CW-044 · A payroll export that reconciles before it writes anything

Priority P1 · Area payroll · Estimate M · Phase 3

What to build

A payroll officer picks a period in the console and downloads a file of what that period paid. A period whose runs are not all APPROVED, or whose payslip totals do not add up to the run totals, is refused with the difference named — it does not produce a file that is quietly wrong. Every export is written to the audit log with who took it and what period it covered.

The file this ticket produces is a plain CSV of the period's payslip totals. That is deliberately the least interesting output: what is being built is the path through every layer — period selection, reconciliation, permission, download, audit — so that ภ.ง.ด.1 (#44), ภ.ง.ด.1ก, 50 ทวิ, ประกันสังคม and the bank file (#17) each become a formatter over a checked set of figures rather than five separate implementations of the same reconciliation, each able to be wrong in its own way.

Everything the formatters need is already on Payslip: taxableIncome, withholdingTax, ssoEmployee, ssoEmployer, grossEarnings, netPay, and a frozen snapshot of the inputs.

Acceptance criteria

• A period with approved, reconciling runs downloads a CSV of its payslip totals from the console.
• A period containing a run that is not APPROVED is refused, and the message names the run.
• A period whose payslip totals disagree with its run totals is refused, and the message names the difference — not a generic failure.
• Every export appends to the audit log: actor, period, format, row count.
• Export requires an explicit permission; a payroll officer without it gets no download and no file.

Blocked by

None (can start immediately).

Blocks #44 and the tickets after it, #45, and #17.

Start at the console's period-selection and download flow, then trace the existing Payslip data, run status checks, permission handling, and audit log entry point. Confirm the reconciliation and refusal paths before adding the CSV export; done means all acceptance criteria pass, including named differences, permission denial without a file, and complete audit records.