site serving one company hides the company picker, so the report used to refuse the request for want of a company nobody could pick.  It now uses the one company it has.

2026.9.53September 21, 2026

• Progress means one thing everywhere.  How far along a task is now reads from its hours:  hours delivered out of the estimate.  Dates, SPI, CPI, Spend and the decision queue all use that one reading, where before some of them used the status and some used the hours, and the two could disagree.  The definition is under Reports, in How numbers are computed.
• Status and hours left stay in step.  Set a status and hours left follow it.  Set hours left and the status moves to match.  This now works the same way for an AI agent reporting its own progress, which used to change the status and leave the hours where they were.
• SPI counts working days.  What a project should have delivered by today now counts the assignee's working days, skipping weekends, their company's holidays and their time off.  SPI no longer dips every Monday.
• CPI shows a grown estimate.  Earned value is measured against the hours a task was first budgeted at, so an estimate that grows, or work that comes back, lowers CPI.
• Expect some numbers to move.  Projects whose status and hours disagreed will show a different SPI, CPI and verdict.  The new figures are the corrected ones, and no stored data was changed.

2026.9.52September 17, 2026

• Duplicate a task.  Open a task and choose Duplicate beside Move to Trash.  Name the copy and it lands directly beneath the original, carrying the estimate, the assignee, the discipline and the notes.  The copy starts at not started with its full estimate to do, and the earliest start date stays with the original.
• An agent's hours are priced at what it actually costs.  Spend on Performance and on Initiatives priced an AI resource at the company's default rate for people, so a project staffed by agents could report tens of thousands of dollars it never spent.  An agent is now priced at its measured cost per hour, and hours it has no measurement for are reported as unrated instead of guessed.
• The Timeline opens where you tell it to.  The date at the top of the Timeline is now where the chart starts, so Today sits near the left edge instead of drifting right as a project's finished work piles up behind it.  Scroll left to see what came before.

2026.9.51September 14, 2026

• Support, Onboarding, Audit, Settings and Reports in the new style.  Each page has section heads with counts and lists whose columns line up, and a report, an audit line or a form opens in the side panel.
• The audit trail shows its dates again.  Every line read "Invalid Date", and quick edits in a row never grouped.  Both are fixed.
• Undo on holidays, and a question before revoking a token.  Deleting a holiday offers Undo.  Revoking a token asks first, because a revoked token cannot come back.
• The company lock holds in Settings.  Under a lock, initiatives, agent scopes and the AI budget show only the locked company.  A firm admin locked to one of its clients can manage that client's initiatives there.

2026.9.50September 14, 2026

• Today, Loose ends, Priorities and Team in the new style.  Each page now uses the Tasks page's layout:  section heads with counts, lists whose columns line up, and a side panel for detail.  Loose ends counts its groups at the top, and each count filters the list.
• Undo in more places.  Cancelling a cutover and revoking a role offer an Undo.  Where a role could not be given back, such as your own admin role, you are asked first instead.
• Today and Resources know what day it is.  After 7 in the evening Central, both pages treated tomorrow's work as today's.
• Colours that follow the theme.  Status chips, Intake sections and decision types take their colours from the theme, so they read in light mode too.  On Resource load, the firm's own people are named with the firm's name instead of "Unaffiliated".

2026.9.49September 14, 2026

• Drag tasks by their grip.  On the Tasks page, grab the grip at the start of a row and drag the task to a new place in its group, or into another group of the same project.  A line shows where it will land, and Esc cancels.  It works with a mouse or a touch screen, and the arrow keys on a grip move its task one place at a time.
• A move saves whole or not at all.  A task's new group and its new place are saved together, so a move that fails leaves the list as it was and says so.
• The up and down buttons work in every project.  They failed on a project holding a task whose group was in the Trash.

2026.9.48September 14, 2026

• A company lock hides other companies on every page.  Locked to one company, the pages that still named others no longer do:  Resource load's capacity panel, a person's company and sign-in pickers on Resources, role labels on Team, saved what-if scenarios, and the AI agents in Settings.  Locked to Internal, Team and Thresholds no longer list clients.
• Notifications follow the lock.  While locked, the bell shows only notifications about that company's work, and Mark all read marks only those.  Unlock to read the rest.
• Resource load's capacity panel follows the report.  Choosing a company in the report's scope now scopes the capacity panel beside it.
• Counts and pickers stay within one company.  Loose ends offers only the row's own company's disciplines, the Disciplines pane counts only that company's tasks, and Delivered's unrated-hours line adds up only the rows in the report.

2026.9.47September 14, 2026

• The site stays responsive while AI assistants are busy.  A surge of assistant requests could take every database connection and leave people waiting on a page that never loaded.  The connection pool is now sized for the database, assistant requests get a fixed share of it, and a request that runs too long is stopped.  When the assistants' share is full, a new request is told to try again in a few seconds instead of taking a connection a person needs.

2026.9.46September 14, 2026

• The Tasks page shows when the work will happen.  Every task has a When column with its projected start and finish and a bar that places it within its project, and a task that pushes its project past the due date is marked in red.  Each project's header shows its due date, its projected finish in workdays early or late, and the hours left.
• Needs attention.  A strip above the list counts late work, unassigned work, work the schedule could not place, and work that needs a discipline nobody has.  Each count filters the list.
• One search box, and filters you can remove.  Search covers task names, projects, people, details and notes.  Each filter shows as a chip with its own remove button.
• A panel for each task.  Clicking a task opens a panel beside the list with its schedule, its effort, its dependencies in both directions, and a notes field.
• Quicker entry, and a way back.  Press Enter on a group's add line to add a task and start the next one.  Moving a task to the Trash and marking a project done both offer an Undo.
• The page keeps your place.  After a change the list stays where you were, Tasks remembers what you collapse separately from the Timeline, and people with view-only access can search and filter.
• A company lock hides other companies on Tasks.  Under a lock, a task's panel names work in another company only as "A task in another company", and the lists for duplicating a group and moving a project no longer name other companies' projects or clients.
• Clients moved to Team.  Adding, renaming and deleting a client now happens on Team, Clients.
• Resources opens when locked to a client company.  It failed to draw under that lock, and the firm's own people are now headed with the firm's name.

