# v0.39.4 UAT Review2 — Pre-Local-UAT Correction List

Project: `HRPAY-BMD-20260911-01`
Source reviewed: `HR-Payroll-Consolidated-v0.39.4-UAT-Review2-Complete.zip`

This review preserves the previously accepted PF/R2 corrections and focuses on the developer-added CRUD/Edit flows plus end-to-end state integrity. Static/source PASS does **not** mean Runtime PASS.

## R3-001 — Pending payroll-input employee reassignment could break workflow context (Critical)
- **Finding:** Pending OT/Bonus/Deduction edit forms allowed changing Employee after an OPEN approval task already existed. A cross-company change could leave the task bound to the old company and make approval fail; same-company change could leave stale task identity.
- **Correction:** Employee is immutable on edit. Save revalidates the OPEN task company and refreshes task title atomically.
- **Files:** `backend/apps/payroll/forms.py`, `backend/apps/payroll/views.py`
- **Local UAT:** Required.

## R3-002 — Finalized attendance could still be mutated by late OT decision (Critical)
- **Finding:** Pending OT was not an attendance-finalization exception, and OT approval directly updated `AttendanceRecord.payable_ot_minutes` even after month finalization.
- **Correction:** Pending OT blocks attendance finalization; OT add/edit and workflow decision are blocked for finalized months until controlled reopen.
- **Files:** `backend/apps/attendance/services.py`, `backend/apps/payroll/forms.py`, `backend/apps/workflow/services.py`
- **Local UAT:** Required.

## R3-003 — Bonus/Deduction could cross a closed payroll workflow state (Critical)
- **Finding:** Pending Bonus/Deduction could be moved/approved into a Reviewed/Approved/Locked target month, creating inputs that were not part of the frozen payroll calculation.
- **Correction:** Form validation blocks non-Draft target periods; workflow approval rechecks the target period state.
- **Files:** `backend/apps/payroll/forms.py`, `backend/apps/workflow/services.py`
- **Local UAT:** Required.

## R3-004 — Payroll could continue with unresolved target-month input approvals (Critical)
- **Finding:** Review/Approve/Lock/Pay did not explicitly fail when OT/Bonus/Deduction for the same month remained PENDING.
- **Correction:** Added a fail-closed pending-input gate to payroll workflow and payment posting.
- **Files:** `backend/apps/payroll/services.py`
- **Local UAT:** Required.

## R3-005 — Workflow reviewer lacked source details for OT/Bonus/Deduction (High)
- **Finding:** Approval task screen showed only generic Source Type/ID, so checker could not see current employee/date/month/amount/minutes/reason before deciding.
- **Correction:** Added live, company-scoped source summaries for OT, Bonus and Deduction.
- **Files:** `backend/apps/workflow/views.py`
- **Local UAT:** Required.

## R3-006 — Pending financial-input edits had weak audit evidence (High)
- **Finding:** Edit audit entries did not capture before/after values and task labels were not refreshed after editable date/type changes.
- **Correction:** Pending edits now store old/new snapshots, explicit company/request context and refresh OPEN task title atomically.
- **Files:** `backend/apps/payroll/views.py`
- **Local UAT:** Required.

## R3-007 — Attendance Device Edit lacked explicit audit trail (Medium)
- **Finding:** New device edit route saved configuration changes without an explicit business audit event.
- **Correction:** Added non-secret old/new configuration audit. Comm-key value is never logged; only whether it changed.
- **Files:** `backend/apps/attendance/views.py`
- **Local UAT:** Required.

## R3-008 — HR-managed Leave screen heading was misleading (Low)
- **Finding:** `Add Leave for Employee` reused a template hard-coded as `Apply Leave`.
- **Correction:** Template now honors `page_title` and falls back to `Apply Leave` for self-service/resubmit.
- **Files:** `backend/templates/leave/leave_form.html`
- **Local UAT:** UI smoke check.

## R3-009 — Review2 package contained generated Python cache files (Release Hygiene)
- **Finding:** 143 `.pyc`/`__pycache__` files were shipped in the developer package.
- **Correction:** Excluded from corrected release tree and regenerated package integrity evidence.
- **Local UAT:** No functional test; verify clean package extraction.

## Verification boundary
- Python/static/link/package checks are source-level evidence only.
- QA-011 migration freeze, Django/PostgreSQL Local UAT, backup/restore, FO-M1 physical test and parallel payroll reconciliation remain real runtime gates.