hr_lite 0.16.0 → 0.18.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14d37a1d62a035315390be2c619a74722c58e6b53b747422aa4ab48458287102
-  data.tar.gz: fbbb6c7efb893ff38d6992971844fd721deca4819943f0e0dd8f1cd343f4b4fc
+  metadata.gz: c73e1512e67fbae1abb7b12f6134564974819e2055c937e3fabcb294a196bea9
+  data.tar.gz: 93bd305c7aa148e6e2f034f9355cc15078ddf8252cf0af92f938da136b945ac1
 SHA512:
-  metadata.gz: 70b42e3a35bd683ab62ecda90d33009511faeda8595cbc9ec9fc9f1ae2388f61592059a4ea1be151ade6ec3062f4ecea2726098f2f58adc55048f8e108de7460
-  data.tar.gz: a19199e7cd8a173713e97d77266d4779951ef47d70171c234ee65d2afec5cc35be8670542db4e49ad2e656efe6031b8aba053cc281f687fd08dd6b20e3d83511
+  metadata.gz: f4c2331de1a65bbfb074277c9a309b1276c213a55747fd8f8446c5d54c72a41edfb3087a950bfd19aff5fc00ed2b96130e20d200583e9e8970dc0edd10750806
+  data.tar.gz: 25103c4830b09f09e13996557e926dfb4bde694fb0cb60a8f10d8adb355ba4f25d553b226ec38f039df395a339a832c4822ecd2a4aaa5ebbf5b6f111a957e88c

data/CHANGELOG.md

@@ -7,6 +7,69 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.18.0] - 2026-09-29
+
+Salary follows leave. One migration (`paid_days` on leave requests, nullable;
+existing rows read as fully paid).
+
+### Changed
+
+- **Leave beyond the balance is loss of pay, not refused.** On approval —
+  applied by the employee or recorded by HR — the balance covers the leave's
+  earliest working days in half-day steps (`paid_days`), and payroll cuts the
+  rest at the month's gross divided by its calendar days. The balance is never
+  overdrawn by it, so next month's accrual is not swallowed. Each unpaid day is
+  cut in its own month when a leave spans two. The split is fixed at approval;
+  correct it with the slip's LOP override while the run is in review.
+- Comp-off is still refused past its earned credit.
+- The monthly draft alert on the 1st goes to whoever runs payroll
+  (`payroll.manage`), with email, instead of leadership — who cannot open it.
+
+### Added
+
+- The employee is told on applying how many days will be unpaid; the approver
+  sees it on the request before approving.
+- `config.slip_release_day` (1..28): employees see a published slip from that
+  day of the following month, and the "slip ready" bell and email wait until
+  then. `nil` (default) keeps today's behaviour. Needs an ActiveJob backend
+  that runs scheduled jobs.
+
+## [0.17.0] - 2026-09-29
+
+Screens for the things other screens were waiting on. An audit of every HR
+screen found four that could never show anything, because the rows they list
+could only be created from a console. No migration.
+
+### Added
+
+- **Expense categories** (Settings → Expense categories, leadership). Until
+  now nothing created one, so the claim form had no categories and every
+  expense claim failed with "Category must exist". Add or edit name, monthly
+  cap, receipt rule and active; untick Active to retire one (no delete —
+  claims point at it).
+- **One-off pay items** (Payroll → a run → One-off pay items, money tier): a
+  bonus, incentive, arrears, reimbursement or one-time deduction for a person
+  and month, carried by that month's computed slip. A month already paid
+  refuses both adding and removing an item; the loan repayment line stays
+  with the loan. Items are money-tier in the audit trail, so the leadership
+  email no longer carries the amount.
+- **Benefits admin** (Manage → Benefits, `benefit.manage`): add a benefit,
+  enrol somebody with their dependants, end their cover. Employees' Benefits
+  page was always empty before.
+
+### Fixed
+
+- **A manager could adjust anybody's leave balance.** The adjust action never
+  asked whose balance it was. It now needs `leave.manage` reaching that person;
+  the balances grid lists only people the viewer can see, and the adjust form
+  shows only to someone who holds `leave.manage`.
+- The professional-tax state picker on the salary structure form had no
+  options.
+- Sidebar links that led nowhere: the employee Approvals inbox shows only once
+  an approval flow exists; Claims shows to whoever approves claims (Finance
+  sees it, HR no longer lands on access denied); Profile is linked, and with it
+  Resignation; both leave balance pages are linked.
+
 ## [0.16.0] - 2026-09-27
 
