@kernhq/module-hr 0.15.0 → 0.17.0

package/dist/server/router.js

@@ -1,4 +1,4 @@
-import { KernError, requires, requiresCapability, uuidv7, workspaceScoped, } from '@kernhq/kernel';
+import { KernError, packageVersion, requires, requiresCapability, uuidv7, workspaceScoped, } from '@kernhq/kernel';
 import { implement } from '@orpc/server';
 import { and, asc, count, desc, eq, getTableColumns, gte, ilike, inArray, isNull, lte, or, sql, } from 'drizzle-orm';
 import { HrSettings, hrContract, hrEvents, MODULE_ID } from '../contract/index.js';
@@ -10,12 +10,16 @@ import { approvalChains, approvalDecisions, approvalRequests, approvalSteps, att
 import { forViewer, HrAccessService, seesRecordOf, visibleSet } from './services/access.js';
 import { ApprovalService } from './services/approvals.js';
 import { AttendanceService } from './services/attendance.js';
+import { accessLogSort, HrAuditService } from './services/audit.js';
 import { inForceOn, todayIso } from './services/db.js';
 import { LedgerService, MINUTES_PER_DAY, yearOf } from './services/ledger.js';
 import { PeopleService } from './services/people.js';
 import { hashConfig, PolicyService } from './services/policies.js';
+import { closingBalance, PrivacyService, RETENTION_CLASSES, stripSensitiveCustom, } from './services/privacy.js';
 import { DEFAULT_WORKING_WEEK, ResolveService } from './services/resolve.js';
 const os = implement(hrContract).$context();
+/** Shared so the ordinary case — no sensitive custom fields defined — allocates nothing per page. */
+const NO_HIDDEN_FIELDS = new Set();
 const encodeCursor = (key, id) => Buffer.from(JSON.stringify([key, id]), 'utf8').toString('base64url');
 function decodeCursor(raw) {
     if (!raw)
@@ -84,6 +88,332 @@ function paginate(rows, limit, cursorOf) {
     const [key, id] = cursorOf(items[items.length - 1]);
     return { items, nextCursor: encodeCursor(key, id) };
 }
+async function loadCalendar(tx, workspaceId, calendarId) {
+    const [row] = await tx
+        .select()
+        .from(calendars)
+        .where(and(eq(calendars.workspaceId, workspaceId), eq(calendars.id, calendarId)))
+        .limit(1);
+    if (!row)
+        throw KernError.notFound('Calendar');
+    return row;
+}
+/** The chain nearest-first: this calendar, then whatever it extends. */
+async function calendarChain(tx, workspaceId, calendarId) {
+    const chain = [];
+    let cursor = calendarId;
+    for (let depth = 0; depth < 4 && cursor; depth++) {
+        const row = await loadCalendar(tx, workspaceId, cursor);
+        chain.push(row);
+        cursor = row.extendsId;
+    }
+    return chain;
+}
+/**
+ * The composed calendar over a range: this calendar's days over the ones it extends.
+ *
+ * Nearest wins per date and kind, and a day that shadows one from a calendar further down is
+ * marked `overrides` so the editor can show what it is replacing — which is what makes "we work
+ * through this national holiday" legible rather than looking like a missing holiday.
+ *
+ * At module scope, because it never needed the router's closure — only a `tx`. That is what lets
+ * `hrSubjects` below reach it, so the leave calculation a deadline runs reads the same calendar as
+ * the one a person runs.
+ */
+async function composedDays(tx, workspaceId, calendarId, from, to) {
+    const chain = await calendarChain(tx, workspaceId, calendarId);
+    const rows = await tx
+        .select()
+        .from(calendarDays)
+        .where(and(eq(calendarDays.workspaceId, workspaceId), inArray(calendarDays.calendarId, chain.map((c) => c.id)), gte(calendarDays.date, from), lte(calendarDays.date, to)));
+    const nameById = new Map(chain.map((c) => [c.id, c.name]));
+    const seen = new Map();
+    const datesFromNearest = new Set();
+    for (const cal of chain) {
+        for (const row of rows.filter((r) => r.calendarId === cal.id)) {
+            const key = `${row.date}:${row.kind}`;
+            if (seen.has(key))
+                continue;
+            const overrides = cal.id !== calendarId ? false : datesFromNearest.has(row.date);
+            seen.set(key, toResolvedDay(row, cal.id, nameById.get(cal.id) ?? '', overrides));
+            if (cal.id === calendarId)
+                datesFromNearest.add(row.date);
+        }
+    }
+    // Second pass: a nearest-calendar day covering a date the base also has *is* an override, and
+    // the first pass cannot know that until the base has been read.
+    const baseDates = new Set(rows.filter((r) => r.calendarId !== calendarId).map((r) => r.date));
+    return [...seen.values()]
+        .map((d) => ({ ...d, overrides: d.fromCalendarId === calendarId && baseDates.has(d.date) }))
+        .sort((a, b) => a.date.localeCompare(b.date));
+}
+/**
+ * What a *decided* request does to its subject, and the calculation both halves of that stand on.
+ *
+ * These lived inside `implement_`'s closure, and that is the whole reason `ApprovalService` had
+ * appliers only when a person was on the other end of the call: a job cannot reach into a router's
+ * closure, so `sweepTimeouts` would advance an intermediate step and then refuse the step that
+ * *completes* a request — logging that it had reminded instead. A deadline an administrator set,
+ * believed, and told their staff about did nothing on the one step that mattered.
+ *
+ * So it is a factory both callers can reach: `implement_` below, and `hrJobs` in `jobs.ts`. It is a
+ * factory rather than a class because the closure is the point — `applyApproval` needs `simulate`,
+ * `simulate` needs the ledger and the composed calendar, and threading those through method
+ * arguments would buy nothing.
+ *
+ * The alternative was a second `simulate` in the job, and it is worth naming why not: two copies of
+ * a leave calculation drift, both of them type-check while they drift, and the first sign of it is
+ * an employee whose balance disagrees with the days they were granted.
+ *
+ * Services are passed in rather than constructed here so a caller keeps one instance of each — two
+ * `AttendanceService`s is not a bug today and is one cache away from being one.
+ */
+export function hrSubjects(deps) {
+    const { resolve, ledger, attendance } = deps;
+    async function loadRequest(tx, workspaceId, requestId) {
+        const [row] = await tx
+            .select()
+            .from(leaveRequests)
+            .where(and(eq(leaveRequests.workspaceId, workspaceId), eq(leaveRequests.id, requestId)))
+            .limit(1);
+        if (!row)
+            throw KernError.notFound('Leave request');
+        return row;
+    }
+    /**
+     * What a request would cost, and every reason it would be refused.
+     *
+     * Used by `simulate` *and* by `create`, deliberately: a preview that runs different code from the
+     * submission is a preview that eventually lies. The blockers are returned rather than thrown here
+     * so the screen can show all of them at once instead of one per round trip.
