From de98924fd392028c2cb93d7802f9b557b639ad27 Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Thu, 21 May 2026 14:45:14 +0200
Subject: [PATCH 1/9] feat(absences) : fondation backend du module de gestion
 des absences
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Module type Payfit (étapes 1+2 de la spec V1) : demande d'absence, validation
admin, soldes à jour.

- Enums : AbsenceType, AbsenceStatus, HalfDay, ContractType, FamilySituation
- Entités : AbsencePolicy, AbsenceBalance, AbsenceRequest + champs RH sur User
- Services : PublicHolidayProvider (fériés FR métropole en PHP pur, Computus),
  AbsenceDayCalculator (décompte jours ouvrés/ouvrables + demi-journées, TDD),
  AbsenceBalanceService (périodes + pending/taken/recrédit)
- API Platform : providers/processors (création, approve/reject/cancel) + RBAC
  me/admin, contrôleurs preview (dry-run), upload/download justificatif, calendrier
- Migrations : une par table + colonnes RH user (DEFAULT puis DROP DEFAULT)
- Fixtures : 5 policies par défaut, salariés démo, soldes et demandes
- Tests unitaires : PublicHolidayProvider, AbsenceDayCalculator (12 tests)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 config/services.yaml                          |   9 +
 migrations/Version20260521123520.php          |  42 +++
 migrations/Version20260521123521.php          |  49 +++
 migrations/Version20260521123522.php          |  64 ++++
 migrations/Version20260521123523.php          |  59 ++++
 .../Absence/AbsenceCalendarController.php     |  43 +++
 ...AbsenceJustificationDownloadController.php |  64 ++++
 .../AbsenceJustificationUploadController.php  |  86 +++++
 .../Absence/AbsencePreviewController.php      |  95 +++++
 src/DataFixtures/AppFixtures.php              | 107 ++++++
 src/Entity/AbsenceBalance.php                 | 163 +++++++++
 src/Entity/AbsencePolicy.php                  | 171 +++++++++
 src/Entity/AbsenceRequest.php                 | 326 ++++++++++++++++++
 src/Entity/User.php                           | 176 +++++++++-
 src/Enum/AbsenceStatus.php                    |  23 ++
 src/Enum/AbsenceType.php                      |  34 ++
 src/Enum/ContractType.php                     |  25 ++
 src/Enum/FamilySituation.php                  |  25 ++
 src/Enum/HalfDay.php                          |  19 +
 src/Repository/AbsenceBalanceRepository.php   |  31 ++
 src/Repository/AbsencePolicyRepository.php    |  26 ++
 src/Repository/AbsenceRequestRepository.php   |  74 ++++
 src/Service/AbsenceBalanceService.php         | 122 +++++++
 src/Service/AbsenceDayCalculator.php          |  73 ++++
 src/Service/PublicHolidayProvider.php         |  86 +++++
 src/State/AbsenceBalanceProvider.php          |  73 ++++
 src/State/AbsenceCancelProcessor.php          |  75 ++++
 src/State/AbsenceRequestProcessor.php         |  91 +++++
 src/State/AbsenceRequestProvider.php          |  82 +++++
 src/State/AbsenceReviewProcessor.php          |  80 +++++
 .../Unit/Service/AbsenceDayCalculatorTest.php |  92 +++++
 .../Service/PublicHolidayProviderTest.php     |  72 ++++
 32 files changed, 2554 insertions(+), 3 deletions(-)
 create mode 100644 migrations/Version20260521123520.php
 create mode 100644 migrations/Version20260521123521.php
 create mode 100644 migrations/Version20260521123522.php
 create mode 100644 migrations/Version20260521123523.php
 create mode 100644 src/Controller/Absence/AbsenceCalendarController.php
 create mode 100644 src/Controller/Absence/AbsenceJustificationDownloadController.php
 create mode 100644 src/Controller/Absence/AbsenceJustificationUploadController.php
 create mode 100644 src/Controller/Absence/AbsencePreviewController.php
 create mode 100644 src/Entity/AbsenceBalance.php
 create mode 100644 src/Entity/AbsencePolicy.php
 create mode 100644 src/Entity/AbsenceRequest.php
 create mode 100644 src/Enum/AbsenceStatus.php
 create mode 100644 src/Enum/AbsenceType.php
 create mode 100644 src/Enum/ContractType.php
 create mode 100644 src/Enum/FamilySituation.php
 create mode 100644 src/Enum/HalfDay.php
 create mode 100644 src/Repository/AbsenceBalanceRepository.php
 create mode 100644 src/Repository/AbsencePolicyRepository.php
 create mode 100644 src/Repository/AbsenceRequestRepository.php
 create mode 100644 src/Service/AbsenceBalanceService.php
 create mode 100644 src/Service/AbsenceDayCalculator.php
 create mode 100644 src/Service/PublicHolidayProvider.php
 create mode 100644 src/State/AbsenceBalanceProvider.php
 create mode 100644 src/State/AbsenceCancelProcessor.php
 create mode 100644 src/State/AbsenceRequestProcessor.php
 create mode 100644 src/State/AbsenceRequestProvider.php
 create mode 100644 src/State/AbsenceReviewProcessor.php
 create mode 100644 tests/Unit/Service/AbsenceDayCalculatorTest.php
 create mode 100644 tests/Unit/Service/PublicHolidayProviderTest.php

diff --git a/config/services.yaml b/config/services.yaml
index f2713cc..1708a92 100644
--- a/config/services.yaml
+++ b/config/services.yaml
@@ -9,6 +9,7 @@
 parameters:
     task_document_upload_dir: '%kernel.project_dir%/var/uploads/documents'
     avatar_upload_dir: '%kernel.project_dir%/var/uploads/avatars'
+    absence_justification_upload_dir: '%kernel.project_dir%/var/uploads/justificatifs'
 
 imports:
     - { resource: version.yaml }
@@ -44,3 +45,11 @@ services:
     App\Controller\UserAvatarController:
         arguments:
             $avatarUploadDir: '%avatar_upload_dir%'
+
+    App\Controller\Absence\AbsenceJustificationUploadController:
+        arguments:
+            $uploadDir: '%absence_justification_upload_dir%'
+
+    App\Controller\Absence\AbsenceJustificationDownloadController:
+        arguments:
+            $uploadDir: '%absence_justification_upload_dir%'
diff --git a/migrations/Version20260521123520.php b/migrations/Version20260521123520.php
new file mode 100644
index 0000000..8a5fe59
--- /dev/null
+++ b/migrations/Version20260521123520.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Absence management: create the absence_policy table.
+ */
+final class Version20260521123520 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Create absence_policy table';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql(<<<'SQL'
+                CREATE TABLE absence_policy (
+                  id INT GENERATED BY DEFAULT AS IDENTITY NOT NULL,
+                  type VARCHAR(32) NOT NULL,
+                  days_per_year DOUBLE PRECISION DEFAULT NULL,
+                  days_per_event DOUBLE PRECISION DEFAULT NULL,
+                  justification_required BOOLEAN NOT NULL,
+                  notice_days INT NOT NULL,
+                  count_working_days_only BOOLEAN NOT NULL,
+                  active BOOLEAN NOT NULL,
+                  PRIMARY KEY (id)
+                )
+            SQL);
+        $this->addSql('CREATE UNIQUE INDEX uniq_absence_policy_type ON absence_policy (type)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('DROP TABLE absence_policy');
+    }
+}
diff --git a/migrations/Version20260521123521.php b/migrations/Version20260521123521.php
new file mode 100644
index 0000000..ea7f4fb
--- /dev/null
+++ b/migrations/Version20260521123521.php
@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Absence management: create the absence_balance table.
+ */
+final class Version20260521123521 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Create absence_balance table';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql(<<<'SQL'
+                CREATE TABLE absence_balance (
+                  id INT GENERATED BY DEFAULT AS IDENTITY NOT NULL,
+                  type VARCHAR(32) NOT NULL,
+                  period VARCHAR(16) NOT NULL,
+                  acquired DOUBLE PRECISION NOT NULL,
+                  taken DOUBLE PRECISION NOT NULL,
+                  pending DOUBLE PRECISION NOT NULL,
+                  user_id INT NOT NULL,
+                  PRIMARY KEY (id)
+                )
+            SQL);
+        $this->addSql('CREATE INDEX IDX_65723A76A76ED395 ON absence_balance (user_id)');
+        $this->addSql('CREATE UNIQUE INDEX uniq_absence_balance_user_type_period ON absence_balance (user_id, type, period)');
+        $this->addSql(<<<'SQL'
+                ALTER TABLE
+                  absence_balance
+                ADD
+                  CONSTRAINT FK_65723A76A76ED395 FOREIGN KEY (user_id) REFERENCES "user" (id) ON DELETE CASCADE NOT DEFERRABLE
+            SQL);
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE absence_balance DROP CONSTRAINT FK_65723A76A76ED395');
+        $this->addSql('DROP TABLE absence_balance');
+    }
+}
diff --git a/migrations/Version20260521123522.php b/migrations/Version20260521123522.php
new file mode 100644
index 0000000..c41736b
--- /dev/null
+++ b/migrations/Version20260521123522.php
@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Absence management: create the absence_request table.
