# HR & Payroll v0.39.4-dev — Pre-Final Review Correction List

Project: `HRPAY-BMD-20260911-01`

Source reviewed: developer-returned `HR-Payroll-Consolidated-Master-v0.39.4-dev.zip`

This list records only issues found in this second full review. Previous PF-001..PF-018 corrections were separately rechecked and remain present.

## R2-001 — Release Engineering / Version Consistency (Medium)

**Problem:** v0.39.4-dev UI/package still carried v0.39.3 runtime metadata and v0.38.0-UAT manual/static-preview labels, so Local UAT could test one source while evidence identified another build.

**Correction:** Aligned APP_VERSION, runtime/freeze scripts, runbooks/status files, static preview and DOCX/PDF manuals to v0.39.4-dev Consolidated. Historical QA/changelog lineage is intentionally preserved.

**Files/paths:** `backend/config/settings.py; backend/templates/base.html; OPEN-ME.html; runtime scripts/runbooks; docs/*.docx; docs/*.pdf; DOCUMENTATION-VERSION-CONSISTENCY.md; tools/package_consistency_check.py; tools/regenerate_package_integrity.py`

**Local UAT required:** Confirm footer and runtime diagnostics both show v0.39.4-dev; confirm manuals/package are the same tested build.

## R2-002 — Leave / Employment Service Period (High)

**Problem:** Leave application validation did not authoritatively prevent dates before joining or after the canonical Final Working Day, allowing leave balance/workflow data outside employment service.

**Correction:** Added service-period validation in LeaveApplicationForm, unified EmployeeRequestForm leave path and leave service boundary for create/resubmit/approval.

**Files/paths:** `backend/apps/leave/forms.py; backend/apps/leave/services.py; backend/apps/workflow/forms.py`

**Local UAT required:** Try leave before joining, after finalized exit date, and a valid in-service range from both Leave and Submit Application screens.

## R2-003 — Leave / Approval Data Freshness (High)

**Problem:** Leave days were calculated at submission but approval consumed stored days without rechecking current weekly-holiday/holiday rules. Calendar changes while pending could deduct stale leave days.

**Correction:** Central leave service now recomputes authoritative day count, half-day eligibility and overlap; approval fails closed when submitted days no longer match current rules and requires correction/resubmission.

**Files/paths:** `backend/apps/leave/services.py`

**Local UAT required:** Submit leave, change an applicable holiday/weekly-off setup before approval, then verify approval blocks stale day count until corrected/resubmitted.

## R2-004 — Exit / Final Settlement Correction Lifecycle (High)

**Problem:** Final Working Day could not be corrected once a settlement was RETURNED or REJECTED even though those statuses are explicitly correction/rebuild states; this created a dead-end.

**Correction:** Final Working Day is now blocked only while settlement is SUBMITTED/APPROVED/PAID; DRAFT/RETURNED/REJECTED can be corrected and then rebuilt/resubmitted.

**Files/paths:** `backend/apps/exits/services.py`

**Local UAT required:** Prepare settlement, Return/Reject it, correct Final Working Day, rebuild and resubmit. Verify Submitted/Approved/Paid still block direct date change.

## R2-005 — Exit / Leave / Payroll Integrity (High)

**Problem:** Changing Final Working Day could retroactively leave approved leave beyond employment or alter a month whose payroll was already Reviewed/Approved/Locked-unpaid, creating stale HR/financial evidence.

**Correction:** Exit date finalization now blocks when approved leave extends beyond the proposed final day and blocks affected non-Draft payroll states until the controlled correction/rebuild path is used. Already-paid payroll remains handled by Final Settlement reconciliation.

**Files/paths:** `backend/apps/exits/services.py`

**Local UAT required:** Test approved future leave then earlier exit date; test Reviewed/Approved/Locked-unpaid payroll then exit-date change; verify each blocks with guidance. Test Paid payroll settlement reconciliation separately.

## R2-006 — Workflow UX / Multi-company Scope (Medium)

**Problem:** QA-101 capability flag showed personal Leave/HR Request buttons whenever an employee profile had a company, even if that company was outside the user’s explicit accessible company scope; route then redirected.

**Correction:** Capability flag now requires employee profile company to be inside accessible_company_ids(user), matching route authorization.

**Files/paths:** `backend/apps/organization/context_processors.py`

**Local UAT required:** Use a user whose linked employee company is not in explicit scope; personal submit buttons must remain hidden and direct route must not permit submission.

## R2-007 — Local UAT Evidence Collection (Medium)

**Problem:** Developer-returned v0.39.4 package omitted the previously prepared runtime-result collector and PC runtime handoff/checklist, making the Local UAT evidence return path incomplete.

**Correction:** Restored 05-COLLECT-RUNTIME-RESULTS-WINDOWS.bat, collect_runtime_results.ps1, maintenance runtime guide and PC runtime checklist/start guide; current build label updated.

**Files/paths:** `05-COLLECT-RUNTIME-RESULTS-WINDOWS.bat; LOCAL-UAT-RUNTIME/tools/collect_runtime_results.ps1; MAINTENANCE-DEVELOPER-RUNTIME-GUIDE.txt; PC-RUNTIME-TEST-CHECKLIST.csv; PC-RUNTIME-TEST-START-HERE-BN.txt`

**Local UAT required:** After runtime tests, run collector and verify HRPAY-RUNTIME-RESULTS.zip contains evidence/migrations but excludes backend/.env.local and credentials.

## R2-008 — Package Integrity / Clean Delivery (Medium)

**Problem:** Developer package contained generated __pycache__/.pyc files and stale SHA256SUMS/PACKAGE-CONTENTS coverage after source additions, so package integrity evidence was not authoritative.

**Correction:** Removed generated cache artifacts and regenerated deterministic package manifest/SHA-256 after all corrections; final ZIP is re-extracted and verified before delivery.

**Files/paths:** `PACKAGE-CONTENTS.txt; SHA256SUMS.txt; package tree cleanup`

**Local UAT required:** Verify supplied ZIP hash, extract to a fresh folder, then use embedded SHA256SUMS/package consistency checker before migration freeze.

## Release boundary

- No `models.py` schema field/constraint change was introduced by this R2 correction set.
- QA-011 remains OPEN because authoritative Django migration files have not yet been generated/frozen from this exact source.
- Source/static evidence is not Runtime PASS. Django/PostgreSQL, backup/restore, reports/PDF, workflows and physical FO-M1 still require Local UAT evidence.