hr_lite 0.5.0 → 0.5.2

data/app/controllers/hr_lite/admin/employees_controller.rb

@@ -7,7 +7,9 @@ module HrLite
     class EmployeesController < LeadershipController
       def index
         @profiles = paginate(EmployeeProfile.includes(:user).order(:employee_code))
-        @users_without_profile = HrLite.employees.reject { |u| EmployeeProfile.exists?(user_id: u.id) }
+        # One pluck instead of an EXISTS query per employee.
+        profiled = EmployeeProfile.pluck(:user_id).to_set
+        @users_without_profile = HrLite.employees.reject { |u| profiled.include?(u.id) }
         @pending_resignations = Resignation.pending.includes(:user).recent_first
       end
 
@@ -24,17 +26,26 @@ module HrLite
       def create
         new_login = params.dig(:employee_profile, :new_user_email).present?
         @profile = EmployeeProfile.new(profile_params)
+        saved = false
 
-        if new_login
-          user = HrLite.config.onboard_user.call(
-            name: params.dig(:employee_profile, :new_user_name).to_s,
-            email: params.dig(:employee_profile, :new_user_email).to_s.strip,
-            password: params.dig(:employee_profile, :new_user_password).to_s
-          )
-          @profile.user_id = user.id
+        # One transaction: a profile that fails validation used to leave the
+        # freshly-created login committed — a role-bearing account with no HR
+        # profile, invisible on every HR screen.
+        ActiveRecord::Base.transaction do
+          if new_login
+            user = HrLite.config.onboard_user.call(
+              name: params.dig(:employee_profile, :new_user_name).to_s,
+              email: params.dig(:employee_profile, :new_user_email).to_s.strip,
+              password: params.dig(:employee_profile, :new_user_password).to_s
+            )
+            @profile.user_id = user.id
+          end
+
+          saved = @profile.save
+          raise ActiveRecord::Rollback unless saved
         end
 
-        if @profile.save
+        if saved
           if new_login
             invite_url = HrLite.config.invite_url_for&.call(@profile.user)
             Notifications.publish(
@@ -66,7 +77,7 @@ module HrLite
 
       def update
         @profile = EmployeeProfile.find(params[:id])
-        if @profile.update(profile_params)
+        if @profile.update(update_profile_params)
           redirect_to admin_employee_path(@profile), notice: "Employee profile updated."
         else
           render :edit, status: :unprocessable_entity
@@ -77,7 +88,9 @@ module HrLite
       # access via the host hook. Audited via the profile update.
       def offboard
         @profile = EmployeeProfile.find(params[:id])
-        exit_date = params[:date_of_exit].presence&.to_date || Date.current
+        # `.to_date` on a raw param raises Date::Error and 500s; the
+        # controller's own parser exists for exactly this.
+        exit_date = params[:date_of_exit].present? ? parse_date_param(params[:date_of_exit]) : Date.current
 
         @profile.update!(date_of_exit: exit_date)
         begin
@@ -87,6 +100,8 @@ module HrLite
         end
         redirect_to admin_employee_path(@profile),
                     notice: "Offboarded — last day #{exit_date.strftime('%d %b %Y')}, access revoked."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_employee_path(@profile), alert: e.record.errors.full_messages.to_sentence
       end
 
       private
@@ -95,9 +110,18 @@ module HrLite
         params.require(:employee_profile).permit(
           :user_id, :manager_id, :designation, :date_of_birth, :date_of_joining,
           :date_of_exit, :department, :work_location, :pan_number, :pf_uan, :esi_number,
-          :bank_account_number, :bank_ifsc, :bank_name, :tax_regime, :declared_annual_deductions
+          :bank_account_number, :bank_ifsc, :bank_name, :tax_regime, :declared_annual_deductions,
+          :fy_opening_gross, :fy_opening_tds
         )
       end
+
+      # user_id says WHOSE profile this is, and salary structures, appraisals
+      # and slips all key off it independently. Repointing an existing profile
+      # hands one person's PAN, bank details and pay history to another, so it
+      # is a create-time field only.
+      def update_profile_params
+        profile_params.except(:user_id)
+      end
     end
   end
 end