2026.9.45September 12, 2026

• Time-off notes are encrypted on a client's private instance.  On a dedicated instance, the reason someone gave for time off is now encrypted where it is stored, like company names and sign-in accounts, and notes already on file are encrypted the next time the app starts.  The audit trail no longer copies a note's text when time off is added or removed;  it records that a note was withheld.

2026.9.44September 12, 2026

• Company separation now also runs inside the database.  The application already kept each company's data apart.  A second check in the database itself now limits every request to the companies its user belongs to, so a mistake in the application alone cannot expose another company's rows.

2026.9.43September 11, 2026

• When an AI tool refuses a request, it says why again.  Since a library update on September 9, a refusal reached the caller as a bare "Error executing tool", for agents and signed-in people alike.  The reason now arrives with it, and an agent refused a person-only tool is told which tools it can use.
• A what-if counts only the people and work you can see.  Its per-discipline breakdown counted every company on the instance and could name their tasks.  It now covers your own view, and the dates still reflect everyone's workload.
• A PM agent's answers stop at its own company.  Find Capacity, What-If and its schedule return only its own people and projects.  A what-if that touches another company's work is refused, and so is a connection with no valid scope.  It recommends only on decisions it can see.
• A PM agent can set the daily hours ceiling on an AI resource doing open work in its book.  The schedule plans that agent at the lower of the ceiling and what its share of the monthly AI budget buys, so a PM can pace an agent without pinning start dates.
• A dependency on a task in the Trash can be removed, and its warning says how.  A task held by a trashed predecessor still waits, and the warning now names that predecessor and says to remove the dependency or restore it.  A PM agent's schedule now shows the warnings for its own tasks.

2026.9.42September 11, 2026

• Access tokens now expire after 90 days.  That covers personal tokens, the tokens behind a Claude connector, and agent tokens.  A token that already existed has 90 days from this release, so nothing stops working today.  Settings shows when each one expires, and a connector whose token has expired asks you to reconnect.
• Every AI tool call is in the audit trail.  Each call a connector or an agent makes, whether it reads or changes something, is recorded with who made it and what was asked.  Choose "AI tool calls" in the audit trail's list to see only those.

2026.9.41September 11, 2026

• Every holiday belongs to one company and one country.  The "Everyone" choice is gone.  A holiday is for a client's people or for your firm's own staff, and only the people who live in its country observe it.  Your firm's holidays no longer stop your clients' people, who keep their own company's calendar.
• A holiday that was set for everyone now belongs to the firm's own staff.  One with no country still applies in every country until you choose one, and each holiday in Settings now has its own country list for that.
• A person with no country set counts as living in the United States.  Set someone's country on their card in Resources and they observe that country's holidays instead.  Settings says how many people have none set.
• The country lists start with the United States, and a new holiday is set to it until you choose another.

2026.9.40September 11, 2026

• Masked email addresses show the first three letters.  On a company's own private instance, an address in the team list, the audit trail and your account read as one letter and dots, so two people on the same domain could look identical.  They now show the first three letters of the name, never the whole of a short one, and the domain stays masked.

2026.9.39September 11, 2026

• Each person can say which country they live in, and holidays can be set by country.  A holiday can now be for a company, a country, or both, and a person observes it when it matches their company and where they live.  An international team at one company no longer shares one set of days off:  a UK bank holiday stops the UK resident and not the one in Ohio.
• You can book someone to work a day they normally would not.  Add an extra working day on a person's card, such as a Saturday, with the hours they will work or their normal day.  The schedule puts their work on it, a cutover booked for that weekend still runs on it, and time off still wins.  Pam can book and remove them too.
• A firm's holiday for everyone now means everyone at that firm.  It used to apply to every person on the whole platform, and every firm could see every other firm's.  Holidays made before today keep working exactly as they did.

2026.9.38September 11, 2026

• A hypothetical hire on What-if can now be given a discipline.  The hire form has a "does" list, the hire's chip shows it, and a saved scenario keeps it.  A scenario can finally answer the question it was built for:  whether hiring a tester closes the testing shortfall.
• A correction to 2026.9.28.  That release said a hypothetical hire has a discipline.  The engine could use one, but nothing let you set it:  the form had no field, and the AI tool never mentioned it.  Every hire until now counted as "discipline not stated".

2026.9.37September 11, 2026

• The Tasks filter lists no longer read as double negatives.  The person and status lists headed their exclusions "everyone except" and "is not", and the options under them said "except" and "not" again, so the first status read "not not started".  The lists now have a Show only section and a Hide section, and every option under Hide says what it hides:  "hide done", "hide Pam".
• Completed projects gather at the bottom of Tasks.  A done project leaves its company's section for a Completed group at the foot of the page, most recently finished first, so finished work stops sitting between the projects still being worked.  Killed and on-hold projects stay with their company, and the group disappears while completed projects are hidden.

2026.9.36September 11, 2026

• The Timeline stays where you left it.  Expanding or collapsing a project used to throw the chart back to the first row, because every redraw built a new chart that started at the top.  It now keeps its place, down the page and across the dates, whether you press a caret, change a filter or recompute.

2026.9.35September 10, 2026

• Tasks can hide completed projects.  A button in the filter bar hides every project whose status is done, and the page says how many it is hiding, so a project never simply disappears.  It stays hidden across visits until you show them again.
• Only completed projects go.  Killed and on-hold projects stay, and so does an active project that has no tasks yet.  Opening a task in a hidden project from Loose ends shows it for that visit rather than landing you on nothing.
• The Timeline's first column is wide enough to read.  It was a fixed width, and once a project's status and finish date took their share, a name like "Warehouse Routing Rebuild" read "Wareho...".  The column now sizes to its longest label, up to a limit, and a name longer than that still shows in full when you hover it.

2026.9.34September 10, 2026

• The company lock now holds on every page.  Locked to Internal, Loose ends could still show a row about a person from a client company, because a row about a person rather than a piece of work carried no project and fell through as Internal.  It now takes the person's own company.  The Tasks page's people list and task counts, the decision stat tiles and the Support list follow the lock too.
• A reallocation card now belongs to one company.  A firm's own person free to help several clients used to get a single card naming all of their projects, which no one company could decide.  They now get one card per company, and a company is no longer told nobody can cover work that a card beside it is proposing someone for.

