The email starts the clock

Seven days. When a TfNSW C41 direction is really a variation but does not say so, the contractor has seven days to write to the RMS Representative and say why it is one, and missing them bars the claim. The direction usually arrives as an email. The project manager reads it on a Thursday afternoon between a crane booking and a pour, and does the work, because the client asked and because it is the right call. The seven days started when the email arrived. Demiton started counting only when the variation reached a register it reads, and an email in one person's inbox is not a register. By the time someone in the office typed the variation in, two or three of the seven days could be gone. The work was always going to be done. Whether it gets paid for comes down to which day the clock starts.

Demiton for Outlook

Open the email, click Demiton, and the panel beside it shows:

• The kind of issue, one of seven, among them extra work, a delay, a defect and a dispute. You pick it; Demiton does not guess yet.
• The job, matched from the address the email was sent to or a job number in it, with up to three suggestions and the reason for each.
• Any related emails. With the panel pinned, opening another email offers to add it.
• The notice date, when the issue is extra work or a delay and the job's contract states a notice period, counted from the email's own date.

Press Raise and four things happen. The original emails are kept as the organisation's evidence, as they arrived. The issue is recorded on the job with the email's date. The person who signs off on that job under Who signs off gets one request, with the emails attached and the notice date on the card. And the countdown starts from the email, not from the day someone noticed. Whoever raised it can withdraw it until it is answered.

The panel reads only the email that is open, and only when you press Raise. It never sends, moves, flags or deletes mail. It works on any plan that includes Protection, within the plan's cover, and a person can belong to more than one organisation and switch between them in the panel.

Before

Found the clause. The window shut Tuesday.

With Demiton

Notice in on day three. The claim stands.

Getting it into Microsoft's store

One link. That is how Demiton for Outlook is installed today: an organisation's Microsoft 365 admin pastes Demiton's manifest link into the admin centre, and the button appears for the people they choose. It works, and almost nobody will do it. The person who looks after Microsoft 365 at a 40-person contractor is often an outside IT firm, and the safe answer to a link from a vendor they have never heard of is no. A listing in Microsoft's store is a different question. Microsoft has checked who published it and tested it by hand, and adding it is a click in Outlook's add-ins store or in the admin centre's list of apps. The add-in is the same either way. Whether a site's project manager ever sees it comes down to who has to say yes.

So the work since 14 October has been the store. Where it stands:

Microsoft's validators test an add-in as a person: they sign in to Outlook with an account the publisher gives them, open an email and use it. Ours could not, for two reasons. The account had no Microsoft 365 licence, so it had no mailbox. Once it had one, on 16 October, Demiton refused its first sign-in. That was the security fix further down this update doing its job: Demiton no longer links a Microsoft sign-in to an account by the email address alone, unless Microsoft proves the address, and our test account was set up before that rule existed. Microsoft now sends the proof, and the retry is next.

Testing in a real Outlook has already paid for itself. It found five defects that every one of the add-in's own tests had passed, the first of which was that nobody could sign in on a first open. All five are fixed. When the listing is approved, it goes here with the date. Until then, if you want it, ask us for the link and your admin can install it today.

Variations that never started a clock

A variation typed into Demiton was saved without the job it belonged to, and every claim window looks for its variations by job. So every variation entered in the app was recorded, shown, and watched by nothing. Since 14 October it is saved on its job and its claim window opens the moment it is entered.

Variation advices Demiton reads from a contractor's documents had the same gap, and were also dated by when Demiton read them rather than when they were written. An advice now opens its window from the submission date printed on it, for advices dated 15 October or later.

Variations entered before the fix stay unwatched. Opening their windows now would raise alerts for notices that were due weeks ago, and an alert about a window that closed in September tells nobody anything they can act on.

Also this week

• Pause a system whose figures are wrong. A customer's finance controller asked us to turn their accounting system off: it was half built and its reports disagreed, and a cost overrun read from a half-built ledger looks the same as a real one. Pause harvests on the system's page asks why, keeps every fact Demiton holds, and puts the pauser's reason, word for word, on the system's page, on every register it feeds, and in front of Studio and every AI assistant before they answer. The docs site's first guide with screenshots shows how: Pausing a system.
• Four more countries. Since 12 October a job can be placed in Ireland, England, Ontario or South Africa, and lists that country's law. Windows counted in working days are refused there, not guessed, until each country has a public holiday calendar.
• 447 obligations from 88 instruments, up from 428 from 87: TfNSW C41 Minor Works (12) and seven quality-system obligations in TMR's MRTS50. On Australian and New Zealand jobs Demiton can check 169, up from 149; 124 cannot be checked yet, down from 125.
• New guides on demiton.io: extension of time, TfNSW R44's compaction table and hold points, and New Zealand.
• Acceptance testing in the app. A customer's tester runs the scenarios their organisation must pass, attaches a screenshot to each, and signs the plan off. We are told the moment one fails.

Fixes and security

We audited every path that signs a person or a system in, found 27 things, and closed these:

• Microsoft sign-in matches the Microsoft account, not the email address it carries, which another Microsoft tenant could set. The email is used only when Microsoft proves it, or an invitation does. Someone whose Demiton account was never linked to Microsoft may be asked once to use an email link.
• A one-hour token cannot be turned into a 30-day one, and a refresh token cannot be used to call the API.
• Refresh tokens expire 30 days after their last use. Before, they never expired. Claude, Copilot or the phone app may ask you to sign in again once.
• A member removed from an organisation loses access through their API keys at once, and an AI assistant granted read access cannot write.
• A connector's sign-in ended on an error page. Since 19 August, finishing a connector's Authorize step sent you back with "oauth_failed" even when it had worked. Fixed, and an Authorize link now works for ten minutes, once, for the person who started it.
• Signing up with Google or Microsoft from the sign-in page now asks you to accept the terms. It used to create the account without asking.

What's next

Demiton for Outlook through publisher verification, the test mailbox, the screenshots and Windows, and then to Microsoft for review. The iPhone app through Apple's review. Holiday calendars for the four new countries.

And still the one this series is waiting to report: a protection that fires on a live job, catches something real, and is signed off with cash recovered. A variation's window now starts on the day of the email, from a button in the inbox where the email arrived. The fewer people who have to say yes before that button appears, the sooner that story gets written.