BUILT. SHIPPED.
WORTH A NOTE.

The rules were agreed months ago in a document the foreman has never seen. Then at seven in the evening, twelve hours into a shift, he is asked to apply them from memory on a phone.

Standby billed at full rate. A four-hour minimum nobody applied. Travel that should have started at the yard. Every one of those is a person guessing at a number somebody else wrote down.

In Pit & Rig the rules live on the purchase order. Regular rate, overtime after eight, double time after twelve, standby multiplier, travel portal to portal, minimum hours. The foreman enters hours. The line prices itself.

He can't get it wrong because he is never asked to be right about it. That's the part worth saying plainly: this isn't a check on the foreman, it's removing a job that was never his.

And when a minimum applies, the ticket says so — worked two hours, four-hour minimum applied — so the person approving it doesn't have to go looking for the contract.

Rain comes in. Wind gets up. A second crew arrives with a machine nobody planned for. The assessment written at the tailgate is now describing a job that no longer exists.

Everybody knows the answer is to redo it. In practice that means a new sheet of paper, or nothing, because the old one has six signatures on it and starting again feels like losing them.

A revision in Pit & Rig creates a new version with its own number. The original stays exactly as it was signed, with every signature intact. Nothing is overwritten — people signed what they were shown, and that has to remain true.

It asks what changed, and requires an answer. Ground softened after rain, added a spotter for the excavator. Six months later that sentence is the difference between a record and a form.

Anyone who signed the previous version needs to acknowledge the new one, and the roster shows who hasn't. That's the question that matters if someone is hurt at three under conditions identified at two.

Most hours get written down three times. A hand tells the foreman, the foreman writes it on the ticket, the office types it in again for payroll. Every copy is a chance to lose a quarter hour, or to bill someone who was on days off.

Every hand can now have an Operator account. It's free and it doesn't take a seat. Operators check in and out from their own phone, and log the day's hours. Turn reminders on and anyone who hasn't logged a workday gets a nudge at the end of it. They see their own hours and nothing else — no rates, no tickets, no client.

Check-in is measured against a fence you draw around the site on a map. Inside the fence goes straight through. Outside it, or with no location at all, isn't refused — a pickup at the lease gate is still a hand at work — but it's flagged, and the supervisor sees it with the reason. Corrections need a reason too, and the original times stay on the record.

Hours go to the crew foreman first, then the site foreman, then the office. Nobody approves their own. A supervisor can enter hours and days off for a hand without a phone, and that entry still needs someone else to sign it off.

Approved hours move onto a draft labour ticket in one step, priced from the PO's rate sheet like any other line. The approved hours never change after that; billing lives on the ticket. Try to move the same hours twice and the second attempt is refused, so nothing gets billed twice.

At month end the hours export as a PDF or a CSV. Your client never sees any of it — timesheets stay inside your company. Payroll itself isn't built yet: the CSV is what you hand to whoever runs it today. Timesheets are included on every plan.

Every job has one. A light tower that finished its work three weeks ago, still on rent, renewing every 28 days because nobody on site knew what it cost and nobody in the office knew it was still there.

Rentals now have their own register. The foreman checks units in from the site — type, unit number, a photo of the serial plate and one of its condition — up to twenty-five at a time. Off-rent and check-out are their own steps, with return and damage photos and the final meter reading.

The office sees the burn. Accrued is what the unit has cost so far, day by day at the rate in force that day. Committed is what you owe for rental periods already started. And if it went back today, the cheapest mix of day, week and 28-day rates says what the bill would be. Every figure is labelled an estimate, because the vendor's invoice is the real number.

Three days before a unit's next period starts, owners and admins get an email listing what each renewal will add. The foreman who checked the unit in gets the same list without the dollars. Set a planned return, or mark the unit as kept through renewal, and the warning stops.

Rentals bill through tickets like everything else. Link a unit to the PO's equipment rate and it shows up on the foreman's ticket. A unit can't be billed for a day it wasn't on site, or twice for the same day on two tickets. The PO page shows what rentals have billed, what's pending, and what the next thirty days will add against what's left.

Foremen never see a rate — not a hidden column, but money the server never sends them. Units can be swapped or moved to another site, and the rate and PO links follow when they should. QR tags and plate scanning are next; today the unit number is typed.

A 14/7 crew works fourteen days and has seven off. Everybody on site knows it. Software usually doesn't, so it reminds people on their days off and flags hours as missing for days nobody was meant to work.

Give a crew its pattern — days on, days off, a start date — and whether it works days or nights. The Crews page shows who's on shift today. When a foreman pulls a crew onto a ticket, on-shift crews come first, each shows which day of the hitch it's on, and only the people on shift are ticked.

Each crew can have a crew foreman, picked by the office. The crew foreman approves the crew's hours first, can enter hours or a day off for a hand without a phone, and can invite the crew into the app. Another foreman can't edit a crew someone else leads.