2026.9.33September 9, 2026

• Reallocation now sees a firm's own staff.  A person who belongs to the firm rather than to one company could only ever be proposed for the firm's internal work, so in a consultancy, where the staff are the firm's and the projects are the clients', the card never appeared at all.  They are now proposed across their own firm's book.
• The company wall is unchanged.  A company's own person still reaches only that company's projects, and reallocation still never crosses out of the book it started in.

2026.9.32September 8, 2026

• Task filters can now say "everything except this".  Start a text box with a dash and it excludes instead of matching:  -spike keeps every task whose name does not carry the word.  The people list gained an "everyone except" section and the status list an "is not" section, so you can ask for the whole book minus one person, or everything that is not done.
• The exclusions stack with each other and with the hours boxes.  Excluding a person and a status at once narrows to what is left over rather than picking one of the two.  A dash on its own hides nothing, so the page does not empty while you are still typing the word.

2026.9.31September 8, 2026

• The Plan menu runs in the order the work is done.  Intake, then Priorities, then Resources, then Tasks.  Demand arrives at Intake, gets ranked in Priorities, meets the people who will carry it in Resources, and breaks into Tasks last.  Tasks used to sit second, which put the smallest unit of the plan ahead of every decision that shapes it.

2026.9.30September 8, 2026

• The Thresholds table names each rule in words.  Account, then Settings, then Thresholds listed the registry key a rule is stored under, so a firm admin deciding whether to tune sla_days_rescope_candidate had to hover it to learn what it governs.  The row now leads with the rule's name and keeps the key underneath, because the key is what an override is audited against and support asks for it by name.

2026.9.29September 6, 2026

• A dedicated deployment shows its own AI budget and no other.  On a deployment serving a single company, the firm list and the AI budget card narrow to that company's own firm.  A deployment holding more than one firm row used to show a budget field for each, which put a figure belonging to somebody else on the screen.
• The same fence applies to changing it.  A firm outside the deployment's own tenant answers exactly as a firm that does not exist, so hiding the figure and leaving it reachable by id was never the fix.

2026.9.28September 4, 2026

• A hypothetical hire has a discipline, and a what-if says whether the people in it can do the work in it.  A scenario now reports its own capacity and its own queued demand per discipline, and names any task in it assigned to somebody who does something else.  Hiring a developer no longer reads as though it closed a tester shortfall, because free hours never transfer between disciplines and the scenario now says so.
• The projected dates are unchanged.  The engine does not allocate by discipline and this does not make it start;  the answer tells you who could do the work behind a date, not a different date.

2026.9.27September 4, 2026

• An AI project manager can group its tasks.  It creates bands inside a project, renames them, reorders them and moves tasks between them, the same way you would on the Tasks page.  Groups stay display bands:  they carry no sequencing, so the order work happens in still comes from dependencies.
• It can run the book rather than only fill it.  Re-estimate a task, change its status or what discipline it needs, move it to Trash, reorder the tasks inside a project, and remove a dependency as well as add one.  Sequencing is worth as much when it is wrong as when it is missing, so it had to be undoable.
• It can start and edit projects, and baseline them.  A new project joins the bottom of its own ranking.  Demand dates can be moved with a reason and a counterparty, recorded as a renegotiation like any other.  Baselining is what gives variance something to measure against, so a manager that could not baseline could not answer the question it exists to answer.
• It can plan with the people in its book.  Record and remove time off, find who has room in a window, and model a change with what-if before making it.
• Creating a task can state what it waits for.  The field existed and the assistant tool never offered it, so a whole plan could be loaded and still arrive flat, read as all-startable-now.
• None of this crosses the book it manages.  Every one of these refuses a project, task, group or person outside its own scope, with the same answer a missing one gets.  It still cannot adopt a decision, see a rate, or reach anything administrative.

2026.9.26September 4, 2026

• Reordering a book refuses on permission before it looks at the request.  Naming a project outside the book you manage is answered the same way a project that does not exist is answered, rather than with a message about the shape of the request.  The old wording told the caller its ids were real and merely mismatched, which is a way of confirming what exists to somebody who should not be told.

2026.9.25September 3, 2026

• An AI project manager can read the book it manages.  Listing projects and tasks, reading the schedule and reading the decision queue now answer for a PM agent, trimmed to its own scope.  Until now it could create a task and then not see it, because those views wanted a signed-in person and an agent never becomes one.
• What it reads is its own book and nothing else.  Projects, tasks, schedule rows and decision cards outside its scope are filtered out rather than returned, and a view the product has not been taught to narrow is refused instead of being passed through whole.

2026.9.24September 3, 2026

• An AI resource stops carrying an hourly rate it cannot use.  Turning a rated person into an AI resource used to keep the rate, and the rate box is hidden for AI resources, so the number sat on the record with no way to see or clear it.  The rate is now dropped on the way in, and any agent already holding one loses it the next time the card is saved.

2026.9.23September 3, 2026

• A read-only agent identity.  A third kind of agent token that reads your whole book and writes nothing at all:  no tasks, no assignments, no decisions, no time off.  It exists so an assistant that supports the product can look at what is actually happening without being handed a person's sign-in and acting as them.
• It takes no scope, and the screen says so.  Because it reads everything, a firm or client scope would describe a limit that does not exist, so it is refused rather than quietly ignored.  Only a platform admin can issue one, the same as a PM.

2026.9.22September 3, 2026

• Asking who you are now tells you what you hold.  A connection made with a person's sign-in reports the roles it carries, so an assistant can tell whether it is using its own credential or somebody's account.  It names the roles and never the person:  what a connection can reach is what decides whether it is the right one, and whose account it is belongs in the audit trail rather than in a reply anyone can read.

2026.9.21September 3, 2026

• Moving a demand date is now a renegotiation, and it leaves a record.  The date a project was FIRST promised is kept, and every time the date moves the product records what it moved from and to, why, and who agreed to it.  A reason is optional:  an unexplained renegotiation you can see beats a silent field edit.
• A moved promise no longer improves the numbers.  Pushing a date out still stops the Decisions queue raising the project, which is the point of renegotiating.  It no longer makes the project look like it was delivered on time:  performance now reports against the original date as well as the current one, and says when the two differ.
• A card knows the date has moved before.  A kill or rescope suggestion on a project whose date has already slipped twice now says so, with the total days.  Previously moving the date removed the card, so the third slip looked exactly like the first.
• The AI budget and agent tokens respect a company lock.  The AI budget is a firm-wide figure, so while the view is locked to one company it is shown rather than editable, the way an all-companies holiday already behaves.  A locked view also no longer offers to mint an agent token scoped to a different company.

