Three tools produced reports that could be read in the application but had no row in the assessment register, which is what the Deliverables module works from. That meant their work could not be marked Ready, issued with a manifest, or opened in the free Viewer. Each now registers a row at the moment it has something to report: ErgoGlare once an analysis has run, Link Analysis once a link exists, and ErgoTempo once a session holds data. The rows are unscored, because none of these methods publishes a risk figure and the platform does not invent one, so they are listed without a number and never move a project average. A document from an earlier release joins the register the next time it is saved with content. Whether any of the three should ever carry a score is a separate decision and has not been made.

ErgoDelta counts what changes between two states of a linked task chain, and until now it presented that count on screen only. It gains a Report ribbon group with View and Export DOCX, in the same shape as ErgoAIR's: abstract, introduction, method, findings, limitations, conclusion, references and appendices. The method text comes from the tool's own guide plus a paragraph on the counting conventions. The findings are the measure table, task operations, operations per node, error modes with the removed and introduced split, and error modes with a recovery path, with a delta printed only where both ends were counted, then a detail table per transition and the exclusion counts. A comparison the tool refuses prints the refusal in words and no count; a count that cannot be made reads Not countable with its reason, never nought. ErgoDelta comparisons now appear as a Deliverables row, can be marked Ready and issued, travel in the package, render in the Viewer, and can be ticked as a close-out appendix. The task and error mode alignment tables stay on screen for now and are not yet in the report.

A photograph attached to a REBA, RULA, NIOSH or Snook assessment now lives inside the .ergsphr project file, in its own region, stored once by content however many assessments share it and checked on the way in by hash and by picture format. Copy the project to another folder or another machine and the reference panel, the report and the Snook carousel show the same pictures. Where a project from an earlier release records photographs whose files are not present in this copy, the REBA, RULA and NIOSH reports keep the card and print the sentence: Reference images recorded, the image files are not available in this copy of the project. Nothing is written to a temporary folder any more, no stored reference depends on the project's file name or a document's title, and every deletion of an image the product performs is confined to the product's own image areas. One number is worth knowing in advance: photographs do not compress, so a project carrying three full-resolution shots grows by roughly six megabytes. That is the right trade, and we are stating it so nobody discovers it.

Human Factors User Requirements are minted per category, SYS, PRO, TRN, TRA and MON, from counters that never reissue a number, which is a property clients rely on for audit. On every display and export surface they now carry a UR- prefix, so a requirement reads UR-SYS-01 in the register, its detail and dialogues, the issue link chip, the EHFA badge, the SHERPA forward-link column, the HFUR report tables, the CSV export and the Viewer package. The stored number is unchanged and CSV import accepts either form. Packages issued before this release keep the bare form; packages issued from now on show UR-. Prose an analyst has already written that cites a bare identifier is left as written.

An ErgoLens analysis built from still photographs alone can now be marked Ready on the strength of a still that the aggregate can score, rather than needing a processed recording, and the score it carries is read through one path by the overview, the capture table, the analysis section of the report, the in-app Analysis page and the Viewer's Findings board, so the same capture shows the same RULA and REBA figures on every one of them. A still's score also reaches its linked HTA node's cross-tool risk on save. An ErgoLens analysis is indexed as unscored until it holds a score, so an analysis without one neither raises nor lowers a project average. ErgoDelta's measure labels print once rather than with their scope repeated in brackets.

REBA can be reached in ErgoSphere by six routes, manual entry, the ErgoLens measurement funnel, the ErgoLens Review worksheet, the ErgoLens report and its Viewer board, ErgoSense and the stored report path, and the dossier read asked whether a posture scores the same on all of them. It now does, by construction. One domain definition holds the REBA legs score, the RULA legs-supported flag and the knee band, and one per-side angle mapper serves every measured route. The knee band follows Hignett and McAtamney (2000), Figure 1: plus one between 30 and 60 degrees of flexion, plus two at 60 and above, taken from whichever knee is the more flexed, because the paper says knee(s). The paper publishes no angle for the legs position score, so that score is the analyst's to set, bilateral weight bearing by default, and the platform no longer infers it from a single-view asymmetry; that is declared in the dossier as ErgoSphere's position. Analyst qualifiers such as shoulder raised now reach the Analysis step, import and playback as well as the worksheet and report. A guard discovers every scoring call site and asserts one score per posture across seven routes, six postures and six qualifier states. Saved ErgoLens captures re-derive their cached scores from the stored measurements when next opened, so a figure on screen may move by a point and the three surfaces then agree.