+     */
+    async function simulate(tx, workspaceId, personId, input) {
+        const blockers = [];
+        if (input.endsOn < input.startsOn)
+            blockers.push({ code: 'range', message: 'The end date is before the start date.' });
+        const [type] = await tx
+            .select()
+            .from(leaveTypes)
+            .where(and(eq(leaveTypes.workspaceId, workspaceId), eq(leaveTypes.id, input.leaveTypeId)))
+            .limit(1);
+        if (!type)
+            throw KernError.notFound('Leave type');
+        if (type.archivedAt)
+            blockers.push({ code: 'archived', message: `${type.name} is no longer available.` });
+        const resolution = await resolve.forPerson(tx, workspaceId, personId, input.startsOn);
+        const calendarDaysInRange = resolution.calendarId
+            ? await composedDays(tx, workspaceId, resolution.calendarId, input.startsOn, input.endsOn)
+            : [];
+        const results = workingDays(input.startsOn, input.endsOn, resolution.workingWeek, type.countsWorkingDaysOnly
+            ? calendarDaysInRange.map((d) => ({
+                date: d.date,
+                name: d.name,
+                workingFraction: d.workingFraction,
+            }))
+            : []);
+        // Half-days trim the ends. Applied after the calendar, so asking for a half day on a public
+        // holiday still costs nothing rather than costing half of nothing.
+        const days = results.map((r) => {
+            let fraction = r.fraction;
+            if (r.date === input.startsOn && input.startPart === 'afternoon')
+                fraction = Math.min(fraction, 0.5);
+            if (r.date === input.endsOn && input.endPart === 'morning')
+                fraction = Math.min(fraction, 0.5);
+            return { date: r.date, fraction, counted: fraction > 0, reason: r.reason };
+        });
+        const workingDaysTotal = Math.round(days.reduce((sum, d) => sum + d.fraction, 0) * 100) / 100;
+        const minutes = type.unit === 'hour' && input.hours
+            ? Math.round(input.hours * 60)
+            : Math.round(workingDaysTotal * MINUTES_PER_DAY);
+        if (minutes <= 0)
+            blockers.push({
+                code: 'empty',
+                message: 'That range contains no working days.',
+            });
+        const year = yearOf(input.startsOn);
+        const balances = await ledger.balances(tx, workspaceId, personId, year);
+        const balance = balances.find((b) => b.leaveTypeId === input.leaveTypeId);
+        const before = balance?.availableMinutes ?? 0;
+        const after = before - minutes;
+        if (after < 0 && !type.allowNegative)
+            blockers.push({
+                code: 'insufficient',
+                message: `Not enough ${type.name}: this would leave ${Math.round((after / MINUTES_PER_DAY) * 100) / 100} days.`,
+            });
+        if (after < 0 && type.allowNegative && Math.abs(after) > type.maxNegativeMinutes)
+            blockers.push({
+                code: 'below_floor',
+                message: `${type.name} cannot go further than ${Math.round(type.maxNegativeMinutes / MINUTES_PER_DAY)} days negative.`,
+            });
+        // Overlap is refused by a unique index as well; checking here turns a constraint violation into
+        // a sentence naming the dates.
+        const counted = days.filter((d) => d.counted).map((d) => d.date);
+        if (counted.length) {
+            const clash = await tx
+                .select({ date: leaveRequestDays.date })
+                .from(leaveRequestDays)
+                .where(and(eq(leaveRequestDays.workspaceId, workspaceId), eq(leaveRequestDays.personId, personId), eq(leaveRequestDays.counted, true), inArray(leaveRequestDays.status, ['pending', 'approved']), inArray(leaveRequestDays.date, counted)))
+                .limit(3);
+            if (clash.length)
+                blockers.push({
+                    code: 'overlap',
+                    message: `You already have leave booked on ${clash.map((c) => c.date).join(', ')}.`,
+                });
+        }
+        if (type.requiresDocumentAfterDays !== null && workingDaysTotal > type.requiresDocumentAfterDays)
+            blockers.push({
+                code: 'document_required',
+                message: `${type.name} longer than ${type.requiresDocumentAfterDays} days needs a document.`,
+            });
+        return {
+            workingDays: workingDaysTotal,
+            minutes,
+            days,
+            balanceBeforeMinutes: before,
+            balanceAfterMinutes: after,
+            blockers,
+        };
+    }
+    /**
+     * Turn an approved request into a ledger consumption.
+     *
+     * The working days are **recomputed here** rather than trusted from submission time: a holiday
+     * can be added to the calendar between asking and approving, and the number that costs somebody
+     * balance should be the one that was true when it was granted.
+     */
+    async function applyApproval(tx, workspaceId, leaveRequestId, actorId) {
+        const request = await loadRequest(tx, workspaceId, leaveRequestId);
+        if (request.status === 'approved')
+            return;
+        const sim = await simulate(tx, workspaceId, request.personId, {
+            leaveTypeId: request.leaveTypeId,
+            startsOn: request.startsOn,
+            endsOn: request.endsOn,
+            startPart: request.startPart,
+            endPart: request.endPart,
+            hours: request.hours === null ? null : Number.parseFloat(request.hours),
+        });
+        await ledger.append(tx, workspaceId, {
+            personId: request.personId,
+            leaveTypeId: request.leaveTypeId,
+            kind: 'consumption',
+            amountMinutes: -sim.minutes,
+            effectiveOn: request.startsOn,
+            periodYear: yearOf(request.startsOn),
+            requestId: request.id,
+            reason: null,
+            createdBy: actorId,
+        });
+        await tx
+            .update(leaveRequestDays)
+            .set({ status: 'approved' })
+            .where(eq(leaveRequestDays.requestId, request.id));
+        await tx
+            .update(leaveRequests)
+            .set({
+            status: 'approved',
+            minutes: sim.minutes,
+            workingDays: String(sim.workingDays),
+            decidedAt: new Date(),
+            updatedAt: new Date(),
+        })
+            .where(eq(leaveRequests.id, request.id));
+    }
+    /**
+     * Everything a punch needs about a person: their zone, and the schedule that shapes their day.
+     *
+     * The zone comes from the resolution ladder — their primary office unless they have an override —
+     * so a punch made on a business trip still counts towards the month they are employed in.
+     *
+     * Everything here is resolved **as of today**, which is what a punch is about. It is therefore
+     * not the place to answer a question about a past date: this used to hand out today's legal
+     * entity as well, and three callers applied it to business dates months back — so a person who
+     * transferred entity had a filed month recomputed against the one they are in now. `recomputeDay`
+     * asks that question of the day it is rebuilding.
+     */
+    async function personContext(tx, workspaceId, personId) {
+        const today = todayIso();
+        const resolution = await resolve.forPerson(tx, workspaceId, personId, today);
+        const schedule = await attendance.scheduleFor(tx, workspaceId, personId, today);
+        return { timezone: resolution.timezone, schedule, resolution };
+    }
+    /**
+     * Apply an approved correction: write the proposed punches, void what they replace, rebuild.
+     *
+     * Nothing is edited. The original punch keeps its row and gains a pointer to what superseded it,
+     * so a corrected timesheet and an edited one stay distinguishable — which is the entire reason
+     * regularization exists rather than an update statement.