2026.9.20September 3, 2026

• The AI budget card always gives you somewhere to type.  It used to show a field only when the deployment had exactly one firm, and otherwise printed a note about that rather than anything you could act on.  Several firms now get a field each, and where no firm can be read the card says so and names the role that can read it.

2026.9.19September 3, 2026

• An assistant can ask which Savi Schedule it is talking to.  A new whoami answers before any data:  the instance name, whether it is the shared multi-tenant service or a single client's dedicated deployment, and who the connection is.  A dedicated instance says so in words rather than leaving it to be worked out from a hostname, and tells an assistant that does not belong there to stop and report it.

2026.9.18September 3, 2026

• An AI project manager can see its own plan failing.  Reading a book now returns the engine's verdict with it:  whether the plan computes at all, which agents have no capacity to work with, how much of the book cannot be scheduled and why, and which of those the manager can fix itself rather than report.  A worker is told the same about its own capacity.  A planner that cannot see its plan failing keeps planning, and nobody catches it until the dates are already wrong.
• A task can say what it waits for, as it is created.  Creating a task takes the tasks it follows, so a whole sequence loads in one pass instead of arriving flat and being read as all-startable-now.  Sequence can be added to existing work too, and loading the same map twice is safe rather than an error halfway through.
• An AI resource no longer accepts an hourly rate.  It was the only dollar box on the card, so a monthly budget typed there was swallowed silently while meaning nothing and the real budget stayed unset.  The field is gone for agents and the value is refused, pointing at the AI budget instead.

2026.9.17September 2, 2026

• Loose ends fixes itself, on the row.  Unlabelled work is labelled there:  one picker sets every unlabelled task in the project, or open the list and do them one at a time.  A dependency circle is broken there, by choosing which wait to drop.  Work assigned across a company boundary is reassigned there.  None of these send you to another page any more.
• Every row says where the work lives.  Project and group, on the row, so you know before you click and you are not hunting after.
• The one row that still moves you says so, and lands on the row.  Work that falls past the planning horizon has no fix on the row, so it offers to take you there:  it expands the company, the project and the group, including the Ungrouped bucket that used to be missed, rings the row until your next click, and tells you where to look if it still cannot reach it.

2026.9.16September 2, 2026

• Your own people are named as your firm, not as "unaffiliated".  Adding somebody who does not belong to a client now offers your firm by name, and records it.  The old label described what a person was not, and the firm behind it was left blank, which is why a whole internal roster could exist that no AI project manager could see and no report could count properly.
• Existing people and agents with no firm have been adopted into it.  This happens once, on deployments with exactly one firm.  Where there is more than one there is no safe answer, so those rows are left exactly as they are.  Nobody who belongs to a client is touched.
• Changing somebody to an AI resource now drops the working week with it.  An agent has no week; its capacity comes from the budget.  Converting a person used to leave their 40 hours sitting on the row, where every report counting hours would read it.
• The monthly AI budget has a field.  Settings now carries it, next to the other firm settings.  It is the number every agent's capacity is worked out from, and until now it could only be set through the API, so an agent could sit at zero capacity with nothing on screen to change.

2026.9.15September 2, 2026

• A PM agent can write its own book.  It creates tasks in the projects it manages and lists the people in its own tenant, so it can appoint work to somebody who is already there.  The project has to be in its book and the person in its scope, and both refusals read the same as a missing one so the tools cannot be used to find out who else exists.
• An agent still cannot rack a resource or mint a token.  Adding people and agents is a person's act on the Resources tab, and an agent that could add its own workers would be an agent setting its own capacity.
• A tool that needs a person says so.  An agent token calling one used to be told it was not authenticated, which reads as a bad credential and sends you to replace a working token.  It now names the reason and lists what an agent can reach.

2026.9.14September 2, 2026

• Loose ends takes you to the row, not to the top of the page.  "Open the task" now lands on that task, expands the company section, the project and the group that would have hidden it, clears a company filter pointing elsewhere, and flashes the row so you can see which one you came for.  "Label the tasks" does the same for a project.  Before this, both buttons only switched tabs and left you to find the thing yourself.
• A jump will not strand you behind your own filter.  A task filter hides rows that do not match, and hides a project whose tasks all fail it, so a jump could land where its target was not on screen.  When that happens the filter is cleared and a message says so.

2026.9.13September 1, 2026

• Agent tokens have a screen.  Settings now carries an AI agent access card beside the personal one, so issuing an agent its credential is a button rather than an API call.  Pick the AI resource, pick worker or PM, pick the PM's scope, and the token is shown once.  Existing tokens list with the agent they belong to, what kind they are and what they can reach, and revoke from the same row.
• The two kinds of token are explained where you issue them.  A personal token carries your own access;  an agent token carries its resource's, and never yours.  Handing an agent a personal token would quietly make it you, so the card says which is which at the point where it matters.
• The screen tells you when there is nothing to issue a token to.  A token has to belong to an AI resource, so with none on the Resources tab the card says that rather than offering a button that cannot work.

2026.9.12September 1, 2026

• An assistant connection cannot inherit the previous caller's identity.  Who is calling is now cleared at the very start of every request to the assistant endpoint, before anything else runs, rather than partway through.  Nothing was reachable this way on a signed-in deployment, and clearing it first means no future change can make it reachable.

