The bug everyone has shipped at least once: leave is approved, the calendar is updated, but the balance doesn't decrement because the second write failed silently. The fix is structural. Leave approval and balance update run inside the same Prisma transaction. If either fails, both roll back. The leave row never lives in "approved" status while the balance still reads as unspent.
Pro-rated annual leave for new joiners is its own small wrinkle: a hire mid-year doesn't get full annual leave. The policy lives in leavePolicy.ts as a single source of truth, so the engine can't read one rule while the UI renders another. Submit, approve/decline, notify, balance auto-adjust. Notifications fire to all managers on submit, to the requester on decision, with email if Resend is configured.