 Employee ID cards, print requests through Ask HR, recording leave for

data/README.md

@@ -141,6 +141,7 @@ HrLite.configure do |c|
   c.render_pdf = ->(template:, assigns:, cache_key:) {
     PdfRenderer.render(template: template, assigns: assigns, cache_key: cache_key)
   }
+  c.slip_release_day = 10 # employees see a slip from the 10th of the next month; nil (default) = on publish
 
   # Mirror promotions into your own user model (optional).
   c.on_designation_change = ->(user, designation) { user.update!(designation: designation) }

data/app/controllers/hr_lite/admin/benefits_controller.rb

@@ -0,0 +1,61 @@
+module HrLite
+  module Admin
+    # Who is covered by what. Before this screen nothing created a benefit,
+    # so every employee's /benefits page said "not enrolled".
+    class BenefitsController < BaseController
+      skip_before_action :require_operations_access!
+      before_action :require_benefits!
+
+      def index
+        @benefits = Benefit.order(:name)
+        @enrolments = paginate(covered.includes(:benefit, :user).order(:enrolled_on))
+      end
+
+      def new
+        @benefit = Benefit.new
+      end
+
+      def create
+        @benefit = Benefit.new(benefit_params)
+        if @benefit.save
+          redirect_to admin_benefits_path, notice: "#{@benefit.name} added."
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def enrol
+        benefit = Benefit.find(params[:id])
+        user = HrLite.user_klass.find(params[:user_id])
+        benefit.benefit_enrolments.create!(user_id: user.id, enrolled_on: parse_date_param(params[:enrolled_on]),
+                                           dependants: params[:dependants].presence || 0)
+        redirect_to admin_benefits_path, notice: "#{HrLite.display_name(user)} enrolled in #{benefit.name}."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_benefits_path, alert: e.record.errors.full_messages.to_sentence
+      end
+
+      # Ends cover rather than deleting the row: who was covered when is
+      # the record an insurance claim gets checked against.
+      def unenrol
+        enrolment = covered.where(benefit_id: params[:id]).find_by!(user_id: params[:user_id])
+        enrolment.update!(ended_on: parse_date_param(params[:ended_on]))
+        redirect_to admin_benefits_path, notice: "Cover ended for #{HrLite.display_name(enrolment.user)}."
+      rescue ActiveRecord::RecordInvalid => e
+        redirect_to admin_benefits_path, alert: e.record.errors.full_messages.to_sentence
+      end
+
+      private
+
+      def require_benefits! = hr_require_permission!("benefit.manage", scope: :all)
+
+      # Still covered today — including cover that ends on a future date, which
+      # HR must still be able to see and change.
+      def covered = BenefitEnrolment.where("ended_on IS NULL OR ended_on >= ?", Date.current)
+
+      def benefit_params
+        params.require(:benefit).permit(:name, :kind, :provider, :policy_number, :coverage, :employer_premium,
+                                        :employee_premium, :effective_from, :expires_on, :notes)
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/expense_categories_controller.rb

@@ -0,0 +1,43 @@
+module HrLite
+  module Admin
+    # No destroy: claims hold the category by foreign key. Retire one by
+    # unticking Active, which takes it off the claim form.
+    class ExpenseCategoriesController < LeadershipController
+      def index
+        @expense_categories = ExpenseCategory.alphabetical
+      end
+
+      def new
+        @expense_category = ExpenseCategory.new
+      end
+
+      def create
+        @expense_category = ExpenseCategory.new(expense_category_params)
+        if @expense_category.save
+          redirect_to admin_expense_categories_path, notice: "Category added."
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def edit
+        @expense_category = ExpenseCategory.find(params[:id])
+      end
+
+      def update
+        @expense_category = ExpenseCategory.find(params[:id])
+        if @expense_category.update(expense_category_params)
+          redirect_to admin_expense_categories_path, notice: "Category updated."
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      private
+
+      def expense_category_params
+        params.require(:expense_category).permit(:name, :monthly_cap, :receipt_required, :active)
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/leave_balances_controller.rb

@@ -4,12 +4,15 @@ module HrLite
       def index
         @year = sanitized_year
         @types = LeaveType.active.where(paid: true).where.not(annual_quota: nil)
-        @employees = HrLite.employees
+        @employees = HrLite.employees.select { |employee| hr_reaches?("leave.view", employee) }
       end
 