+     */
+    async function applyRegularization(tx, workspaceId, regularizationId) {
+        const [row] = await tx
+            .select()
+            .from(regularizations)
+            .where(and(eq(regularizations.workspaceId, workspaceId), eq(regularizations.id, regularizationId)))
+            .limit(1);
+        if (!row || row.status === 'approved')
+            return;
+        if (row.punchId)
+            await attendance.voidPunch(tx, workspaceId, row.punchId, 'Regularized', null);
+        const { timezone, schedule } = await personContext(tx, workspaceId, row.personId);
+        for (const proposal of row.proposed)
+            await tx.insert(punches).values({
+                id: uuidv7(),
+                workspaceId,
+                personId: row.personId,
+                direction: proposal.direction,
+                at: new Date(proposal.at),
+                businessDate: row.businessDate,
+                timezone,
+                method: 'manual',
+                trust: 'trusted',
+                note: `Regularization ${row.id}`,
+            });
+        await attendance.recomputeDay(tx, workspaceId, row.personId, row.businessDate, timezone, schedule);
+        await tx
+            .update(regularizations)
+            .set({ status: 'approved', appliedAt: new Date() })
+            .where(eq(regularizations.id, row.id));
+    }
+    /** A rejected request costs no balance and writes no punches; it just stops being live. */
+    async function applyLeaveDecision(tx, workspaceId, leaveRequestId, status, actorId) {
+        if (status === 'approved')
+            return applyApproval(tx, workspaceId, leaveRequestId, actorId);
+        await tx
+            .update(leaveRequests)
+            .set({ status: 'rejected', decidedAt: new Date(), updatedAt: new Date() })
+            .where(eq(leaveRequests.id, leaveRequestId));
+    }
+    /** The same, for a correction. */
+    async function applyRegularizationDecision(tx, workspaceId, regularizationId, status) {
+        if (status === 'approved')
+            return applyRegularization(tx, workspaceId, regularizationId);
+        await tx
+            .update(regularizations)
+            .set({ status: 'rejected' })
+            .where(eq(regularizations.id, regularizationId));
+    }
+    return {
+        loadRequest,
+        simulate,
+        applyApproval,
+        applyRegularization,
+        personContext,
+        /**
+         * The same two functions in the shape `ApprovalService` calls them in, keyed by `subjectType` —
+         * the only thing the engine knows about a subject.
+         *
+         * Parameterised by the actor because that is the one thing the two callers genuinely disagree
+         * about: a person approving leave is written onto the ledger entry as `created_by`, and a
+         * deadline running out is written as nobody. Passing the approver's id for a timeout would put
+         * a name against a decision that person did not make, which is exactly what
+         * `TIMEOUT_APPROVER_ID` exists to avoid one table over.
+         */
+        appliersFor: (actorId) => ({
+            leave: (tx, workspaceId, request, status) => applyLeaveDecision(tx, workspaceId, request.subjectId, status, actorId),
+            regularization: (tx, workspaceId, request, status) => applyRegularizationDecision(tx, workspaceId, request.subjectId, status),
+        }),
+    };
+}
 /**
  * The router.
  *
@@ -103,9 +433,18 @@ export function implement_(kernel) {
     const svc = new PeopleService(kernel);
     const access = new HrAccessService(kernel);
     const ledger = new LedgerService();
-    const approvals = new ApprovalService(kernel);
     const policySvc = new PolicyService(resolve);
     const attendance = new AttendanceService(resolve, policySvc);
+    const subjects = hrSubjects({ resolve, ledger, attendance });
+    const { applyApproval, applyRegularization, loadRequest, personContext, simulate } = subjects;
+    /**
+     * The engine gets the appliers here as well as in `jobs.ts`, so the two constructions read the
+     * same and stay the same. A sweep started from a request is still nobody's decision, which is why
+     * this one is built for no actor — the per-request actor arrives at `decide` below.
+     */
+    const approvals = new ApprovalService(kernel, subjects.appliersFor(null));
+    const privacy = new PrivacyService();
+    const audit = new HrAuditService(kernel, access);
     const db = kernel.database;
     const settingsOf = (workspaceId) => kernel.settings.module(workspaceId, MODULE_ID, HrSettings);
     const changed = (workspaceId, entity, id, op) => kernel.realtime.change(workspaceId, { module: MODULE_ID, entity, id, op });
@@ -182,9 +521,12 @@ export function implement_(kernel) {
                         .where(and(eq(officeAssignments.workspaceId, input.workspaceId), inArray(officeAssignments.personId, rows.map((r) => r.id)), eq(officeAssignments.isPrimary, true), isNull(officeAssignments.effectiveTo)))
                     : [];
                 const officeBy = new Map(assignments.map((a) => [a.personId, a]));
+                const hidden = await sensitiveCustomKeys(tx, input.workspaceId, context.principal);
+                const own = hidden.size ? await access.personIdOf(tx, input.workspaceId, context.principal) : null;
                 return {
                     items: rows.map((r) => forViewer({
                         ...PeopleService.toPerson(r),
+                        custom: r.id === own ? (r.custom ?? {}) : stripSensitiveCustom(r.custom ?? {}, hidden),
                         // Spreading into a fresh literal drops the branded WorkspaceId that flowed through
                         // `toPerson`, so it is restored rather than widened to `string`.
                         workspaceId: r.workspaceId,
@@ -204,7 +546,13 @@ export function implement_(kernel) {
              */
             get: scoped.people.get.use(requires('hr.person.view')).handler(({ input, context }) => db.withWorkspace(input.workspaceId, async (tx) => {
                 const visible = visibleSet(await access.visiblePersonIds(tx, input.workspaceId, context.principal));
-                return forViewer(PeopleService.toPerson(await svc.load(tx, input.workspaceId, input.personId)), visible);
+                const person = PeopleService.toPerson(await svc.load(tx, input.workspaceId, input.personId));
+                const hidden = await sensitiveCustomKeys(tx, input.workspaceId, context.principal);
+                const own = hidden.size ? await access.personIdOf(tx, input.workspaceId, context.principal) : null;
+                return forViewer({
+                    ...person,
+                    custom: person.id === own ? person.custom : stripSensitiveCustom(person.custom, hidden),
+                }, visible);
             })),
             /**
              * No permission check: everybody may read their own record, and a permission nobody can lack
@@ -2036,10 +2384,17 @@ export function implement_(kernel) {
                         // Same reason as leave: the approvers are told after this commits, never inside it.
