hr_lite 0.5.0 → 0.5.3

data/README.md

@@ -1,43 +1,66 @@
 # hr_lite
 
+[![Gem Version](https://img.shields.io/gem/v/hr_lite.svg)](https://rubygems.org/gems/hr_lite)
 [![CI](https://github.com/kshtzkr/hr_lite/actions/workflows/ci.yml/badge.svg)](https://github.com/kshtzkr/hr_lite/actions/workflows/ci.yml)
-[![Gem Version](https://badge.fury.io/rb/hr_lite.svg)](https://rubygems.org/gems/hr_lite)
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](MIT-LICENSE)
-
-A lightweight, self-contained HRMS engine for Rails — attendance with
-geolocation, leave management with comp-off requests, regularization tickets,
-an everyone-visible team board, holiday calendar, full Indian payroll
-(PF/ESI/PT/TDS) with salary-slip PDFs, kudos with @mentions, appraisals and
-promotions. Think Keka-lite, mounted inside your existing app in a few lines.
-
-- **Mountable engine**, isolated namespace (`HrLite`), tables prefixed `hr_lite_`.
-- **Bring your own users**: any user model + auth (Devise or otherwise) via config hooks.
-- **Three access tiers**: employee (self-service), admin (day-to-day operations),
-  leadership (policy, money, payroll — a configurable email list).
-- **Powerful notifications**: one event bus routing every HR event to in-app
-  bells (your notifier), employee emails, and leadership emails — with an
-  append-only audit trail of every governing change.
-- **Self-contained UI**: mobile-first, dependency-free JS, all theming via
-  CSS custom properties (`--hrl-*`).
-- **Encrypted at rest**: PAN/UAN/bank numbers and every money amount use
-  ActiveRecord encryption.
-
-## Try it in one command
-
-```bash
-git clone https://github.com/kshtzkr/hr_lite && cd hr_lite
-bin/demo    # → http://localhost:3999
-```
-
-A throwaway sandbox boots with three persona tiers (leadership / admin /
-employee — one click to sign in as each) and pre-seeded attendance, leaves,
-kudos, a published payroll run and a shared appraisal. Data resets on every
-restart.
+[![Ruby](https://img.shields.io/badge/ruby-%3E%3D%203.2-CC342D.svg)](https://www.ruby-lang.org)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](MIT-LICENSE)
+
+A mountable Rails engine that adds a small HRMS to an app you already have:
+attendance with geolocation, leave and holidays, Indian payroll (PF/ESI/PT/TDS)
+with salary-slip PDFs, kudos with @mentions, appraisals and promotions. It
+brings its own models, controllers and views under the `HrLite` namespace and
+talks to your app through configuration hooks — you keep your users and your
+auth, it does the HR.
+
+- Mountable engine, isolated namespace (`HrLite`), tables prefixed `hr_lite_`.
+- Bring your own users: any user model and auth (Devise or otherwise) via config hooks.
+- Access tiers: employee (self-service), admin (day-to-day operations),
+  leadership (policy and people), and an optional superadmin tier for money.
+- One event bus routes every HR event to in-app bells, employee emails and a
+  leadership fan-out, with an append-only audit trail of governing changes.
+- Self-contained UI: mobile-first, dependency-free JS, theming through CSS
+  custom properties (`--hrl-*`).
+- PAN/UAN/bank numbers and every money amount use ActiveRecord encryption.
+
+## Contents
+
+- [Requirements](#requirements)
+- [Installation](#installation)
+- [Quick start (sandbox)](#quick-start-sandbox)
+- [Configuration](#configuration)
+- [Access tiers](#access-tiers)
+- [Features](#features)
+  - [Attendance and geolocation](#attendance-and-geolocation)
+  - [Leave, comp-off and regularization](#leave-comp-off-and-regularization)
+  - [Holidays and calendar](#holidays-and-calendar)
+  - [Payroll and salary slips](#payroll-and-salary-slips)
+  - [Kudos and @mentions](#kudos-and-mentions)
+  - [Notifications and the event bus](#notifications-and-the-event-bus)
+  - [Appraisals, promotions and the org chart](#appraisals-promotions-and-the-org-chart)
+- [Recurring jobs](#recurring-jobs)
+- [Rake tasks](#rake-tasks)
+- [Generators](#generators)
+- [Theming](#theming)
+- [Statutory disclaimer](#statutory-disclaimer)
+- [Testing and development](#testing-and-development)
+- [Versioning](#versioning)
+- [Contributing](#contributing)
+- [Documentation](#documentation)
+- [License](#license)
+
+## Requirements
+
+- Ruby >= 3.2.
+- Rails >= 8.0.
+- Any ActiveRecord database. The migrations use portable column types; the gem
+  is developed against PostgreSQL and CI runs on SQLite.
+- ActiveRecord encryption keys configured in the host app — money amounts and
+  identity PII (PAN, UAN, bank details) are encrypted at rest. Run
+  `bin/rails db:encryption:init` if you have not set keys up yet.
 