       # Manual credit/debit — also the comp-off credit mechanism.
       def adjust
         user = HrLite.user_klass.find(params[:user_id])
+        # A manager reaches this screen through leave.approve; changing
+        # somebody's quota is leave.manage, for THAT person.
+        hr_require_reach!("leave.manage", user)
         type = LeaveType.find(params[:leave_type_id])
         # Unsanitised, a missing param wrote the adjustment into leave year 0,
         # where no screen can ever show it.

data/app/controllers/hr_lite/admin/leave_requests_controller.rb

@@ -17,7 +17,7 @@ module HrLite
       end
 
       # HR records leave somebody forgot to apply for. Approved on save, by the
-      # person recording it; the balance check still applies.
+      # person recording it; days beyond the balance become loss of pay.
       def new
         @request = LeaveRequest.new(start_date: Date.current, end_date: Date.current)
         @people = recordable
@@ -32,7 +32,7 @@ module HrLite
         end
         return redirect_to(admin_leave_request_path(@request), notice: "Leave recorded and approved.") if recorded
 
-        @request.errors.add(:base, profile ? "Not enough balance — adjust it first or use unpaid leave" : "Pick an employee from the list") if @request.errors.empty?
+        @request.errors.add(:base, profile ? "Not enough comp-off credit" : "Pick an employee from the list") if @request.errors.empty?
         @people = recordable
         render :new, status: :unprocessable_entity
       end
@@ -43,7 +43,7 @@ module HrLite
           redirect_to admin_leave_requests_path, notice: "Leave approved."
         else
           redirect_to admin_leave_request_path(request),
-                      alert: "Cannot approve — balance no longer covers this request."
+                      alert: "Cannot approve — comp-off credit no longer covers this request."
         end
       rescue ActiveRecord::RecordInvalid
         redirect_to admin_leave_request_path(request), alert: "Only pending requests can be decided."

data/app/controllers/hr_lite/admin/payroll_line_items_controller.rb

@@ -0,0 +1,47 @@
+module HrLite
+  module Admin
+    # One-off payslip lines: a bonus, an incentive, arrears, a reimbursement,
+    # a one-time deduction. Money tier, like loans — this is somebody's pay.
+    # Create and destroy are audited by PayrollLineItem's Audited concern.
+    class PayrollLineItemsController < SuperadminController
+      def index
+        @month = parse_month_param(params[:month])
+        @items = paginate(PayrollLineItem.for_month(@month).includes(:user, :component).order(:created_at))
+      end
+
+      def new
+        @item = PayrollLineItem.new(period_month: parse_month_param(params[:month]))
+      end
+
+      def create
+        @item = PayrollLineItem.new(item_params.merge(
+          period_month: parse_month_param(params.dig(:payroll_line_item, :period_month)),
+          created_by_id: hr_current_user.id,
+          # Same list the form offers: loan repayments come from the loan itself.
+          component: addable_components.find_by(id: params.dig(:payroll_line_item, :component_id))
+        ))
+        if @item.save
+          redirect_to admin_payroll_line_items_path(month: @item.period_month.strftime("%Y-%m")),
+                      notice: "#{@item.component.label} added for #{HrLite.display_name(@item.user)}."
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def destroy
+        item = PayrollLineItem.find(params[:id])
+        removed = item.destroy
+        redirect_to admin_payroll_line_items_path(month: item.period_month.strftime("%Y-%m")), status: :see_other,
+                    **(removed ? { notice: "Removed." } : { alert: "That month has already been paid — it can't change now." })
+      end
+
+      private
+
+      def item_params
+        params.require(:payroll_line_item).permit(:user_id, :amount, :note)
+      end
+
+      def addable_components = SalaryComponent.active.where.not(code: "loan_repayment")
+    end
+  end
+end

data/app/controllers/hr_lite/admin/payroll_runs_controller.rb

@@ -48,7 +48,9 @@ module HrLite
       end
 
       def publish
-        transition { |run| run.publish!(actor: hr_current_user) && "Published — employees notified." }
+        day = HrLite.config.slip_release_day
+        opens = day && "Published — employees can open it, and are notified, from the #{day.ordinalize} of next month."
+        transition { |run| run.publish!(actor: hr_current_user) && (opens || "Published — employees notified.") }
       end
 