+ */
+final class Version20260521123522 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Create absence_request table';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql(<<<'SQL'
+                CREATE TABLE absence_request (
+                  id INT GENERATED BY DEFAULT AS IDENTITY NOT NULL,
+                  type VARCHAR(32) NOT NULL,
+                  start_date DATE NOT NULL,
+                  end_date DATE NOT NULL,
+                  start_half_day VARCHAR(16) DEFAULT NULL,
+                  end_half_day VARCHAR(16) DEFAULT NULL,
+                  counted_days DOUBLE PRECISION NOT NULL,
+                  reason TEXT DEFAULT NULL,
+                  justification_file_name VARCHAR(255) DEFAULT NULL,
+                  status VARCHAR(16) NOT NULL,
+                  rejection_reason TEXT DEFAULT NULL,
+                  created_at TIMESTAMP(0) WITHOUT TIME ZONE NOT NULL,
+                  reviewed_at TIMESTAMP(0) WITHOUT TIME ZONE DEFAULT NULL,
+                  user_id INT NOT NULL,
+                  reviewed_by_id INT DEFAULT NULL,
+                  PRIMARY KEY (id)
+                )
+            SQL);
+        $this->addSql('CREATE INDEX IDX_F211AA17A76ED395 ON absence_request (user_id)');
+        $this->addSql('CREATE INDEX IDX_F211AA17FC6B21F1 ON absence_request (reviewed_by_id)');
+        $this->addSql(<<<'SQL'
+                ALTER TABLE
+                  absence_request
+                ADD
+                  CONSTRAINT FK_F211AA17A76ED395 FOREIGN KEY (user_id) REFERENCES "user" (id) ON DELETE CASCADE NOT DEFERRABLE
+            SQL);
+        $this->addSql(<<<'SQL'
+                ALTER TABLE
+                  absence_request
+                ADD
+                  CONSTRAINT FK_F211AA17FC6B21F1 FOREIGN KEY (reviewed_by_id) REFERENCES "user" (id) ON DELETE SET NULL NOT DEFERRABLE
+            SQL);
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE absence_request DROP CONSTRAINT FK_F211AA17A76ED395');
+        $this->addSql('ALTER TABLE absence_request DROP CONSTRAINT FK_F211AA17FC6B21F1');
+        $this->addSql('DROP TABLE absence_request');
+    }
+}
diff --git a/migrations/Version20260521123523.php b/migrations/Version20260521123523.php
new file mode 100644
index 0000000..0cbb8d1
--- /dev/null
+++ b/migrations/Version20260521123523.php
@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Absence management: add HR fields to the user table.
+ *
+ * Columns are created with DEFAULTs so the migration applies cleanly on an
+ * already-populated user table (production).
+ */
+final class Version20260521123523 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add HR / absence fields to user';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE "user" ADD is_employee BOOLEAN NOT NULL DEFAULT false');
+        $this->addSql('ALTER TABLE "user" ADD hire_date DATE DEFAULT NULL');
+        $this->addSql('ALTER TABLE "user" ADD end_date DATE DEFAULT NULL');
+        $this->addSql('ALTER TABLE "user" ADD contract_type VARCHAR(16) DEFAULT NULL');
+        $this->addSql('ALTER TABLE "user" ADD work_time_ratio DOUBLE PRECISION NOT NULL DEFAULT 1.0');
+        $this->addSql('ALTER TABLE "user" ADD annual_leave_days DOUBLE PRECISION NOT NULL DEFAULT 25.0');
+        $this->addSql("ALTER TABLE \"user\" ADD reference_period_start VARCHAR(5) NOT NULL DEFAULT '06-01'");
+        $this->addSql('ALTER TABLE "user" ADD initial_leave_balance DOUBLE PRECISION NOT NULL DEFAULT 0');
+        $this->addSql('ALTER TABLE "user" ADD family_situation VARCHAR(16) DEFAULT NULL');
+        $this->addSql('ALTER TABLE "user" ADD nb_children INT NOT NULL DEFAULT 0');
+
+        // Defaults were only needed to backfill existing rows; the ORM mapping
+        // carries no DB default, so drop them to keep the schema in sync.
+        $this->addSql('ALTER TABLE "user" ALTER is_employee DROP DEFAULT');
+        $this->addSql('ALTER TABLE "user" ALTER work_time_ratio DROP DEFAULT');
+        $this->addSql('ALTER TABLE "user" ALTER annual_leave_days DROP DEFAULT');
+        $this->addSql('ALTER TABLE "user" ALTER reference_period_start DROP DEFAULT');
+        $this->addSql('ALTER TABLE "user" ALTER initial_leave_balance DROP DEFAULT');
+        $this->addSql('ALTER TABLE "user" ALTER nb_children DROP DEFAULT');
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE "user" DROP is_employee');
+        $this->addSql('ALTER TABLE "user" DROP hire_date');
+        $this->addSql('ALTER TABLE "user" DROP end_date');
+        $this->addSql('ALTER TABLE "user" DROP contract_type');
+        $this->addSql('ALTER TABLE "user" DROP work_time_ratio');
+        $this->addSql('ALTER TABLE "user" DROP annual_leave_days');
+        $this->addSql('ALTER TABLE "user" DROP reference_period_start');
+        $this->addSql('ALTER TABLE "user" DROP initial_leave_balance');
+        $this->addSql('ALTER TABLE "user" DROP family_situation');
+        $this->addSql('ALTER TABLE "user" DROP nb_children');
+    }
+}
diff --git a/src/Controller/Absence/AbsenceCalendarController.php b/src/Controller/Absence/AbsenceCalendarController.php
new file mode 100644
index 0000000..aec8f07
--- /dev/null
+++ b/src/Controller/Absence/AbsenceCalendarController.php
@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Absence;
+
+use App\Repository\AbsenceRequestRepository;
+use DateTimeImmutable;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+
+/**
+ * Admin calendar view: all pending/approved absences overlapping a date range.
+ */
+class AbsenceCalendarController extends AbstractController
+{
+    public function __construct(
+        private readonly AbsenceRequestRepository $requestRepository,
+    ) {}
+
+    #[Route('/api/admin/absences/calendar', name: 'absence_calendar', methods: ['GET'], priority: 1)]
+    #[IsGranted('ROLE_ADMIN')]
+    public function __invoke(Request $request): JsonResponse
+    {
+        $fromRaw = (string) $request->query->get('from', '');
+        $toRaw   = (string) $request->query->get('to', '');
+
+        if ('' === $fromRaw || '' === $toRaw) {
+            throw new UnprocessableEntityHttpException('Query parameters "from" and "to" are required.');
+        }
+
+        $from = new DateTimeImmutable($fromRaw);
+        $to   = new DateTimeImmutable($toRaw);
+
+        $absences = $this->requestRepository->findInRange($from, $to);
+
+        return $this->json($absences, context: ['groups' => ['absence_request:read']]);
+    }
+}
diff --git a/src/Controller/Absence/AbsenceJustificationDownloadController.php b/src/Controller/Absence/AbsenceJustificationDownloadController.php
new file mode 100644
index 0000000..3a48dd8
--- /dev/null
+++ b/src/Controller/Absence/AbsenceJustificationDownloadController.php
@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Absence;
+
+use App\Entity\AbsenceRequest;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+
+/**
+ * Streams the justification file of an absence request. Owner or admin only.
+ */
+class AbsenceJustificationDownloadController extends AbstractController
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+        private readonly string $uploadDir,
+    ) {}
+
+    #[Route('/api/absence_requests/{id}/justificatif', name: 'absence_justification_download', methods: ['GET'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function __invoke(int $id): BinaryFileResponse
+    {
+        $absence = $this->entityManager->getRepository(AbsenceRequest::class)->find($id);
+        if (null === $absence) {
+            throw new NotFoundHttpException('Absence request not found.');
+        }
+
+        if (!$this->security->isGranted('ROLE_ADMIN') && $absence->getUser() !== $this->security->getUser()) {
+            throw new AccessDeniedHttpException('You do not have access to this file.');
+        }
+
+        $fileName = $absence->getJustificationFileName();
+        if (null === $fileName) {
+            throw new NotFoundHttpException('No justification file for this request.');
+        }
+
+        $filePath = $this->uploadDir.'/'.$fileName;
+        if (!file_exists($filePath)) {
+            throw new NotFoundHttpException('File not found on disk.');
+        }
+
+        $response = new BinaryFileResponse($filePath);
+        $mimeType = mime_content_type($filePath) ?: 'application/octet-stream';
+
+        $disposition = (str_starts_with($mimeType, 'image/') || 'application/pdf' === $mimeType)
+            ? ResponseHeaderBag::DISPOSITION_INLINE
+            : ResponseHeaderBag::DISPOSITION_ATTACHMENT;
+
+        $response->setContentDisposition($disposition, $fileName);
+        $response->headers->set('Content-Type', $mimeType);
+
+        return $response;
+    }
+}
diff --git a/src/Controller/Absence/AbsenceJustificationUploadController.php b/src/Controller/Absence/AbsenceJustificationUploadController.php
new file mode 100644
index 0000000..5cfaa20
--- /dev/null
+++ b/src/Controller/Absence/AbsenceJustificationUploadController.php
@@ -0,0 +1,86 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Absence;
+
+use App\Entity\AbsenceRequest;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+use Symfony\Component\Uid\Uuid;
+
+/**
+ * Uploads a justification file (PDF / image) for an absence request. The owner
+ * or an admin may upload; the server-detected MIME type is validated.
+ */
+class AbsenceJustificationUploadController extends AbstractController
+{
+    private const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10 MB
+
+    private const MIME_TO_EXTENSION = [
+        'image/jpeg'      => 'jpg',
+        'image/png'       => 'png',
+        'image/webp'      => 'webp',
+        'application/pdf' => 'pdf',
+    ];
+
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+        private readonly string $uploadDir,
+    ) {}
+
+    #[Route('/api/absence_requests/{id}/justificatif', name: 'absence_justification_upload', methods: ['POST'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function __invoke(int $id, Request $request): JsonResponse
+    {
+        $absence = $this->entityManager->getRepository(AbsenceRequest::class)->find($id);
+        if (null === $absence) {
+            throw new NotFoundHttpException('Absence request not found.');
+        }
+
+        if (!$this->security->isGranted('ROLE_ADMIN') && $absence->getUser() !== $this->security->getUser()) {
+            throw new AccessDeniedHttpException('You can only attach a file to your own request.');
+        }
+
+        $file = $request->files->get('file');
+        if (null === $file || !$file->isValid()) {
+            throw new BadRequestHttpException('No valid file uploaded.');
+        }
+        if ($file->getSize() > self::MAX_FILE_SIZE) {
+            throw new BadRequestHttpException('File size exceeds 10 MB limit.');
+        }
+
+        $mimeType = $file->getMimeType() ?: 'application/octet-stream';
+        if (!isset(self::MIME_TO_EXTENSION[$mimeType])) {
+            throw new BadRequestHttpException(sprintf('File type "%s" is not allowed (PDF or image only).', $mimeType));
+        }
+
+        $fileName = Uuid::v4()->toRfc4122().'.'.self::MIME_TO_EXTENSION[$mimeType];
+
+        if (!is_dir($this->uploadDir)) {
+            mkdir($this->uploadDir, 0o775, true);
+        }
+
+        // Remove a previously uploaded file if any
+        $previous = $absence->getJustificationFileName();
+        if (null !== $previous && file_exists($this->uploadDir.'/'.$previous)) {
+            unlink($this->uploadDir.'/'.$previous);
+        }
+
+        $file->move($this->uploadDir, $fileName);
+
+        $absence->setJustificationFileName($fileName);
+        $this->entityManager->flush();
+
+        return $this->json($absence, context: ['groups' => ['absence_request:read']]);
+    }
+}
diff --git a/src/Controller/Absence/AbsencePreviewController.php b/src/Controller/Absence/AbsencePreviewController.php
new file mode 100644
index 0000000..c313cc2
--- /dev/null
+++ b/src/Controller/Absence/AbsencePreviewController.php
@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Absence;
+
+use App\Entity\User;
+use App\Enum\AbsenceType;
+use App\Enum\HalfDay;
+use App\Repository\AbsenceBalanceRepository;
+use App\Repository\AbsencePolicyRepository;
+use App\Service\AbsenceBalanceService;
+use App\Service\AbsenceDayCalculator;
+use DateTimeImmutable;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+
+/**
+ * Dry-run endpoint for the "new request" form: returns the number of deducted
+ * days and the projected balance without creating anything. Required because
+ * public holidays are computed server-side.
