# HR & Payroll v0.39.4-dev Consolidated — P2/P3 Static Evidence

This file records source-level evidence only. It is not a substitute for Local Django/PostgreSQL runtime/UAT evidence.

## QA-015 — Branding/company identity is hard-coded in templates

**Status:** Source-level static evidence PASS.

## QA-026 — Company-wide Holiday uniqueness is not reliable with nullable branch

**Status:** Source-level static evidence PASS.

## QA-041 — Report/PDF rendering is not fully Unicode/Bangla-safe

**Status:** Source-level static evidence PASS.

## QA-042 — Payroll/bonus/deduction month fields accept arbitrary dates instead of canonical month values

**Status:** Source-level static evidence PASS.

## QA-052 — Login throttling is only per username + source IP

**Status:** Source-level static evidence PASS.

## QA-053 — LoginAttempt records have no cleanup/retention mechanism

**Status:** Source-level static evidence PASS.

## QA-055 — Backup verification treats SHA-256 sidecar as optional

**Status:** Source-level static evidence PASS.

## QA-067 — Attendance status can conflict with entered timestamps

**Status:** Source-level static evidence PASS.

## QA-078 — Leave date-range CSV reports the full leave-request day count, not days within the selected report window

**Status:** Source-level static evidence PASS.

## QA-080 — Payslip/report output lacks payroll-day explanation needed for salary dispute reconciliation

**Status:** Source-level static evidence PASS.

## QA-087 — Navigation is not role-aware and exposes inaccessible modules to ordinary users

**Status:** Source-level static evidence PASS.

## QA-088 — Top bar does not show the user's actual role(s)

**Status:** Source-level static evidence PASS.

## QA-091 — No first-class employee document/custom-field visibility on Employee Detail creates an incomplete personnel profile

**Status:** Source-level static evidence PASS.

## QA-092 — Core list screens use hard row caps without pagination or an explicit “results limited” warning

**Status:** Source-level static evidence PASS.

## QA-093 — Destructive/deactivation lifecycle is not available as a controlled business workflow

**Status:** Source-level static evidence PASS.

## QA-095 — No JavaScript/AJAX dependent-master behavior exists on the backend employee form

**Status:** Source-level static evidence PASS.

## QA-056 / QA-057 positive controls

AuditLog admin protection and named-template URL wiring remain positive regression controls; no remediation change was required.

- **QA-016 — Documentation version consistency:** PASS. Installation/Maintenance Guide, User Manual, Developer Orientation, runtime scripts, backend runbooks, package labels and APP_VERSION are aligned to `v0.39.4-dev Consolidated`; DOCX files were rendered and visually inspected, and package consistency check reports PASS.

- **QA-027 — Attendance correction requester attribution:** PASS. Adjustment stores the actual requester user and linked requester employee, derives self-service attribution instead of hard-coding it, notifies the actual requester, and limits returned correction resubmission to the original requester.