data/app/controllers/hr_lite/admin/leave_balances_controller.rb

@@ -2,8 +2,7 @@ module HrLite
   module Admin
     class LeaveBalancesController < BaseController
       def index
-        year = params[:year].to_i
-        @year = year.between?(2000, 2100) ? year : LeaveYear.current_key
+        @year = sanitized_year
         @types = LeaveType.active.where(paid: true).where.not(annual_quota: nil)
         @employees = HrLite.employees
       end
@@ -12,7 +11,9 @@ module HrLite
       def adjust
         user = HrLite.user_klass.find(params[:user_id])
         type = LeaveType.find(params[:leave_type_id])
-        year = params[:year].to_i
+        # Unsanitised, a missing param wrote the adjustment into leave year 0,
+        # where no screen can ever show it.
+        year = sanitized_year
         delta = BigDecimal(params[:delta].to_s)
         note = params[:note].to_s.strip
 
@@ -20,10 +21,7 @@ module HrLite
           return redirect_to admin_leave_balances_path(year: year), alert: "A note is required."
         end
 
-        balance = LeaveBalance.for(user, type, year)
-        balance.adjustment += delta
-        balance.adjustment_note = [ balance.adjustment_note.presence, "#{delta.to_f} — #{note}" ].compact.join("; ")
-        balance.save!
+        balance = LeaveBalance.adjust!(user, type, year, delta: delta, note: "#{delta.to_f} — #{note}")
 
         AuditLog.create!(
           actor: hr_current_user, action: "adjust",
@@ -34,7 +32,16 @@ module HrLite
         redirect_to admin_leave_balances_path(year: year),
                     notice: "Balance adjusted for #{HrLite.display_name(user)}."
       rescue ArgumentError
-        redirect_to admin_leave_balances_path, alert: "Enter a valid adjustment number."
+        # Keep the admin on the year they were looking at.
+        redirect_to admin_leave_balances_path(year: sanitized_year),
+                    alert: "Enter a valid adjustment number."
+      end
+
+      private
+
+      def sanitized_year
+        year = params[:year].to_i
+        year.between?(2000, 2100) ? year : LeaveYear.current_key
       end
     end
   end

data/app/controllers/hr_lite/admin/leave_requests_controller.rb

@@ -24,6 +24,22 @@ module HrLite
         redirect_to admin_leave_request_path(request), alert: "Only pending requests can be decided."
       end
 
+      # LeaveRequest#cancellable_by? has always allowed an admin to call off
+      # approved future leave, but no route reached it — the only cancel action
+      # was the employee's own, scoped to their own rows. A trip called off
+      # while the person was unreachable, or after they were offboarded, could
+      # not be released at all, and the quota stayed spent.
+      def cancel
+        request = LeaveRequest.find(params[:id])
+        if request.cancellable_by?(hr_current_user)
+          request.cancel!(actor: hr_current_user)
+          redirect_to admin_leave_requests_path, notice: "Leave cancelled — the balance is released."
+        else
+          redirect_to admin_leave_request_path(request),
+                      alert: "Only pending leave, or approved leave that has not started, can be cancelled."
+        end
+      end
+
       def reject
         request = LeaveRequest.find(params[:id])
         note = params[:decision_note].to_s.strip