+ */
+class AbsencePreviewController extends AbstractController
+{
+    public function __construct(
+        private readonly Security $security,
+        private readonly AbsenceDayCalculator $calculator,
+        private readonly AbsencePolicyRepository $policyRepository,
+        private readonly AbsenceBalanceRepository $balanceRepository,
+        private readonly AbsenceBalanceService $balanceService,
+    ) {}
+
+    #[Route('/api/absence_requests/preview', name: 'absence_request_preview', methods: ['POST'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function __invoke(Request $request): JsonResponse
+    {
+        /** @var array<string, mixed> $payload */
+        $payload = json_decode($request->getContent(), true) ?? [];
+
+        $type = AbsenceType::tryFrom((string) ($payload['type'] ?? ''));
+        if (null === $type) {
+            throw new UnprocessableEntityHttpException('Unknown absence type.');
+        }
+
+        $startRaw = (string) ($payload['startDate'] ?? '');
+        $endRaw   = (string) ($payload['endDate'] ?? '');
+        if ('' === $startRaw || '' === $endRaw) {
+            throw new UnprocessableEntityHttpException('Start date and end date are required.');
+        }
+
+        $start = new DateTimeImmutable($startRaw);
+        $end   = new DateTimeImmutable($endRaw);
+        if ($end < $start) {
+            throw new UnprocessableEntityHttpException('End date must be on or after start date.');
+        }
+
+        $policy          = $this->policyRepository->findOneByType($type);
+        $workingDaysOnly = $policy?->isCountWorkingDaysOnly() ?? true;
+
+        $countedDays = $this->calculator->countWorkingDays(
+            $start,
+            $end,
+            isset($payload['startHalfDay']) ? HalfDay::tryFrom((string) $payload['startHalfDay']) : null,
+            isset($payload['endHalfDay']) ? HalfDay::tryFrom((string) $payload['endHalfDay']) : null,
+            $workingDaysOnly,
+        );
+
+        $user = $this->security->getUser();
+        assert($user instanceof User);
+
+        $available          = null;
+        $projectedAvailable = null;
+        $period             = null;
+
+        if ($type->decrementsBalance()) {
+            $period             = $this->balanceService->periodFor($user, $type, $start);
+            $balance            = $this->balanceRepository->findOneForPeriod($user, $type, $period);
+            $available          = $balance?->getAvailable() ?? 0.0;
+            $projectedAvailable = $available - $countedDays;
+        }
+
+        return $this->json([
+            'countedDays'           => $countedDays,
+            'period'                => $period,
+            'available'             => $available,
+            'projectedAvailable'    => $projectedAvailable,
+            'justificationRequired' => $policy?->isJustificationRequired() ?? false,
+        ]);
+    }
+}
diff --git a/src/DataFixtures/AppFixtures.php b/src/DataFixtures/AppFixtures.php
index a6a1c03..90efbe8 100644
--- a/src/DataFixtures/AppFixtures.php
+++ b/src/DataFixtures/AppFixtures.php
@@ -4,6 +4,9 @@ declare(strict_types=1);
 
 namespace App\DataFixtures;
 
+use App\Entity\AbsenceBalance;
+use App\Entity\AbsencePolicy;
+use App\Entity\AbsenceRequest;
 use App\Entity\Client;
 use App\Entity\ClientTicket;
 use App\Entity\MailConfiguration;
@@ -19,6 +22,10 @@ use App\Entity\TimeEntry;
 use App\Entity\User;
 use App\Entity\Workflow;
 use App\Entity\ZimbraConfiguration;
+use App\Enum\AbsenceStatus;
+use App\Enum\AbsenceType;
+use App\Enum\ContractType;
+use App\Enum\FamilySituation;
 use App\Enum\RecurrenceType;
 use App\Enum\StatusCategory;
 use DateTimeImmutable;
@@ -722,6 +729,106 @@ class AppFixtures extends Fixture
         $mailConfig->setEnabled(false);
         $manager->persist($mailConfig);
 
+        // =============================================
+        // Absence management — policies, employees, balances, requests
+        // =============================================
+
+        // Default policies for the 5 absence types (legal defaults, editable by admin)
+        $policyData = [
+            // [type, daysPerYear, daysPerEvent, justifRequired, noticeDays, workingDaysOnly]
+            [AbsenceType::PaidLeave, 25.0, null, false, 30, true],
+            [AbsenceType::MarriagePacs, null, 4.0, true, 0, true],
+            [AbsenceType::ParentalLeave, null, null, true, 30, true],
+            [AbsenceType::Bereavement, null, 3.0, true, 0, true],
+            [AbsenceType::SickLeave, null, null, true, 0, true],
+        ];
+
+        foreach ($policyData as [$type, $daysPerYear, $daysPerEvent, $justif, $notice, $workingDaysOnly]) {
+            $policy = new AbsencePolicy();
+            $policy->setType($type);
+            $policy->setDaysPerYear($daysPerYear);
+            $policy->setDaysPerEvent($daysPerEvent);
+            $policy->setJustificationRequired($justif);
+            $policy->setNoticeDays($notice);
+            $policy->setCountWorkingDaysOnly($workingDaysOnly);
+            $policy->setActive(true);
+            $manager->persist($policy);
+        }
+
+        // Mark internal users as employees
+        $admin->setIsEmployee(true);
+        $admin->setHireDate(new DateTimeImmutable('2020-01-15'));
+        $admin->setContractType(ContractType::Cdi);
+        $admin->setFamilySituation(FamilySituation::Married);
+        $admin->setNbChildren(2);
+
+        $userAlice->setIsEmployee(true);
+        $userAlice->setHireDate(new DateTimeImmutable('2022-09-01'));
+        $userAlice->setContractType(ContractType::Cdi);
+        $userAlice->setFamilySituation(FamilySituation::Single);
+
+        $userBob->setIsEmployee(true);
+        $userBob->setHireDate(new DateTimeImmutable('2023-03-10'));
+        $userBob->setContractType(ContractType::Cdd);
+        $userBob->setWorkTimeRatio(0.8);
+        $userBob->setFamilySituation(FamilySituation::Pacsed);
+        $userBob->setNbChildren(1);
+
+        // Paid-leave balances for the current reference period (June 1st → May 31st)
+        $cpPeriod    = '2025-2026';
+        $balanceData = [
+            // [user, acquired, taken, pending]
+            [$admin, 22.5, 5.0, 0.0],
+            [$userAlice, 18.0, 2.0, 5.0],
+            [$userBob, 14.0, 0.0, 0.0],
+        ];
+
+        foreach ($balanceData as [$bUser, $acquired, $taken, $pending]) {
+            $balance = new AbsenceBalance();
+            $balance->setUser($bUser);
+            $balance->setType(AbsenceType::PaidLeave);
+            $balance->setPeriod($cpPeriod);
+            $balance->setAcquired($acquired);
+            $balance->setTaken($taken);
+            $balance->setPending($pending);
+            $manager->persist($balance);
+        }
+
+        // Demo requests
+        $approvedCp = new AbsenceRequest();
+        $approvedCp->setUser($admin);
+        $approvedCp->setType(AbsenceType::PaidLeave);
+        $approvedCp->setStartDate(new DateTimeImmutable('2026-04-13'));
+        $approvedCp->setEndDate(new DateTimeImmutable('2026-04-17'));
+        $approvedCp->setCountedDays(5.0);
+        $approvedCp->setReason('Vacances de printemps');
+        $approvedCp->setStatus(AbsenceStatus::Approved);
+        $approvedCp->setCreatedAt(new DateTimeImmutable('2026-03-10'));
+        $approvedCp->setReviewedAt(new DateTimeImmutable('2026-03-11'));
+        $approvedCp->setReviewedBy($admin);
+        $manager->persist($approvedCp);
+
+        $pendingCp = new AbsenceRequest();
+        $pendingCp->setUser($userAlice);
+        $pendingCp->setType(AbsenceType::PaidLeave);
+        $pendingCp->setStartDate(new DateTimeImmutable('2026-06-15'));
+        $pendingCp->setEndDate(new DateTimeImmutable('2026-06-19'));
+        $pendingCp->setCountedDays(5.0);
+        $pendingCp->setStatus(AbsenceStatus::Pending);
+        $pendingCp->setCreatedAt(new DateTimeImmutable('-2 days'));
+        $manager->persist($pendingCp);
+
+        $pendingMarriage = new AbsenceRequest();
+        $pendingMarriage->setUser($userBob);
+        $pendingMarriage->setType(AbsenceType::MarriagePacs);
+        $pendingMarriage->setStartDate(new DateTimeImmutable('2026-07-06'));
+        $pendingMarriage->setEndDate(new DateTimeImmutable('2026-07-09'));
+        $pendingMarriage->setCountedDays(4.0);
+        $pendingMarriage->setReason('Mariage');
+        $pendingMarriage->setStatus(AbsenceStatus::Pending);
+        $pendingMarriage->setCreatedAt(new DateTimeImmutable('-1 day'));
+        $manager->persist($pendingMarriage);
+
         $manager->flush();
     }
 }
diff --git a/src/Entity/AbsenceBalance.php b/src/Entity/AbsenceBalance.php
new file mode 100644
index 0000000..32977a6
--- /dev/null
+++ b/src/Entity/AbsenceBalance.php
@@ -0,0 +1,163 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Entity;
+
+use ApiPlatform\Metadata\ApiResource;
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\GetCollection;
+use ApiPlatform\Metadata\Patch;
+use App\Enum\AbsenceType;
+use App\Repository\AbsenceBalanceRepository;
+use App\State\AbsenceBalanceProvider;
+use Doctrine\DBAL\Types\Types;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Serializer\Attribute\Groups;
+
+/**
+ * Per-employee, per-type leave balance for a given reference period.