 ## Installation
 
-Everything lives in the gem — a host app adds the gem, a mount line and one
-initializer. Nothing else.
+Add the gem to the host app:
 
 ```ruby
 # Gemfile
@@ -45,55 +68,73 @@ gem "hr_lite"
 ```
 
 ```bash
-bin/rails g hr_lite:install          # annotated initializer + next steps
-bin/rails g hr_lite:install --route  # …and mount at /hr for you
+bundle install
+bin/rails g hr_lite:install          # writes the annotated initializer, prints next steps
+bin/rails g hr_lite:install --route  # …and mounts the engine at /hr for you
 bin/rails db:migrate                 # engine migrations load straight from the gem
-bin/rails hr_lite:seed               # leave types + fixed national holidays (idempotent)
+bin/rails hr_lite:seed               # default leave types + fixed national holidays (idempotent)
 ```
 
-Migrations are served from the gem (upgrades included) — nothing is copied
-into your repo. If you prefer copies, run `bin/rails hr_lite:install:migrations`
-once and the engine steps aside.
+Migrations ship from the gem — `bin/rails db:migrate` picks them up and upgrades
+bring their own migrations, so nothing is copied into your repo and nothing
+drifts. If you prefer copies you can manage, run
+`bin/rails hr_lite:install:migrations` once; the engine detects the copied
+files (`*.hr_lite.rb`) and stops appending its own.
 
-To serve it on a subdomain instead of a path:
+If you did not pass `--route`, mount it yourself:
 
 ```ruby
-# config/routes.rb
+# config/routes.rb — at a path…
+mount HrLite::Engine => "/hr", as: :hr_lite
+
+# …or on a subdomain:
 constraints subdomain: "hr" do
   mount HrLite::Engine => "/", as: :hr_lite
 end
 ```
 
-Your app must have ActiveRecord encryption keys configured
-(`bin/rails db:encryption:init` if you have not).
+## Quick start (sandbox)
+
+```bash
+git clone https://github.com/kshtzkr/hr_lite && cd hr_lite
+bin/demo    # boots a throwaway app on http://localhost:3999
+```
+
+The sandbox boots a fresh SQLite database with sample data across three persona
+tiers (leadership, admin, employee — one click to sign in as each) and
+pre-seeded attendance, leaves, kudos, a published payroll run and a shared
+appraisal. The data resets on every restart.
 
