The spreadsheet in the middle is where payroll goes wrong. Hours are transcribed from one system, adjusted by hand, and the adjustment is invisible by the following month.
Vestibel generates payroll lines directly from attendance, and the generation is idempotent — "regenerate from attendance" can be pressed as often as an operator likes while corrections arrive.
What makes that safe is that a line a manager has locked is never touched by a regeneration. The employees behind locked lines are excluded from the rewrite entirely, so a deliberate override survives every subsequent recalculation.
Generation is refused once a run advances past draft. At that point its lines are frozen, which is what makes a payroll run something you can defend afterwards rather than a view that keeps changing.