Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

tests/integration/authorization.test.ts

@@ -0,0 +1,93 @@
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  adminClient,
+  createBareAuthUser,
+  createHrUser,
+  deleteTestUser,
+  signInAs,
+  type TestUser,
+} from "./helpers";
+
+// HR-only access model (supabase/migrations/20260714120000_hr_only_access.sql):
+// nobody except an active, explicitly-provisioned HR user may read or write
+// anything beyond their own profile row.
+describe("HR-only access (is_hr_user gate)", () => {
+  const createdUsers: TestUser[] = [];
+
+  afterEach(async () => {
+    while (createdUsers.length) {
+      const user = createdUsers.pop()!;
+      await deleteTestUser(user);
+    }
+  });
+
+  it("a bare authenticated user (no profile row) reads zero employees, not an error", async () => {
+    const user = await createBareAuthUser();
+    createdUsers.push(user);
+    const client = await signInAs(user);
+
+    const { data, error } = await client.from("employees").select("id");
+    expect(error).toBeNull();
+    expect(data).toEqual([]);
+  });
+
+  it("a bare authenticated user cannot insert into org reference tables", async () => {
+    const user = await createBareAuthUser();
+    createdUsers.push(user);
+    const client = await signInAs(user);
+
+    const { error } = await client.from("divisions").insert({ org_number: "20999999", name: `Test-${user.id}` });
+    expect(error).not.toBeNull();
+  });
+
+  it("an inactive HR profile can read its own profile row", async () => {
+    const user = await createHrUser({ active: false });
+    createdUsers.push(user);
+    const client = await signInAs(user);
+
+    const { data, error } = await client.from("profiles").select("id, is_active").eq("id", user.id);
+    expect(error).toBeNull();
+    expect(data).toHaveLength(1);
+    expect(data?.[0].is_active).toBe(false);
+  });
+
+  it("an inactive HR profile reads zero employees and cannot call mutation RPCs", async () => {
+    const user = await createHrUser({ active: false });
+    createdUsers.push(user);
+    const client = await signInAs(user);
+
+    const { data: employees, error: readError } = await client.from("employees").select("id");
+    expect(readError).toBeNull();
+    expect(employees).toEqual([]);
+
+    const { error: rpcError } = await client.rpc("hire_employee", {
+      payload: { first_name: "X", last_name: "Y", gender: "m", birth_date: "1990-01-01", entry_date: "2020-01-01" },
+    });
+    expect(rpcError?.message).toMatch(/Nicht berechtigt/);
+  });
+
+  it("an active HR user reads the seeded employee roster", async () => {
+    const user = await createHrUser({ active: true });
+    createdUsers.push(user);
+    const client = await signInAs(user);
+
+    const { data, error } = await client.from("employees").select("id").limit(1);
+    expect(error).toBeNull();
+    expect((data ?? []).length).toBeGreaterThan(0);
+  });
+
+  it("apply_due_pending_changes is revoked from authenticated users, even active HR", async () => {
+    const user = await createHrUser({ active: true });
+    createdUsers.push(user);
+    const client = await signInAs(user);
+
+    const { error } = await client.rpc("apply_due_pending_changes");
+    expect(error).not.toBeNull();
+  });
+
+  it("apply_due_pending_changes is callable by the service-role client", async () => {
+    const { data, error } = await adminClient.rpc("apply_due_pending_changes");
+    expect(error).toBeNull();
+    expect(typeof data).toBe("number");
+  });
+});

tests/integration/data-integrity.test.ts

@@ -0,0 +1,123 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import {
+  adminClient,
+  createHrUser,
+  deleteTestEmployee,
+  deleteTestUser,
+  hireTestEmployee,
+  isoDateOffset,
+  pickSeededTeam,
+  signInAs,
+  type TestUser,
+} from "./helpers";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { Database } from "@/lib/supabase/types";
+
+// Two guards added by supabase/migrations/20260714120600_data_integrity_guards.sql
+// that previously had no enforcement anywhere: a Karenz return date may not
+// precede its own Karenz start, and a history entry may not predate the
+// employee's entry date.