 ## Configuration
 
+`bin/rails g hr_lite:install` writes `config/initializers/hr_lite.rb`. Every
+key has a working default, so the engine boots in any app; override what your
+app needs:
+
 ```ruby
 # config/initializers/hr_lite.rb
 HrLite.configure do |c|
-  c.parent_controller   = "ApplicationController"  # inherits your auth, set BEFORE boot
+  c.parent_controller   = "ApplicationController"  # inherit your auth; resolved once at boot
   c.user_class          = "User"
   c.current_user_method = :current_user
   c.authenticate_method = :authenticate_user!
-  c.admin_check         = ->(user) { user.admin? }
+  c.admin_check         = ->(user) { user.respond_to?(:admin?) && user.admin? }
 
-  # Leadership: the governing tier. Only these people can change leave
-  # policy, offices, holidays, employee profiles, salary structures,
-  # payroll, appraisals. Change the list, not the code.
+  # The governing tier: only these people change leave policy, offices,
+  # holidays, employee profiles, salary structures, payroll and appraisals.
   c.leadership_emails = ENV.fetch("HR_LEADERSHIP_EMAILS", "").split(",").map(&:strip)
 
-  # In-app notifications -> your bell system.
+  # In-app notifications -> your bell system (optional; a no-op by default).
   c.notify = ->(user:, kind:, title:, body:, path:) {
     StaffNotifier.notify(user, kind: kind, title: title, body: body, path: path)
   }
 
-  c.mailer_from    = "hr@example.com"
-  c.mail_link_base = "https://hr.example.com"   # enables deep links in emails
-  c.company        = -> { { name: "Acme", address: "Head office address", logo_path: nil } }
+  c.mailer_from     = "hr@example.com"
+  c.public_url_base = "https://hr.example.com"  # enables deep links in emails
+  c.company         = -> { { name: "Acme", address: "Head office address", logo_path: nil } }
 
-  # Salary-slip PDFs: plug your renderer, or add wicked_pdf to your bundle
-  # and the built-in renderer takes over. Without either, PDF is disabled.
+  # Salary-slip PDFs: plug your renderer, or add wicked_pdf to the bundle and
+  # the built-in renderer takes over. With neither, PDF export is disabled.
   c.render_pdf = ->(template:, assigns:, cache_key:) {
     PdfRenderer.render(template: template, assigns: assigns, cache_key: cache_key)
   }
@@ -103,16 +144,190 @@ HrLite.configure do |c|
 end
 ```
 
