A bug pass through all ten lifecycle stages

We walked every module in lifecycle order — CRM, Estimating, Proposal, Award, Setup, Field, Changes, Billing, Closeout, Warranty — and fixed what we found. The ones you may have hit:

• Dates behaved. Bids due today no longer flag as overdue, substantial-completion and warranty dates no longer render a day early in the evening, warranty history no longer shows "Invalid Date", and the roster's month headers are the right month.
• The printed page matches the screen. The estimate bid sheet, the G702/G703 pay-application cover, and the change-order rollups now compute from the same math their on-screen counterparts use — including retainage on stored materials, held persistently, with the cover's Current Payment Due matching the invoice to the penny.
• Edits stick or say why they didn't. A long list of places swallowed failed saves and kept showing your edit as if it landed — company bulk actions, contract fields, proposal toggles, PCO lines, pay-app transitions, timecard approvals. They now either land or tell you what went wrong. The PCO builder also stops closing itself after every cell edit.
• Records that shouldn't change, can't. Approved timecards, signed T&M tickets, decided PCOs, and executed change orders are locked against stale-tab overwrites; new-revision copies of estimates actually carry the lines over.
• Numbering holds up. Warranty callbacks past WC-999 create again, and PCO/CO numbers are minted server-side so two people can't get the same one.

A number of endpoints also now enforce role permissions they'd been missing — nothing changes for day-to-day use, but the doors match the signs.