data/app/controllers/hr_lite/admin/resignations_controller.rb

@@ -5,13 +5,25 @@ module HrLite
         resignation = Resignation.find(params[:id])
         resignation.accept!(
           actor: hr_current_user,
-          last_day: params[:last_day].presence&.to_date,
+          # `.to_date` on a raw param raises Date::Error and 500s; the
+          # controller's own parser exists for exactly this.
+          last_day: params[:last_day].presence && parse_date_param(params[:last_day]),
           note: params[:note]
         )
-        redirect_to admin_employees_path,
-                    notice: "Resignation accepted — exit date recorded on the profile."
-      rescue ActiveRecord::RecordInvalid
-        redirect_to admin_employees_path, alert: "Only pending resignations can be accepted."
+        notice = if resignation.exit_date_recorded?
+          "Resignation accepted — exit date recorded on the profile."
+        else
+          "Resignation accepted. No employee profile exists for " \
+            "#{hr_display_name(resignation.user)}, so no exit date was recorded — " \
+            "create the profile to clip attendance and payroll."
+        end
+        redirect_to admin_employees_path, notice: notice
+      rescue ActiveRecord::RecordInvalid => e
+        # A rejected exit date used to be reported as "not pending", which was
+        # simply the wrong reason: the transaction rolls back either way.
+        message = resignation.reload.pending? ? e.record.errors.full_messages.to_sentence
+                                              : "Only pending resignations can be accepted."
+        redirect_to admin_employees_path, alert: message
       end
     end
   end

data/app/controllers/hr_lite/admin/salary_slips_controller.rb

@@ -20,11 +20,26 @@ module HrLite
         tds_override = params.dig(:salary_slip, :tds_override).presence
         profile = EmployeeProfile.find_by(user_id: slip.user_id)
         structure = SalaryStructure.effective_for(slip.user, run.period_month)
+        if structure.nil?
+          return redirect_to admin_salary_slip_path(slip),
+                             alert: "No salary structure is effective for #{run.label} — add one first."
+        end
+
+        lop = lop_override && BigDecimal(lop_override)
+        tds = tds_override && BigDecimal(tds_override)
+        # Unbounded overrides are a money bug, not a typo: a negative LOP pays
+        # for days never worked, one above the month zeroes the person out.
+        if lop && !lop.between?(0, slip.days_in_month)
+          return redirect_to admin_salary_slip_path(slip),
+                             alert: "LOP days must be between 0 and #{slip.days_in_month}."
+        end
+        if tds&.negative?
+          return redirect_to admin_salary_slip_path(slip), alert: "TDS cannot be negative."
+        end
 
         attributes = SlipBuilder.call(
           run: run, user: slip.user, structure: structure, profile: profile,
-          lop_override: lop_override && BigDecimal(lop_override),
-          tds_override: tds_override && BigDecimal(tds_override)
+          lop_override: lop, tds_override: tds
         )
         slip.update!(attributes)
 

data/app/controllers/hr_lite/admin/superadmin_controller.rb

@@ -3,7 +3,12 @@ module HrLite
     # Money tier: salary structures, payroll, slips, appraisals and
     # promotions. Only config.superadmin_emails — ordinary leadership can
     # govern policy and people but never sees another person's pay.
+    # The money tier stands on its own rather than layering on leadership: a
+    # payroll operator does not have to also govern people and policy.
+    # Inheriting the leadership check locked a configured superadmin who was
+    # absent from leadership_emails out of payroll entirely.
     class SuperadminController < LeadershipController
+      skip_before_action :require_hr_leadership!
       before_action :require_hr_superadmin!
 
       private

data/app/controllers/hr_lite/org_controller.rb

@@ -10,8 +10,13 @@ module HrLite
       @by_user = profiles.index_by(&:user_id)
       build_tree(profiles)
       @own_profile = @by_user[hr_current_user.id]
+      # STOPS at the first exited manager rather than skipping past them. The
+      # L-labels are positional, so dropping a link from the middle promoted
+      # everyone above it — the card then called a skip-level manager your L1,
+      # contradicting the tree below, which drops exited managers entirely and
+      # renders their reports as roots.
       exited = EmployeeProfile.where(date_of_exit: ...Date.current).pluck(:user_id).to_set
-      @own_chain = (@own_profile&.reporting_chain || []).reject { |boss| exited.include?(boss.id) }
+      @own_chain = (@own_profile&.reporting_chain || []).take_while { |boss| !exited.include?(boss.id) }
     end
 