The REBA and RULA editors now take every value from the document on open, including the assessed side and the neck and trunk flexion, so a finalised assessment reads on screen exactly as it was signed. A new REBA document starts at the neutral neck of 10 degrees, set at construction rather than on load, and there is now one load seam for both editors, guarded by nine tests. The calculators, tables and bands were verified in an earlier dossier and are untouched. The three RULA sample assessments that ship with the product now compute their results through the calculator rather than carrying typed ones. Every project file in our own archive was scanned as part of this work and none needed correcting.

The HSE's manual handling assessment chart, INDG 383, gives the environmental factor three rows in every mode: No factors, green, nought; One factor, amber, one; Two or more factors, red, two. ErgoSphere had the second and third. The MAC editor's environmental card now carries a fourth pill, No factors present, mutually exclusive with the three conditions, so a benign environment can be recorded as a finding rather than left as an absence. Press it on a clean lifting assessment and the score bar reads 8 of 8, the derived pill reads G/0 and the Results stage opens with no dialogue. Leave the card untouched and it still reads not rated, 7 of 8, and the gate still asks, because not filled in and nothing present are different values. One code arm serves the lifting, carrying and team handling modes, a new golden case M-04 pins it, and deviation D2 in the MAC dossier is closed against pages 6, 11 and 16 of the leaflet. Task scores and bands do not move. An existing document with nothing ticked reads as it did until an assessor records the row.

ANSI/ISA-18.2-2016 clause 9.8 says a rejected alarm shall be documented with the criterion it failed to meet, and clause 9.3.1 gives the three criteria: directed to the operator, indicates a process deviation, abnormal condition or equipment malfunction, and requires a timely response. ErgoAIR recorded the disposition given to a candidate that fell below the care threshold, but not which criterion it failed. The requirement dialogue now offers the three criteria as tick boxes, enabled only while the row sits below the threshold, and a below-threshold row with none ticked reads Not recorded on the worksheet chip, in the report table and on the dashboard, never blank. The report's reclassified-items table gains a column, Basis (criterion failed), and states the clause 9.8 requirement in its prose. Five strings that had described the threshold test as operator action now read timely response, the standard's words, with a guard across the whole ErgoAIR string set. The dossier declares that applying a clause written for existing alarms to a candidate rejected during rationalisation is ErgoSphere's own extension, and records it as such rather than as conformance.

Page 41 of the STPA Handbook, Leveson and Thomas (2018), lists among the common mistakes: review any control action types assumed to be not applicable and verify that they are. ErgoTrace seeds four base unsafe control action rows for every control action, and a seeded row now reads not reviewed until the analyst either describes the hazard or ticks Confirm not applicable. A control action is complete when each of its four types is one or the other, and the page, the per-card count and the shell rail all read that from one pure function. The report prints No hazardous UCAs identified only when every type is confirmed; otherwise it says how many of the four have not been reviewed, and the completeness section says how many control actions are fully reviewed. Along the way a rule was set for the whole tool: a stage that holds recorded work is always reachable, so an older analysis keeps its Findings and Recommendations open while its seeded rows wait for review. CAST is untouched, because its rows are never seeded.