       # Payout register: the full money sheet including bank details —

data/app/controllers/hr_lite/leave_requests_controller.rb

@@ -19,7 +19,9 @@ module HrLite
     def create
       @request = LeaveRequest.new(request_params.merge(user_id: hr_current_user.id))
       if @request.save
-        redirect_to leave_requests_path, notice: "Leave request submitted."
+        # Say it now, not on the payslip: days past the balance are unpaid.
+        short = @request.days_beyond_balance
+        redirect_to leave_requests_path, notice: "Leave request submitted.#{" #{short.to_s('F')} day(s) are beyond your balance and will be unpaid if approved." if short.positive?}"
       else
         @balances = balance_cards
         render :new, status: :unprocessable_entity

data/app/controllers/hr_lite/salary_slips_controller.rb

@@ -1,13 +1,13 @@
 module HrLite
-  # Employee surface: strictly own PUBLISHED slips — a foreign or
-  # unpublished id 404s through the scoped relation, never 403s.
+  # Employee surface: strictly own RELEASED slips — a foreign, unpublished
+  # or not-yet-released id 404s through the scoped relation, never 403s.
   class SalarySlipsController < ApplicationController
     def index
-      @slips = paginate(own_published.recent_first)
+      @slips = paginate(own_released.recent_first)
     end
 
     def show
-      @slip = own_published.find(params[:id])
+      @slip = own_released.find(params[:id])
 
       respond_to do |format|
         format.html
@@ -17,8 +17,8 @@ module HrLite
 
     private
 
-    def own_published
-      SalarySlip.published.where(user_id: hr_current_user.id)
+    def own_released
+      SalarySlip.released.where(user_id: hr_current_user.id)
     end
 
     def send_slip_pdf(slip)

data/app/helpers/hr_lite/application_helper.rb

@@ -11,7 +11,8 @@ module HrLite
       # belongs in "More" rather than displacing something everybody uses.
       # Employee tier all the same — holding an approval IS the authorisation,
       # so a manager and a stand-in covering for one reach the same screen.
-      { label: "Approvals",  path: :approvals_path,      match: [ "/approvals" ] },
+      { label: "Approvals",  path: :approvals_path,      match: [ "/approvals" ],
+        if: -> { HrLite::ApprovalFlow.where(active: true).exists? } },
       { label: "Expenses",   path: :expenses_path,       match: [ "/expenses" ] },
       { label: "Benefits",   path: :benefits_path,       match: [ "/benefits" ] },
       { label: "Policies",   path: :policies_path,       match: [ "/policies" ] },
@@ -19,7 +20,8 @@ module HrLite
       { label: "Org",        path: :org_path,            match: [ "/org" ] },
       { label: "Kudos",      path: :kudos_path,          match: [ "/kudos" ] },
       { label: "Slips",      path: :salary_slips_path,   match: [ "/salary_slips" ] },
-      { label: "Career",     path: :career_path,         match: [ "/career", "/appraisals", "/profile" ] },
+      { label: "Career",     path: :career_path,         match: [ "/career", "/appraisals" ] },
+      { label: "Profile",    path: :employee_profile_path, match: [ "/profile", "/resignation" ] },
       { label: "Documents",  path: :documents_path,      match: [ "/documents" ] },
       { label: "ID card",    path: :id_card_path,        match: [ "/id_card" ] },
       { label: "Tax",        path: :tax_declaration_path, match: [ "/tax_declaration" ] },
@@ -31,15 +33,17 @@ module HrLite
       { label: "Team attendance", path: :admin_attendances_path,     match: [ "/admin/attendances" ] },
       { label: "Approvals",       path: :admin_leave_requests_path,  match: [ "/admin/leave_requests", "/admin/leave_balances", "/admin/comp_off_requests", "/admin/regularization_requests" ] },
       { label: "Reports",         path: :admin_reports_path,         match: [ "/admin/reports" ] },
-      { label: "Claims",          path: :admin_expenses_path,        match: [ "/admin/expenses" ] },
+      { label: "Claims",          path: :admin_expenses_path,        match: [ "/admin/expenses" ],
+        if: -> { hr_can?("expense.approve", scope: :team) } },
       { label: "Help desk",       path: :admin_hr_requests_path,     match: [ "/admin/hr_requests" ] },
       { label: "Assets",          path: :admin_assets_path,          match: [ "/admin/assets" ] },
+      { label: "Benefits",        path: :admin_benefits_path,        match: [ "/admin/benefits" ] },
       { label: "Joining & exits", path: :admin_checklists_path,      match: [ "/admin/checklists" ] }
     ].freeze
 