A day off shows as off, not missing, and stops the end-of-day reminder. A worker's own workdays override the crew rotation, and the rotation overrides the company's workweek — so the person on a different pattern from the rest of the crew isn't chased for it.

Crew templates save a day's lines — people and machines — against a PO. They store which rate applies, never the price, so lines are priced from the PO's rate sheet when the template is loaded. Overtime is saved as one whole shift with the worker's name on it and split again by the PO's overtime rule.

What this isn't: a dispatch board. There's no calendar for sending people and machines to jobs yet. A rotation today decides who's expected at work, and that's all it decides.

Wet, soft, rutted, iced. Four words that mean four different things to four people, and all of them end up in the same box on a form.

You can now photograph the hazard, the control in place, the state of the ground — and it stays attached to the assessment. On a phone the button opens the camera directly rather than a file browser, because a supervisor in gloves is taking the photo now, not choosing one from a library.

Images are scaled down before they upload. A modern phone photo is several megabytes and the person taking it is usually on one bar in a pit. That's the difference between a record that exists and one that timed out.

They print on the assessment PDF too. A photograph nobody can produce after an incident may as well not have been taken — and the PDF is the copy that gets handed over.

A photo can be removed before the assessment is signed, for the thumb over the lens or the face nobody agreed to put in a permanent record. After signing it can't, because removing evidence from a signed record is the opposite of what the record is for. Revise it instead, and both versions stay.

Ask an owner how a client is doing and you'll get a feeling. Busy. Slow to pay. Good people. What you rarely get is a number, because the number lives across forty tickets and six invoices and nobody adds it up.

The report page does. Filter by client, project, PO, site or crew, and the totals move as you do — it's all loaded, so changing a filter is instant rather than a request to the office.

Four figures across the top, and the distinction that matters is the first two. Earned is approved work: money you have made. Invoiced is money you have asked for. The gap between them is revenue sitting in your own system that nobody has billed.

Most dashboards show one number for both. That's how a contractor ends up believing he's owed more than he's sent out.

Group by crew and a ticket with two people on it appears under both names at its full value. That answers who was on what work, not how to split the money — and the page says so, because an unlabelled column gets read as a payroll split.

Minimums are standard in crane and equipment hire. Four hours, eight hours, sometimes ten. The contract says so, both parties agreed to it months ago, and nobody in accounts payable is holding that contract when the invoice lands.

So a line reading “2 hrs × $300 = $1,200” gets queried. Not because anyone is being difficult — because the arithmetic on the page doesn't work, and the only person who can explain it is the foreman who went home three weeks ago.

Pit & Rig has always applied the minimum correctly. What it didn't do was say so on the ticket. It printed the hours worked next to a total calculated on the hours billed, which is exactly the shape of a mistake.

Now the line shows the billed quantity, with a note underneath: worked 2.00 hrs, 4.00 minimum applied. Same number, same contract, and an AP clerk can approve it without picking up the phone.

It's a small change. But a signed record that can't explain its own arithmetic undermines the reason for signing it.

POs move. The client adds scope, a second machine goes on, the ground turns out worse than the survey said. That's normal, and every contractor handles it the same way: a phone call, an agreement, and a number that changes.

Until now the only way to reflect that in Pit & Rig was to edit the PO's value. The number would be right and the reason would be gone — which is fine until somebody asks why a PO issued at $150,000 is now $180,000, and the only person who knows has left.

Change orders are their own record now. An amount, the client's own reference — CO-004, whatever they call it — and what changed. The PO page shows the arithmetic rather than just the current figure: as issued, changes, current.

A correction is another change order, not an edit. That's deliberate. A change order you can quietly rewrite is worth nothing in a dispute, which is the only time anybody reads one.

Standby on the second machine — does it apply? The client's rep said something about travel that doesn't match the PO. The hours are right but the cost code might not be.

None of that means the ticket is wrong. It means one person isn't sure, and the next thing that happens is either a phone call or a guess. Both cost more than the question is worth.

Now a draft can go to someone in the office, or to a named person, with a note saying what to check. They open it, change whatever needs changing, and send it back. It stays a draft the whole time and the client sees nothing.

When it comes back, the email says what moved: one line added, total up $850, with the old figure struck through. Not “someone looked at it” — the actual difference, because you're about to put your name on it in front of a customer.

It's a conversation, not a hand-off. Either side can send it back again, and the whole exchange stays on the ticket.

Ask a contractor how safety paperwork works and you'll hear the same shape: an FLHA gets filled out at the tailgate, signed by whoever is standing there, and filed. Separately, a ticket gets written at the end of the day listing who worked and for how long. Two documents describing one shift, kept in two systems, reconciled by nobody.

They disagree more often than anyone admits. Someone signs on at the tailgate and then goes to another job. Someone arrives at nine and never signs at all. A name on the ticket was never on the assessment. None of that is malice — it's what happens when two records are maintained by different people at different times of day.

