Paid out £500 from a drawer holding £40
The till’s cash route took any amount while the Money screen put the drawer at £40. One sum feeds both now; a pay-out above the count is refused, quoting it.
A tester tapped Paid out on the till, typed £500, and the screen said Paid out £500. The Money screen next to it put the drawer at £40. Both were telling the truth about their own data. The cash route recorded whatever amount it was given; the Money screen added up what the drawer should hold. Neither read the other, so the drawer could pay out twelve times what it contained and the only thing that would notice was the person counting it at close.
One sum, read before the money moves
The fix was not a warning on the till. It was making the drawer’s arithmetic a single helper on the server, one that the Money screen, the cash route and every toast now share: today’s cash sales, less cash refunds, plus what was paid in, less what was paid out, over the venue’s own trading day rather than the calendar one. The cash route reads that figure before it records a removal, and refuses anything above it in a sentence that quotes the count: the drawer holds £40, so £500 cannot come out of it.
Paying in has no ceiling, because a float can be any size. But every paid-in and paid-out toast now ends with the new expected figure, so the person at the till sees the drawer move rather than a bare confirmation. And £0.00 in either direction is refused out loud, since a zero that goes through quietly is a line in the cash log that means nothing and asks a question at close.
Recorded, not opened
The same screen had a button labelled as if it opened the drawer. The till has no drawer kick of its own, and the product has never claimed one: the button writes a line saying the drawer was opened, for the record, and that is all it does. It reads Drawer open recorded now, which is longer and true.
The test for this drives both halves through the real gate: a removal above the count is refused with the count in the message, and a removal within it goes through and moves the figure. A refusal with no allowed case beside it would pass a route that refused everything, and a till that cannot pay out at all is a different bug with the same green test.