2026.9.11September 1, 2026

• Work finished in the evening no longer shows tomorrow's date.  Dates were being read straight off the clock the server keeps, which runs five hours ahead of Central.  Anything completed after 7pm was therefore filed on the following day, so Delivered, the lateness figures and the audit trail all disagreed with the person who did the work.  Every date you read is now the day it happened where you are.
• An AI project manager can run a book for you.  A PM agent reads its projects in rank order, appoints work to people, and reorders the ranking, all inside one scope:  a single client, or your firm's own internal work, never both.  It cannot rank a project above something that project depends on, the same refusal a person gets.
• A PM agent recommends and never decides.  It can add its recommendation to an open card in the Decisions queue, and the card stays open for a person to adopt, defer or reject.  That is enforced in the product rather than left as a matter of good behaviour.
• The plan says when an agent is costing more than it assumed.  If an agent reports what its work cost and that disagrees with the rate behind your projections, Loose ends says so, and says whether your dates are optimistic or pessimistic as a result.  Nothing is re-rated behind you, and an agent that reports no costs produces no message rather than a false reassurance.

2026.9.10September 1, 2026

• An AI agent can sign in as itself, read the work you appointed to it, and report back.  Mint a token against an AI resource and hand it to the agent.  It sees its own open tasks in the order the plan wants them worked, with anything blocking them named, and it reports status and hours remaining on those tasks.  That is the whole list.  It cannot read your other people, your rates, your other clients, your decisions or your rankings.
• It is a machine identity, not a person with a fake email.  An agent is bound to its resource rather than to a sign-in, so granting it a role changes nothing about what it can reach, and the audit trail names it as an agent rather than as a member of staff.  Turning the resource off, or deleting it, stops the token in the same moment.
• An agent can tell you what the work cost it, and the plan learns.  Reporting a cost alongside progress corrects that agent's own rate, so its projected capacity gets truer the more it does.  Saying nothing is a valid answer and changes nothing:  Savi Schedule never goes looking for what an agent spent, and it holds no part of how an agent does its work.
• The token is shown once.  Only a one-way hash is stored, exactly as personal access tokens already work, and you can revoke it at any time.

2026.9.9September 1, 2026

• An AI resource can do the work, and it is planned in dollars rather than hours.  Add one on the Resources tab by picking AI as the type.  You state a single number, your firm's monthly AI budget, and the plan works out the rest:  the agent's share of that budget, what an hour of its delivered work actually costs, and how many hours a day that buys.  Nobody is asked for an hourly rate for an AI, because nobody who buys a subscription can produce that number.
• The card says which limit is holding an agent back.  A generous budget rarely runs out first, so an agent can look like it has room on a day it is really being throttled.  Set an optional ceiling in hours per day and the summary says whether the budget or the ceiling produced the figure.
• An agent works every day and takes no holidays.  It has no week and no weekend, so it carries no weekly hours and your company's holiday calendar does not stop it.  Time off still works if you need to take one out of the plan for a maintenance window or a suspended budget.
• The estimate on a task means the same thing whoever does it.  Hours stay the unit of work for people and agents alike, so a project worked by both is dated by one engine, and the cost reports, earned value and the Decisions queue all keep working with no second set of rules.
• A planner who cannot see rates can still see an agent's capacity.  The hours per day show to anyone who can see a person's hours;  the dollars behind them stay with the roles that may see money.

2026.9.8September 1, 2026

• The audit trail records who signed in, who was turned away, and who signed out.  It held successful changes only, so a page of activity could tell you that a task was edited and never that somebody spent the afternoon failing to sign in, or that a signed-in person was repeatedly refused a client they cannot see.  Sign-ins, refused sign-ins, sign-outs and refusals now appear alongside the changes, on the same tamper-evident chain, and they are filterable the same way.  A refused sign-in is recorded without an email address on it, so a dedicated deployment that encrypts email at rest keeps that promise here too.  Requests from visitors who never signed in are counted rather than listed, because one line per attempt would let a stranger bury your real entries.

2026.9.7September 1, 2026

• Say what a task needs while you are creating it.  The new-task row on the Tasks page now carries a "needs" box beside the assignee, so the discipline goes on at creation instead of requiring you to open the task afterwards.  Naming a discipline that does not exist yet adds it to your company's list in the same step.

2026.9.6September 1, 2026

• The timeline can show one person's work.  A Person control beside the Client filter narrows the Gantt to a single individual across every project they touch;  projects and clients they are not on drop out of the view.  Project and client dates continue to show the whole project's and the whole client's projected completion, and the view says so, because the engine computes one date per project and this view does not invent a second one.
• Loose ends stops naming the wrong people.  The list of people missing a discipline included anyone moved to Trash, so somebody deleted and recreated appeared under their old blank record while their current one was correctly labelled.  It also ignored who you are allowed to see, and it flagged people carrying no work at all, including the records that exist only to give somebody a login.  It now lists live, visible people who actually hold open work, which is the point at which a missing discipline can hide a real problem.

2026.9.5September 1, 2026

• Nobody is recommended for work they are already doing.  A reallocation suggestion counted every open task on a late project, including the tasks already assigned to the person being suggested.  The only specialist in a discipline was therefore recommended, every day, for the work that had always been theirs.  Suggestions now look only at work somebody else holds or nobody holds, so a person with nowhere to move produces no card at all.
• The card says what it means.  It read "is missing demand dates", which sounds like a project with no date set.  It always meant the opposite:  the project has a date and is projected to finish past it.  It now says so.

2026.9.4September 1, 2026

• The Tasks page filters.  Narrow by task name, by assignee, by status, by hours remaining, and by details.  Filtering happens as you type, the header shows how many of your tasks match, and projects with nothing matching drop out of the way rather than leaving empty headings behind.  The details box searches what the Details column actually shows, so a match is always visible on the row that produced it, and it reaches the notes inside Edit as well.

2026.9.3September 1, 2026

• Reallocation no longer suggests people who cannot do the work.  The Decisions queue was proposing anyone with free time for any late project, because work with no discipline stated was treated as work anyone could take, and almost no work is labelled yet.  A suggestion now requires that the person has a stated discipline and the project actually has open work asking for it.  Expect a shorter, truer queue.
• Loose ends says what is missing.  Because unlabelled people and unlabelled work can never produce a suggestion, both now appear in Action then Loose ends with the fix on the row, so a quiet queue explains itself instead of looking like there is nothing to do.

2026.9.2September 1, 2026

• Loose ends: everything that needs a second look, in one place.  Action then Loose ends gathers the things that were previously scattered across five screens:  work assigned to somebody whose discipline does not match, work assigned to someone no longer active, work nobody is assigned to, work the engine cannot schedule, and active projects with no baseline.  Every row carries its own fix, so you reassign or relabel right there instead of hunting for the task.  Portfolio calls stay in Decisions;  this page is for tidying.

