- Shipped
- 12 Agosti 2026, 22:00 UTC
- Author
- kamo
- Commit
- bfae15d
The nav clock punched straight off the click. Every other control in that bar is idempotent or trivially undoable; a punch is a wage record that afterwards only an HR admin with a mandatory written reason can correct — and the button sits one pixel from Logout. It now raises TimecardPunchConfirmDialog, built to the standard of NewSupportRequestPopup and deliberately not a copy of it: that card is an alert that interrupts, so it breathes, refuses its backdrop and arms its buttons late. This one was asked for by a click, so it arms at once and closes on Escape and on the backdrop. Green for in, amber for out, because the two outcomes have to be told apart before a word is read. Its centrepiece is a clock ticking to the SECOND, and the copy says outright that the time recorded is the moment of confirmation rather than the moment on screen while deciding — the point being that hesitating is free and nothing is written until you say so. The first tick is aligned to the second boundary, so the readout agrees with every other clock on the member's screen instead of landing wherever the click did. Behaviour that changed with it: - the idempotency key is minted when the dialog OPENS and reused for a retry. Per-attempt keys were the bug this prevents: a request that timed out may well have landed, and retrying under a fresh key is a second punch on a wage record. - the action is frozen at open time, so a 60s poll flipping the clock underneath the card (a punch from their phone) cannot change the question mid-answer. - the optimistic flip is gone. It existed because the punch fired off the click; the member now watches a card that stays up until the server answers, so a guessed state would only be a chance to show the wrong one. - a failed punch holds the card open and says so. Silently reverting an icon is no way to learn about a punch that did not happen — that surfaces days later as a missing-punch exception on the timecard. - switching identity (god-mode sudo, session switch) drops an open confirmation, which would otherwise write the previous member's punch against the new one.