Correct worked time without rewriting the evidence.

Raw evidence is read-only

GET /work-events requires work_events:read. There is no organization-API write operation. Employee scans remain behind credential and transition validation.

Canonical effective entries

GET /timesheets requires timesheets:read and returns stable IDs, discriminated fixed/mobile context, effective time and break, origin, state, adjusted flag, and revision. Source references appear only when the key also has work_events:read.

from/to use interval-overlap semantics, so sessions crossing a period boundary are not dropped.

Create, correct, or void

timesheets:write, Idempotency-Key, and a reason are mandatory. Corrections and voids also require the latest ETag in If-Match.

• POST /timesheets creates one complete closed manual entry and never an active check-in.
• PATCH /timesheets/{timeEntryId} changes effective values. Scan-derived employee/context/evidence remain immutable.
• POST /timesheets/{timeEntryId}/void creates an audited void revision without deleting history.

Safe audit and export evidence

GET /audit requires audit:read and returns allowlisted actor/action/change fields—never unrestricted snapshots, credentials, typed addresses, precise positions, or private actor IDs.

Corrections return stale export manifest IDs. Internal reports rebuild from current revisions; payroll is never resent automatically. A replacement dispatch is explicit, revision-specific, and linked to the prior manifest.

Capability gate

timesheets:write cannot be granted until the organization entitlement and rollout proof are enabled. Disabled writes return 409 FEATURE_NOT_ENABLED. The pre-adoption alignment keeps /v1 and 1.0.0; issued-key inventory and access logs must prove no external consumer before release.