2026.9.1September 1, 2026

• The discipline list can be edited.  Plan then Resources now carries a Disciplines panel for your company:  add one, rename one, or retire one you no longer use.  Each row shows how many people and tasks carry the label, so you can see what a change will touch before you make it.  Renaming updates every person and task at once, and retiring a label still in use asks before it strips it.

2026.8.51August 31, 2026

• People have a discipline, and spare hours belong to it.  Resource load used to report booked hours over available hours with nothing saying what the free hours were good for, so a tester with an empty queue read as capacity the portfolio could spend.  Each person now carries one discipline and each task carries the discipline it needs, both managed per company the way initiatives are.  Resource load groups by discipline, and a new panel above it puts free hours beside the work actually waiting on that discipline.  Hours are never pooled across disciplines, so a shortage of system administrators is never hidden by idle testers.  Nothing is filled in for you: everyone starts with no discipline set until you say otherwise.
• The decision queue stopped suggesting people who cannot do the work.  A reallocation used to be raised on free hours alone, and it would offer an idle tester the unassigned system administration work with a projected date attached.  It now needs the person's discipline to match work that is actually waiting, and the option it prices only moves work they could pick up.  Where starving work needs a discipline nobody free has, you get a shortage card naming the discipline and the hours instead of a body who would not help.
• Every decision card shows how it appeared.  "How this was computed" used to list two or three thresholds.  It now shows each condition the rule tested with what it measured, including the conditions that were checked and did not hold, and a rescope says which part of the kill rule it failed.  The definitions underneath are the ones those conditions consulted rather than a list kept by hand.  The capacity panel carries the same disclosure.
• A project's rank reads the same everywhere.  Priorities counts position among active projects;  What-If and the dependency chips read the stored rank.  A finished project used to keep its number, so everything under it stored a rank one lower than Priorities displayed.  Finishing or killing a project now frees its number, a reopened one joins the bottom, and existing rankings were renumbered on release.
• Updates reach your browser without a hard refresh.  The app's files are now addressed by their contents, so a release changes the address and your browser fetches the new version by itself.  A release that changes nothing re-fetches nothing.

2026.8.50August 30, 2026

• Finished projects are visible again.  A project marked done or killed used to disappear from the product entirely.  Each client's ranking now carries a Completed list underneath it, collapsed until you open it, and Reports has a new Delivered tab showing what finished, when, how it landed against the baseline you committed to, and what it consumed.  Projects that finished before this release show their last task's completion date where one exists, and say so plainly where it does not.

2026.8.49August 28, 2026

• The public pages say what the product does.  The home page now carries the full set of feature blocks, including how a date is defended, key-person risk as a number, and testing a deal before signing it.  Sharing a link to Savi Schedule anywhere that builds a preview card now produces a real card with a headline and an image instead of a bare link.
• The onboarding request form is clearer before you submit.  The work-email field says up front that a company domain is required, the planning-tool question names some examples, and a line under the button says what we do with what you send.  The page can also confirm a place on the waitlist when a week is full.

2026.8.48August 28, 2026

• Support tickets can be read by a connected assistant.  Tickets filed through the app are now available to an AI assistant connected to your account, so one can be picked up and looked at as soon as it arrives.  It is read-only, and it shows exactly what the person asking would see on screen: everything for an administrator, and only their own tickets for anyone else.

2026.8.47August 28, 2026

• A sign-in can only be linked to one person.  The list of sign-ins on a person's record offered everyone, including people already linked elsewhere, and nothing stopped the same sign-in being attached twice.  That quietly turned one person into two: their work appeared in both places and a status they reported could land on the wrong record.  Sign-ins already in use no longer appear in the list, and linking one that is taken is refused with the name of whoever holds it.

2026.8.46August 28, 2026

• Fixed: roles could not be granted on a dedicated deployment.  On an instance serving a single company, the company picker in the grant row had nothing readable to choose, so the grant could not be completed.  With only one company there is nothing to choose, so it is now filled in for you and the picker is gone.

2026.8.45August 28, 2026

• Fixed: the "How this works" page opened blank.  The menu entry appeared and the page was empty.

2026.8.44August 28, 2026

• A "How this works" page under Account.  One place explaining the funnel end to end: how an idea enters, how one idea can wait on another, what it means to price an idea against the plan and what that pricing assumes, how a proof of concept is bought and closed, how a committed bet gets judged later, and which initiatives wait on which.  It is marked admin only and, for now, that is who can open it.  The figures it quotes are read from your own settings, so tuning a threshold changes what the page says rather than leaving it quietly out of date.

2026.8.43August 28, 2026

• Committing an idea can now set a date to come back and judge it.  The funnel used to end the moment something was committed: it became a project, shipped, and nothing recorded whether it was worth doing.  A commitment can carry a review date, the items whose date has arrived are listed for you, and the verdict is recorded as paid off, mixed, or did not pay.
• A new measure of whether the decisions were any good.  The funnel already reported how quickly decisions were made and how many were followed through.  It now also reports what share of the judged bets paid off.
• See which products are waiting on which.  Where work in one initiative depends on work in another, that now shows as a plain list of which depends on which, built from the links already in the plan rather than anything anyone has to draw again.  Two initiatives sharing the same person is not shown as a dependency: that is a question of what comes first, which the timeline already answers.

2026.8.42August 28, 2026

• Price an idea before anyone argues about it.  An idea in the funnel can now be costed against the real plan: what committing it would push, and whose time it would take.  Anyone who can run a what-if can ask, so the person with the idea gets the number without booking the people who would build it.  Nothing is written; asking the question changes no plan.
• The price includes anything the idea is waiting on.  If an idea needs another one finished first, and that one has not been built, its cost is carried into the number.  Chains are followed all the way back.  A prerequisite already committed is not charged twice, because its cost is in the plan already.
• The assumed size of an idea is now yours to set.  Small, medium and large each carry an hours assumption, editable in Settings next to the other thresholds and explained in the glossary alongside every other number the product uses.