     LEADERSHIP_NAV_ITEMS = [
       { label: "Employees", path: :admin_employees_path,        match: [ "/admin/employees" ] },
-      { label: "Settings",  path: :admin_leave_types_path,      match: [ "/admin/leave_types", "/admin/office_locations", "/admin/holidays", "/admin/setting" ] },
+      { label: "Settings",  path: :admin_leave_types_path,      match: [ "/admin/leave_types", "/admin/office_locations", "/admin/holidays", "/admin/setting", "/admin/expense_categories" ] },
       { label: "Audit",     path: :admin_audit_logs_path,       match: [ "/admin/audit_logs" ] },
       { label: "Policies",  path: :admin_policies_path,         match: [ "/admin/policies" ] },
       { label: "Documents", path: :admin_documents_path,        match: [ "/admin/documents" ] }
@@ -63,9 +67,11 @@ module HrLite
       RQRCode::QRCode.new(text).as_svg(use_path: true, viewbox: true, color: "0F172A").html_safe
     end
 
-    # Only items whose routes exist yet (the nav grows with each phase).
+    # Only items whose routes exist yet (the nav grows with each phase), and
+    # whose optional `if:` holds — a link that always lands on "access
+    # denied" or an empty page is worse than no link.
     def hrl_nav_items(items)
-      items.select { |item| hr_lite_route?(item[:path]) }
+      items.select { |item| hr_lite_route?(item[:path]) && (item[:if].nil? || instance_exec(&item[:if])) }
     end
 
     def hr_lite_route?(helper_name)

data/app/jobs/hr_lite/payroll_auto_draft_job.rb

@@ -1,7 +1,7 @@
 module HrLite
   # Monthly automation: on the 1st, draft + compute the previous month's
-  # payroll from attendance and the policy, then tell leadership it is
-  # waiting for review. Publishing stays a deliberate human action —
+  # payroll from attendance and the policy, then tell whoever runs payroll
+  # (payroll.manage) it is waiting for review — leadership cannot open it. Publishing stays a deliberate human action —
   # the system prepares, people approve.
   class PayrollAutoDraftJob < ApplicationJob
     queue_as :default
@@ -16,10 +16,11 @@ module HrLite
       return unless run.draft? && run.salary_slips.none?
 
       run.compute!(actor: nil)
+      payroll = HrLite.users_holding("payroll.manage", scope: :all).to_a
       Notifications.publish(
         "payroll.draft_ready",
         title: "Payroll #{run.label} computed from attendance — #{run.salary_slips.count} slips await review",
-        path: "/admin/payroll_runs/#{run.id}"
+        path: "/admin/payroll_runs/#{run.id}", bell_to: payroll, email_to: payroll
       )
     end
   end

data/app/jobs/hr_lite/slips_ready_job.rb

@@ -0,0 +1,10 @@
+module HrLite
+  # Tells employees their slip is ready on config.slip_release_day, when
+  # SalarySlip.released first lets them open it. Enqueued by
+  # PayrollRun#publish!, which already sent the leadership copy.
+  class SlipsReadyJob < ApplicationJob
+    def perform(run)
+      run.notify_slips_ready(leadership: false)
+    end
+  end
+end

data/app/models/hr_lite/audit_log.rb

@@ -14,7 +14,7 @@ module HrLite
     # leadership audit screen or the policy.changed email.
     MONEY_TIER_TYPES = %w[
       HrLite::Appraisal HrLite::DesignationChange HrLite::SalaryStructure
-      HrLite::PayrollRun HrLite::SalarySlip
+      HrLite::PayrollRun HrLite::SalarySlip HrLite::PayrollLineItem
     ].freeze
 
     scope :recent, -> { order(created_at: :desc) }

data/app/models/hr_lite/benefit_enrolment.rb

@@ -9,7 +9,7 @@ module HrLite
     belongs_to :user, class_name: HrLite.config.user_class
 
     validates :enrolled_on, presence: true
-    validates :user_id, uniqueness: { scope: :benefit_id }
+    validates :user_id, uniqueness: { scope: :benefit_id, message: "is already enrolled" }
     validates :dependants, numericality: { greater_than_or_equal_to: 0 }
     validate :ended_after_it_started
 