                         return {
                             row: fresh,
-                            approval: { requestId: raised.request.id, approverIds: raised.firstStepApprovers },
+                            approval: {
+                                requestId: raised.request.id,
+                                approverIds: raised.firstStepApprovers,
+                                userIds: await accountsOf(tx, input.workspaceId, raised.firstStepApprovers),
+                                summary: raised.request.summary,
+                                summaryParams: raised.request.summaryParams,
+                                actorId: raised.request.requestedBy,
+                            },
                         };
                     });
-                    if (filed.approval.approverIds.length)
+                    if (filed.approval.approverIds.length) {
                         await kernel.emit(hrEvents.approvalRequested, {
                             requestId: filed.approval.requestId,
                             workspaceId: input.workspaceId,
@@ -2047,6 +2402,16 @@ export function implement_(kernel) {
                             subjectId: filed.row.id,
                             approverIds: filed.approval.approverIds,
                         }, { workspaceId: input.workspaceId, actorId: context.principal.userId });
+                        await notifyApprovers({
+                            workspaceId: input.workspaceId,
+                            requestId: filed.approval.requestId,
+                            subjectType: 'regularization',
+                            summary: filed.approval.summary,
+                            summaryParams: filed.approval.summaryParams,
+                            userIds: filed.approval.userIds,
+                            actorId: filed.approval.actorId,
+                        });
+                    }
                     await changed(input.workspaceId, 'regularization', filed.row.id, 'created');
                     return toRegularization(filed.row);
                 }),
@@ -2357,7 +2722,17 @@ export function implement_(kernel) {
                             request: fresh,
                             personId,
                             replay: false,
-                            approval: { requestId: raised.request.id, approverIds: raised.firstStepApprovers },
+                            approval: {
+                                requestId: raised.request.id,
+                                approverIds: raised.firstStepApprovers,
+                                // Resolved here because it needs `tx`, delivered outside because a notification
+                                // cannot be rolled back. Person ids are HR's identity and accounts are core's, so
+                                // the translation happens once, on the way out.
+                                userIds: await accountsOf(tx, input.workspaceId, raised.firstStepApprovers),
+                                summary: raised.request.summary,
+                                summaryParams: raised.request.summaryParams,
+                                actorId: raised.request.requestedBy,
+                            },
                         };
                     });
                     const result = await filing.catch(async (err) => {
@@ -2389,7 +2764,7 @@ export function implement_(kernel) {
                     // the people the *first* step is on. Nothing for a chain that resolved to nobody — that
                     // was approved on the way in and is not waiting on anyone. The ids are person ids, the
                     // same identity the rest of `hr.*` carries.
-                    if (result.approval.approverIds.length)
+                    if (result.approval.approverIds.length) {
                         await kernel.emit(hrEvents.approvalRequested, {
                             requestId: result.approval.requestId,
                             workspaceId: input.workspaceId,
@@ -2397,6 +2772,18 @@ export function implement_(kernel) {
                             subjectId: result.request.id,
                             approverIds: result.approval.approverIds,
                         }, { workspaceId: input.workspaceId, actorId: context.principal.userId });
+                        // And then the approvers themselves. The event is for other modules; this is for the
+                        // people whose signature the request is now waiting on.
+                        await notifyApprovers({
+                            workspaceId: input.workspaceId,
+                            requestId: result.approval.requestId,
+                            subjectType: 'leave',
+                            summary: result.approval.summary,
+                            summaryParams: result.approval.summaryParams,
+                            userIds: result.approval.userIds,
+                            actorId: result.approval.actorId,
+                        });
+                    }
                     await changed(input.workspaceId, 'leave_request', result.request.id, 'created');
                     return toLeaveRequest(result.request);
                 }),
@@ -2547,24 +2934,15 @@ export function implement_(kernel) {
                     // The approval engine knows nothing about leave. Applying the decision to the subject is
                     // the caller's job, which is what keeps the engine reusable for regularization and
                     // overtime later.
+                    //
+                    // Through the same appliers the timeout sweep is given, rather than a branch of its own:
+                    // this used to be a `switch` on `subjectType` here and nothing at all in the job, which is
+                    // how a deadline could approve a request and leave its leave unbooked. One table of
+                    // subject types, and adding overtime means adding a line to it and nothing here.
                     const request = result.request;
-                    if (request.subjectType === 'leave') {
-                        if (result.status === 'approved')
-                            await applyApproval(tx, input.workspaceId, request.subjectId, context.principal.userId ?? null);
-                        else if (result.status === 'rejected')
-                            await tx
-                                .update(leaveRequests)
-                                .set({ status: 'rejected', decidedAt: new Date(), updatedAt: new Date() })
-                                .where(eq(leaveRequests.id, request.subjectId));
-                    }
-                    else if (request.subjectType === 'regularization') {
-                        if (result.status === 'approved')
-                            await applyRegularization(tx, input.workspaceId, request.subjectId);
-                        else if (result.status === 'rejected')
-                            await tx
-                                .update(regularizations)
-                                .set({ status: 'rejected' })
-                                .where(eq(regularizations.id, request.subjectId));
+                    if (result.status !== 'pending') {
+                        const apply = subjects.appliersFor(context.principal.userId ?? null)[request.subjectType];
+                        await apply?.(tx, input.workspaceId, request, result.status);
                     }
                     const [fresh] = await tx
                         .select()
@@ -2805,28 +3183,313 @@ export function implement_(kernel) {
                 return { ok: true };
             }),
         },
-    });
-    // ------------------------------------------------------------------ helpers
-    // Closures over `kernel` and `db`, kept at the bottom so the router above reads as a list of
-    // procedures rather than a list of procedures interrupted by plumbing.
-    async function loadOffice(tx, input) {
-        const [row] = await tx
-            .select()
-            .from(offices)
-            .where(and(eq(offices.workspaceId, input.workspaceId), eq(offices.id, input.officeId)))
-            .limit(1);
-        if (!row)
-            throw KernError.notFound('Office');
-        return row;
+        // ================================================================= privacy
+        /**
+         * Subject access, erasure and retention.
+         *
+         * `hr.privacy.manage` gates all of it except reading your own access log, and it is granted to
+         * nobody by default — so on a fresh workspace only an owner, who passes every check, can reach
+         * any of this. That is the intended starting position: whether anybody below an owner may export
+         * or erase a colleague is a decision the workspace makes deliberately, in the role editor.
+         */
+        privacy: {
+            /**
+             * Everything HR holds about one person.
+             *
+             * Two transactions rather than one, and on purpose. `PeopleService.readSensitive` opens its
+             * own so the decrypt and the `sensitive_access_log` row it writes are atomic with each other —
+             * that atomicity is the point of the log and it must not be widened into a transaction that
+             * also holds several thousand rows of punches open. The bundle's own reads then run in a
+             * second transaction. The consequence is that the two halves are a moment apart, which for a
+             * subject-access snapshot is not a property anybody depends on.
+             *
+             * The access log is read **after** the export's own row is written, so a subject's bundle
+             * always contains the read that produced it. A bundle that could not account for its own
+             * existence is the first hole somebody would find in it.
+             */
+            subjectAccess: scoped.privacy.subjectAccess
+                .use(requires('hr.privacy.manage'))
+                .handler(async ({ input, context }) => {
+                const { workspaceId, personId } = input;
+                // Before anything else: this both proves the person exists and records the disclosure.
+                // Refusing here means nothing was decrypted and nothing was assembled.
+                const sensitive = await svc.readSensitive({
+                    workspaceId,
+                    personId,
+                    principal: context.principal,
+                    via: 'export',
+                    purpose: input.purpose ?? null,
+                });
+                return db.withWorkspace(workspaceId, async (tx) => {
+                    const person = await svc.load(tx, workspaceId, personId);
+                    const data = await privacy.subjectAccess(tx, workspaceId, personId);
+                    // Resolved here rather than left to the client, and included whatever the
+                    // `leave_accrual` capability says: "why is my balance this number" is the commonest
+                    // follow-up to a subject-access request, and it is the subject's own data either way.