+ */
+#[ApiResource(
+    operations: [
+        new GetCollection(
+            paginationEnabled: false,
+            security: "is_granted('ROLE_USER')",
+            provider: AbsenceBalanceProvider::class,
+        ),
+        new Get(
+            security: "is_granted('ROLE_USER')",
+            provider: AbsenceBalanceProvider::class,
+        ),
+        new Patch(security: "is_granted('ROLE_ADMIN')"),
+    ],
+    normalizationContext: ['groups' => ['absence_balance:read']],
+    denormalizationContext: ['groups' => ['absence_balance:write']],
+)]
+#[ORM\Entity(repositoryClass: AbsenceBalanceRepository::class)]
+#[ORM\Table(name: 'absence_balance')]
+#[ORM\UniqueConstraint(name: 'uniq_absence_balance_user_type_period', columns: ['user_id', 'type', 'period'])]
+class AbsenceBalance
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    #[Groups(['absence_balance:read'])]
+    private ?int $id = null;
+
+    #[ORM\ManyToOne(targetEntity: User::class)]
+    #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
+    #[Groups(['absence_balance:read'])]
+    private ?User $user = null;
+
+    #[ORM\Column(type: Types::STRING, length: 32, enumType: AbsenceType::class)]
+    #[Groups(['absence_balance:read'])]
+    private AbsenceType $type;
+
+    /** Reference period, e.g. "2025-2026" for paid leave or "2025" for yearly. */
+    #[ORM\Column(length: 16)]
+    #[Groups(['absence_balance:read'])]
+    private ?string $period = null;
+
+    #[ORM\Column(type: Types::FLOAT)]
+    #[Groups(['absence_balance:read', 'absence_balance:write'])]
+    private float $acquired = 0.0;
+
+    #[ORM\Column(type: Types::FLOAT)]
+    #[Groups(['absence_balance:read', 'absence_balance:write'])]
+    private float $taken = 0.0;
+
+    /** Sum of days in PENDING requests, for information. */
+    #[ORM\Column(type: Types::FLOAT)]
+    #[Groups(['absence_balance:read'])]
+    private float $pending = 0.0;
+
+    #[Groups(['absence_balance:read'])]
+    public function getAvailable(): float
+    {
+        return $this->acquired - $this->taken;
+    }
+
+    #[Groups(['absence_balance:read'])]
+    public function getLabel(): string
+    {
+        return $this->type->label();
+    }
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getUser(): ?User
+    {
+        return $this->user;
+    }
+
+    public function setUser(?User $user): static
+    {
+        $this->user = $user;
+
+        return $this;
+    }
+
+    public function getType(): AbsenceType
+    {
+        return $this->type;
+    }
+
+    public function setType(AbsenceType $type): static
+    {
+        $this->type = $type;
+
+        return $this;
+    }
+
+    public function getPeriod(): ?string
+    {
+        return $this->period;
+    }
+
+    public function setPeriod(string $period): static
+    {
+        $this->period = $period;
+
+        return $this;
+    }
+
+    public function getAcquired(): float
+    {
+        return $this->acquired;
+    }
+
+    public function setAcquired(float $acquired): static
+    {
+        $this->acquired = $acquired;
+
+        return $this;
+    }
+
+    public function getTaken(): float
+    {
+        return $this->taken;
+    }
+
+    public function setTaken(float $taken): static
+    {
+        $this->taken = $taken;
+
+        return $this;
+    }
+
+    public function getPending(): float
+    {
+        return $this->pending;
+    }
+
+    public function setPending(float $pending): static
+    {
+        $this->pending = $pending;
+
+        return $this;
+    }
+}
diff --git a/src/Entity/AbsencePolicy.php b/src/Entity/AbsencePolicy.php
new file mode 100644
index 0000000..00abb17
--- /dev/null
+++ b/src/Entity/AbsencePolicy.php
@@ -0,0 +1,171 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Entity;
+
+use ApiPlatform\Metadata\ApiResource;
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\GetCollection;
+use ApiPlatform\Metadata\Patch;
+use App\Enum\AbsenceType;
+use App\Repository\AbsencePolicyRepository;
+use Doctrine\DBAL\Types\Types;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Serializer\Attribute\Groups;
+
+/**
+ * Per-type configuration of absence rules. Overrides the legal defaults and
+ * lets an admin tune days/year, days/event, notice period, etc.
+ */
+#[ApiResource(
+    operations: [
+        new GetCollection(
+            paginationEnabled: false,
+            security: "is_granted('ROLE_USER')",
+        ),
+        new Get(security: "is_granted('ROLE_USER')"),
+        new Patch(security: "is_granted('ROLE_ADMIN')"),
+    ],
+    normalizationContext: ['groups' => ['absence_policy:read']],
+    denormalizationContext: ['groups' => ['absence_policy:write']],
+    order: ['type' => 'ASC'],
+)]
+#[ORM\Entity(repositoryClass: AbsencePolicyRepository::class)]
+#[ORM\Table(name: 'absence_policy')]
+#[ORM\UniqueConstraint(name: 'uniq_absence_policy_type', columns: ['type'])]
+class AbsencePolicy
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    #[Groups(['absence_policy:read'])]
+    private ?int $id = null;
+
+    #[ORM\Column(type: Types::STRING, length: 32, enumType: AbsenceType::class)]
+    #[Groups(['absence_policy:read', 'absence_balance:read', 'absence_request:read'])]
+    private AbsenceType $type;
+
+    /** Yearly entitlement (e.g. 25 for paid leave); null when not relevant. */
+    #[ORM\Column(type: Types::FLOAT, nullable: true)]
+    #[Groups(['absence_policy:read', 'absence_policy:write'])]
+    private ?float $daysPerYear = null;
+
+    /** Days granted per event (e.g. 4 for marriage); null when not relevant. */
+    #[ORM\Column(type: Types::FLOAT, nullable: true)]
+    #[Groups(['absence_policy:read', 'absence_policy:write'])]
+    private ?float $daysPerEvent = null;
+
+    #[ORM\Column]
+    #[Groups(['absence_policy:read', 'absence_policy:write'])]
+    private bool $justificationRequired = false;
+
+    /** Minimum notice period in days (e.g. 30 for paid leave, 0 for sick leave). */
+    #[ORM\Column]
+    #[Groups(['absence_policy:read', 'absence_policy:write'])]
+    private int $noticeDays = 0;
+
+    /** true => "jours ouvrés" (Mon-Fri), false => "jours ouvrables" (Mon-Sat). */
+    #[ORM\Column]
+    #[Groups(['absence_policy:read', 'absence_policy:write'])]
+    private bool $countWorkingDaysOnly = true;
+
+    #[ORM\Column]
+    #[Groups(['absence_policy:read', 'absence_policy:write'])]
+    private bool $active = true;
+
+    #[Groups(['absence_policy:read'])]
+    public function getLabel(): string
+    {
+        return $this->type->label();
+    }
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getType(): AbsenceType
+    {
+        return $this->type;
+    }
+
+    public function setType(AbsenceType $type): static
+    {
+        $this->type = $type;
+
+        return $this;
+    }
+
+    public function getDaysPerYear(): ?float
+    {
+        return $this->daysPerYear;
+    }
+
+    public function setDaysPerYear(?float $daysPerYear): static
+    {
+        $this->daysPerYear = $daysPerYear;
+
+        return $this;
+    }
+
+    public function getDaysPerEvent(): ?float
+    {
+        return $this->daysPerEvent;
+    }
+
+    public function setDaysPerEvent(?float $daysPerEvent): static
+    {
+        $this->daysPerEvent = $daysPerEvent;
+
+        return $this;
+    }
+
+    public function isJustificationRequired(): bool
+    {
+        return $this->justificationRequired;
+    }
+
+    public function setJustificationRequired(bool $justificationRequired): static
+    {
+        $this->justificationRequired = $justificationRequired;
+
+        return $this;
+    }
+
+    public function getNoticeDays(): int
+    {
+        return $this->noticeDays;
+    }
+
+    public function setNoticeDays(int $noticeDays): static
+    {
+        $this->noticeDays = $noticeDays;
+
+        return $this;
+    }
+
+    public function isCountWorkingDaysOnly(): bool
+    {
+        return $this->countWorkingDaysOnly;
+    }
+
+    public function setCountWorkingDaysOnly(bool $countWorkingDaysOnly): static
+    {
+        $this->countWorkingDaysOnly = $countWorkingDaysOnly;
+
+        return $this;
+    }
+
+    public function isActive(): bool
+    {
+        return $this->active;
+    }
+
+    public function setActive(bool $active): static
+    {
+        $this->active = $active;
+
+        return $this;
+    }
+}
diff --git a/src/Entity/AbsenceRequest.php b/src/Entity/AbsenceRequest.php
new file mode 100644
index 0000000..5045bdf
--- /dev/null
+++ b/src/Entity/AbsenceRequest.php
@@ -0,0 +1,326 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Entity;
+
+use ApiPlatform\Metadata\ApiResource;
+use ApiPlatform\Metadata\Delete;
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\GetCollection;
+use ApiPlatform\Metadata\Patch;
+use ApiPlatform\Metadata\Post;
+use App\Enum\AbsenceStatus;
+use App\Enum\AbsenceType;
+use App\Enum\HalfDay;
+use App\Repository\AbsenceRequestRepository;
+use App\State\AbsenceCancelProcessor;
+use App\State\AbsenceRequestProcessor;
+use App\State\AbsenceRequestProvider;
+use App\State\AbsenceReviewProcessor;
+use DateTimeImmutable;
+use Doctrine\DBAL\Types\Types;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Serializer\Attribute\Groups;
+use Symfony\Component\Validator\Constraints as Assert;
+
+#[ApiResource(
+    operations: [
+        new GetCollection(
+            paginationEnabled: false,
+            security: "is_granted('ROLE_USER')",
+            provider: AbsenceRequestProvider::class,
+        ),
+        new Get(
+            security: "is_granted('ROLE_USER')",
+            provider: AbsenceRequestProvider::class,
+        ),
+        new Post(
+            security: "is_granted('ROLE_USER')",
+            processor: AbsenceRequestProcessor::class,
+        ),
+        new Patch(
+            uriTemplate: '/absence_requests/{id}/approve',
+            security: "is_granted('ROLE_ADMIN')",
+            processor: AbsenceReviewProcessor::class,