-Every event's channels are configurable via `c.notification_matrix` — see
-`HrLite::Notifications::DEFAULT_MATRIX` for the routing table (bell /
-employee email / leadership email / leadership bell per event).
+`docs/CONFIGURATION.md` documents every key with its type, default and when to
+override it, plus the full event/notification matrix. `parent_controller` is
+resolved once at boot — restart after changing it.
+
+## Access tiers
+
+Authorization is layered on top of the checks you provide. There is no separate
+role table; a user's tier is derived per request.
+
+- **Employee** — every signed-in user. All self-service screens are scoped to
+  `current_user` (asking for someone else's record 404s), so a new hire is
+  never locked out.
+- **Admin** (`admin_check`, or anyone in leadership) — day-to-day operations:
+  team attendance, leave and regularization decisions, the overview board.
+- **Leadership** (`leadership_check` only — admin is not enough) — policy and
+  people: leave types, offices, holidays, the weekend rule, employee profiles,
+  onboarding/offboarding, the audit trail. Every leadership mutation writes an
+  append-only `hr_lite_audit_logs` row and emails leadership with the diff.
+- **Superadmin (money)** (`superadmin_check`) — salary structures, payroll
+  runs, salary-slip administration, appraisals and promotions. Set
+  `superadmin_emails` to a subset of leadership to separate money from policy.
+  Left empty (the default), the money tier is the leadership tier.
+
+Leadership is a list you control, not code. The generated initializer reads it
+from `HR_LEADERSHIP_EMAILS` (a comma-separated list) so you can change who
+governs without a deploy — that env var is a convention in the initializer the
+generator writes, not something the gem reads on its own. You can drop the env
+var and assign `c.leadership_emails` directly, or replace `c.leadership_check`
+to derive leadership some other way.
+
+`HrLite.admin?(user)`, `HrLite.leadership?(user)` and `HrLite.superadmin?(user)`
+are available if you need the same checks in host code.
+
+## Features
+
+Once mounted, staff use the portal at the mount point; admins and leadership get
+an `/admin` area. The routes below are relative to the mount path.
+
+### Attendance and geolocation
+
+Employees check in and out from `/attendance` (`POST check_in` / `check_out`).
+The browser sends latitude, longitude and accuracy with each punch. Geolocation
+never blocks a punch: a punch with no GPS, or one outside every office radius,
+is still recorded and then flagged for review — denying location access must not
+stop anyone from working. Distance is a pure-Ruby haversine, so there is no
+geocoding dependency:
+
+```ruby
+HrLite::Geo.distance_m(office.lat, office.lng, punch_lat, punch_lng) # => metres
+```
+
+Offices are `HrLite::OfficeLocation` records with a `radius_m`; leadership
+manages them under `/admin/office_locations`. `OfficeLocation.covering?(lat,
+lng)` answers whether a point falls inside any active office, and
+`OfficeLocation.nearest(lat, lng)` backs the flag note ("1.2 km from Head
+Office"). Admins see the team's day and flagged punches under
+`/admin/attendances`.
+
+### Leave, comp-off and regularization
+
+Leave types are policy rows (`HrLite::LeaveType`) with quota, accrual
+(`monthly` or `yearly_upfront`), carry-forward cap and paid/unpaid flag; seeds
+create a sensible default set (CL, SL, EL, LWP, CO). Balances are computed
+against a leave year whose start month is configurable:
+
+```ruby
+HrLite.configure { |c| c.leave_year_start_month = 7 } # July–June instead of Jan–Dec
+HrLite::LeaveYear.current_key   # => 2026
+HrLite::LeaveYear.label(2026)   # => "2026–27"
+```
+
+Set `leave_year_start_month` once, at install time — balance rows are keyed by
+leave year, and changing it later reinterprets stored balances. Entitlement
+prorates from the joining date (joined on or before the 15th counts that month).
+
+Employees apply, cancel and track balances at `/leave_requests` and
+`/leave_balances`; admins approve or reject under `/admin/leave_requests`.
+Comp-off requests (`/comp_off_requests`) credit the comp-off leave type when
+approved; regularization tickets (`/regularization_requests`) let someone who
+forgot to punch propose the real times for admin approval, which writes them
+onto the attendance record with a full audit trail.
+
+### Holidays and calendar
+
+`bin/rails hr_lite:seed` inserts the three fixed-date national holidays
+(Republic Day, Independence Day, Gandhi Jayanti). Movable festival dates shift
+every year, so leadership adds them under `/admin/holidays` — including a
+bulk-paste flow. Everyone sees the holiday list at `/holidays` and a combined
+company calendar at `/calendar`. The weekend rule (Sunday only, Saturday and
+Sunday, or 2nd and 4th Saturday) is a leadership setting.
+
+### Payroll and salary slips
+
+Payroll runs one month at a time through
+`draft → processing → review → finalized → published`. A run prorates each
+salary structure by attendance, applies the statutory calculators, and produces
+a salary slip per employee plus a payout-register CSV. Statutory rates live in a
+date-keyed table so a budget change is one new entry and old runs keep computing
+on the card that was in force:
+
+```ruby
+HrLite::StatutoryRateCard.for(Date.new(2026, 4, 1)) # => the card effective on/before that month
+```
+
+Leadership (or the superadmin tier, if set) drives runs under
+`/admin/payroll_runs`; employees see their published slips at `/salary_slips`.
+Salary-slip PDFs render through `config.render_pdf`, or through a built-in
+WickedPdf path if `wicked_pdf` is in the bundle. The exact math, rounding rules
+and what is deliberately not modelled are in `docs/PAYROLL.md` — read it with
+your accountant before the first run.
+
+### Kudos and @mentions
+
+The kudos wall (`/kudos`) lets staff thank each other with @mentions. The picker
+inserts a plain-text marker, `@[Asha Rao](42)`, and the server parses the ids
+out of it:
+
+```ruby
+HrLite::MentionParser.user_ids("Great save @[Asha Rao](42)")  # => [42]
+HrLite::MentionParser.strip_markers("Nice @[Asha Rao](42)")   # => "Nice @Asha Rao"
+```
+
+The autocomplete source is `GET <mount>/users/search?q=…`, backed by
+`config.mentionable_users` (a name/email match on your user table by default;
+override it to scope or to use your own search). Each mention notifies the
+mentioned person; the marker is never shown raw in a bell or email.
+
+### Notifications and the event bus
+
+Domain code publishes an event; a per-event row in the notification matrix
+decides which channels fire — an in-app bell, an employee email, a single
+leadership email with every configured address in `To:`, and a leadership bell:
+
+```ruby
+HrLite::Notifications.publish(
+  "leave.requested",
+  title: "Asha requested casual leave",
+  bell_to: HrLite.admin_users
+)
+```
+
+The matrix is `HrLite::Notifications::DEFAULT_MATRIX`; override
+`config.notification_matrix` to mute or add channels per event (a host matrix
+pinned on an older gem version still works — unknown events fall back to the
+defaults). Governing changes also publish `policy.changed` with a redacted diff
+and land in the audit trail. The full event list and channel table is in
+`docs/CONFIGURATION.md`.
 