+                    const kinds = ['accrual', 'carry_forward', 'overtime', 'rounding', 'working_time'];
+                    const policiesInForce = [];
+                    for (const kind of kinds)
+                        policiesInForce.push(await policySvc.forPerson(tx, workspaceId, personId, kind, todayIso()));
+                    const decisionsOf = (stepId) => data.approvals.stepDecisions
+                        .filter((d) => d.stepId === stepId)
+                        .map((d) => ({ ...d, decision: d.decision, at: d.at.toISOString() }));
+                    const toStep = (s) => ({
+                        ...s,
+                        mode: s.mode,
+                        status: s.status,
+                        dueAt: s.dueAt?.toISOString() ?? null,
+                        escalatedAt: s.escalatedAt?.toISOString() ?? null,
+                        decisions: decisionsOf(s.id),
+                    });
+                    return {
+                        manifest: {
+                            workspaceId,
+                            personId,
+                            generatedAt: new Date().toISOString(),
+                            generatedBy: context.principal.userId ?? null,
+                            moduleVersion: packageVersion(import.meta.url),
+                            truncated: data.truncated,
+                            // Stated rather than left to be noticed. HR holds the metadata and the file id for
+                            // every document; the bytes live in core's storage and `core.files.get` signs one
+                            // download at a time, so a module cannot put them in a bundle. Naming the omission
+                            // is the difference between an incomplete export and a dishonest one.
+                            excluded: [{ section: 'documents.contents', reason: 'fileContentsNotExportable' }],
+                        },
+                        // The whole row, never `forViewer`: the four personnel fields it withholds from a
+                        // reader are the subject's own.
+                        person: PeopleService.toPerson(person),
+                        sensitive,
+                        employment: data.employment.map(PeopleService.toEmployment),
+                        offices: data.offices.map((r) => ({ ...r, createdAt: r.createdAt.toISOString() })),
+                        history: data.history.map((r) => ({
+                            id: r.id,
+                            field: r.field,
+                            from: r.from ?? null,
+                            to: r.to ?? null,
+                            at: r.at.toISOString(),
+                            actorId: r.actorId,
+                            source: r.source,
+                        })),
+                        documents: data.documents.map((r) => ({ ...r, createdAt: r.createdAt.toISOString() })),
+                        leave: {
+                            types: data.leave.types.map(toLeaveType),
+                            requests: data.leave.requests.map(toLeaveRequest),
+                            days: data.leave.days.map((r) => ({
+                                id: r.id,
+                                requestId: r.requestId,
+                                date: r.date,
+                                fraction: Number.parseFloat(r.fraction),
+                                counted: r.counted,
+                                status: r.status,
+                            })),
+                            ledger: data.leave.ledger.map(toLedgerEntry),
+                            closingBalanceMinutes: closingBalance(data.leave.ledger),
+                        },
+                        attendance: {
+                            punches: data.attendance.punches.map(toPunch),
+                            days: data.attendance.days.map(toAttendanceDay),
+                        },
+                        regularizations: data.regularizations.map(toRegularization),
+                        approvals: {
+                            raised: data.approvals.raised.map((r) => ({
+                                ...r,
+                                subjectType: r.subjectType,
+                                status: r.status,
+                                // The requester is the subject of this bundle, so the name is already loaded —
+                                // and after an erasure it is the tombstone token, which is the right answer.
+                                requesterName: person.displayName,
+                                requestedAt: r.requestedAt.toISOString(),
+                                decidedAt: r.decidedAt?.toISOString() ?? null,
+                                steps: data.approvals.raisedSteps.filter((s) => s.requestId === r.id).map(toStep),
+                            })),
+                            approverOn: data.approvals.approverOn.map(toStep),
+                            decisions: data.approvals.decisions.map((d) => ({
+                                ...d,
+                                decision: d.decision,
+                                at: d.at.toISOString(),
+                            })),
+                        },
+                        delegations: {
+                            given: data.delegations.given.map(toDelegation),
+                            received: data.delegations.received.map(toDelegation),
+                        },
+                        policiesInForce,
+                        accessLog: data.accessLog.map(HrAuditService.toEntry),
+                    };
+                });
+            }),
+            /**
+             * Redact a person, or say what redacting them would do.
+             *
+             * One transaction for the whole erasure: a half-run erasure is worse than a refused one, and a
+             * partial one is not something anybody could tell had happened. It is replayable as well as
+             * atomic — every step matches only rows that still have something to clear — so the recovery
+             * from any failure is to run it again.
+             *
+             * The dry run takes the same transaction and rolls nothing back because it writes nothing; it
+             * runs the identical predicates, which is what stops a preview drifting from the act.
+             */
+            erase: scoped.privacy.erase.use(requires('hr.privacy.manage')).handler(async ({ input, context }) => {
+                const result = await db.withWorkspace(input.workspaceId, (tx) => privacy.erase(tx, {
+                    workspaceId: input.workspaceId,
+                    personId: input.personId,
+                    dryRun: input.dryRun,
+                    reason: input.reason ?? null,
+                    keepNationalIdForAudit: input.keepNationalIdForAudit,
+                    actorUserId: context.principal.userId ?? null,
+                }));
+                // Only a real run moved anything. A dry run that pushed a realtime change would blank the
+                // person's card on every open screen in the workspace for a preview nobody committed.
+                if (!input.dryRun)
+                    await changed(input.workspaceId, 'person', input.personId, 'updated');
+                return {
+                    workspaceId: input.workspaceId,
+                    personId: input.personId,
+                    dryRun: input.dryRun,
+                    erasedAt: result.erasedAt?.toISOString() ?? null,
+                    displayName: result.displayName,
+                    redacted: result.redacted,
+                    kept: result.kept,
+                    caveats: result.caveats,
+                    filesRemaining: result.filesRemaining,
+                };
+            }),
+            accessLog: {
+                /**
+                 * Who read this person's sensitive fields.
+                 *
+                 * **No `requires()`, and that is the whole design of this procedure.** Reading your own
+                 * access log is a thing nobody may lack — a grantable key here could only ever be one
+                 * somebody could be *denied*, and "you may not see who has been looking at your bank
+                 * details" is not a state this product should be able to express. It is in
+                 * `module.test.ts`'s `SELF_SERVICE` allowlist for that reason, beside `people.me`.
+                 *
+                 * The permission check is in the handler because it depends on the arguments: any
+                 * `personId` that is not the caller's own, and any `actorUserId` at all. The second is not
+                 * the smaller case — "what has this account been looking at" is an investigation into a
+                 * colleague, and it is the query that makes this log a thing to be careful with rather than
+                 * only a thing to be reassured by.
+                 */
+                list: scoped.privacy.accessLog.list.handler(({ input, context }) => db.withWorkspace(input.workspaceId, async (tx) => {
+                    const own = await access.personIdOf(tx, input.workspaceId, context.principal);
+                    const aboutSomebodyElse = input.personId !== undefined && input.personId !== own;
+                    const isInvestigation = input.actorUserId !== undefined;
+                    if (aboutSomebodyElse || isInvestigation)
+                        await kernel.authz.require(context.principal, 'hr.privacy.manage', {
+                            kind: 'workspace',
+                            workspaceId: input.workspaceId,
+                        });
+                    // A member who was never made a person has no log of their own and no permission to
+                    // read anybody's. Refusing beats returning an empty page, which reads as "nobody has
+                    // ever looked at your record" — an answer, and the wrong one.