+            provider: AbsenceRequestProvider::class,
+        ),
+        new Patch(
+            uriTemplate: '/absence_requests/{id}/reject',
+            security: "is_granted('ROLE_ADMIN')",
+            processor: AbsenceReviewProcessor::class,
+            provider: AbsenceRequestProvider::class,
+        ),
+        new Patch(
+            uriTemplate: '/absence_requests/{id}/cancel',
+            security: "is_granted('ROLE_USER')",
+            processor: AbsenceCancelProcessor::class,
+            provider: AbsenceRequestProvider::class,
+        ),
+        new Delete(security: "is_granted('ROLE_ADMIN')"),
+    ],
+    normalizationContext: ['groups' => ['absence_request:read']],
+    denormalizationContext: ['groups' => ['absence_request:write']],
+    order: ['createdAt' => 'DESC'],
+)]
+#[ORM\Entity(repositoryClass: AbsenceRequestRepository::class)]
+#[ORM\Table(name: 'absence_request')]
+class AbsenceRequest
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    #[Groups(['absence_request:read'])]
+    private ?int $id = null;
+
+    #[ORM\ManyToOne(targetEntity: User::class)]
+    #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
+    #[Groups(['absence_request:read'])]
+    private ?User $user = null;
+
+    #[ORM\Column(type: Types::STRING, length: 32, enumType: AbsenceType::class)]
+    #[Groups(['absence_request:read', 'absence_request:write'])]
+    #[Assert\NotNull]
+    private ?AbsenceType $type = null;
+
+    #[ORM\Column(type: Types::DATE_IMMUTABLE)]
+    #[Groups(['absence_request:read', 'absence_request:write'])]
+    #[Assert\NotNull]
+    private ?DateTimeImmutable $startDate = null;
+
+    #[ORM\Column(type: Types::DATE_IMMUTABLE)]
+    #[Groups(['absence_request:read', 'absence_request:write'])]
+    #[Assert\NotNull]
+    private ?DateTimeImmutable $endDate = null;
+
+    #[ORM\Column(type: Types::STRING, length: 16, nullable: true, enumType: HalfDay::class)]
+    #[Groups(['absence_request:read', 'absence_request:write'])]
+    private ?HalfDay $startHalfDay = null;
+
+    #[ORM\Column(type: Types::STRING, length: 16, nullable: true, enumType: HalfDay::class)]
+    #[Groups(['absence_request:read', 'absence_request:write'])]
+    private ?HalfDay $endHalfDay = null;
+
+    /** Number of deducted days, computed server-side at creation. */
+    #[ORM\Column(type: Types::FLOAT)]
+    #[Groups(['absence_request:read'])]
+    private float $countedDays = 0.0;
+
+    #[ORM\Column(type: Types::TEXT, nullable: true)]
+    #[Groups(['absence_request:read', 'absence_request:write'])]
+    private ?string $reason = null;
+
+    #[ORM\Column(length: 255, nullable: true)]
+    #[Groups(['absence_request:read'])]
+    private ?string $justificationFileName = null;
+
+    #[ORM\Column(type: Types::STRING, length: 16, enumType: AbsenceStatus::class)]
+    #[Groups(['absence_request:read'])]
+    private AbsenceStatus $status = AbsenceStatus::Pending;
+
+    #[ORM\Column(type: Types::TEXT, nullable: true)]
+    #[Groups(['absence_request:read', 'absence_request:write'])]
+    private ?string $rejectionReason = null;
+
+    #[ORM\Column(type: Types::DATETIME_IMMUTABLE)]
+    #[Groups(['absence_request:read'])]
+    private ?DateTimeImmutable $createdAt = null;
+
+    #[ORM\Column(type: Types::DATETIME_IMMUTABLE, nullable: true)]
+    #[Groups(['absence_request:read'])]
+    private ?DateTimeImmutable $reviewedAt = null;
+
+    #[ORM\ManyToOne(targetEntity: User::class)]
+    #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
+    #[Groups(['absence_request:read'])]
+    private ?User $reviewedBy = null;
+
+    #[Groups(['absence_request:read'])]
+    public function getLabel(): ?string
+    {
+        return $this->type?->label();
+    }
+
+    #[Groups(['absence_request:read'])]
+    public function getJustificationUrl(): ?string
+    {
+        if (null === $this->justificationFileName) {
+            return null;
+        }
+
+        return '/api/absence_requests/'.$this->id.'/justificatif';
+    }
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getUser(): ?User
+    {
+        return $this->user;
+    }
+
+    public function setUser(?User $user): static
+    {
+        $this->user = $user;
+
+        return $this;
+    }
+
+    public function getType(): ?AbsenceType
+    {
+        return $this->type;
+    }
+
+    public function setType(?AbsenceType $type): static
+    {
+        $this->type = $type;
+
+        return $this;
+    }
+
+    public function getStartDate(): ?DateTimeImmutable
+    {
+        return $this->startDate;
+    }
+
+    public function setStartDate(?DateTimeImmutable $startDate): static
+    {
+        $this->startDate = $startDate;
+
+        return $this;
+    }
+
+    public function getEndDate(): ?DateTimeImmutable
+    {
+        return $this->endDate;
+    }
+
+    public function setEndDate(?DateTimeImmutable $endDate): static
+    {
+        $this->endDate = $endDate;
+
+        return $this;
+    }
+
+    public function getStartHalfDay(): ?HalfDay
+    {
+        return $this->startHalfDay;
+    }
+
+    public function setStartHalfDay(?HalfDay $startHalfDay): static
+    {
+        $this->startHalfDay = $startHalfDay;
+
+        return $this;
+    }
+
+    public function getEndHalfDay(): ?HalfDay
+    {
+        return $this->endHalfDay;
+    }
+
+    public function setEndHalfDay(?HalfDay $endHalfDay): static
+    {
+        $this->endHalfDay = $endHalfDay;
+
+        return $this;
+    }
+
+    public function getCountedDays(): float
+    {
+        return $this->countedDays;
+    }
+
+    public function setCountedDays(float $countedDays): static
+    {
+        $this->countedDays = $countedDays;
+
+        return $this;
+    }
+
+    public function getReason(): ?string
+    {
+        return $this->reason;
+    }
+
+    public function setReason(?string $reason): static
+    {
+        $this->reason = $reason;
+
+        return $this;
+    }
+
+    public function getJustificationFileName(): ?string
+    {
+        return $this->justificationFileName;
+    }
+
+    public function setJustificationFileName(?string $justificationFileName): static
+    {
+        $this->justificationFileName = $justificationFileName;
+
+        return $this;
+    }
+
+    public function getStatus(): AbsenceStatus
+    {
+        return $this->status;
+    }
+
+    public function setStatus(AbsenceStatus $status): static
+    {
+        $this->status = $status;
+
+        return $this;
+    }
+
+    public function getRejectionReason(): ?string
+    {
+        return $this->rejectionReason;
+    }
+
+    public function setRejectionReason(?string $rejectionReason): static
+    {
+        $this->rejectionReason = $rejectionReason;
+
+        return $this;
+    }
+
+    public function getCreatedAt(): ?DateTimeImmutable
+    {
+        return $this->createdAt;
+    }
+
+    public function setCreatedAt(DateTimeImmutable $createdAt): static
+    {
+        $this->createdAt = $createdAt;
+
+        return $this;
+    }
+
+    public function getReviewedAt(): ?DateTimeImmutable
+    {
+        return $this->reviewedAt;
+    }
+
+    public function setReviewedAt(?DateTimeImmutable $reviewedAt): static
+    {
+        $this->reviewedAt = $reviewedAt;
+
+        return $this;
+    }
+
+    public function getReviewedBy(): ?User
+    {
+        return $this->reviewedBy;
+    }
+
+    public function setReviewedBy(?User $reviewedBy): static
+    {
+        $this->reviewedBy = $reviewedBy;
+
+        return $this;
+    }
+}
diff --git a/src/Entity/User.php b/src/Entity/User.php
index 11067e0..e796ae4 100644
--- a/src/Entity/User.php
+++ b/src/Entity/User.php
@@ -10,6 +10,8 @@ use ApiPlatform\Metadata\Get;
 use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
+use App\Enum\ContractType;
+use App\Enum\FamilySituation;
 use App\Repository\UserRepository;
 use App\State\MeProvider;
 use App\State\UserPasswordHasherProcessor;
@@ -48,11 +50,11 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
     #[ORM\Id]
     #[ORM\GeneratedValue]
     #[ORM\Column]
-    #[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'client_ticket:read'])]
+    #[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'client_ticket:read', 'absence_request:read', 'absence_balance:read'])]
     private ?int $id = null;
 
     #[ORM\Column(length: 180, unique: true)]
-    #[Groups(['me:read', 'task:read', 'user:list', 'user:write', 'time_entry:read', 'client_ticket:read'])]
+    #[Groups(['me:read', 'task:read', 'user:list', 'user:write', 'time_entry:read', 'client_ticket:read', 'absence_request:read', 'absence_balance:read'])]
     private ?string $username = null;
 
     /** @var list<string> */
@@ -87,6 +89,54 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
     #[Groups(['me:read', 'user:list', 'user:write'])]
     private Collection $allowedProjects;
 
+    // --- HR / absence management fields ---
+
+    /** Whether this user is an employee subject to absence management. */
+    #[ORM\Column]
+    #[Groups(['me:read', 'user:list', 'user:write'])]
+    private bool $isEmployee = false;
+
+    /** Hiring date — start of paid-leave acquisition. */
+    #[ORM\Column(type: Types::DATE_IMMUTABLE, nullable: true)]
+    #[Groups(['me:read', 'user:list', 'user:write'])]
+    private ?DateTimeImmutable $hireDate = null;
+
+    #[ORM\Column(type: Types::DATE_IMMUTABLE, nullable: true)]
+    #[Groups(['me:read', 'user:list', 'user:write'])]
+    private ?DateTimeImmutable $endDate = null;
+
+    #[ORM\Column(type: Types::STRING, length: 16, nullable: true, enumType: ContractType::class)]
+    #[Groups(['me:read', 'user:list', 'user:write'])]
+    private ?ContractType $contractType = null;
+
+    /** Work-time ratio: 1.0 = full time, 0.8 = 4 days out of 5. */
+    #[ORM\Column(type: Types::FLOAT)]
+    #[Groups(['me:read', 'user:list', 'user:write'])]
+    private float $workTimeRatio = 1.0;