     private

data/app/controllers/hr_lite/resignations_controller.rb

@@ -4,7 +4,12 @@ module HrLite
   class ResignationsController < ApplicationController
     def show
       @resignation = own.recent_first.first
-      @new_resignation = Resignation.new(proposed_last_day: Date.current + 30) unless @resignation&.pending?
+      # No form once one is pending OR already accepted: an agreed exit date is
+      # not something to re-file, and accepting a second one would overwrite
+      # the date payroll and attendance already clip to.
+      unless @resignation&.pending? || @resignation&.accepted?
+        @new_resignation = Resignation.new(proposed_last_day: Date.current + 30)
+      end
     end
 
     def create

data/app/helpers/hr_lite/application_helper.rb

@@ -71,19 +71,9 @@ module HrLite
       render "hr_lite/shared/pagination"
     end
 
+    # Delegates to the PORO so the host-rendered slip PDF formats identically.
     def hrl_money(amount)
-      return "—" if amount.nil?
-
-      whole, fraction = HrLite::Money.round2(amount).to_s("F").split(".")
-      sign = whole.start_with?("-") ? "-" : ""
-      whole = whole.delete_prefix("-")
-      # Indian digit grouping: last three digits together, then pairs
-      # (12,34,567 — not the western 1,234,567).
-      if whole.length > 3
-        head = whole[0..-4].reverse.scan(/\d{1,2}/).join(",").reverse
-        whole = "#{head},#{whole[-3..]}"
-      end
-      "#{sign}#{HrLite.config.currency_symbol}#{whole}.#{fraction.ljust(2, '0')}"
+      HrLite::Money.format(amount)
     end
 
     # Indian-system amount in words for the slip footer. Delegates to the

data/app/jobs/hr_lite/application_job.rb

@@ -1,4 +1,9 @@
 module HrLite
+  # Parent of the engine's jobs. It existed but nothing inherited from it, so
+  # no retry policy applied anywhere: a digest or a rollover that hit a
+  # dropped connection was simply lost for that day — or for that year.
   class ApplicationJob < ActiveJob::Base
+    retry_on ActiveRecord::ConnectionNotEstablished, ActiveRecord::Deadlocked,
+             wait: :polynomially_longer, attempts: 5
   end
 end

data/app/jobs/hr_lite/daily_digest_job.rb

@@ -1,7 +1,7 @@
 module HrLite
   # Morning leadership email: who's out, what's pending, what's flagged.
   # Sends nothing on a quiet day.
-  class DailyDigestJob < ActiveJob::Base
+  class DailyDigestJob < ApplicationJob
     queue_as :default
 
     def perform(date: Date.current)

data/app/jobs/hr_lite/leave_year_rollover_job.rb

@@ -4,7 +4,7 @@ module HrLite
   # carry-forward into the new year's balance rows. Idempotent — a balance
   # whose carry has already been written is never touched again (manual
   # adjustments stay safe).
-  class LeaveYearRolloverJob < ActiveJob::Base
+  class LeaveYearRolloverJob < ApplicationJob
     queue_as :default
 
     def perform(year: nil)

data/app/jobs/hr_lite/payroll_auto_draft_job.rb

@@ -3,14 +3,17 @@ module HrLite
   # payroll from attendance and the policy, then tell leadership it is
   # waiting for review. Publishing stays a deliberate human action —
   # the system prepares, people approve.
-  class PayrollAutoDraftJob < ActiveJob::Base
+  class PayrollAutoDraftJob < ApplicationJob
     queue_as :default
 
     def perform(month: Date.current.prev_month.beginning_of_month)
       return unless EmployeeProfile.active_for(month).exists?
 
       run = PayrollRun.find_or_create_by!(period_month: month)
-      return unless run.draft? || run.review?
+      # Only ever drafts an UNTOUCHED run. Accepting `review` as well meant a
+      # re-run recomputed a month somebody was already reviewing and told
+      # leadership all over again that it was waiting for them.
+      return unless run.draft? && run.salary_slips.none?
 
       run.compute!(actor: nil)
       Notifications.publish(

data/app/models/concerns/hr_lite/audited.rb

@@ -9,10 +9,14 @@ module HrLite
     SKIPPED_ATTRIBUTES = %w[updated_at created_at].freeze
     REDACTED = "[changed]".freeze
 