+                    if (!aboutSomebodyElse && !isInvestigation && !own)
+                        throw KernError.notFound('Person');
+                    const cursor = decodeCursor(input.cursor);
+                    const rows = await audit.list(tx, {
+                        workspaceId: input.workspaceId,
+                        personId: input.personId ?? own ?? undefined,
+                        actorUserId: input.actorUserId,
+                        limit: input.limit,
+                        after: cursor ? after(accessLogSort.at, accessLogSort.id, 'desc', cursor) : undefined,
+                    });
+                    // `atText`, never the `Date`: one export writes its rows in a single insert, so they
+                    // share `now()` to the microsecond, and a millisecond-truncated cursor drops every row
+                    // that ties with the last one on the page.
+                    const { items, nextCursor } = paginate(rows, input.limit, (r) => [r.atText, r.id]);
+                    // No `total`. Counting an append-only log a subject scrolls through costs a second scan
+                    // of the same rows to answer a question nobody asked, and `page()` makes it optional
+                    // precisely so a list can decline.
+                    return { items: items.map(HrAuditService.toEntry), nextCursor };
+                })),
+            },
+            retention: {
+                /**
+                 * The horizons, and what is already past them.
+                 *
+                 * `sweepEnabled` is a literal `false` in the contract, and it says the thing this feature
+                 * must not imply: nothing in HR deletes on a timer. The horizons are read here, to count
+                 * what has passed one, and by `privacy.erase`, to say under which horizon each surviving
+                 * class was kept. An unattended job that prunes personnel records is the one act in this
+                 * module that cannot be undone by re-running anything, so it ships off, with a dry run and
+                 * a per-run report naming every person it touched — and until it exists, saying so in the
+                 * response is what keeps this screen from promising it.
+                 */
+                get: scoped.privacy.retention.get.use(requires('hr.privacy.manage')).handler(({ input }) => db.withWorkspace(input.workspaceId, async (tx) => {
+                    const { retention, updatedAt, updatedBy } = await privacy.retention(tx, input.workspaceId);
+                    const counts = input.withCounts
+                        ? await privacy.retentionCounts(tx, input.workspaceId, retention)
+                        : null;
+                    return {
+                        workspaceId: input.workspaceId,
+                        classes: RETENTION_CLASSES.map((cls) => ({
+                            class: cls,
+                            days: retention[cls],
+                            dueNow: counts?.[cls] ?? null,
+                        })),
+                        updatedAt: updatedAt?.toISOString() ?? null,
+                        updatedBy,
+                        sweepEnabled: false,
+                    };
+                })),
+                set: scoped.privacy.retention.set.use(requires('hr.privacy.manage')).handler(({ input, context }) => db.withWorkspace(input.workspaceId, async (tx) => {
+                    const { retention, updatedAt, updatedBy } = await privacy.setRetention(tx, input.workspaceId, input.retention, context.principal.userId ?? null);
+                    // The counts are not recomputed on a write: a screen that has just changed a horizon
+                    // asks for them again, and doing eight counts inside the write transaction would hold
+                    // it open across the most expensive queries in this file.
+                    return {
+                        workspaceId: input.workspaceId,
+                        classes: RETENTION_CLASSES.map((cls) => ({
+                            class: cls,
+                            days: retention[cls],
+                            dueNow: null,
+                        })),
+                        updatedAt: updatedAt?.toISOString() ?? null,
+                        updatedBy,
+                        sweepEnabled: false,
+                    };
+                })),
+            },
+        },
+    });
+    // ------------------------------------------------------------------ helpers
+    // Closures over `kernel` and `db`, kept at the bottom so the router above reads as a list of
+    // procedures rather than a list of procedures interrupted by plumbing.
+    /**
+     * The `people.custom` keys this reader may not be shown.
+     *
+     * `custom_field_defs.sensitive` has been declared, stored, editable and documented as "needs
+     * `hr.person.view_sensitive`, like a national identity number" since the day custom fields
+     * shipped — and until now **nothing read it**. `toPerson` returns `custom` whole and `forViewer`
+     * narrows only the four personnel fields, so a field an administrator deliberately marked
+     * sensitive went to every holder of `hr.person.view`, which is a `member` default. That is the
+     * same defect as a permission key nothing asks about, one level down, and it is why the fix lands
+     * here rather than waiting for a screen.
+     *
+     * Empty for a reader who holds the permission, and empty for a workspace with no sensitive fields
+     * — which is the ordinary case and the one that must not pay for this. Archived definitions are
+     * still counted: `fields.archive` deliberately leaves the values in `people.custom`, so an
+     * archived sensitive field is a sensitive value with its guard removed.
+     *
+     * A person always sees their own, which is the same rule `people.me` follows: a permission you
+     * would need to read your own record is one nobody may lack.
+     */
+    async function sensitiveCustomKeys(tx, workspaceId, principal) {
+        if (await kernel.authz.can(principal, 'hr.person.view_sensitive', { kind: 'workspace', workspaceId }))
+            return NO_HIDDEN_FIELDS;
+        const rows = await tx
+            .select({ key: customFieldDefs.key })
+            .from(customFieldDefs)
+            .where(and(eq(customFieldDefs.workspaceId, workspaceId), eq(customFieldDefs.sensitive, true)));
+        return rows.length ? new Set(rows.map((r) => r.key)) : NO_HIDDEN_FIELDS;
     }
-    async function loadCalendar(tx, workspaceId, calendarId) {
+    async function loadOffice(tx, input) {
         const [row] = await tx
             .select()
-            .from(calendars)
-            .where(and(eq(calendars.workspaceId, workspaceId), eq(calendars.id, calendarId)))
+            .from(offices)
+            .where(and(eq(offices.workspaceId, input.workspaceId), eq(offices.id, input.officeId)))
             .limit(1);
         if (!row)
-            throw KernError.notFound('Calendar');
+            throw KernError.notFound('Office');
         return row;
     }
     /** The workspace's calendar for a country pack, created on first use so offices can share one. */
@@ -2892,51 +3555,6 @@ export function implement_(kernel) {
         }
         throw KernError.badRequest('Calendars may only be built on three levels.');
     }
-    /** The chain nearest-first: this calendar, then whatever it extends. */
-    async function calendarChain(tx, workspaceId, calendarId) {
-        const chain = [];
-        let cursor = calendarId;
-        for (let depth = 0; depth < 4 && cursor; depth++) {
-            const row = await loadCalendar(tx, workspaceId, cursor);
-            chain.push(row);
-            cursor = row.extendsId;
-        }
-        return chain;
-    }
-    /**
-     * The composed calendar over a range: this calendar's days over the ones it extends.
-     *
-     * Nearest wins per date and kind, and a day that shadows one from a calendar further down is
-     * marked `overrides` so the editor can show what it is replacing — which is what makes "we work
-     * through this national holiday" legible rather than looking like a missing holiday.