+
+    /** Yearly paid-leave entitlement in worked days (default 25 = jours ouvrés). */
+    #[ORM\Column(type: Types::FLOAT)]
+    #[Groups(['me:read', 'user:list', 'user:write'])]
+    private float $annualLeaveDays = 25.0;
+
+    /** Reference period start as MM-DD (default 06-01, 1st of June). */
+    #[ORM\Column(length: 5)]
+    #[Groups(['me:read', 'user:list', 'user:write'])]
+    private string $referencePeriodStart = '06-01';
+
+    /** Paid-leave already acquired when the module is rolled out. */
+    #[ORM\Column(type: Types::FLOAT)]
+    #[Groups(['me:read', 'user:list', 'user:write'])]
+    private float $initialLeaveBalance = 0.0;
+
+    #[ORM\Column(type: Types::STRING, length: 16, nullable: true, enumType: FamilySituation::class)]
+    #[Groups(['me:read', 'user:list', 'user:write'])]
+    private ?FamilySituation $familySituation = null;
+
+    #[ORM\Column]
+    #[Groups(['me:read', 'user:list', 'user:write'])]
+    private int $nbChildren = 0;
+
     public function __construct()
     {
         $this->createdAt       = new DateTimeImmutable();
@@ -217,7 +267,7 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
         return $this;
     }
 
-    #[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'client_ticket:read'])]
+    #[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'client_ticket:read', 'absence_request:read', 'absence_balance:read'])]
     public function getAvatarUrl(): ?string
     {
         if (null === $this->avatarFileName) {
@@ -243,4 +293,124 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
     {
         $this->plainPassword = null;
     }
+
+    public function isEmployee(): bool
+    {
+        return $this->isEmployee;
+    }
+
+    public function setIsEmployee(bool $isEmployee): static
+    {
+        $this->isEmployee = $isEmployee;
+
+        return $this;
+    }
+
+    public function getHireDate(): ?DateTimeImmutable
+    {
+        return $this->hireDate;
+    }
+
+    public function setHireDate(?DateTimeImmutable $hireDate): static
+    {
+        $this->hireDate = $hireDate;
+
+        return $this;
+    }
+
+    public function getEndDate(): ?DateTimeImmutable
+    {
+        return $this->endDate;
+    }
+
+    public function setEndDate(?DateTimeImmutable $endDate): static
+    {
+        $this->endDate = $endDate;
+
+        return $this;
+    }
+
+    public function getContractType(): ?ContractType
+    {
+        return $this->contractType;
+    }
+
+    public function setContractType(?ContractType $contractType): static
+    {
+        $this->contractType = $contractType;
+
+        return $this;
+    }
+
+    public function getWorkTimeRatio(): float
+    {
+        return $this->workTimeRatio;
+    }
+
+    public function setWorkTimeRatio(float $workTimeRatio): static
+    {
+        $this->workTimeRatio = $workTimeRatio;
+
+        return $this;
+    }
+
+    public function getAnnualLeaveDays(): float
+    {
+        return $this->annualLeaveDays;
+    }
+
+    public function setAnnualLeaveDays(float $annualLeaveDays): static
+    {
+        $this->annualLeaveDays = $annualLeaveDays;
+
+        return $this;
+    }
+
+    public function getReferencePeriodStart(): string
+    {
+        return $this->referencePeriodStart;
+    }
+
+    public function setReferencePeriodStart(string $referencePeriodStart): static
+    {
+        $this->referencePeriodStart = $referencePeriodStart;
+
+        return $this;
+    }
+
+    public function getInitialLeaveBalance(): float
+    {
+        return $this->initialLeaveBalance;
+    }
+
+    public function setInitialLeaveBalance(float $initialLeaveBalance): static
+    {
+        $this->initialLeaveBalance = $initialLeaveBalance;
+
+        return $this;
+    }
+
+    public function getFamilySituation(): ?FamilySituation
+    {
+        return $this->familySituation;
+    }
+
+    public function setFamilySituation(?FamilySituation $familySituation): static
+    {
+        $this->familySituation = $familySituation;
+
+        return $this;
+    }
+
+    public function getNbChildren(): int
+    {
+        return $this->nbChildren;
+    }
+
+    public function setNbChildren(int $nbChildren): static
+    {
+        $this->nbChildren = $nbChildren;
+
+        return $this;
+    }
 }
diff --git a/src/Enum/AbsenceStatus.php b/src/Enum/AbsenceStatus.php
new file mode 100644
index 0000000..ce45714
--- /dev/null
+++ b/src/Enum/AbsenceStatus.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enum;
+
+enum AbsenceStatus: string
+{
+    case Pending   = 'pending';
+    case Approved  = 'approved';
+    case Rejected  = 'rejected';
+    case Cancelled = 'cancelled';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::Pending   => 'En attente',
+            self::Approved  => 'Approuvée',
+            self::Rejected  => 'Refusée',
+            self::Cancelled => 'Annulée',
+        };
+    }
+}
diff --git a/src/Enum/AbsenceType.php b/src/Enum/AbsenceType.php
new file mode 100644
index 0000000..c868e32
--- /dev/null
+++ b/src/Enum/AbsenceType.php
@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enum;
+
+enum AbsenceType: string
+{
+    case PaidLeave     = 'cp';
+    case MarriagePacs  = 'mariage_pacs';
+    case ParentalLeave = 'conge_parental';
+    case Bereavement   = 'deces';
+    case SickLeave     = 'maladie';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::PaidLeave     => 'Congés payés',
+            self::MarriagePacs  => 'Mariage / PACS',
+            self::ParentalLeave => 'Congé parental',
+            self::Bereavement   => 'Décès proche',
+            self::SickLeave     => 'Arrêt maladie',
+        };
+    }
+
+    /**
+     * Whether taking this absence decrements a balance.
+     * Sick leave is managed by social security and has no balance.
+     */
+    public function decrementsBalance(): bool
+    {
+        return self::SickLeave !== $this;
+    }
+}
diff --git a/src/Enum/ContractType.php b/src/Enum/ContractType.php
new file mode 100644
index 0000000..fe1d7b1
--- /dev/null
+++ b/src/Enum/ContractType.php
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enum;
+
+enum ContractType: string
+{
+    case Cdi        = 'CDI';
+    case Cdd        = 'CDD';
+    case Internship = 'STAGE';
+    case Apprentice = 'ALTERNANCE';
+    case Other      = 'AUTRE';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::Cdi        => 'CDI',
+            self::Cdd        => 'CDD',
+            self::Internship => 'Stage',
+            self::Apprentice => 'Alternance',
+            self::Other      => 'Autre',
+        };
+    }
+}
diff --git a/src/Enum/FamilySituation.php b/src/Enum/FamilySituation.php
new file mode 100644
index 0000000..938498b
--- /dev/null
+++ b/src/Enum/FamilySituation.php
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enum;
+
+enum FamilySituation: string
+{
+    case Single   = 'CELIBATAIRE';
+    case Married  = 'MARIE';
+    case Pacsed   = 'PACSE';
+    case Divorced = 'DIVORCE';
+    case Widowed  = 'VEUF';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::Single   => 'Célibataire',
+            self::Married  => 'Marié(e)',
+            self::Pacsed   => 'Pacsé(e)',
+            self::Divorced => 'Divorcé(e)',
+            self::Widowed  => 'Veuf(ve)',
+        };
+    }
+}
diff --git a/src/Enum/HalfDay.php b/src/Enum/HalfDay.php
new file mode 100644
index 0000000..fa868f3
--- /dev/null
+++ b/src/Enum/HalfDay.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enum;
+
+enum HalfDay: string
+{
+    case Morning   = 'matin';
+    case Afternoon = 'apres_midi';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::Morning   => 'Matin',
+            self::Afternoon => 'Après-midi',
+        };
+    }
+}
diff --git a/src/Repository/AbsenceBalanceRepository.php b/src/Repository/AbsenceBalanceRepository.php
new file mode 100644
index 0000000..9e74b73
--- /dev/null
+++ b/src/Repository/AbsenceBalanceRepository.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Repository;
+
+use App\Entity\AbsenceBalance;
+use App\Entity\User;
+use App\Enum\AbsenceType;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<AbsenceBalance>
+ */
+class AbsenceBalanceRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, AbsenceBalance::class);
+    }
+
+    public function findOneForPeriod(User $user, AbsenceType $type, string $period): ?AbsenceBalance
+    {
+        return $this->findOneBy([
+            'user'   => $user,
+            'type'   => $type,
+            'period' => $period,
+        ]);
+    }
+}
diff --git a/src/Repository/AbsencePolicyRepository.php b/src/Repository/AbsencePolicyRepository.php
new file mode 100644
index 0000000..b1467a7
--- /dev/null
+++ b/src/Repository/AbsencePolicyRepository.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Repository;
+
+use App\Entity\AbsencePolicy;
+use App\Enum\AbsenceType;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<AbsencePolicy>
+ */
+class AbsencePolicyRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, AbsencePolicy::class);
+    }
+
+    public function findOneByType(AbsenceType $type): ?AbsencePolicy
+    {
+        return $this->findOneBy(['type' => $type]);
+    }
+}
diff --git a/src/Repository/AbsenceRequestRepository.php b/src/Repository/AbsenceRequestRepository.php
new file mode 100644
index 0000000..620755b
--- /dev/null
+++ b/src/Repository/AbsenceRequestRepository.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Repository;
+
+use App\Entity\AbsenceRequest;
+use App\Entity\User;
+use App\Enum\AbsenceStatus;
+use DateTimeInterface;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<AbsenceRequest>
+ */
+class AbsenceRequestRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, AbsenceRequest::class);
+    }
+
+    /**
+     * Whether the user already has a PENDING or APPROVED absence that overlaps
+     * the given date range. Two ranges overlap when start_a <= end_b and
+     * end_a >= start_b.