-## Recurring jobs (host scheduler)
+### Appraisals, promotions and the org chart
+
+Appraisals move `draft → shared` and become permanent once shared; employees
+read theirs at `/appraisals`. Promotions and role changes are recorded as
+designation changes with a timeline (`/career`) and can mirror into your own
+user model through `config.on_designation_change`. The org chart at `/org` is
+visible to everyone and shows the reporting tree — names, designations and
+departments only, never salary or private data — with each viewer's own
+reporting line labelled L1/L2/…
+
+## Recurring jobs
+
+Schedule these on the host's job scheduler (cron, GoodJob, Sidekiq-cron,
+whatever you run). Each is idempotent and sends nothing on a quiet day.
 
 | Job | Schedule | Purpose |
 |---|---|---|
-| `HrLite::DailyDigestJob` | mornings | leadership digest: out today, pending approvals, flagged punches |
-| `HrLite::LeaveYearRolloverJob` | Jan 1 | carry-forward balances (idempotent) |
+| `HrLite::DailyDigestJob` | each morning | Leadership digest: who is out today, pending approvals, flagged punches, missing checkouts |
+| `HrLite::PayrollAutoDraftJob` | monthly, on the 1st | Draft and compute the previous month's payroll from attendance, then notify leadership for review (publishing stays a human action) |
+| `HrLite::LeaveYearRolloverJob` | leave year's first day (Jan 1, or Jul 1 for a July–June year) | Materialize carry-forward into the new year's balances |
+
+## Rake tasks
+
+| Task | What it does |
+|---|---|
+| `hr_lite:seed` | Idempotently seed default leave types and the fixed national holidays. Safe to run on every deploy; it never overwrites operator edits. |
+| `hr_lite:install:migrations` | Copy the engine migrations into the host's `db/migrate` (Rails-provided). Only needed if you want copies instead of gem-served migrations. |
+
+## Generators
+
+`hr_lite:install` writes `config/initializers/hr_lite.rb` and prints the
+remaining wiring steps.
+
+| Option | Default | Effect |
+|---|---|---|
+| `--route` | off | Also append `mount HrLite::Engine => "/hr", as: :hr_lite` to `config/routes.rb`. |
 