The handbook names two kinds of loss scenario on page 43: why an unsafe control action would occur, and why a control action would be improperly executed or not executed at all. The second kind has no unsafe control action to hang from, and ErgoTrace had nowhere to record it. Each control action now carries an Improper or no execution section with a description, a hazard link and two pickers taken from pages 49 to 51, where the failure sits, control path or controlled process, and what happened, not executed or improperly executed; a picker left unset prints Not classified, never a default. The report gains a table per control action and a completeness sentence naming the class. The causal factor picker now offers six entries in the handbook's own order, failures involving the controller, inadequate control algorithm, conflicting control actions, process model inconsistency, missing feedback and other, with two members the source does not publish retired from the picker but still readable on any scenario that carries them. The canvas gains the third edge kind the handbook describes on page 32, other information, drawn on the canvas, in the legend, in the report and in the Viewer. And because neither handbook publishes a priority scale, a recommendation now starts at Not set rather than at a middle value, and Raise as issue waits until one is chosen. Existing recommendations keep their saved priority.

Last release's rule for a findings card, one control drawn by both applications from one specification, now applies to a whole page. A single Findings page walks a tool's dashboard projection through the shared card factory, lays the cards out in two columns above a thousand pixels and one below, honours each region's declared columns and spans, and draws figures from a baked still: the editor's own bytes in the application, the verified package part in the Viewer, which refuses a missing or altered part. A registry names the tools that use it, and a tool joins only in the work that gives its editor the tab, because joining changes what the Viewer draws for every existing package of that tool. Four tools are on it: ErgoLoop, whose Findings tab came first, ErgoTempo, ErgoAct and SCTA. Nothing in the Viewer computes; the page reads what the analyst's application baked.

ErgoTempo's workspace ribbon now reads Home, Details, Findings, Help. Findings shows session information, four summary tiles, the session timeline with its segment table, and the task breakdown, without leaving the workspace, and a recording keeps its clock while the tab is open; a session that has not ended says so rather than printing a total. ErgoAct's stage tabs read Editor, Findings, Results, Help on both its editor and its Results page. Findings is the baked read-back the Viewer shares, six stat tiles with their baseline deltas, the completion-time distribution, the step breakdown, module utilisation, the sensitivity sweep when one exists, and the findings cards, while Results stays the live analysis page with Compare Models, which has no baked form. Findings is always reachable: before a run it says Run the model to read its findings here, and an edit that invalidates the run returns it to that sentence.

Nineteen tools already carried their steps as tabs in the shell header. Safety-critical task analysis was the last with a rail, a collapsible column holding four tiles, a numbered step list and a diagnostics readout. The rail is gone and the body is one column. The header now reads Task Overview, Task Analysis, Human Error Analysis, Recommendations, Review and Findings, then Governance and Help; Previous and Continue in each step footer move the underline; no step is gated. The new Findings tab is the shared page: a progress strip with the study spine across the top and the four tiles, Failures, SPF, Open Recs and Review, in one row; the seventeen diagnostics lines as four titled columns, Study, Error analysis, Measures, and Recommendations and review; and the task breakdown as a live HTA-style diagram that pans, zooms and selects in the editor, drawn by the same engine as the View HTA pop-out. In the Viewer the breakdown is the baked still. A study with no task step, no failure row and no recommendation shows one sentence naming all three. Step content, gates, save path and report are unchanged.

The Task Register's Spawn SCTA button becomes an Analyse dropdown with two entries, HTA and SCTA, each reading Spawn when no analysis exists and Open when one does. Spawn HTA creates an HTA titled from the task, links the two both ways, carries the site across, saves and opens the editor. A task carries one HTA and one SCTA, and every HTA task picker omits a task already linked elsewhere. The register's status column becomes Analysis, with one pill per linked analysis, HTA Ongoing or SCTA Complete, and the detail panel gains Linked HTA. The HTA session page gains the Linked context strip that SCTA already had, with Site and Task rows; linking a task sets the site and holds it read-only for as long as the link stands. On the SCTA session page, the task section at the top and the Linked context row below now route through the same code, so they always agree. An HTA saved before this release re-saves byte identical until a site is set.