+    # *_commit, not *_create/_update/_destroy: these callbacks write an audit
+    # row and email leadership a diff. Fired inside the transaction they
+    # announce changes that then roll back — a failed onboarding used to mail
+    # out a profile diff for a profile that was never saved.
     included do
-      after_create  { hr_lite_audit!("create") }
-      after_update  { hr_lite_audit!("update") }
-      after_destroy { hr_lite_audit!("destroy") }
+      after_create_commit  { hr_lite_audit!("create") }
+      after_update_commit  { hr_lite_audit!("update") }
+      after_destroy_commit { hr_lite_audit!("destroy") }
     end
 
     private
@@ -63,7 +67,10 @@ module HrLite
         "policy.changed",
         title: "#{actor_name.presence || 'Someone'} #{log.action}d #{subject}",
         body: nil,
-        diff: log.audited_changes
+        # policy.changed fans out to leadership_emails, which is a WIDER list
+        # than the money tier. Leadership may know an appraisal changed; the
+        # ratings and review text inside it are not theirs to read.
+        diff: log.money_tier? ? nil : log.audited_changes
       )
     end
   end

data/app/models/hr_lite/appraisal.rb

@@ -43,7 +43,15 @@ module HrLite
         body: rating ? "Rating: #{rating}/5" : nil,
         path: "/appraisals/#{id}",
         bell_to: [ user ],
-        email_to: [ user ]
+        email_to: [ user ],
+        # Leadership gets the fact, named, pointing somewhere they can open —
+        # but not the rating: appraisal content is money-tier and this list is
+        # wider than that tier.
+        leadership: {
+          title: "#{HrLite.display_name(user)}'s appraisal for #{period_label} was shared",
+          body: nil,
+          path: "/admin/employees"
+        }
       )
       true
     end

data/app/models/hr_lite/audit_log.rb

@@ -8,7 +8,18 @@ module HrLite
 
     validates :action, :subject_type, :subject_id, presence: true
 
+    # Subjects whose CONTENTS belong to the money tier. Salary structures
+    # encrypt their amounts so the diff is already redacted, but appraisal
+    # ratings and review text are plain columns — they must not reach the
+    # leadership audit screen or the policy.changed email.
+    MONEY_TIER_TYPES = %w[HrLite::Appraisal HrLite::DesignationChange HrLite::SalaryStructure].freeze
+
     scope :recent, -> { order(created_at: :desc) }
+    scope :outside_money_tier, -> { where.not(subject_type: MONEY_TIER_TYPES) }
+
+    def money_tier?
+      MONEY_TIER_TYPES.include?(subject_type)
+    end
 
     def readonly?
       persisted?

data/app/models/hr_lite/comp_off_request.rb

@@ -106,21 +106,11 @@ module HrLite
     # balance. The balance row is locked for the increment; two admins
     # approving two different requests for one person cannot lose an update.
     def credit_balance!(type)
-      year = LeaveYear.current_key
-      balance = LeaveBalance.for(user, type, year)
-      if balance.new_record?
-        begin
-          balance.save!
-        rescue ActiveRecord::RecordNotUnique
-          balance = LeaveBalance.for(user, type, year)
-        end
-      end
-      balance.with_lock do
-        balance.adjustment += credit_days
-        balance.adjustment_note = [ balance.adjustment_note.presence,
-                                    "+#{credit_days.to_f} comp-off for #{date_worked} (request ##{id})" ].compact.join("; ")
-        balance.save!
-      end
+      LeaveBalance.adjust!(
+        user, type, LeaveYear.current_key,
+        delta: credit_days,
+        note: "+#{credit_days.to_f} comp-off for #{date_worked} (request ##{id})"
+      )
     end
 
     def transition!(new_status, actor, note)

data/app/models/hr_lite/designation_change.rb

@@ -27,7 +27,17 @@ module HrLite
       self.from_designation ||= EmployeeProfile.find_by(user_id: user_id)&.designation
     end
 