-     */
-    async function composedDays(tx, workspaceId, calendarId, from, to) {
-        const chain = await calendarChain(tx, workspaceId, calendarId);
-        const rows = await tx
-            .select()
-            .from(calendarDays)
-            .where(and(eq(calendarDays.workspaceId, workspaceId), inArray(calendarDays.calendarId, chain.map((c) => c.id)), gte(calendarDays.date, from), lte(calendarDays.date, to)));
-        const nameById = new Map(chain.map((c) => [c.id, c.name]));
-        const seen = new Map();
-        const datesFromNearest = new Set();
-        for (const cal of chain) {
-            for (const row of rows.filter((r) => r.calendarId === cal.id)) {
-                const key = `${row.date}:${row.kind}`;
-                if (seen.has(key))
-                    continue;
-                const overrides = cal.id !== calendarId ? false : datesFromNearest.has(row.date);
-                seen.set(key, toResolvedDay(row, cal.id, nameById.get(cal.id) ?? '', overrides));
-                if (cal.id === calendarId)
-                    datesFromNearest.add(row.date);
-            }
-        }
-        // Second pass: a nearest-calendar day covering a date the base also has *is* an override, and
-        // the first pass cannot know that until the base has been read.
-        const baseDates = new Set(rows.filter((r) => r.calendarId !== calendarId).map((r) => r.date));
-        return [...seen.values()]
-            .map((d) => ({ ...d, overrides: d.fromCalendarId === calendarId && baseDates.has(d.date) }))
-            .sort((a, b) => a.date.localeCompare(b.date));
-    }
     /**
      * What applying a pack would do — and, just as importantly, what it would leave alone.
      *
@@ -3072,154 +3690,75 @@ export function implement_(kernel) {
             .limit(1);
         return row;
     }
-    async function loadRequest(tx, workspaceId, requestId) {
-        const [row] = await tx
-            .select()
-            .from(leaveRequests)
-            .where(and(eq(leaveRequests.workspaceId, workspaceId), eq(leaveRequests.id, requestId)))
-            .limit(1);
-        if (!row)
-            throw KernError.notFound('Leave request');
-        return row;
-    }
     /**
-     * What a request would cost, and every reason it would be refused.
+     * The Kern accounts behind a set of people.
      *
-     * Used by `simulate` *and* by `create`, deliberately: a preview that runs different code from the
-     * submission is a preview that eventually lies. The blockers are returned rather than thrown here
-     * so the screen can show all of them at once instead of one per round trip.
+     * An employee need not have an account, and one removed from the workspace has had the link
+     * cleared on purpose by the `core.member.removed` subscription. Both are "nothing to deliver",
+     * not an error — the same rule `sweepTimeouts` applies to the people it has to reach.
      */
-    async function simulate(tx, workspaceId, personId, input) {
-        const blockers = [];
-        if (input.endsOn < input.startsOn)
-            blockers.push({ code: 'range', message: 'The end date is before the start date.' });
-        const [type] = await tx
-            .select()
-            .from(leaveTypes)
-            .where(and(eq(leaveTypes.workspaceId, workspaceId), eq(leaveTypes.id, input.leaveTypeId)))
-            .limit(1);
-        if (!type)
-            throw KernError.notFound('Leave type');
-        if (type.archivedAt)
-            blockers.push({ code: 'archived', message: `${type.name} is no longer available.` });
-        const resolution = await resolve.forPerson(tx, workspaceId, personId, input.startsOn);
-        const calendarDaysInRange = resolution.calendarId
-            ? await composedDays(tx, workspaceId, resolution.calendarId, input.startsOn, input.endsOn)
-            : [];
-        const results = workingDays(input.startsOn, input.endsOn, resolution.workingWeek, type.countsWorkingDaysOnly
-            ? calendarDaysInRange.map((d) => ({
-                date: d.date,
-                name: d.name,
-                workingFraction: d.workingFraction,
-            }))
-            : []);
-        // Half-days trim the ends. Applied after the calendar, so asking for a half day on a public
-        // holiday still costs nothing rather than costing half of nothing.
-        const days = results.map((r) => {
-            let fraction = r.fraction;
-            if (r.date === input.startsOn && input.startPart === 'afternoon')
-                fraction = Math.min(fraction, 0.5);
-            if (r.date === input.endsOn && input.endPart === 'morning')
-                fraction = Math.min(fraction, 0.5);
-            return { date: r.date, fraction, counted: fraction > 0, reason: r.reason };
-        });
-        const workingDaysTotal = Math.round(days.reduce((sum, d) => sum + d.fraction, 0) * 100) / 100;
-        const minutes = type.unit === 'hour' && input.hours
-            ? Math.round(input.hours * 60)
-            : Math.round(workingDaysTotal * MINUTES_PER_DAY);
-        if (minutes <= 0)
-            blockers.push({
-                code: 'empty',
-                message: 'That range contains no working days.',
-            });
-        const year = yearOf(input.startsOn);
-        const balances = await ledger.balances(tx, workspaceId, personId, year);
-        const balance = balances.find((b) => b.leaveTypeId === input.leaveTypeId);
-        const before = balance?.availableMinutes ?? 0;
-        const after = before - minutes;
-        if (after < 0 && !type.allowNegative)
-            blockers.push({
-                code: 'insufficient',
-                message: `Not enough ${type.name}: this would leave ${Math.round((after / MINUTES_PER_DAY) * 100) / 100} days.`,
-            });
-        if (after < 0 && type.allowNegative && Math.abs(after) > type.maxNegativeMinutes)
-            blockers.push({
-                code: 'below_floor',
-                message: `${type.name} cannot go further than ${Math.round(type.maxNegativeMinutes / MINUTES_PER_DAY)} days negative.`,
-            });
-        // Overlap is refused by a unique index as well; checking here turns a constraint violation into
-        // a sentence naming the dates.
-        const counted = days.filter((d) => d.counted).map((d) => d.date);
-        if (counted.length) {
-            const clash = await tx
-                .select({ date: leaveRequestDays.date })
-                .from(leaveRequestDays)
-                .where(and(eq(leaveRequestDays.workspaceId, workspaceId), eq(leaveRequestDays.personId, personId), eq(leaveRequestDays.counted, true), inArray(leaveRequestDays.status, ['pending', 'approved']), inArray(leaveRequestDays.date, counted)))
-                .limit(3);
-            if (clash.length)
-                blockers.push({
-                    code: 'overlap',
-                    message: `You already have leave booked on ${clash.map((c) => c.date).join(', ')}.`,
-                });
-        }
-        if (type.requiresDocumentAfterDays !== null && workingDaysTotal > type.requiresDocumentAfterDays)
-            blockers.push({
-                code: 'document_required',
-                message: `${type.name} longer than ${type.requiresDocumentAfterDays} days needs a document.`,
-            });
-        return {
-            workingDays: workingDaysTotal,
-            minutes,
-            days,
-            balanceBeforeMinutes: before,
-            balanceAfterMinutes: after,
-            blockers,
-        };
+    async function accountsOf(tx, workspaceId, personIds) {
+        if (!personIds.length)
+            return [];
+        const rows = await tx
+            .select({ userId: people.userId })
+            .from(people)
+            .where(and(eq(people.workspaceId, workspaceId), inArray(people.id, personIds)));
+        return [...new Set(rows.map((r) => r.userId).filter((id) => !!id))];
     }
     /**
-     * Turn an approved request into a ledger consumption.