Last release the HTA gained timing estimates, a Walk tab and observation runs. ErgoTempo is now a second producer of the same run. In ErgoTempo's setup, with a saved document and no session started, Import from HTA opens a picker: a list of HTA documents defaulting to the one already linked, the leaf steps grouped under their parents with a timed hint where an estimate exists, Select all and Deselect all, and a live count against the twenty-card limit. Ticked leaves become cards named by node number and coloured by parent lane; a re-import refreshes renamed nodes, and a node since deleted in the HTA becomes a badged card that is kept but never timed back. On End Session, and on any later save of that ended session, one run is written into the HTA under its own identity, so there is never a duplicate and nothing is written mid-session. In the HTA's playback the Observed run picker lists it as ErgoTempo followed by the session title, and the pooled statistics, the observed table, the whiskers and Adopt take it up unchanged; the deviations list treats an ErgoTempo run as order-free. ErgoTempo never writes an estimate into the HTA. Only Adopt does that, one row and one click at a time, and it is undoable. ErgoTempo's segments now store a monotonic duration, so a clock change during a session cannot move a timing.

Last release we parked a button that keeps the figure within joint limits during posing until we held a range-of-motion dataset we could cite. We now do. MIL-STD-1472H clause 5.8.4.3, Table XXXI, Range of human motion, gives thirty-six movements over eight body members as a mean minus one standard deviation and a mean plus one, and every row was cross-checked against the corresponding table in 1472G. A Comfort Limits toggle, off by default, sits in the Adjust group of the Pose ribbon. With it on, a joint stops at the comfort band instead of the structural limit, the jog gizmo's restraint arcs read the same band, and the tooltip and status line carry the full declaration: the standard, the clause, the table and its pages, that the values are not percentiles, that the subjects were male, and that the mapping of the table's rows onto the figure's cones is ErgoSphere's own. Two rows on which the two editions disagree, shoulder flexion and neck extension, are withheld, so no comfort band is derived for those. Comfort only ever tightens a limit; it never creates one. The structural cones stay on everywhere, including the Viewer, and the toggle is not saved in the design.

The second held item. An Envelope toggle joins the Show group and draws a clearance volume around the figure in the 3D perspective view, at true scale in population millimetres, from the five ANSUR II rows declared last release. For a seated design it draws a hip prism from hip breadth sitting and abdominal extension depth sitting, a shoulder plane pair from bideltoid breadth and a thigh clearance plane pair; for a standing design, one plane pair from hip breadth standing, with the four rows that were not measured standing refusing with their reason; a reclined posture, no recorded posture and an unknown population each refuse and say why. A combined-sex design draws one solid per published sex value, each named. An axis the dataset does not price uses a display extent of 200 millimetres, declared as ErgoSphere's. The envelope is display only: it takes part in no occupancy or contact calculation, is never hit-tested, never colours, counts, passes or fails, and no surface uses the words clearance or accommodation of it. One sentence, read identically by the panel, the report and the Viewer, states that the envelope is at true scale, that the figure's own breadth and depth are not measurements, and that the gap between them states nothing. The report's perspective figure carries it when the toggle was on at capture, and the Viewer gains an Envelope layer with a two-line readout. A clearance check against placed items is not built, and a joint accommodation statement stays fenced off until a multivariate source is held.

In quad view, all four panes are now built once and render for the life of the view, so clicking a quadrant moves the amber band, the gizmos and the input and changes nothing about what the other three are showing. Every quadrant draws its own analytic overlay whether or not it is active, the grid, the reach envelope, labels, dimensions, measurement lines, the posed eye, the ERP wedges and glare, and carries its own Wire, Edges, Solid and All strip, its own X-ray toggle and its own view label, so one quadrant can be wireframe while the others are solid. The eye view's coloured field legend, its pitch and yaw compasses and its field rings now stay in whichever quadrant shows the eye view; only Apply Gaze waits for that quadrant to be active, because it commits a gesture. The view cube travels with the selected quadrant, as it did, and a double tap on it is now measured in the cube's own coordinates, which makes it reliable. The ERP readout pill, a document-level figure, stays with the active cell.