+    # Only the newest row owns the profile's designation. Backfilling an older
+    # promotion used to overwrite the current title and push the stale one to
+    # the host as well. (A future-dated promotion still applies on save — that
+    # is how sharing an appraisal announces the new role.)
+    def latest_by_effective_date?
+      self.class.where(user_id: user_id).timeline.first&.id == id
+    end
+
     def apply_to_profile
+      return unless latest_by_effective_date?
+
       profile = EmployeeProfile.find_by(user_id: user_id)
       profile&.update!(designation: to_designation)
 
@@ -45,7 +55,14 @@ module HrLite
         body: "Effective #{effective_date.strftime('%d %b %Y')}.",
         path: "/career",
         bell_to: [ user ],
-        email_to: [ user ]
+        email_to: [ user ],
+        # "/career" is the reader's OWN career page, so a leadership copy of
+        # this used to link them to their own record instead of the person the
+        # promotion is about.
+        leadership: {
+          title: "#{HrLite.display_name(user)} — new role: #{to_designation}",
+          path: "/admin/employees"
+        }
       )
     end
   end

data/app/models/hr_lite/employee_profile.rb

@@ -13,7 +13,11 @@ module HrLite
     belongs_to :manager, class_name: HrLite.config.user_class, optional: true
 
     encrypts :pan_number, :pf_uan, :esi_number, :bank_account_number, :bank_ifsc
-    encrypted_money :declared_annual_deductions
+    # fy_opening_*: income already paid this financial year that this install
+    # did not run — a previous employer, or the months before payroll was
+    # switched on here. Feeds the TDS projection so a mid-year start does not
+    # read as zero income for the months it cannot see.
+    encrypted_money :declared_annual_deductions, :fy_opening_gross, :fy_opening_tds
 
     TAX_REGIMES = %w[new old].freeze
 

data/app/models/hr_lite/leave_balance.rb

@@ -19,6 +19,34 @@ module HrLite
       find_or_initialize_by(user_id: user.id, leave_type: leave_type, year: year)
     end
 
+    # Persisted and row-locked so concurrent writers serialize here. The
+    # create sits in its own savepoint: on PostgreSQL a failed INSERT aborts
+    # the enclosing transaction, so a plain rescue could never run.
+    def self.lock_for(user, leave_type, year)
+      attributes = { user_id: user.id, leave_type_id: leave_type.id, year: year }
+      balance = find_by(attributes)
+      balance ||= begin
+        transaction(requires_new: true) { create!(attributes) }
+      rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid
+        find_by!(attributes)
+      end
+      balance.lock!
+      balance
+    end
+
+    # The single write path for the stored adjustment. Both callers — the
+    # comp-off credit and the admin correction — increment the same column,
+    # and read-modify-write without the lock lost one of them.
+    def self.adjust!(user, leave_type, year, delta:, note:)
+      transaction do
+        balance = lock_for(user, leave_type, year)
+        balance.adjustment += delta
+        balance.adjustment_note = [ balance.adjustment_note.presence, note ].compact.join("; ")
+        balance.save!
+        balance
+      end
+    end
+
     def entitled(as_of: Date.current)
       return Float::INFINITY if leave_type.unlimited?
 
@@ -30,7 +58,12 @@ module HrLite
       requests = LeaveRequest.approved
                              .where(user_id: user_id, leave_type_id: leave_type_id)
                              .where(start_date: range)
-      requests.sum { |request| LeaveDayCounter.count(request) }
+      # ONE calendar for the whole leave year, reused across every request.
+      # Building one per request meant a Holiday query and a Setting query
+      # each — and the admin balances grid reads this cell for every employee
+      # times every leave type.
+      calendar = WorkingCalendar.new(range)
+      requests.sum { |request| LeaveDayCounter.count(request, calendar: calendar) }
     end
 
     def available(as_of: Date.current)
@@ -46,28 +79,41 @@ module HrLite
     def accrued_base(as_of)
       range = LeaveYear.range(year)
       start = accrual_start(range)
-      return 0 if start.nil?
+      finish = accrual_end(range)
+      return 0 if start.nil? || start > finish
 
       monthly_rate = leave_type.annual_quota / 12
       months =
         if leave_type.accrual == "monthly"
-          cap = [ as_of, range.last ].min
+          cap = [ as_of, finish ].min
           start > cap ? 0 : months_between(start, cap)
         else
-          months_between(start, range.last)
+          months_between(start, finish)
         end
       monthly_rate * months
     end
 