+     */
+    public function hasOverlap(
+        User $user,
+        DateTimeInterface $startDate,
+        DateTimeInterface $endDate,
+        ?int $excludeId = null,
+    ): bool {
+        $qb = $this->createQueryBuilder('a')
+            ->select('COUNT(a.id)')
+            ->andWhere('a.user = :user')
+            ->andWhere('a.status IN (:statuses)')
+            ->andWhere('a.startDate <= :endDate')
+            ->andWhere('a.endDate >= :startDate')
+            ->setParameter('user', $user)
+            ->setParameter('statuses', [AbsenceStatus::Pending, AbsenceStatus::Approved])
+            ->setParameter('startDate', $startDate->format('Y-m-d'))
+            ->setParameter('endDate', $endDate->format('Y-m-d'))
+        ;
+
+        if (null !== $excludeId) {
+            $qb->andWhere('a.id != :excludeId')->setParameter('excludeId', $excludeId);
+        }
+
+        return (int) $qb->getQuery()->getSingleScalarResult() > 0;
+    }
+
+    /**
+     * Absences (approved or pending) overlapping a date range, all employees —
+     * used by the admin calendar view.
+     *
+     * @return AbsenceRequest[]
+     */
+    public function findInRange(DateTimeInterface $from, DateTimeInterface $to): array
+    {
+        return $this->createQueryBuilder('a')
+            ->andWhere('a.status IN (:statuses)')
+            ->andWhere('a.startDate <= :to')
+            ->andWhere('a.endDate >= :from')
+            ->setParameter('statuses', [AbsenceStatus::Pending, AbsenceStatus::Approved])
+            ->setParameter('from', $from->format('Y-m-d'))
+            ->setParameter('to', $to->format('Y-m-d'))
+            ->orderBy('a.startDate', 'ASC')
+            ->getQuery()
+            ->getResult()
+        ;
+    }
+}
diff --git a/src/Service/AbsenceBalanceService.php b/src/Service/AbsenceBalanceService.php
new file mode 100644
index 0000000..399cb64
--- /dev/null
+++ b/src/Service/AbsenceBalanceService.php
@@ -0,0 +1,122 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Service;
+
+use App\Entity\AbsenceBalance;
+use App\Entity\AbsenceRequest;
+use App\Entity\User;
+use App\Enum\AbsenceType;
+use App\Repository\AbsenceBalanceRepository;
+use DateTimeInterface;
+use Doctrine\ORM\EntityManagerInterface;
+
+/**
+ * Maintains per-employee leave balances as absence requests move through their
+ * lifecycle: a PENDING request reserves days in `pending`, an APPROVED one
+ * moves them to `taken`, and a cancellation gives them back.
+ */
+final readonly class AbsenceBalanceService
+{
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+        private AbsenceBalanceRepository $balanceRepository,
+    ) {}
+
+    /**
+     * Reference period string for a request: paid leave follows the employee's
+     * reference period (e.g. "2025-2026"), other types are tracked yearly.
+     */
+    public function periodFor(User $user, AbsenceType $type, DateTimeInterface $date): string
+    {
+        if (AbsenceType::PaidLeave !== $type) {
+            return $date->format('Y');
+        }
+
+        $year            = (int) $date->format('Y');
+        $startMonthDay   = $user->getReferencePeriodStart(); // e.g. "06-01"
+        $currentMonthDay = $date->format('m-d');
+
+        $startYear = $currentMonthDay >= $startMonthDay ? $year : $year - 1;
+
+        return sprintf('%d-%d', $startYear, $startYear + 1);
+    }
+
+    public function getOrCreateBalance(User $user, AbsenceType $type, string $period): AbsenceBalance
+    {
+        $balance = $this->balanceRepository->findOneForPeriod($user, $type, $period);
+
+        if (null === $balance) {
+            $balance = new AbsenceBalance()
+                ->setUser($user)
+                ->setType($type)
+                ->setPeriod($period)
+            ;
+            $this->entityManager->persist($balance);
+        }
+
+        return $balance;
+    }
+
+    /** Reserve the requested days in the PENDING bucket. */
+    public function reservePending(AbsenceRequest $request): void
+    {
+        if (!$this->shouldTrack($request)) {
+            return;
+        }
+
+        $balance = $this->balanceForRequest($request);
+        $balance->setPending($balance->getPending() + $request->getCountedDays());
+    }
+
+    /** Move reserved days from PENDING to TAKEN on approval. */
+    public function applyApproval(AbsenceRequest $request): void
+    {
+        if (!$this->shouldTrack($request)) {
+            return;
+        }
+
+        $balance = $this->balanceForRequest($request);
+        $balance->setPending(max(0.0, $balance->getPending() - $request->getCountedDays()));
+        $balance->setTaken($balance->getTaken() + $request->getCountedDays());
+    }
+
+    /**
+     * Give days back when a request is cancelled or rejected.
+     *
+     * @param bool $wasApproved true if the request had already been approved
+     *                          (days were in TAKEN), false if still PENDING
+     */
+    public function release(AbsenceRequest $request, bool $wasApproved): void
+    {
+        if (!$this->shouldTrack($request)) {
+            return;
+        }
+
+        $balance = $this->balanceForRequest($request);
+
+        if ($wasApproved) {
+            $balance->setTaken(max(0.0, $balance->getTaken() - $request->getCountedDays()));
+        } else {
+            $balance->setPending(max(0.0, $balance->getPending() - $request->getCountedDays()));
+        }
+    }
+
+    private function balanceForRequest(AbsenceRequest $request): AbsenceBalance
+    {
+        /** @var User $user */
+        $user   = $request->getUser();
+        $type   = $request->getType();
+        $period = $this->periodFor($user, $type, $request->getStartDate());
+
+        return $this->getOrCreateBalance($user, $type, $period);
+    }
+
+    private function shouldTrack(AbsenceRequest $request): bool
+    {
+        $type = $request->getType();
+
+        return null !== $type && $type->decrementsBalance() && null !== $request->getUser();
+    }
+}
diff --git a/src/Service/AbsenceDayCalculator.php b/src/Service/AbsenceDayCalculator.php
new file mode 100644
index 0000000..fd8ed5a
--- /dev/null
+++ b/src/Service/AbsenceDayCalculator.php
@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Service;
+
+use App\Enum\HalfDay;
+use DateInterval;
+use DatePeriod;
+use DateTimeImmutable;
+
+/**
+ * Computes the number of days deducted for an absence request, following the
+ * business rules of the spec (§5.1): weekends and public holidays are skipped,
+ * and half-days on the boundaries subtract 0.5 each.
+ */
+final readonly class AbsenceDayCalculator
+{
+    public function __construct(
+        private PublicHolidayProvider $holidayProvider,
+    ) {}
+
+    /**
+     * @param bool $workingDaysOnly true => "jours ouvrés" (Mon-Fri),
+     *                              false => "jours ouvrables" (Mon-Sat, Sunday excluded)
+     */
+    public function countWorkingDays(
+        DateTimeImmutable $start,
+        DateTimeImmutable $end,
+        ?HalfDay $startHalfDay = null,
+        ?HalfDay $endHalfDay = null,
+        bool $workingDaysOnly = true,
+    ): float {
+        $start = $start->setTime(0, 0);
+        $end   = $end->setTime(0, 0);
+
+        if ($end < $start) {
+            return 0.0;
+        }
+
+        $days   = 0.0;
+        $period = new DatePeriod($start, new DateInterval('P1D'), $end->modify('+1 day'));
+
+        foreach ($period as $day) {
+            $weekday = (int) $day->format('N'); // 1 (Mon) .. 7 (Sun)
+
+            if (7 === $weekday) {
+                continue; // Sunday: never counted
+            }
+            if (6 === $weekday && $workingDaysOnly) {
+                continue; // Saturday: only counted for "jours ouvrables"
+            }
+            if ($this->holidayProvider->isHoliday($day)) {
+                continue;
+            }
+
+            ++$days;
+        }
+
+        if ($days <= 0.0) {
+            return 0.0;
+        }
+
+        if (null !== $startHalfDay) {
+            $days -= 0.5;
+        }
+        if (null !== $endHalfDay) {
+            $days -= 0.5;
+        }
+
+        return max(0.0, $days);
+    }
+}
diff --git a/src/Service/PublicHolidayProvider.php b/src/Service/PublicHolidayProvider.php
new file mode 100644
index 0000000..1897757
--- /dev/null
+++ b/src/Service/PublicHolidayProvider.php
@@ -0,0 +1,86 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Service;
+
+use DateTimeImmutable;
+use DateTimeInterface;
+
+/**
+ * Provides French métropole public holidays.
+ *
+ * Dates are computed in pure PHP: fixed-date holidays are hardcoded and
+ * Easter-based ones are derived from the Computus (Meeus/Jones/Butcher
+ * Gregorian algorithm), so the provider has no runtime dependency and is
+ * fully deterministic. Alsace-Moselle / DOM specifics are out of scope.
+ */
+final class PublicHolidayProvider
+{
+    /** @var array<int, array<string, string>> cache of holidays per year */
+    private array $cache = [];
+
+    /**
+     * @return array<string, string> map of 'Y-m-d' => label, sorted by date
+     */
+    public function getHolidays(int $year): array
+    {
+        if (isset($this->cache[$year])) {
+            return $this->cache[$year];
+        }
+
+        $easter       = $this->easterSunday($year);
+        $easterMonday = $easter->modify('+1 day');
+        $ascension    = $easter->modify('+39 days');
+        $whitMonday   = $easter->modify('+50 days');
+
+        $holidays = [
+            sprintf('%d-01-01', $year)     => 'Jour de l\'an',
+            $easterMonday->format('Y-m-d') => 'Lundi de Pâques',
+            sprintf('%d-05-01', $year)     => 'Fête du Travail',
+            sprintf('%d-05-08', $year)     => 'Victoire 1945',
+            $ascension->format('Y-m-d')    => 'Ascension',
+            $whitMonday->format('Y-m-d')   => 'Lundi de Pentecôte',
+            sprintf('%d-07-14', $year)     => 'Fête nationale',
+            sprintf('%d-08-15', $year)     => 'Assomption',
+            sprintf('%d-11-01', $year)     => 'Toussaint',
+            sprintf('%d-11-11', $year)     => 'Armistice 1918',
+            sprintf('%d-12-25', $year)     => 'Noël',
+        ];
+
+        ksort($holidays);
+
+        return $this->cache[$year] = $holidays;
+    }
+
+    public function isHoliday(DateTimeInterface $date): bool
+    {
+        $holidays = $this->getHolidays((int) $date->format('Y'));
+
+        return isset($holidays[$date->format('Y-m-d')]);
+    }
+
+    /**
+     * Easter Sunday date for the given year (Gregorian Computus).