A detailed imported workstation is occupied one voxel row at a time, and three overlays that were designed around boxes showed it: the contact shadow was a stack of overlapping greys, a desktop's reach wash was a hundred and fifty translucent strips, and a contour that should have run round the desk broke into pieces. The shadow is now one flat grey, a silhouette drawn once on a four-millimetre grid and laid on the floor as one quad, in the editor, the report's perspective figure and the Viewer. Adjacent voxel runs are merged into rectangles before the reach wash is clipped, and there is one mesh per surface and band, so the printed reach areas do not move. Contours are sampled over the whole surface, restoring continuity and their labels. Each item now has one work plane: the level with the most columns between 550 and 1200 millimetres above the floor, with levels from 30 below to 150 above folded into it, and the report states that band as ErgoSphere's own declared position along with what was folded and what is not measured. In the 3D view the wash, the ISO working areas and the contours are cut against one rectangle at work height spanning the largest connected region, which is presentation; the plan view and the report keep measuring the work plane. Designs with imported models will draw and read differently in these overlays. Box items are unchanged.

The nine-entry Contact flyout beside Interact, kept as the keyboard, screen reader and off-screen route into contact selection, now shows a tick on the active contact and nothing while Interact is off. On the Pose gizmo, a hinge such as the elbow or knee showed one ring; the two axes the joint does not turn on are now drawn as greyed, disabled rings that never respond to hover or drag, a deliberate exception to the platform rule that visible chrome is pressable, so a joint's degrees of freedom can be read at a glance.

Last release began moving each findings card onto one control drawn by both applications, with five cards done. Sixteen tools now draw their results cards that way: REBA, RULA, NIOSH, SCTA, DRT, ATWIT, NASA-TLX, SART, MAC, Snook, SWAT, CREAM, ErgoLens, ErgoDesign, RAPP and ART, on a set of shared card kinds that grew to cover capacity erosion, readout grids, pill registers, banded actions, zone heroes, population grids, chip rows, stat boxes, ladder rows, advisory banners and ring summaries, all inside one card frame with the application's shadow. What is not a card stays a live block by design: the charts on DRT, NASA-TLX, SART, SWAT and ATWIT, SCTA's task breakdown, and ErgoLens's recorded-session picker. Readers will notice that the Viewer's ErgoLens board now takes the Report tab's two-column layout and draws the real 270-degree ring, that NIOSH's capacity bar carries its end labels, and that a Snook result the method refuses shows the recommendations card's sentence rather than a blank. One rule ran through every card: absence never scores, so a NIOSH task the equation does not cover prints the manual's reason on both surfaces and an ErgoLens joint with nothing behind it reads No data. A NIOSH lifting index of exactly 1.0 now bands as Low in the Word report, per section 1.4.3 of publication 94-110. The new cards appear in a fresh export; a package in the field keeps drawing as it did.

The final score hero shared by REBA, RULA and NIOSH pairs a numeral and a risk pill with a dial. In a narrow window, which the Viewer launches into, the dial now drops beneath the readout when the two will not fit side by side, and only when the card is narrower than the numeral itself do all three scale down together, so nothing is ever cropped. Nothing on the wire changed: existing packages benefit the moment they are opened in the new Viewer.

The Viewer's task hierarchy screen now takes the application's own furniture. The diagram well is white in the light theme and navy in the dark, as the editor draws it. The tree rail is the application's tree card, with its search box, a filter row reading All, High Risk, Unassessed, Physical, Cognitive, Reliability and Safety-critical, fourteen-point rows and the blue selection wash, behind a draggable splitter that double-taps back to its default. The diagram card carries the application's toolbar band, Risk Mode and Icons on the left, Fit and Restore on the right, above the canvas and a collapsible playback dock with the same transport, Restart, step back, Play, step forward, scrub, a readout and speeds from half to four times, over a Gantt timeline drawn to the application's frame. It reads the replay keys that packages already carry, so an existing HTA package with a schedule needs no re-export. Trace, Observed, Story, the handoff register and the scenario picker are not offered, because the package does not yet carry that data. The SCTA tree takes the same fourteen-point rows.