+describe("data integrity guards", () => {
+  let hrUser: TestUser;
+  let hrClient: SupabaseClient<Database>;
+  let teamA: { id: string };
+  const employeeIds: string[] = [];
+
+  beforeAll(async () => {
+    hrUser = await createHrUser({ active: true });
+    hrClient = await signInAs(hrUser);
+    teamA = await pickSeededTeam();
+  });
+
+  afterAll(async () => {
+    for (const id of employeeIds) await deleteTestEmployee(id);
+    await deleteTestUser(hrUser);
+  });
+
+  async function freshEmployeeOnKarenz(): Promise<{ employeeId: string; karenzStartDate: string }> {
+    const employeeId = await hireTestEmployee(hrClient, teamA.id);
+    employeeIds.push(employeeId);
+    const karenzStartDate = isoDateOffset(-5);
+    const { error } = await hrClient.rpc("start_karenz", {
+      payload: { employee_id: employeeId, karenz_start_date: karenzStartDate, planned_return_date: isoDateOffset(100) },
+    });
+    if (error) throw new Error(`start_karenz setup failed: ${error.message}`);
+    return { employeeId, karenzStartDate };
+  }
+
+  it("adjust_karenz_return rejects a return date on or before karenz_start_date", async () => {
+    const { employeeId, karenzStartDate } = await freshEmployeeOnKarenz();
+
+    const { error } = await hrClient.rpc("adjust_karenz_return", {
+      payload: { employee_id: employeeId, new_return_date: karenzStartDate },
+    });
+    expect(error?.message).toMatch(/Rückkehrdatum muss nach dem Karenzbeginn/);
+  });
+
+  it("adjust_karenz_return accepts a return date after karenz_start_date", async () => {
+    const { employeeId } = await freshEmployeeOnKarenz();
+    const newReturnDate = isoDateOffset(50);
+
+    const { error } = await hrClient.rpc("adjust_karenz_return", {
+      payload: { employee_id: employeeId, new_return_date: newReturnDate },
+    });
+    expect(error).toBeNull();
+
+    const { data: employee } = await adminClient.from("employees").select("karenz_return_date").eq("id", employeeId).single();
+    expect(employee?.karenz_return_date).toBe(newReturnDate);
+  });
+
+  it("record_karenz_return rejects a return date on or before karenz_start_date", async () => {
+    const { employeeId, karenzStartDate } = await freshEmployeeOnKarenz();
+
+    const { error } = await hrClient.rpc("record_karenz_return", {
+      payload: { employee_id: employeeId, return_date: karenzStartDate, employment_mode: "unverändert" },
+    });
+    expect(error?.message).toMatch(/Rückkehrdatum muss nach dem Karenzbeginn/);
+  });
+
+  it("record_karenz_return with a valid date flips status back to Aktiv and clears karenz_start_date", async () => {
+    const { employeeId } = await freshEmployeeOnKarenz();
+
+    const { error } = await hrClient.rpc("record_karenz_return", {
+      payload: { employee_id: employeeId, return_date: isoDateOffset(0), employment_mode: "unverändert" },
+    });
+    expect(error).toBeNull();
+
+    const { data: employee } = await adminClient
+      .from("employees")
+      .select("status, karenz_start_date, karenz_return_date")
+      .eq("id", employeeId)
+      .single();
+    expect(employee?.status).toBe("Aktiv");
+    expect(employee?.karenz_start_date).toBeNull();
+    expect(employee?.karenz_return_date).toBeNull();
+  });
+
+  it("rejects an employee_history row dated before the employee's entry_date", async () => {
+    const employeeId = await hireTestEmployee(hrClient, teamA.id, { entry_date: isoDateOffset(-10) });
+    employeeIds.push(employeeId);
+
+    const { error } = await adminClient.from("employee_history").insert({
+      employee_id: employeeId,
+      event_date: isoDateOffset(-11),
+      event_type: "Vertragsänderung",
+      description: "Sollte vom Trigger abgelehnt werden",
+    });
+    expect(error?.message).toMatch(/darf nicht vor dem Eintrittsdatum/);
