Ages ago, my girlfriend at the time worked for a company that routinely got SIBR (small business innovation research) grants. Such grants made up part of her total workload.

The crazy thing was that if she worked for 10 hours on SBIR stuff, then worked 40 hours on her normal work stuff (so overtime), the SBIR billing would get scaled down to 8 hours (that is, 25% of 40 hours). There would be no way to bill 80 hours.

The other thing that seemed somewhat crazy is that it was also common to have multiple SBIR contracts going on at the same time. If they bought a $10K tool for SBIR grant #1 and SBIR grant #2 needed it two, they'd have to buy a second one. So the tool would be out, then when switching between work on the grants, the tool would go into a locked cabinet, then the second copy of the tool would get unlocked from a different cabinet. I understand that firewalling like that prevents a company from "borrowing" expensive equipment for their own work, but it lead to waste like I just described.

You would have been fine: Your pay stubs reflected the correct time and your correct payment.

Wait, did you get paid overtime when he modified your time sheet?

I guess it may not be normal but I got straight time overtime when I worked for a contractor. Made those weeks I really did do 80 hrs nice. But if they have any system involved the fact you did not get paid for the time would be a big red flag.

If you were salary and not benefitting from it, there's literally no chance you would have gone to jail. This was the equivalent of panicking about running a yellow light in terms of overreaction. The only thing you had to do was write an email, cc your personal email, and tell your boss you think the punches are messed up and that they reflect more than you worked. Your boss would tell you not to worry about it and you're done.