+     * Tell the people a newly raised request is waiting on.
      *
-     * The working days are **recomputed here** rather than trusted from submission time: a holiday
-     * can be added to the calendar between asking and approving, and the number that costs somebody
-     * balance should be the one that was true when it was granted.
+     * `hr.approval.requested` has always been *emitted*, and an event is not a notification: nothing
+     * subscribes to it, so the first thing an approver ever heard about a request was the timeout
+     * sweep reminding them about something they had never been told about in the first place.
+     *
+     * The route is the sweep's own, deliberately and to the letter: `core.notifications.create`, the
+     * same `groupKey` so one request stays one card however often it is later reminded about, the
+     * same `url`, and a catch per notification — by the time this runs the request is committed, so a
+     * notification that fails must not become an error for the person who filed it. What they would
+     * lose is a card; what a throw would cost them is the request.
+     *
+     * **After the transaction, never inside it.** Core writes on its own connection, so a
+     * notification sent inside a transaction that then rolls back has already been delivered, and an
+     * approver is holding a card for a request that does not exist.
+     *
+     * No sentence is composed here beyond the English fallback, for the reason the sweep gives: a
+     * title built on the server is built before anyone knows who will read it, so it can only ever be
+     * English on a Persian screen. `data` carries the subject type and the request's own
+     * `summaryParams`, which is what a localised renderer needs to write the sentence itself.
      */
-    async function applyApproval(tx, workspaceId, leaveRequestId, actorId) {
-        const request = await loadRequest(tx, workspaceId, leaveRequestId);
-        if (request.status === 'approved')
-            return;
-        const sim = await simulate(tx, workspaceId, request.personId, {
-            leaveTypeId: request.leaveTypeId,
-            startsOn: request.startsOn,
-            endsOn: request.endsOn,
-            startPart: request.startPart,
-            endPart: request.endPart,
-            hours: request.hours === null ? null : Number.parseFloat(request.hours),
-        });
-        await ledger.append(tx, workspaceId, {
-            personId: request.personId,
-            leaveTypeId: request.leaveTypeId,
-            kind: 'consumption',
-            amountMinutes: -sim.minutes,
-            effectiveOn: request.startsOn,
-            periodYear: yearOf(request.startsOn),
-            requestId: request.id,
-            reason: null,
-            createdBy: actorId,
-        });
-        await tx
-            .update(leaveRequestDays)
-            .set({ status: 'approved' })
-            .where(eq(leaveRequestDays.requestId, request.id));
-        await tx
-            .update(leaveRequests)
-            .set({
-            status: 'approved',
-            minutes: sim.minutes,
-            workingDays: String(sim.workingDays),
-            decidedAt: new Date(),
-            updatedAt: new Date(),
-        })
-            .where(eq(leaveRequests.id, request.id));
+    async function notifyApprovers(notice) {
+        for (const userId of notice.userIds)
+            try {
+                await kernel.call('core.notifications.create', {
+                    userId,
+                    workspaceId: notice.workspaceId,
+                    module: MODULE_ID,
+                    type: 'hr.approval.requested',
+                    title: 'Your approval is requested',
+                    body: notice.summary || null,
+                    object: null,
+                    url: '/hr/approvals',
+                    data: {
+                        subjectType: notice.subjectType,
+                        requestId: notice.requestId,
+                        params: notice.summaryParams ?? {},
+                    },
+                    groupKey: `hr.approval:${notice.requestId}`,
+                    // Whoever filed it, which is not always the person it is about — HR files leave for
+                    // somebody often enough that `requestedBy` exists as its own column.
+                    actorId: notice.actorId,
+                }, kernel.system);
+            }
+            catch (err) {
+                kernel.log.warn({
+                    module: 'hr',
+                    workspaceId: notice.workspaceId,
+                    requestId: notice.requestId,
+                    err: err.message,
+                }, 'approval notification not delivered');
+            }
     }
     async function clearDefaultChain(tx, workspaceId, subjectType) {
         await tx
@@ -3275,24 +3814,6 @@ export function implement_(kernel) {
             })),
         };
     }
-    /**
-     * Everything a punch needs about a person: their zone, and the schedule that shapes their day.
-     *
-     * The zone comes from the resolution ladder — their primary office unless they have an override —
-     * so a punch made on a business trip still counts towards the month they are employed in.
-     *
-     * Everything here is resolved **as of today**, which is what a punch is about. It is therefore
-     * not the place to answer a question about a past date: this used to hand out today's legal
-     * entity as well, and three callers applied it to business dates months back — so a person who
-     * transferred entity had a filed month recomputed against the one they are in now. `recomputeDay`
-     * asks that question of the day it is rebuilding.
-     */
-    async function personContext(tx, workspaceId, personId) {
-        const today = todayIso();
-        const resolution = await resolve.forPerson(tx, workspaceId, personId, today);
-        const schedule = await attendance.scheduleFor(tx, workspaceId, personId, today);
-        return { timezone: resolution.timezone, schedule, resolution };
-    }
     /**
      * The same, plus the one decision every clock procedure has to agree about: which shift *this
      * instant* belongs to, and what is already filed on it.
@@ -3389,43 +3910,6 @@ export function implement_(kernel) {
         await changed(input.workspaceId, 'attendance_day', row.personId, 'updated');
         return toPunch(row);
     }
-    /**
-     * Apply an approved correction: write the proposed punches, void what they replace, rebuild.
-     *
-     * Nothing is edited. The original punch keeps its row and gains a pointer to what superseded it,
-     * so a corrected timesheet and an edited one stay distinguishable — which is the entire reason
-     * regularization exists rather than an update statement.
-     */
-    async function applyRegularization(tx, workspaceId, regularizationId) {
-        const [row] = await tx
-            .select()
-            .from(regularizations)
-            .where(and(eq(regularizations.workspaceId, workspaceId), eq(regularizations.id, regularizationId)))
-            .limit(1);
-        if (!row || row.status === 'approved')
-            return;
-        if (row.punchId)
-            await attendance.voidPunch(tx, workspaceId, row.punchId, 'Regularized', null);
-        const { timezone, schedule } = await personContext(tx, workspaceId, row.personId);
-        for (const proposal of row.proposed)
-            await tx.insert(punches).values({
-                id: uuidv7(),
-                workspaceId,
-                personId: row.personId,
-                direction: proposal.direction,
-                at: new Date(proposal.at),
-                businessDate: row.businessDate,
-                timezone,
-                method: 'manual',
-                trust: 'trusted',
-                note: `Regularization ${row.id}`,
-            });
-        await attendance.recomputeDay(tx, workspaceId, row.personId, row.businessDate, timezone, schedule);
-        await tx
-            .update(regularizations)
-            .set({ status: 'approved', appliedAt: new Date() })
-            .where(eq(regularizations.id, row.id));
-    }
     async function loadPolicy(tx, workspaceId, policyId) {
         const [row] = await tx
             .select()