It only becomes visible after an incident, when an investigator lays the two side by side and asks why they don't match. By then the answer is a year old and nobody remembers.

In Pit & Rig they're linked. Attach the morning's assessment to the day's ticket and the system compares who signed on to who is being billed. If someone signed on at the tailgate and isn't on the ticket — or is on the ticket and never signed on — it says so, on the ticket, before it's submitted. Not in a monthly report. While it can still be fixed.

The tailgate itself runs from a phone. The supervisor shows a QR code; the crew scans it from their own phones, reads the hazards, taps to acknowledge any control marked critical, and signs. No app to install, no accounts to create, no passing one tablet around a circle in the cold. The supervisor's screen fills in as each person signs, so they can see who's still missing before the machines start.

Ordinary hazards are read, not tapped. Only controls marked critical require a deliberate acknowledgement — because making someone tap through fifteen items is how acknowledgement stops meaning anything.

Anyone who isn't happy can raise a concern instead of signing. It notifies the supervisor and explicitly does not count as a signature. If they sign later, the record keeps both: the concern, and what changed.

Conditions change, so assessments can be revised mid-shift. The ground softens, the wind comes up, a second crew arrives. A revision creates a new version with its own number; the original stays exactly as it was signed, along with every signature on it. Nothing is overwritten, because people signed what they were shown.

The assessment carries the conditions that actually applied — location from GPS, weather captured for the work date rather than the day someone typed it up — and photographs of the hazard, the control, the ground. When an incident is investigated the question is always the same: what did the crew know, and can you prove it. A signed record with a timestamp, a location and the conditions of the day answers that. A photocopied sheet in a truck usually doesn't.

None of this is a safety module bolted onto a billing product. It's the same record, and that's the point.

The safety module is part of Pro (current pricing is at pitandrig.com/pricing). The plan includes ten full users, with additional full users at $40 per month. Crew members use QR sign-on for the safety record.

The first question an accountant asks about any system claiming to be a source of truth is what stops someone editing last quarter. We didn't have a good answer, so we built one.

Three states. Open is normal work. Closed-for-month-end blocks foremen but lets owners and admins post with a written reason — every override is recorded and counted, because real month-end lives in that state for a week or two and pretending otherwise just means people lock late or not at all.

Locked means locked. No override, no admin exception, no support escape hatch. A lock somebody can quietly step around isn't a lock, and the first time it's used the claim that the books are final becomes untrue.

Periods match on the work date, not the date someone typed the ticket in. A ticket written today for work done on the 28th belongs to August — backdating is the entire thing this prevents.

Contractors bid against each other. A rate sheet is a competitive secret, and a PO value tells a competitor exactly what a job was worth. So the question that matters isn't whether we encrypt data — everyone does — it's whether Company A can reach Company B's records at all.

Three things enforce that. Your organization is written into your session token by our servers, never read from a request — so changing an ID in a URL doesn't change who you are. Every API route resolves ownership from the database before it returns anything. And our database rules permit no client-side writes whatsoever: every change goes through a server that checks first.

We also test it adversarially. Our test suite includes checks that fail the build if a route reads a field nobody writes, if a financial control is enforced on one path and missing from another, or if two functions that compute money drift apart. Several of those tests exist because they caught something real.

We're not going to claim we've found everything. We run these audits assuming the code is broken and looking for where — and when we find something, we fix it and add a test so it can't come back quietly.

Most field software captures a signature as a picture and staples it to a record. That proves someone drew something. It does not prove what they were looking at.

When a client rep signs a ticket in Pit & Rig, we hash the commercial facts of that ticket — the lines, the quantities, the rates, the total — and store the hash with the signature. The PDF generated at that moment is frozen and stored as-is.

The practical result: if anything about that ticket changes afterwards, the stored hash no longer matches a freshly computed one. Our own integrity tools recompute it live and report the divergence. Nobody has to remember to check.

Every signed ticket also carries a QR code. Scanning it opens a public verification page showing the frozen snapshot — the total as signed, not the total as it stands today. Anyone holding a printed copy can confirm it in ten seconds without an account.

This is the difference between a record and a claim. We wanted a record.

A tailgate meeting with twenty people used to mean passing one tablet around a circle in the cold, or a paper sheet that gets transcribed later and sometimes not at all.

Now the supervisor opens a sign-on session and shows a QR on their screen. Everyone scans it, reads the hazards, acknowledges any critical controls, and signs — from their own phone, with no account and no app to install. The supervisor's screen shows who has signed and who hasn't, updating as it happens.

Two details we spent time on. Ordinary hazards are read, not tapped — only controls marked critical require an acknowledgement, because making someone tap through fifteen items is how acknowledgement stops meaning anything. And there's a button to raise a concern instead of signing, which notifies the supervisor and explicitly does not count as a signature.

The tablet still works for anyone without a phone. Both routes land in the same roster.