2026.8.41August 27, 2026

• An idea can now record that it needs another one finished first.  Until now a prerequisite between two ideas had nowhere to live: the plan could only express it once both had already been committed and broken into tasks, which is after the point where knowing it would have changed the decision.  Intake items can now depend on each other, and the constraint follows them.
• Declining an idea tells whoever was counting on it.  Turning down a prerequisite used to leave anything built on top of it standing, with nobody told it had just become unbuildable.  Those items now come back for a fresh decision and their owner is notified.  The link is kept, because it is the record of what is now missing.
• The order is enforced once both are committed.  The dependency carries into the plan on its own, the timeline holds the dependent until its prerequisite is finished, and the priority list refuses an order that puts a dependent above the thing it is waiting on.

2026.8.40August 27, 2026

• The "Projects & Tasks" tab is now called "Tasks".  Same screen, shorter name.

2026.8.39August 27, 2026

• A dedicated deployment can carry its own name in the browser tab.  Companies on their own instance were showing the same tab name as everyone else, which is unhelpful when you keep several tabs open.  An instance can now be given its own title, so the tab reads the company name alongside the product.  Nothing changes for the shared service.

2026.8.38August 27, 2026

• AI assistant access opens to the people who run the plan.  Connecting Savi Schedule to an AI assistant was limited to firm-side accounts.  Client admins, project managers and resource managers can now connect one too.  A connection carries only what that person can already see and do: the assistant reads and writes through the same permission checks as the screens, so a project manager gets a project manager's view and nothing wider.  Member and stakeholder seats stay read-only in the app and cannot connect an assistant.

2026.8.37August 27, 2026

• Approving an AI assistant's access now completes.  The approval page took the click and recorded it, then left you sitting on the same screen instead of returning you to the assistant, and a second click reported the approval already used.  The browser was refusing the final hop back because our own security headers did not list the assistant as somewhere a form may send you.  It does now, and the list is built from the same set of approved destinations the sign-in code checks, so the two cannot fall out of step.

2026.8.36August 27, 2026

• Assistant connectors can reach a private deployment again.  A deployment restricted to named addresses answered every other caller with "not found", which also blocked the sign-in service an AI assistant uses to connect.  That sign-in and data channel is now reachable from the assistant provider's published addresses.  The application itself, and its sign-in page, stay hidden from everyone outside your own allow list, and a bearer token or a Microsoft sign-in is still required to read anything.

2026.8.35August 26, 2026

• Put a what-if scenario into motion.  A scenario you have run now carries a "Put this into motion" button that writes every lever to the real plan:  new people, new projects and their tasks and dependencies, reassignments, capacity changes, time off, stopped projects, re-ranks, and hand-off cutovers.  The button first shows the full list of changes it is about to make and writes nothing until you approve it.  Everything applies together or not at all, and each change is checked against your own permissions before any of it is written.  Afterwards the plan is recomputed and held against the dates the scenario projected, so you can see that it landed where the screen said.
• Capacity changes can be dated.  A person dropping to fewer hours on a future date is now something the plan itself can hold, rather than an edit somebody has to remember to make on the day.  The timeline projects it from the moment it is recorded.

2026.8.34August 26, 2026

• Punctuation cleaned up across the product.  Dashes used as sentence breaks are gone from every screen, tooltip, dropdown, and the PDF report, replaced with plain punctuation.  Empty table cells now show a simple hyphen.

2026.8.33August 25, 2026

• Assistant connections are checked earlier and more strictly.  A connection request with an unapproved destination is now refused outright instead of being sent onward, and destinations containing unusual characters are rejected.

2026.8.32August 25, 2026

• Connecting an AI assistant now asks your permission.  Linking an external assistant to your Savi Schedule account shows an explicit approval screen naming the app and where it will send you, and connections are limited to approved destinations.

2026.8.31August 24, 2026

• Private instance answers as not found on every address.  On a private instance, visitors outside the allow list now receive a plain not-found response on the platform's built-in address as well, matching the instance's own address.

2026.8.30August 23, 2026

• Intake requester first name only.  On a private instance, the "who wants it" name on a demand item is reduced to a first name, matching how resource names are handled.

2026.8.29August 23, 2026

• Company identity fully removed on a private instance.  On a single-company deployment the company name and contact no longer appear anywhere. The Plan and Timeline drop the company grouping and its management controls, and the name is cleared at the data source so no screen can surface it.

2026.8.28August 23, 2026

• Private-instance polish.  On a single-company instance, the company name is now also removed from role badges, the audit trail's Company column, and resource assignment tables, and stale interface caching was fixed so updates land without a manual refresh.

2026.8.27August 23, 2026

• Tighter privacy on a dedicated deployment.  On a single-company instance, email addresses are masked in the interface (for example s••••@a••••.com) and the company name and its selectors are removed everywhere, since there is only one company.

2026.8.26August 23, 2026

• Readable rule names.  The "How numbers work" tab now shows a friendly name for each policy in the Rule column (for example "Minimum hours before status" instead of the internal key), with the technical identifier kept as a hover tooltip.

2026.8.25August 23, 2026

• Confidentiality for dedicated deployments.  A dedicated tenant can now have its company and firm names and email domains protected at rest, so a database-level breach cannot identify the client;  the team still sees real first names, and authorized users still see the real company name.
• Single-company deployments simplify holidays.  On a dedicated, one-company deployment, holidays are a single shared set with no per-company scoping, and the company lock is hidden since there is nothing to filter to.

2026.8.24August 23, 2026

• Performance report fixed.  The Performance tab rendered a blank page since the on-time delivery release; it now draws again, on-time rates included.

2026.8.23August 21, 2026

• On-time delivery tracking.  The Performance report now shows an on-time rate per project, comparing when work was completed against its committed dates, and a completed task that finished late gets a "days late" mark on the timeline.
• Add people while locked to a company.  The new-resource form is available when you're locked to a client; the person joins that company.

2026.8.22August 21, 2026

• Privacy controls for admins.  Firm admins can now download or erase a person's data for their client companies, and platform admins for anyone, right from the Team tab.  Each user row has Data and Erase actions, erasure behind a typed confirmation.
• Aligned Today columns.  The Task, Group, Status, and Left columns now line up across every project card on the Today tab.