+  });
+
+  it("accepts an employee_history row dated exactly on the entry_date", async () => {
+    const entryDate = isoDateOffset(-10);
+    const employeeId = await hireTestEmployee(hrClient, teamA.id, { entry_date: entryDate });
+    employeeIds.push(employeeId);
+
+    const { error } = await adminClient.from("employee_history").insert({
+      employee_id: employeeId,
+      event_date: entryDate,
+      event_type: "Vertragsänderung",
+      description: "Am Eintrittsdatum selbst, sollte erlaubt sein",
+    });
+    expect(error).toBeNull();
+  });
+});

tests/integration/effective-dating.test.ts

@@ -0,0 +1,163 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import {
+  adminClient,
+  createHrUser,
+  deleteTestEmployee,
+  deleteTestUser,
+  hireTestEmployee,
+  isoDateOffset,
+  pickSeededTeam,
+  signInAs,
+  teamLeadId,
+  type TestUser,
+} from "./helpers";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { Database } from "@/lib/supabase/types";
+
+// Deferred/effective-dated changes (supabase/migrations/20260714120200_
+// effective_dating_rpcs.sql): a future "wirksam ab" date must queue a
+// pending_org_changes row instead of writing to `employees` immediately;
+// apply_due_pending_changes() applies it once due.
+describe("effective-dated mutations", () => {
+  let hrUser: TestUser;
+  let hrClient: SupabaseClient<Database>;
+  let teamA: { id: string };
+  let teamB: { id: string };
+  const employeeIds: string[] = [];
+
+  beforeAll(async () => {
+    hrUser = await createHrUser({ active: true });
+    hrClient = await signInAs(hrUser);
+    teamA = await pickSeededTeam();
+    teamB = await pickSeededTeam(teamA.id);
+  });
+
+  afterAll(async () => {
+    for (const id of employeeIds) await deleteTestEmployee(id);
+    await deleteTestUser(hrUser);
+  });
+
+  async function freshEmployee(teamId: string): Promise<string> {
+    const id = await hireTestEmployee(hrClient, teamId);
+    employeeIds.push(id);
+    return id;
+  }
+
+  it("transfer_employee with today's date writes immediately", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const newLead = await teamLeadId(teamB.id);
+
+    const { error } = await hrClient.rpc("transfer_employee", {
+      payload: { employee_id: employeeId, effective_date: isoDateOffset(0), new_team_id: teamB.id },
+    });
+    expect(error).toBeNull();
+
+    const { data: employee } = await adminClient.from("employees").select("team_id, manager_id").eq("id", employeeId).single();
+    expect(employee?.team_id).toBe(teamB.id);
+    expect(employee?.manager_id).toBe(newLead);
+  });
+
+  it("transfer_employee with a future date defers the write and applies it once due", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const newLead = await teamLeadId(teamB.id);
+
+    const { error } = await hrClient.rpc("transfer_employee", {
+      payload: { employee_id: employeeId, effective_date: isoDateOffset(30), new_team_id: teamB.id },
+    });
+    expect(error).toBeNull();
+
+    // Not written yet — this is the exact bug the migration fixes: a
+    // future-dated transfer must not overwrite the live record today.
+    const { data: unchanged } = await adminClient.from("employees").select("team_id").eq("id", employeeId).single();
+    expect(unchanged?.team_id).toBe(teamA.id);
+
+    const { data: pending } = await adminClient
+      .from("pending_org_changes")
+      .select("id, status, payload")
+      .eq("employee_id", employeeId)
+      .eq("change_type", "transfer")
+      .single();
+    expect(pending?.status).toBe("pending");
+    expect(pending?.payload.new_team_id).toBe(teamB.id);
+
+    // Fast-forward: simulate the effective date having arrived, then run
+    // the same function the daily cron route calls.