Until now nothing in the solution could instantiate a real window control under test, so every claim that a card looked the same in both applications rested on a source scan and a person's eye. A small unpackaged host now mounts a real shared card in a real window and reads the measured values off the live element, wrapped as ordinary tests that run on a desktop session. The first four checks are in: the score derivation card's diagram host stands at its declared 336 pixels; the final score numeral is 96 points, bold and unscaled at a normal width; the shared frame and its brushes resolve and paint the same under each application's own resource set, with 31 of the 43 keys the shared controls name proven identical and six that are one-host by design; and the card's absent and unavailable states show their notice and create no web view. Each check was proven by mutation, and the host's first finding, three brush keys that fall back to a default colour on both surfaces, is already in the queue. It is the missing third leg of the card programme.

An audit read every one of the 149 tool pages and the 7,447 text elements on them, grouped the fifty-four editors into four families by the skeleton their body is built from, sixteen on the workspace shell, eight on its panels, twenty-eight on the ribbon-and-card form and the two capture journeys, and found the families sound and the drift inside them: the same text role set at different sizes and weights from page to page. More than fourteen hundred hand-set sizes and weights were converted onto named styles, four new roles were added for subheadings, labels, strong body and eyebrows, and the rulings were written down: body at 12, card titles at 16 semibold, and three readout tiers at 22, 32 and 48 in the platform's mono face, which also replaces the last of the Consolas literals on NASA-TLX, Nielsen and SUS. The eight panel-family tools take the workspace family's status strip tokens. ErgoEnsemble's results page was rebuilt as a two-column grid with Mission Success beside Time to First Error and Per-Leaf Failure beside Critical Path. You will see it as RULA, REBA and NIOSH labels settling to one size, ErgoTrace stage titles and Nielsen and SUS results titles coming down to the card title size, and ErgoGlare's and ErgoEnsemble's headline readouts landing on the 48 tier. ErgoSense's four pages, the colour literals and the ErgoDesign, ErgoLens, Snook and CREAM surfaces are the next passes and are named as such. Nothing here touches data, documents or issued packages.

Projects saved by 1.6.2 and earlier open in 1.6.3 and keep their data, and no file format or migration was needed this release: every new field is additive and omitted when empty, and every legacy payload is pinned by a test that reads it literally. HTA and ErgoTempo files re-serialise byte identical. A MAC document with nothing ticked on its environmental card reads 7 of 8 as it did until the assessor records the No factors row. An ErgoAIR requirement without a recorded basis reads Not recorded. An ErgoTrace analysis opens with its seeded rows awaiting review, and every stage that holds recorded work stays reachable. ErgoLens captures re-derive their cached scores on open; unscored captures stay unscored, and titles and labels are untouched. A reference photograph recorded by path in an earlier release resolves exactly as before while the file exists, and moves into the project region on the next save. ErgoGlare, Link Analysis, ErgoTempo and ErgoDelta documents join the assessment register the next time they are saved with content.

Three things draw differently on an existing document without any data changing. ErgoDesign designs with imported models show the one-plane shadow, the merged reach wash, continuous contours and a single work plane per item, and their report's work-surface paragraphs read to the declared band. The fifty-four editors carry the converged type ramp. And the ErgoLens Review gauge, Analysis headline and report card now agree on a capture's REBA and RULA scores, which for a small number of captures means a figure moving by a point to match its stored measurements under the one definition described above.

Nothing here rewrites an issued package. A review still produces a new file and the sealed region of the original is never touched. To carry the new Viewer content, the shared findings pages, the migrated cards, the ErgoDelta report, the UR- prefix and the Envelope layer, an assessment is re-captured in its editor, marked Ready again and composed into a new package. Two things reach older packages without a re-export: the final score card's reflow, and the HTA screen's new furniture, which reads the replay keys packages already carry. The four workbook packages on this site were reissued from this build.