data/app/models/hr_lite/leave_balance.rb

@@ -63,7 +63,8 @@ module HrLite
       # each — and the admin balances grid reads this cell for every employee
       # times every leave type.
       calendar = WorkingCalendar.new(range)
-      requests.sum { |request| LeaveDayCounter.count(request, calendar: calendar) }
+      # Loss-of-pay days (beyond paid_days) never drew on the balance.
+      requests.sum { |request| [ LeaveDayCounter.count(request, calendar: calendar), request.paid_days ].compact.min }
     end
 
     def available(as_of: Date.current)

data/app/models/hr_lite/leave_request.rb

@@ -40,6 +40,26 @@ module HrLite
       leave_type.paid
     end
 
+    # Days this request would take past the balance — the loss of pay
+    # approving it today would fix, or did fix once approved. 0 for unlimited types.
+    def days_beyond_balance
+      return 0 if leave_type.unlimited?
+      return paid_days ? LeaveDayCounter.count(self) - paid_days : 0 if approved?
+
+      [ LeaveDayCounter.count(self) - covered_by(balance.available(as_of: start_date)), 0 ].max
+    end
+
+    # Unpaid share (0, 0.5 or 1) of `date`: the balance covered the leave's
+    # EARLIEST working days (paid_days of them), so the rest are loss of pay.
+    def unpaid_on(date)
+      return 0 if paid_days.nil?
+
+      @leave_calendar ||= WorkingCalendar.new(start_date..end_date)
+      through = LeaveDayCounter.count_range(start_date: start_date, end_date: date, half_day: half_day,
+                                            calendar: @leave_calendar)
+      (through - paid_days).clamp(0, half_day ? BigDecimal("0.5") : 1)
+    end
+
     # --- transitions -------------------------------------------------------
 
     # With a flow configured this is ONE RUNG: the request becomes `approved`
@@ -47,9 +67,10 @@ module HrLite
     # the flow is not waiting on, such as HR overriding — the first approval
     # settles it, exactly as before.
     #
-    # Returns false (leaving the request pending) when the balance no longer
-    # covers it; the re-check runs inside the row lock so two concurrent
-    # approvals cannot overdraw one balance.
+    # Days beyond the balance are approved as loss of pay (paid_days); only
+    # comp-off returns false (still pending) when its credit no longer covers
+    # it. The balance is read inside the row lock, so two concurrent
+    # approvals cannot both spend it.
     def approve!(actor:, note: nil)
       return record_routed_decision!(actor, note, :approved) if awaiting?(actor)
 
@@ -132,15 +153,20 @@ module HrLite
     def approve_outright!(actor:, note:)
       insufficient = false
       transition!("approved", actor, note) do
+        next if leave_type.unlimited?
+
         # Serialize on the BALANCE row. `transition!`'s own lock is on this
         # request, and two pending requests are two different rows — so both
         # approvals could read the same untouched balance and overdraw it.
-        LeaveBalance.lock_for(user, leave_type, LeaveYear.key_for(start_date)) unless leave_type.unlimited?
+        # As of start_date: the same date the create-time check uses.
+        covered = covered_by(LeaveBalance.lock_for(user, leave_type, LeaveYear.key_for(start_date)).available(as_of: start_date))
+        next if LeaveDayCounter.count(self) <= covered
 
-        if insufficient_balance_now?
+        if leave_type.comp_off
           insufficient = true
           raise ActiveRecord::Rollback
         end
+        self.paid_days = covered
       end
       return false if insufficient
 
@@ -195,24 +221,17 @@ module HrLite
           "type" => leave_type.code,
           "dates" => date_range_label,
           "days" => days_count&.to_s("F"),
+          "paid_days" => paid_days&.to_s("F"),
           "note" => note.presence
         }.compact
       )
     end
 
-    # This request is still pending here, so balance.used excludes it:
-    # approving is valid iff the request fits the remaining balance.
-    def insufficient_balance_now?
-      return false if leave_type.unlimited?
-
-      # Same as-of date the create-time check used. Reading it as of TODAY
-      # meant a request validated against the balance it would have on the
-      # leave dates could never be approved on a monthly-accrual type.
-      LeaveDayCounter.count(self) > balance.available(as_of: start_date)
-    end
-
     def recorded_by_hr? = created_by_id.present? && created_by_id != user_id
 