2026.8.21August 21, 2026

• Edit demand as clarity emerges.  Intake items now have an Edit button while they are live in the funnel, so you can sharpen the title, problem, owner, value, effort, door type, and date at any point without forcing them through a screening or shaping step.
• Cleaner dialogs, no more browser pop-ups.  Every confirmation, prompt, and notice is now an in-app dialog.  Multi-step flows like shaping a demand or buying a proof-of-concept are a single form instead of a stack of pop-ups.

2026.8.20August 21, 2026

• The icon really shows up now.  savischedule.com serves a proper icon file, so the product mark appears on browser tabs and on the Savi Schedule tile in AI assistant connector lists.

2026.8.19August 20, 2026

• The icon shows up.  savischedule.com now serves a real favicon, so the product mark appears in browser tabs and on the Savi Schedule tile in AI assistant connector lists, instead of a letter placeholder.

2026.8.18August 20, 2026

• Clearer time-off history.  The change history now records adding or removing someone's time off as a leave period, with the dates and note in plain words, instead of looking like an edit to the person's record.

2026.8.17August 20, 2026

• Real spend, real CV and CPI.  The Performance report's cost side now runs in dollars:  each consumed hour is priced at the assignee's rate, a new Spend column shows what each project has actually cost, and CV and CPI measure earned value against that spend.  SV, SPI, and the status bands stay hours-based, exactly as before.  Dollar columns appear only for rate-visible roles.
• Default hourly rate per company.  Set it in Settings next to Thresholds;  it fills in for any person without their own rate, and a person's own rate always wins.  Hours with no rate anywhere are excluded from spend and disclosed, never guessed.

2026.8.16August 20, 2026

• Connector icon fixed.  AI assistants connected through MCP now actually display the Savi Schedule icon;  the brand images were being blocked cross-origin and clients fell back to a letter avatar.

2026.8.15August 20, 2026

• A proper Privacy dialog.  The Privacy link now opens a real in-app dialog:  download everything in one click, correct your display name in place, and erase your account behind a typed confirmation, replacing the old browser prompt.

2026.8.14August 20, 2026

• Your own thresholds.  Firm admins tune the rules for their own book in Settings > Thresholds:  status floors, decision gates, and SLAs, each inside guarded ranges, applied on the next computation and audited.  Companies without overrides keep the platform defaults.
• Decisions remember their rules.  Every recommendation now permanently records which definitions version surfaced it and which was current when it was decided, so the decision log stays defensible after rules change.

2026.8.13August 20, 2026

• Reports and decisions explain their own math.  Every decision card gains a "How this was computed" expander citing the exact rules that fired it;  report columns and the PDF carry the same served definitions;  and a new "How numbers work" tab under Reports lists every band, column, and policy the product computes with.  AI assistants get the same definitions through a new connection tool.

2026.8.12August 20, 2026

• One source of truth for status math.  Every screen now computes project status from a single server-side definition, so the dashboard lights, Gantt, reports, and AI connections can never disagree.  The exact rules and thresholds the product uses are published at /api/definitions.

2026.8.11August 19, 2026

• Projects in priority order, everywhere.  Every list of projects now follows the management ranking:  the dashboard's today's-work cards, the Gantt timeline, the Portfolio, Initiatives, and Performance reports, the Work tab, and project pickers.  What-if screens follow the scenario's own ranking, with your priority changes applied.

2026.8.10August 19, 2026

• Performance status floor.  A project reports no performance status until at least 8 hours are earned or planned against its baseline.  Before that, the Reports and Gantt views say "too early" instead of judging a sliver of work.
• Performance in priority order.  The Performance report lists projects by their management rank instead of alphabetically.

2026.8.9August 19, 2026

• Hardened edge.  savischedule.com now sits behind a web application firewall at Microsoft's global edge:  abusive traffic is rate-limited and common attack probes are blocked before they reach the application.  Client identification for security limits is now spoof-resistant.

2026.8.8August 19, 2026

• Privacy, self-serve.  A Privacy link in the top bar lets you download everything Savi Schedule holds about you as one file, correct your display name, and erase your account permanently.  You can also delete a bug report you filed.
• This page.  What's New tracks every release from here on.
• AI connections show our icon.  Assistants connected through the Savi Schedule MCP now display the product icon.
• Readable target dollars.  Target values on the Priorities page display as $150,000, and the field accepts dollar signs and commas when you type.

2026.8.7August 19, 2026

• Export your firm's data.  Firm admins download everything the firm owns as one file from the Team tab.
• Client offboarding in one step.  Deleting a client now moves the client and its whole book of projects, tasks, and people to the Trash together;  one restore brings it all back.
• Remove people from your domain.  Firm admins remove a user's access in one action;  the account deactivates once no roles remain anywhere.
• Manage initiatives in Settings.  Each company's initiative choices are now an editable list:  add one before any project uses it, rename it everywhere at once, or retire it.  Settings is now open to firm and client admins.

2026.8.6August 19, 2026

• Privacy and security layer.  Tamper-evident audit history, rate limits on sensitive endpoints, automatic data-retention windows, and public privacy, terms, and security pages.

2026.8.5August 18, 2026

• Intake funnel.  New demand enters through Plan > Intake:  screen it, shape it, and promote it into the schedule, with proof-of-concept work capped and expiring by design.
• Delegated decisions.  Clients can set a dollar line under which their PMs may decide directly.
• Request access.  Prospective firms ask to join through a public request form.

2026.8.4August 14, 2026

• Decision layer.  The system surfaces kill, rescope, and reallocation candidates with evidence;  executives decide with a required rationale, and decision velocity becomes measurable.
• Recalibrated reports.  Portfolio and Strategy Alignment views;  the PDF report opens with a decision brief.
• Support tab.  File a bug report from inside the app.

2026.8.3August 13, 2026

• Firm tier.  Multiple consulting firms, each with its own book of clients, staff domains, and admins.

2026.8.2August 12, 2026

• savischedule.com.  Savi Schedule moved to the cloud:  sign in with Microsoft, nothing to install, automatic deploys.

2026.8.1August 5, 2026

• First release.  Clients, projects, tasks, and people;  a deterministic scheduling engine that projects finish dates from real capacity, priorities, dependencies, and time off;  Gantt timeline, priorities, and what-if scenarios.