+    await adminClient.from("pending_org_changes").update({ effective_date: isoDateOffset(0) }).eq("id", pending!.id);
+    const { data: appliedCount, error: applyError } = await adminClient.rpc("apply_due_pending_changes");
+    expect(applyError).toBeNull();
+    expect(appliedCount).toBeGreaterThanOrEqual(1);
+
+    const { data: employee } = await adminClient.from("employees").select("team_id, manager_id").eq("id", employeeId).single();
+    expect(employee?.team_id).toBe(teamB.id);
+    expect(employee?.manager_id).toBe(newLead);
+
+    const { data: appliedRow } = await adminClient
+      .from("pending_org_changes")
+      .select("status, applied_at")
+      .eq("id", pending!.id)
+      .single();
+    expect(appliedRow?.status).toBe("applied");
+    expect(appliedRow?.applied_at).not.toBeNull();
+  });
+
+  it("promote_employee with a future date does not change job_title/paygrade until applied", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+
+    const { error } = await hrClient.rpc("promote_employee", {
+      payload: { employee_id: employeeId, effective_date: isoDateOffset(14), new_title: "Senior Testperson", new_paygrade: "D" },
+    });
+    expect(error).toBeNull();
+
+    const { data: unchanged } = await adminClient.from("employees").select("job_title, paygrade").eq("id", employeeId).single();
+    expect(unchanged?.job_title).not.toBe("Senior Testperson");
+
+    const { data: pending } = await adminClient
+      .from("pending_org_changes")
+      .select("id")
+      .eq("employee_id", employeeId)
+      .eq("change_type", "promotion")
+      .single();
+    await adminClient.from("pending_org_changes").update({ effective_date: isoDateOffset(0) }).eq("id", pending!.id);
+    await adminClient.rpc("apply_due_pending_changes");
+
+    const { data: employee } = await adminClient.from("employees").select("job_title, paygrade").eq("id", employeeId).single();
+    expect(employee?.job_title).toBe("Senior Testperson");
+    expect(employee?.paygrade).toBe("D");
+  });
+
+  it("start_karenz with a future date sets karenz_start_date immediately but keeps status Aktiv", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const startDate = isoDateOffset(20);
+    const returnDate = isoDateOffset(200);
+
+    const { error } = await hrClient.rpc("start_karenz", {
+      payload: { employee_id: employeeId, karenz_start_date: startDate, planned_return_date: returnDate },
+    });
+    expect(error).toBeNull();
+
+    const { data: employee } = await adminClient
+      .from("employees")
+      .select("status, karenz_start_date")
+      .eq("id", employeeId)
+      .single();
+    expect(employee?.status).toBe("Aktiv");
+    expect(employee?.karenz_start_date).toBe(startDate);
+
+    const { data: pending } = await adminClient
+      .from("pending_org_changes")
+      .select("id")
+      .eq("employee_id", employeeId)
+      .eq("change_type", "karenz_start")
+      .single();
+    await adminClient.from("pending_org_changes").update({ effective_date: isoDateOffset(0) }).eq("id", pending!.id);
+    await adminClient.rpc("apply_due_pending_changes");
+
+    const { data: afterApply } = await adminClient
+      .from("employees")
+      .select("status, karenz_return_date")
+      .eq("id", employeeId)
+      .single();
+    expect(afterApply?.status).toBe("Karenz");
+    expect(afterApply?.karenz_return_date).toBe(returnDate);
+  });
+});

tests/integration/helpers.ts

@@ -0,0 +1,146 @@
+import { createClient, type SupabaseClient } from "@supabase/supabase-js";
+import { randomUUID } from "node:crypto";
+import type { Database, EmploymentStatus } from "@/lib/supabase/types";
+
+const URL = process.env.NEXT_PUBLIC_SUPABASE_URL;
+const ANON_KEY = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+const SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
+
+if (!URL || !ANON_KEY || !SERVICE_ROLE_KEY) {
+  throw new Error(
+    "Missing Supabase env vars for integration tests. Start local Supabase (`npx supabase start`) and run " +
+      "`npm run test:integration`, which loads .env.test.local automatically. See README.md."