     # nil when the person joins only after this leave year ends.
     def accrual_start(range)
-      doj = EmployeeProfile.where(user_id: user_id).pick(:date_of_joining)
+      doj = employment_window.first
       return range.first if doj.nil? || doj <= range.first
 
       start = doj.day <= 15 ? doj.beginning_of_month : doj.next_month.beginning_of_month
       start > range.last ? nil : start
     end
 
+    # Quota stops accruing on the last working day — entitlement used to keep
+    # growing for months after someone had left.
+    def accrual_end(range)
+      exit_date = employment_window.last
+      exit_date ? [ exit_date, range.last ].min : range.last
+    end
+
+    def employment_window
+      @employment_window ||= EmployeeProfile.where(user_id: user_id)
+                                            .pick(:date_of_joining, :date_of_exit) || [ nil, nil ]
+    end
+
     def months_between(from, to)
       (to.year * 12 + to.month) - (from.year * 12 + from.month) + 1
     end

data/app/models/hr_lite/leave_request.rb

@@ -44,6 +44,11 @@ module HrLite
     def approve!(actor:, note: nil)
       insufficient = false
       transition!("approved", actor, note) do
+        # Serialize on the BALANCE row. `transition!`'s own lock is on this
+        # request, and two pending requests are two different rows — so both
+        # approvals could read the same untouched balance and overdraw it.
+        LeaveBalance.lock_for(user, leave_type, LeaveYear.key_for(start_date)) unless leave_type.unlimited?
+
         if insufficient_balance_now?
           insufficient = true
           raise ActiveRecord::Rollback
@@ -120,7 +125,10 @@ module HrLite
     def insufficient_balance_now?
       return false if leave_type.unlimited?
 
-      LeaveDayCounter.count(self) > balance.available
+      # Same as-of date the create-time check used. Reading it as of TODAY
+      # meant a request validated against the balance it would have on the
+      # leave dates could never be approved on a monthly-accrual type.
+      LeaveDayCounter.count(self) > balance.available(as_of: start_date)
     end
 
     def notify_requested

data/app/models/hr_lite/leave_type.rb

@@ -13,6 +13,9 @@ module HrLite
     validates :annual_quota, numericality: { greater_than_or_equal_to: 0 }, allow_nil: true
     validates :carry_forward_cap, numericality: { greater_than_or_equal_to: 0 }
     validate :single_comp_off_type
+    # Retiring the flagged type hands the flag back, so a replacement can take
+    # it and `comp_off_type` (which resolves through `active`) keeps working.
+    before_save :release_comp_off_when_retired
 
     scope :active, -> { where(active: true).order(:position, :id) }
 
@@ -28,12 +31,19 @@ module HrLite
     private
 
     # Approvals credit into THE comp-off type — two flagged types would
-    # make the credit target position-order roulette.
+    # make the credit target position-order roulette. Scoped to ACTIVE rows
+    # so it agrees with `comp_off_type`, which resolves through `active`:
+    # counting a retired type here made the flag impossible to move to its
+    # replacement, and comp-off approval then failed for everyone.
     def single_comp_off_type
-      return unless comp_off
+      return unless comp_off && active
 
-      clash = self.class.where(comp_off: true).where.not(id: id)
+      clash = self.class.active.where(comp_off: true).where.not(id: id)
       errors.add(:comp_off, "is already set on #{clash.first.name}") if clash.exists?
     end
+
+    def release_comp_off_when_retired
+      self.comp_off = false if comp_off && !active
+    end
   end
 end