A New Jersey behavioral-health nonprofit was managing referrals, service authorizations, and contractor pay in spreadsheets. Contractor invoicing is a financial-integrity problem wearing an operations costume: units of service, authorizations, and pay periods have to reconcile exactly — and errors surface as underpaid people, not as exceptions.
Silently wrong is worse than missing. Here, silently wrong meant contractors being underpaid.
A typed schema layer over Airtable, verified against the live metadata API — introduced after hand-maintained status lists in two places drifted from the base, producing empty result sets for users and rejected requests for four valid statuses.
The invoicing engine, with unit coverage, plus Playwright end-to-end tests with screenshot regression across the portal.
A controlled data repair: the corrective backfill ran behind an opt-in flag the scheduler never sets, with before-and-after snapshots diffed field by field to prove the exact scope of what changed.
Invoices were being rebuilt from a partial set of sessions because a linked-record query used a formula that renders record links as display values rather than identifiers — so it matched nothing, silently, every time, and each approval overwrote the invoice with only the latest batch. The fix reads the platform's own reverse links and matches identifiers in application code.
View deep diveAirtable is flexible right up until two hand-maintained copies of a status list drift apart. The typed schema layer is verified against the live metadata API, so drift surfaces as a failing check instead of an empty screen.
View deep diveThe backfill that repaired the invoices runs only behind an opt-in flag the scheduler never sets, and its before/after snapshots are diffed field by field. The repair restored 310 units and $3,881.50 of contractor pay across 8 invoices — and the diff proves exactly 8 records changed, with no unintended writes.
View deep dive