+    # The balance covers whole half-days only, never less than nothing.
+    def covered_by(available) = [ (BigDecimal(available.to_s) * 2).floor / BigDecimal(2), 0 ].max
+
     # Recorded leave is approved in the same transaction, so there is nothing
     # left for a flow to route.
     def open_approval_route = pending? && super
@@ -310,9 +329,11 @@ module HrLite
       errors.add(:base, "Attendance is marked in this period") if punched.exists?
     end
 
+    # Only comp-off is refused past its balance: it is earned credit, never
+    # borrowed. Any other type's excess becomes loss of pay at approval.
     def sufficient_balance
       return unless start_date && end_date && leave_type
-      return if leave_type.unlimited? || errors.any?
+      return if leave_type.unlimited? || !leave_type.comp_off || errors.any?
 
       if LeaveDayCounter.count(self) > balance.available(as_of: start_date)
         errors.add(:base, "Not enough #{leave_type.name} balance")

data/app/models/hr_lite/payroll_line_item.rb

@@ -18,6 +18,8 @@ module HrLite
     validate :period_is_first_of_month
     validate :amount_is_positive
     validate :period_is_not_already_paid, on: :create
+    # Removing a line from a paid month rewrites a settled payslip just the same.
+    before_destroy { throw :abort if paid_month? }
 
     scope :for_month, ->(month) { where(period_month: month) }
 
@@ -47,11 +49,11 @@ module HrLite
     # TDS projector reads.
     def period_is_not_already_paid
       return if user_id.nil? || period_month.nil?
-
-      settled = SalarySlip.settled.exists?(user_id: user_id, period_month: period_month)
-      return unless settled
+      return unless paid_month?
 
       errors.add(:period_month, "has already been paid — put this on the next open month")
     end
+
+    def paid_month? = SalarySlip.settled.exists?(user_id: user_id, period_month: period_month)
   end
 end

data/app/models/hr_lite/payroll_run.rb

@@ -96,7 +96,23 @@ module HrLite
         audit!("payroll.published", actor, "slips" => salary_slips.count)
       end
 
-      slips = salary_slips.includes(:user).to_a
+      # config.slip_release_day holds the employee notice until the slip opens
+      # (SalarySlip.released); leadership still hears at publish.
+      day = HrLite.config.slip_release_day
+      release_at = day && period_month.next_month.change(day: day).in_time_zone(HrLite.config.time_zone)
+      if release_at&.future?
+        notify_slips_ready(employees: false)
+        SlipsReadyJob.set(wait_until: release_at).perform_later(self)
+      else
+        notify_slips_ready
+      end
+      true
+    end
+
+    # "Your salary slip is ready". SlipsReadyJob sends the employee half on
+    # the release day, without repeating the leadership copy.
+    def notify_slips_ready(employees: true, leadership: true)
+      slips = employees ? salary_slips.includes(:user).to_a : []
       # Everyone is emailed — a final settlement matters most to the person who
       # has left — but a bell is only useful to someone who can still sign in,
       # and offboarding revokes that. Sending one pointed at a page they cannot
@@ -111,9 +127,9 @@ module HrLite
         body: "Open Earthly HR to view or download it.",
         path: "/salary_slips",
         bell_to: slips.reject { |slip| exited.include?(slip.user_id) }.map(&:user),
-        email_to: slips.map(&:user)
+        email_to: slips.map(&:user),
+        skip_leadership: !leadership
       )
-      true
     end
 
     # Ruby-side aggregates (amounts are encrypted — no SQL sums).

data/app/models/hr_lite/salary_slip.rb

@@ -18,6 +18,12 @@ module HrLite
     before_save :ensure_run_editable
 
     scope :published, -> { joins(:payroll_run).where(hr_lite_payroll_runs: { status: "published" }) }
+    # What an employee may open: published, and with config.slip_release_day
+    # only from that day of the next month (day 10: October's slip on 10 Nov).
+    scope :released, ->(on: Date.current) {
+      day = HrLite.config.slip_release_day
+      day ? published.where(period_month: ..(on - (day - 1)).beginning_of_month.prev_month) : published
+    }
     # What counts as already paid for tax-to-date. A finalized run is money
     # already decided; waiting for publication made the next month's TDS
     # projection read those earnings as zero.