Every cross-tenant read in background jobs and services was audited and given an explicit, logged justification; state transitions re-check their status after taking the row lock; and error reporting is throttled so a burst cannot hide a real incident.

Dashboard and report date presets now respect your time zone at both edges, saved ranges survive save and reload, quarter presets are correct, and a Today option was added. Rate-manual parse errors now say what went wrong.

Payments are now applied through an immutable, ordered application ledger: every dollar has a line saying which charge it settled, corrections converge on replay, and a read-only projection feeds statements and reports.