 ## Theming
 
@@ -122,58 +337,56 @@ Override the CSS variables, nothing else:
 :root { --hrl-accent: #00a24f; --hrl-font: "Inter", sans-serif; }
 ```
 
-All views are also overridable via standard engine view precedence.
-
-## Docs
-
-- [docs/CONFIGURATION.md](docs/CONFIGURATION.md) — every config key, the event
-  list and the notification matrix, how the three access tiers gate.
-- [docs/PAYROLL.md](docs/PAYROLL.md) — the exact payroll math, rounding rules,
-  run lifecycle, and what is deliberately not modelled.
+Point `config.extra_stylesheets` at a stylesheet and it is linked after the
+engine's own CSS, so your `--hrl-*` overrides win. Every view is also
+overridable through standard engine view precedence — drop a file at the same
+path under your app's `app/views/hr_lite/…`.
 
 ## Statutory disclaimer
 
 Payroll math (PF, ESI, PT, TDS) is projection-grade and configured in
-`HrLite::StatutoryRateCard` — a date-keyed rate table. **Verify the rates for
-each financial year with your accountant** before the first run; per-slip
-LOP/TDS overrides are the escape hatch. Surcharge, perquisites and
-HRA-exemption math are not modelled.
+`HrLite::StatutoryRateCard` — a date-keyed rate table. Verify the rates for each
+financial year with your accountant before the first run; the per-slip LOP and
+TDS overrides are the escape hatch. Surcharge, perquisites and HRA-exemption
+math are not modelled — see `docs/PAYROLL.md` for the full list of what is left
+to the override.
 
-## Requirements & versioning
+## Testing and development
 
-- Rails >= 8.0, Ruby >= 3.2, any ActiveRecord database (portable column
-  types; developed against PostgreSQL, CI runs SQLite).
-- The host app must have ActiveRecord encryption keys configured.
-- [SemVer](https://semver.org): 0.x minors may break with a CHANGELOG note;
-  from 1.0, breaking changes only in majors.
+The test harness is a minimal dummy app in `spec/dummy` — SQLite, a bare `User`
+model and a session-based auth stub — so the suite runs in a few seconds with no
+external services.
 
-## Documentation
+```bash
+bundle install
+bundle exec rspec            # dummy-app suite
+COVERAGE=1 bundle exec rspec # with SimpleCov (the project holds 100% line coverage)
+bundle exec rubocop          # rubocop-rails-omakase style
+```
 
-- [docs/CONFIGURATION.md](docs/CONFIGURATION.md) — every config hook, the
-  event/notification matrix, access-tier gating.
-- [docs/PAYROLL.md](docs/PAYROLL.md) — exact payroll math, rounding rules,
-  and what is deliberately not modelled.
-- [CHANGELOG.md](CHANGELOG.md) — release history.
+## Versioning
+
+This project follows [Semantic Versioning](https://semver.org). While on 0.x a
+minor release may include a breaking change, always called out in
+[CHANGELOG.md](CHANGELOG.md); from 1.0 breaking changes land only in majors.
 
 ## Contributing
 
-Bug reports and pull requests are welcome — see
-[CONTRIBUTING.md](CONTRIBUTING.md) for setup and ground rules (100%
-coverage, BigDecimal money, config hooks over host couplings). Security
-issues: report privately per [SECURITY.md](SECURITY.md). Everyone
-interacting with this project is expected to follow the
+Bug reports and pull requests are welcome — see [CONTRIBUTING.md](CONTRIBUTING.md)
+for setup, the branch and PR flow, and the ground rules (Conventional Commits,
+100% coverage, BigDecimal money, config hooks over host couplings, CI must
+pass). Security issues: report privately per [SECURITY.md](SECURITY.md).
+Everyone interacting with the project is expected to follow the
 [code of conduct](CODE_OF_CONDUCT.md).
 
-## Development
+## Documentation
 
-```bash
-bundle install
-bundle exec rspec          # dummy-app test suite (100% line coverage)
-COVERAGE=1 bundle exec rspec
-bundle exec rubocop
-```
+- [docs/CONFIGURATION.md](docs/CONFIGURATION.md) — every config key with type and
+  default, the event/notification matrix, and how the access tiers gate.
+- [docs/PAYROLL.md](docs/PAYROLL.md) — the exact payroll math, rounding rules,
+  run lifecycle, and what is deliberately not modelled.
+- [CHANGELOG.md](CHANGELOG.md) — release history.
 
 ## License
 
-The gem is available as open source under the terms of the
-[MIT License](MIT-LICENSE).
+hr_lite is released under the terms of the [MIT License](MIT-LICENSE).

data/app/assets/javascripts/hr_lite/confirm.js

@@ -0,0 +1,31 @@
+// Confirmation prompts for destructive actions.
+//
+// The views carry `data-turbo-confirm` on the forms that delete a draft
+// payroll run, remove a kudos, offboard someone or withdraw a resignation —
+// but the engine deliberately ships no Turbo and no Stimulus, so nothing was
+// ever reading that attribute. Every one of those buttons fired on the first
+// click with no prompt at all.
+//
+// Same attribute name so the markup does not change, and a no-op when a host