+  );
+}
+
+export const adminClient: SupabaseClient<Database> = createClient(URL, SERVICE_ROLE_KEY, {
+  auth: { autoRefreshToken: false, persistSession: false },
+});
+
+export function anonClient(): SupabaseClient<Database> {
+  return createClient(URL!, ANON_KEY!, { auth: { autoRefreshToken: false, persistSession: false } });
+}
+
+export type TestUser = { id: string; email: string; password: string };
+
+// Creates a real auth.users row (via the admin API) with no profiles row —
+// this is exactly the "signed up but never provisioned" state §2.3
+// describes: authenticated, but not HR.
+export async function createBareAuthUser(): Promise<TestUser> {
+  const email = `test-${randomUUID()}@example.test`;
+  const password = `Test-${randomUUID()}!`;
+  const { data, error } = await adminClient.auth.admin.createUser({ email, password, email_confirm: true });
+  if (error || !data.user) throw new Error(`createBareAuthUser failed: ${error?.message}`);
+  return { id: data.user.id, email, password };
+}
+
+export async function createHrUser(opts: { active: boolean }): Promise<TestUser> {
+  const user = await createBareAuthUser();
+  const { error } = await adminClient
+    .from("profiles")
+    .insert({ id: user.id, email: user.email, full_name: "Integrationstest HR", role: "hr", is_active: opts.active });
+  if (error) throw new Error(`createHrUser profile insert failed: ${error.message}`);
+  return user;
+}
+
+export async function deleteTestUser(user: TestUser): Promise<void> {
+  await adminClient.from("profiles").delete().eq("id", user.id);
+  await adminClient.auth.admin.deleteUser(user.id);
+}
+
+export async function signInAs(user: TestUser): Promise<SupabaseClient<Database>> {
+  const client = anonClient();
+  const { error } = await client.auth.signInWithPassword({ email: user.email, password: user.password });
+  if (error) throw new Error(`signInAs(${user.email}) failed: ${error.message}`);
+  return client;
+}
+
+// Pulled from the seeded dataset (supabase/seed.ts) — any active, non-lead
+// employee works for read/mutation tests that don't care which one.
+export async function pickSeededEmployee(
+  filter: Partial<{ status: EmploymentStatus; is_lead: boolean }> = {}
+): Promise<{
+  id: string;
+  team_id: string | null;
+  division_id: string;
+  manager_id: string | null;
+  status: string;
+}> {
+  let q = adminClient.from("employees").select("id, team_id, division_id, manager_id, status").limit(1);
+  if (filter.status) q = q.eq("status", filter.status);
+  if (filter.is_lead !== undefined) q = q.eq("is_lead", filter.is_lead);
+  const { data, error } = await q.maybeSingle();
+  if (error || !data) throw new Error(`pickSeededEmployee failed: ${error?.message ?? "no matching row"}`);
+  return data;
+}
+
+export async function pickSeededTeam(excludeTeamId?: string): Promise<{ id: string }> {
+  const q = adminClient.from("teams").select("id").limit(2);
+  const { data, error } = await q;
+  if (error || !data?.length) throw new Error(`pickSeededTeam failed: ${error?.message}`);
+  const match = data.find((t) => t.id !== excludeTeamId) ?? data[0];
+  return match;
+}
+
+export async function pickSeededLocation(): Promise<{ id: string }> {
+  const { data, error } = await adminClient.from("locations").select("id").limit(1).maybeSingle();
+  if (error || !data) throw new Error(`pickSeededLocation failed: ${error?.message ?? "no rows"}`);
+  return data;
+}
+
+// The seeded org guarantees exactly one active team lead per team (§2's
+// "reports-to" rule) — resolve_manager_for() relies on the same query.
+export async function teamLeadId(teamId: string): Promise<string | null> {
+  const { data, error } = await adminClient
+    .from("employees")
+    .select("id")
+    .eq("team_id", teamId)
+    .eq("is_lead", true)
+    .neq("status", "Ausgetreten")
+    .maybeSingle();
+  if (error) throw new Error(`teamLeadId(${teamId}) failed: ${error.message}`);
+  return data?.id ?? null;
+}
+
+// YYYY-MM-DD, offset from today — for building "wirksam ab" test payloads
+// without hardcoding dates that eventually go stale.
