Restaurant mein staff paisa kaise nikaalta hai — aur chaar controls jo bina manager ke rokte hain.

No statistics here: the numbers usually quoted are American and unsourced, and there is no honest Indian figure. What there is, is the same five patterns every owner who has run a counter for a year has seen:

• The plate with no bill. A regular pays the waiter in cash, the kitchen cooks it from a shouted order, the register never hears about it.
• The discount nobody asked for. The guest pays the full ₹892; the bill shows 10% off; the difference stays at the counter.
• The void after the food went out. The dish is cooked and served, the line is deleted before settle, the cash for it never reaches the drawer.
• The reprint. One bill printed twice; the copy handed to the next cash-paying table for the same amount.
• The drawer and the phone. A paid-out with no slip; a guest's UPI sent to a personal QR held up at the counter.

Four controls close all five, and a Desktop App that enforces them means you do not have to stand at the counter to have them.

The rule for the kitchen is one sentence: cook only what the screen or the printer says. If the ticket did not come from the Desktop App, the dish does not get made. Then every plate that leaves the pass is already a line on a bill, and the first leak is gone. The Desktop App makes it easy to keep: firing takes one tap, the ticket carries the table and the round, and the kitchen screen shows only what was fired: a shouted order has nowhere to appear.

Once fired, a line is locked to that table's bill. Its quantity can come down (three waters, one returned, billed for two, no manager) but it cannot go up (the kitchen only cooks what a ticket named; a plus opens a new line for the next fire) and it cannot reach zero without the next control.

Removing a dish the kitchen has already been told to cook is writing off real food, so the Desktop App treats it as one. Whoever removes a sent dish picks a reason from a fixed list (customer changed their mind, kitchen cannot make it, rung on the wrong table, wrong item rung), and the void is recorded under whoever is signed in. There is no manager PIN to fetch, the same as on the captain app: a queue at the counter cannot wait for one. What makes the control work is that the name on the void can only be the person who did it, so give every person their own sign-in PIN; a shared login turns every void into nobody's. The line stays on the bill struck through with the time it was sent, so the plate is real until someone tells the kitchen, and the write-off stays on record with its reason and its name.

Discounts are handled by role rather than by PIN in the Desktop App. An owner, manager or cashier at the counter can apply one directly (a queue cannot wait for a manager) and every discount is recorded against the PIN that applied it and adds to the Discounts line on the day's report. A waiter on a phone cannot discount alone: a discount asked for at the table routes through a manager's PIN, because money coming off a bill from a handset in the dining room is exactly where a second person should sign.

Reprints get the same treatment as voids: every copy is stamped DUPLICATE with its copy number, keeps the original invoice number and date, and is recorded on the ledger with who asked. A duplicate handed to the next table cannot be passed off as their bill.

The newest leak is the oldest one in new clothes: a guest scanning a QR that belongs to the person at the counter, not to the shop. Print your merchant QR on the counter and on the bill, and make it the rule that no guest pays to a phone screen. Then the UPI total on the day's report should match your bank app the next morning to the rupee, because every UPI settle in the Desktop App was to the same account.

The Desktop App records the tender on every bill (UPI, cash, card, part-paid) and the dashboard's payment mix shows the split for any day. A cashier whose cash share is higher than everyone else's on the same shifts is worth a look; a cashier whose UPI share suddenly drops is worth a look sooner.

Count the drawer before looking at what the Desktop App expected. If the cashier knows the target, the count matches the target: that is not dishonesty, it is how people count. Blind first, compare second, and the variance is a real number: opening float plus cash sales minus paid-outs, against what is physically there. A paid-out (the vegetables, the auto) needs a slip, and on a phone a manager's PIN.

The close itself takes five minutes in the Desktop App: last night's leftovers decided (an empty stray tap discarded; for a check with food on it, the sheet asks whether the money came in, and only "No, the guest did not pay" writes it off, with a reason and a manager PIN), the bills issued per series listed with a warning if a number is missing. The day-end report post is the eight lines to read every night; the staff PINs and roles guide is how to set up who can do what.

None of this is surveillance. A camera catches the theft after the money is gone; a control makes the money not go. And every one of these protects the honest cashier as much as it catches the other kind: a blind count that matched is proof, a reason on a void means food the kitchen could not make is recorded as the kitchen's problem, and a discount log means the owner stops guessing. Staff who are doing the job right tend to like a Desktop App that can show it. One thing to be straight about: the names behind a discount, a void or a reprint are on the order ledger today and not yet on a screen. The reason and the totals are; the who is next.

All of it works offline. Fired lines locking, the void reason, the DUPLICATE stamp, the day close: the Desktop App enforces every control on its own database, on the laptop, with the internet up or down. The dashboard's report is the only part that needs a connection. Three months free, no card, to see your own discount line tomorrow.