+// app does load Turbo (Turbo handles it first; two prompts would be worse
+// than none).
+(function () {
+  if (window.Turbo) return;
+
+  document.addEventListener(
+    "submit",
+    function (event) {
+      var form = event.target;
+      if (!form || form.nodeName !== "FORM") return;
+
+      var message = form.getAttribute("data-turbo-confirm");
+      if (!message) return;
+
+      if (!window.confirm(message)) {
+        event.preventDefault();
+        event.stopPropagation();
+      }
+    },
+    true // capture, so the check runs before any other submit handler
+  );
+})();

data/app/assets/stylesheets/hr_lite/hr_lite.css

@@ -75,6 +75,34 @@
   padding: .25rem .25rem calc(.25rem + env(safe-area-inset-bottom));
 }
 .hrl-tabbar .hrl-nav__link { flex: 1; justify-content: center; font-size: .78rem; }
+/* "More" sheet — everything five tabs cannot hold. Pure <details>: the
+   engine ships no Turbo or Stimulus and this must not need any. */
+.hrl-tabbar__more { flex: 1; display: flex; }
+.hrl-tabbar__more > summary {
+  flex: 1; justify-content: center; list-style: none; cursor: pointer;
+}
+.hrl-tabbar__more > summary::-webkit-details-marker { display: none; }
+.hrl-tabbar__more[open] > summary { color: var(--hrl-accent); font-weight: 600; }
+.hrl-sheet {
+  position: fixed; left: 0; right: 0;
+  bottom: calc(3.3rem + env(safe-area-inset-bottom));
+  max-height: 60vh; overflow-y: auto;
+  display: flex; flex-direction: column; gap: 2px;
+  background: var(--hrl-card); border-top: 1px solid var(--hrl-line);
+  padding: .6rem .85rem;
+  box-shadow: 0 -6px 18px rgb(0 0 0 / 8%);
+}
+/* Left-aligned like the desktop rail — the tab-bar rule centres its own
+   links and would otherwise apply here too. */
+.hrl-sheet .hrl-nav__link {
+  display: flex; justify-content: flex-start;
+  min-height: 44px; font-size: .92rem; padding: .5rem .6rem;
+}
+.hrl-sheet .hrl-side__group {
+  color: var(--hrl-muted); font-size: .72rem; font-weight: 700;
+  text-transform: uppercase; letter-spacing: .06em;
+  margin: .7rem 0 .15rem; padding: 0 .6rem;
+}
 
 @media (min-width: 768px) {
   .hrl-tabbar { display: none; }

data/app/controllers/hr_lite/admin/attendances_controller.rb

@@ -35,12 +35,27 @@ module HrLite
 
         attrs = params.require(:attendance_record).permit(:check_in_at, :check_out_at, :status)
         if attrs[:check_in_at].blank? && attrs[:check_out_at].blank?
-          record.destroy if record.persisted?
+          # Nothing to remove used to still write a `destroy` audit row with
+          # subject_id 0 and email the employee that a punch was removed.
+          unless record.persisted?
+            return redirect_to admin_attendance_path(@employee.id, month: date.strftime("%Y-%m")),
+                               notice: "Nothing to remove for that day."
+          end
+
+          record.destroy
           log_regularization(record, note, removed: true)
           return redirect_to admin_attendance_path(@employee.id, month: date.strftime("%Y-%m")),
                              notice: "Punch removed."
         end
 
+        # A check-out with no check-in produces a row every consumer reads as
+        # absent (they all key off check_in_at), so the day silently stays LOP
+        # while the screen reports the fix succeeded.
+        if attrs[:check_in_at].blank?
+          return redirect_to admin_attendance_path(@employee.id, date: date, month: date.strftime("%Y-%m")),
+                             alert: "A check-in time is required when a check-out is set."
+        end
+
         record.assign_attributes(attrs)
         record.status = "present" if record.status.blank?
         record.regularized_by_id = hr_current_user.id
@@ -60,10 +75,9 @@ module HrLite
       private
 
       def log_regularization(record, note, removed:)
-        AuditLog.create!(
-          actor: hr_current_user, action: removed ? "destroy" : "regularize",
-          subject_type: record.class.name, subject_id: record.id || 0,
-          audited_changes: { "date" => record.date.to_s, "note" => note }
+        AuditLog.record!(
+          action: removed ? "destroy" : "regularize", subject: record, actor: hr_current_user,
+          changes: { "date" => record.date.to_s, "note" => note }
         )
         Notifications.publish(
           "attendance.regularized",

data/app/controllers/hr_lite/admin/audit_logs_controller.rb

@@ -2,7 +2,10 @@ module HrLite
   module Admin
     class AuditLogsController < LeadershipController
       def index
-        @audit_logs = paginate(AuditLog.recent.includes(:actor))
+        # Appraisal and promotion rows carry review text in plain columns:
+        # ordinary leadership governs people and policy, not pay.
+        scope = hr_superadmin? ? AuditLog.recent : AuditLog.recent.outside_money_tier
+        @audit_logs = paginate(scope.includes(:actor))
       end
     end
   end