Every liter has a source, a person, and a time

The system supports a mobile tanker — with its plate, assigned driver and cumulative flow meter — and a fixed station identified by name and location that field staff draw from directly. Each type has its own evidence requirements: a tanker fill demands five photos including the tanker meter before and after, a station fill four photos plus the dispensed quantity. In both cases the machine's own fuel-gauge reading is captured before and after the fill — the true measure of what the equipment actually received, not what was claimed on paper.

The server refuses a record without valid coordinates and a timestamp matching the actual moment, rejects fills for decommissioned units or suspended sources, and blocks resubmission of identical readings within minutes. The data then passes nine automatic checks — from tank-capacity overruns and meter rewinds to a suspicious gap between what was dispensed and what the machine actually received, off-hours timing, and consumption that breaks the vehicle's statistical baseline. Clean fills are verified automatically; flagged ones stop for human review and never pass on their own.

The flags raised at submission are frozen into an immutable copy, and the approval gate reads that copy — so editing the readings to clear a critical flag and then approving solo does not work. A fill carrying a critical flag requires two approvals from two different people, and the system explicitly rejects a second approval by the same person who gave the first. Every approve, reject or edit lands in an append-only audit trail carrying the actor's name and the transaction's state before and after the decision.

Each source's balance is computed, never typed: the opening comes from the last physical dipstick count, deliveries are added, approved issues subtracted, and the book balance stands against the physical one with the gap valued at the company's approved diesel unit price. Field counts start by scanning a code on the tanker itself, and a photo of the gauge plus coordinates are required before a reading is accepted — no number typed at a desk. The variance is computed for the period since the last count, so you learn when the diesel went missing, not merely that it did.

Closing a period separates maker from checker: whoever submits the settlement with the closing dipstick reading cannot approve it, any overlap with a previously locked period is rejected, and a reconciled settlement is frozen against edits. While one awaits approval, the source accepts no new fills until it is decided. Each driver carries a trust score recomputed statistically from their full history at every final decision — a colluding supervisor cannot farm it upward with repeated approvals — and fills by low-trust drivers are flagged automatically.