The clock is whichever phone is already at the pass
Two features shipped in the web console recently: check-in exemptions, which excuse one named person from one workspace check, and proxy check-in, which lets a named person clock a colleague in. Both are now in the app, on iOS and Android.
For exemptions that's a convenience. For proxy check-in it's the whole point.
The console was the wrong room
An exemption is set once, when someone joins or their job changes. It's a settings decision, and settings decisions happen sitting down. Having it in the app is nice; nobody was blocked without it.
Proxy check-in is the opposite. It happens at 18:40 with one hand free, because the commis has just walked in and their phone is in a locker. The person doing it is standing at the pass, not at a desk with a browser open. A feature that requires a laptop during service is a feature that doesn't get used during service — it gets remembered at 23:00 and entered as a correction, which is precisely the manual-backfill workflow this was meant to replace.
So the version that matters is the one on the phone that's already in the room.
What it looks like
A sheet, and the body is a list of people rather than a form. There's no date field and no reason box, because a live punch isn't a correction — the only decision is who, so that's the only thing on screen.
Tap a name. It punches at the current time and toggles the same way a scan does: someone already clocked in gets clocked out.
Your location, not theirs
This is the part that keeps the feature honest, and it works the way it has to rather than the way you might guess.
The workspace's geofence and network checks still run — measured against the phone doing the tapping. Checking the absent colleague's position would be meaningless: the entire premise is that they aren't holding a phone. So the shift lead has to actually be at the restaurant to punch anyone in, and can't do it from the bus home.
The app reuses the same location logic as ordinary check-in, which prefers a recent cached fix over a fresh GPS lock. That isn't laziness — indoors, in a building with a roof, a fresh high-accuracy lock frequently never returns before the request times out, and a check-in with no coordinates fails a geofence outright. A ninety-second-old fix from the same room is both faster and more likely to be right.
If location permission is refused, the app sends no coordinates at all and lets the server decide. It refuses when the fence is on and coordinates are missing, and that refusal — with its own message — is more useful than the app guessing on the server's behalf.
Who sees the button
Only someone the owner has switched it on for. Not managers, not owners, not anyone holding an attendance permission — none of those grant it. It's a per-person switch on an employee's record, off by default, and it's the only route in.
That means the button simply isn't there for almost everyone, which is the correct amount of surface for something that lets one person touch another person's timesheet.