+export function isoDateOffset(days: number): string {
+  const d = new Date();
+  d.setDate(d.getDate() + days);
+  return d.toISOString().slice(0, 10);
+}
+
+// Hires a throwaway employee into `teamId` via the real hire_employee RPC
+// (not a raw insert) so every mutation test starts from a state the app
+// itself can produce. Caller must clean up with deleteTestEmployee.
+export async function hireTestEmployee(
+  hrClient: SupabaseClient<Database>,
+  teamId: string,
+  overrides: Partial<Record<string, unknown>> = {}
+): Promise<string> {
+  const location = await pickSeededLocation();
+  const payload = {
+    first_name: "Integrationstest",
+    last_name: `Person-${randomUUID().slice(0, 8)}`,
+    gender: "w",
+    birth_date: "1990-01-01",
+    location_id: location.id,
+    team_id: teamId,
+    job_title: "Integrationstest-Rolle",
+    entry_date: isoDateOffset(-30),
+    source: "Extern",
+    ...overrides,
+  };
+  const { data, error } = await hrClient.rpc("hire_employee", { payload });
+  if (error || !data) throw new Error(`hireTestEmployee failed: ${error?.message ?? "no id returned"}`);
+  return data;
+}
+
+// employees has no cascade from audit_log (target_employee_id is a plain
+// FK, immutable log by design) — clear those rows first so the employee
+// delete itself doesn't fail with a foreign key violation. employee_history
+// and pending_org_changes do cascade on employee_id.
+export async function deleteTestEmployee(employeeId: string): Promise<void> {
+  await adminClient.from("audit_log").delete().eq("target_employee_id", employeeId);
+  await adminClient.from("employees").delete().eq("id", employeeId);
+}

tests/integration/reorg.test.ts

@@ -0,0 +1,147 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import {
+  adminClient,
+  createHrUser,
+  deleteTestEmployee,
+  deleteTestUser,
+  hireTestEmployee,
+  isoDateOffset,
+  pickSeededTeam,
+  signInAs,
+  teamLeadId,
+  type TestUser,
+} from "./helpers";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { Database } from "@/lib/supabase/types";
+
+// Reorg scenarios: immediate apply/undo must respect employee_history's
+// append-only contract (20260714120300_reorg_undo_append_only.sql), and a
+// future-dated scenario must defer every move via pending_org_changes until
+// its effective date, flipping reorg_scenarios.applied only once every move
+// has landed (20260714120200_effective_dating_rpcs.sql).
+describe("reorg scenarios", () => {
+  let hrUser: TestUser;
+  let hrClient: SupabaseClient<Database>;
+  let teamA: { id: string };
+  let teamB: { id: string };
+  const employeeIds: string[] = [];
+
+  beforeAll(async () => {
+    hrUser = await createHrUser({ active: true });
+    hrClient = await signInAs(hrUser);
+    teamA = await pickSeededTeam();
+    teamB = await pickSeededTeam(teamA.id);
+  });
+
+  afterAll(async () => {
+    for (const id of employeeIds) await deleteTestEmployee(id);
+    await deleteTestUser(hrUser);
+  });
+
+  async function freshEmployee(teamId: string): Promise<string> {
+    const id = await hireTestEmployee(hrClient, teamId);
+    employeeIds.push(id);
+    return id;
+  }
+
+  it("applies an immediate reorg now, and undo appends a compensating history row instead of deleting", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const teamBLead = await teamLeadId(teamB.id);
+
+    const { data: scenarioId, error: applyError } = await hrClient.rpc("apply_reorg", {
+      payload: {
+        name: `Integrationstest Reorg ${employeeId.slice(0, 8)}`,
+        effective_date: isoDateOffset(0),
+        moves: [{ kind: "emp", label: "Test", employee_ids: [employeeId], target_team_id: teamB.id }],
+      },
+    });
+    expect(applyError).toBeNull();
+    expect(scenarioId).toBeTruthy();
+
+    const { data: movedEmployee } = await adminClient.from("employees").select("team_id, manager_id").eq("id", employeeId).single();
+    expect(movedEmployee?.team_id).toBe(teamB.id);
+    expect(movedEmployee?.manager_id).toBe(teamBLead);
+
+    const { data: scenario } = await adminClient
+      .from("reorg_scenarios")
+      .select("applied, applied_at")
+      .eq("id", scenarioId as string)
+      .single();
+    expect(scenario?.applied).toBe(true);
+    expect(scenario?.applied_at).not.toBeNull();
+
+    const { count: historyBeforeUndo } = await adminClient
+      .from("employee_history")
+      .select("id", { count: "exact", head: true })
+      .eq("employee_id", employeeId)
+      .eq("event_type", "Reorganisation");
+    expect(historyBeforeUndo).toBe(1);
+
+    const { error: undoError } = await hrClient.rpc("undo_reorg", { payload: { scenario_id: scenarioId } });
+    expect(undoError).toBeNull();
+
+    const { data: revertedEmployee } = await adminClient.from("employees").select("team_id").eq("id", employeeId).single();
+    expect(revertedEmployee?.team_id).toBe(teamA.id);
+
+    const { data: undoneScenario } = await adminClient.from("reorg_scenarios").select("applied").eq("id", scenarioId as string).single();
+    expect(undoneScenario?.applied).toBe(false);
+
+    // The original "Reorganisation" row must still be there — undo appends
+    // a compensating entry, it never deletes (the bug the migration fixed).
+    const { count: historyAfterUndo } = await adminClient
+      .from("employee_history")
+      .select("id", { count: "exact", head: true })
+      .eq("employee_id", employeeId)
+      .eq("event_type", "Reorganisation");
+    expect(historyAfterUndo).toBe(2);
+  });
+
+  it("defers a future-dated reorg and only flips reorg_scenarios.applied once its pending change lands", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const teamBLead = await teamLeadId(teamB.id);
+
+    const { data: scenarioId, error: applyError } = await hrClient.rpc("apply_reorg", {
+      payload: {
+        name: `Integrationstest Reorg (zukünftig) ${employeeId.slice(0, 8)}`,
+        effective_date: isoDateOffset(30),
+        moves: [{ kind: "emp", label: "Test", employee_ids: [employeeId], target_team_id: teamB.id }],
+      },
+    });
+    expect(applyError).toBeNull();
+
+    const { data: unchangedEmployee } = await adminClient.from("employees").select("team_id").eq("id", employeeId).single();
+    expect(unchangedEmployee?.team_id).toBe(teamA.id);
+
+    const { data: scenarioBefore } = await adminClient
+      .from("reorg_scenarios")
+      .select("applied")
+      .eq("id", scenarioId as string)
+      .single();
+    expect(scenarioBefore?.applied).toBe(false);
+
+    const { data: pending } = await adminClient
+      .from("pending_org_changes")
+      .select("id")
+      .eq("employee_id", employeeId)
+      .eq("reorg_scenario_id", scenarioId as string)
+      .eq("status", "pending")
+      .single();
+    expect(pending).not.toBeNull();
+
+    await adminClient.from("pending_org_changes").update({ effective_date: isoDateOffset(0) }).eq("id", pending!.id);
+    const { error: cronError } = await adminClient.rpc("apply_due_pending_changes");
+    expect(cronError).toBeNull();
+
+    const { data: movedEmployee } = await adminClient.from("employees").select("team_id, manager_id").eq("id", employeeId).single();
+    expect(movedEmployee?.team_id).toBe(teamB.id);
+    expect(movedEmployee?.manager_id).toBe(teamBLead);
+
+    const { data: scenarioAfter } = await adminClient
+      .from("reorg_scenarios")
+      .select("applied, applied_at")
+      .eq("id", scenarioId as string)
+      .single();
+    expect(scenarioAfter?.applied).toBe(true);
+    expect(scenarioAfter?.applied_at).not.toBeNull();
+  });
+});