+     */
+    private function easterSunday(int $year): DateTimeImmutable
+    {
+        $a = $year % 19;
+        $b = intdiv($year, 100);
+        $c = $year % 100;
+        $d = intdiv($b, 4);
+        $e = $b % 4;
+        $f = intdiv($b + 8, 25);
+        $g = intdiv($b - $f + 1, 3);
+        $h = (19 * $a + $b - $d - $g + 15) % 30;
+        $i = intdiv($c, 4);
+        $k = $c % 4;
+        $l = (32 + 2 * $e + 2 * $i - $h - $k) % 7;
+        $m = intdiv($a + 11 * $h + 22 * $l, 451);
+
+        $month = intdiv($h + $l - 7 * $m + 114, 31);
+        $day   = (($h + $l - 7 * $m + 114) % 31) + 1;
+
+        return new DateTimeImmutable(sprintf('%04d-%02d-%02d', $year, $month, $day));
+    }
+}
diff --git a/src/State/AbsenceBalanceProvider.php b/src/State/AbsenceBalanceProvider.php
new file mode 100644
index 0000000..d155efa
--- /dev/null
+++ b/src/State/AbsenceBalanceProvider.php
@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\State;
+
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProviderInterface;
+use App\Entity\AbsenceBalance;
+use App\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\SecurityBundle\Security;
+
+/**
+ * @implements ProviderInterface<AbsenceBalance>
+ */
+final readonly class AbsenceBalanceProvider implements ProviderInterface
+{
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+        private Security $security,
+    ) {}
+
+    public function provide(Operation $operation, array $uriVariables = [], array $context = []): AbsenceBalance|array|null
+    {
+        $user = $this->security->getUser();
+        assert($user instanceof User);
+
+        $repo    = $this->entityManager->getRepository(AbsenceBalance::class);
+        $isAdmin = $this->security->isGranted('ROLE_ADMIN');
+
+        if (isset($uriVariables['id'])) {
+            $balance = $repo->find($uriVariables['id']);
+            if (null === $balance) {
+                return null;
+            }
+            if (!$isAdmin && $balance->getUser() !== $user) {
+                return null;
+            }
+
+            return $balance;
+        }
+
+        $qb = $repo->createQueryBuilder('b')
+            ->orderBy('b.type', 'ASC')
+        ;
+
+        if (!$isAdmin) {
+            $qb->andWhere('b.user = :user')->setParameter('user', $user);
+        }
+
+        $filters = $context['filters'] ?? [];
+
+        if (isset($filters['type'])) {
+            $qb->andWhere('b.type = :type')->setParameter('type', $filters['type']);
+        }
+        if (isset($filters['period'])) {
+            $qb->andWhere('b.period = :period')->setParameter('period', $filters['period']);
+        }
+        if ($isAdmin && isset($filters['user'])) {
+            $qb->andWhere('b.user = :filterUser')
+                ->setParameter('filterUser', self::extractId($filters['user']))
+            ;
+        }
+
+        return $qb->getQuery()->getResult();
+    }
+
+    private static function extractId(string $value): int
+    {
+        return is_numeric($value) ? (int) $value : (int) basename($value);
+    }
+}
diff --git a/src/State/AbsenceCancelProcessor.php b/src/State/AbsenceCancelProcessor.php
new file mode 100644
index 0000000..59b9e0f
--- /dev/null
+++ b/src/State/AbsenceCancelProcessor.php
@@ -0,0 +1,75 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\State;
+
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProcessorInterface;
+use App\Entity\AbsenceRequest;
+use App\Enum\AbsenceStatus;
+use App\Service\AbsenceBalanceService;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\ConflictHttpException;
+
+/**
+ * Cancellation of an absence request. An employee may cancel their own PENDING
+ * request; an admin may additionally cancel an APPROVED one, which credits the
+ * deducted days back to the balance.
+ *
+ * @implements ProcessorInterface<AbsenceRequest, AbsenceRequest>
+ */
+final readonly class AbsenceCancelProcessor implements ProcessorInterface
+{
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+        private Security $security,
+        private AbsenceBalanceService $balanceService,
+    ) {}
+
+    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): AbsenceRequest
+    {
+        assert($data instanceof AbsenceRequest);
+
+        // Cancellation carries no payload: keep the persisted content intact.
+        $previous = $context['previous_data'] ?? null;
+        if ($previous instanceof AbsenceRequest) {
+            $data->setType($previous->getType());
+            $data->setStartDate($previous->getStartDate());
+            $data->setEndDate($previous->getEndDate());
+            $data->setStartHalfDay($previous->getStartHalfDay());
+            $data->setEndHalfDay($previous->getEndHalfDay());
+            $data->setReason($previous->getReason());
+            $data->setCountedDays($previous->getCountedDays());
+            $data->setStatus($previous->getStatus());
+        }
+
+        $user    = $this->security->getUser();
+        $isAdmin = $this->security->isGranted('ROLE_ADMIN');
+        $status  = $data->getStatus();
+
+        if (AbsenceStatus::Pending === $status) {
+            $this->balanceService->release($data, false);
+        } elseif (AbsenceStatus::Approved === $status) {
+            if (!$isAdmin) {
+                throw new AccessDeniedHttpException('Only an admin can cancel an approved request.');
+            }
+            $this->balanceService->release($data, true);
+        } else {
+            throw new ConflictHttpException('This request can no longer be cancelled.');
+        }
+
+        // An employee may only cancel their own request (admins can cancel any).
+        if (!$isAdmin && $data->getUser() !== $user) {
+            throw new AccessDeniedHttpException('You can only cancel your own requests.');
+        }
+
+        $data->setStatus(AbsenceStatus::Cancelled);
+
+        $this->entityManager->flush();
+
+        return $data;
+    }
+}
diff --git a/src/State/AbsenceRequestProcessor.php b/src/State/AbsenceRequestProcessor.php
new file mode 100644
index 0000000..4322195
--- /dev/null
+++ b/src/State/AbsenceRequestProcessor.php
@@ -0,0 +1,91 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\State;
+
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProcessorInterface;
+use App\Entity\AbsenceRequest;
+use App\Entity\User;
+use App\Enum\AbsenceStatus;
+use App\Repository\AbsencePolicyRepository;
+use App\Repository\AbsenceRequestRepository;
+use App\Service\AbsenceBalanceService;
+use App\Service\AbsenceDayCalculator;
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpKernel\Exception\ConflictHttpException;
+use Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException;
+
+/**
+ * Handles creation of an absence request: computes the deducted days, enforces
+ * the overlap rule, and reserves the days in the employee's pending balance.
+ *
+ * @implements ProcessorInterface<AbsenceRequest, AbsenceRequest>
+ */
+final readonly class AbsenceRequestProcessor implements ProcessorInterface
+{
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+        private Security $security,
+        private AbsenceDayCalculator $calculator,
+        private AbsencePolicyRepository $policyRepository,
+        private AbsenceRequestRepository $requestRepository,
+        private AbsenceBalanceService $balanceService,
+    ) {}
+
+    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): AbsenceRequest
+    {
+        assert($data instanceof AbsenceRequest);
+
+        $user = $this->security->getUser();
+        assert($user instanceof User);
+
+        $type      = $data->getType();
+        $startDate = $data->getStartDate();
+        $endDate   = $data->getEndDate();
+
+        if (null === $type || null === $startDate || null === $endDate) {
+            throw new UnprocessableEntityHttpException('Type, start date and end date are required.');
+        }
+
+        if ($endDate < $startDate) {
+            throw new UnprocessableEntityHttpException('End date must be on or after start date.');
+        }
+
+        $policy = $this->policyRepository->findOneByType($type);
+        if (null === $policy || !$policy->isActive()) {
+            throw new UnprocessableEntityHttpException('This absence type is not available.');
+        }
+
+        if ($this->requestRepository->hasOverlap($user, $startDate, $endDate)) {
+            throw new ConflictHttpException('This request overlaps an existing absence.');
+        }
+
+        $countedDays = $this->calculator->countWorkingDays(
+            $startDate,
+            $endDate,
+            $data->getStartHalfDay(),
+            $data->getEndHalfDay(),
+            $policy->isCountWorkingDaysOnly(),
+        );
+
+        if ($countedDays <= 0.0) {
+            throw new UnprocessableEntityHttpException('The selected range contains no working day.');
+        }
+
+        $data->setUser($user);
+        $data->setCountedDays($countedDays);
+        $data->setStatus(AbsenceStatus::Pending);
+        $data->setRejectionReason(null);
+        $data->setCreatedAt(new DateTimeImmutable());
+
+        $this->entityManager->persist($data);
+        $this->balanceService->reservePending($data);
+        $this->entityManager->flush();
+
+        return $data;
+    }
+}
diff --git a/src/State/AbsenceRequestProvider.php b/src/State/AbsenceRequestProvider.php
new file mode 100644
index 0000000..0e05508
--- /dev/null
+++ b/src/State/AbsenceRequestProvider.php
@@ -0,0 +1,82 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\State;
+
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProviderInterface;
+use App\Entity\AbsenceRequest;
+use App\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\SecurityBundle\Security;
+
+/**
+ * @implements ProviderInterface<AbsenceRequest>
+ */
+final readonly class AbsenceRequestProvider implements ProviderInterface
+{
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+        private Security $security,
+    ) {}
+
+    public function provide(Operation $operation, array $uriVariables = [], array $context = []): AbsenceRequest|array|null
+    {
+        $user = $this->security->getUser();
+        assert($user instanceof User);
+
+        $repo    = $this->entityManager->getRepository(AbsenceRequest::class);
+        $isAdmin = $this->security->isGranted('ROLE_ADMIN');
+
+        // Single item: owner or admin only
+        if (isset($uriVariables['id'])) {
+            $request = $repo->find($uriVariables['id']);
+            if (null === $request) {
+                return null;
+            }
+            if (!$isAdmin && $request->getUser() !== $user) {
+                return null;
+            }
+
+            return $request;
+        }
+
+        $qb = $repo->createQueryBuilder('a')
+            ->orderBy('a.createdAt', 'DESC')
+        ;
+
+        if (!$isAdmin) {
+            $qb->andWhere('a.user = :user')->setParameter('user', $user);
+        }
+
+        $filters = $context['filters'] ?? [];
+
+        if (isset($filters['status'])) {
+            $qb->andWhere('a.status = :status')->setParameter('status', $filters['status']);
+        }
+        if (isset($filters['type'])) {
+            $qb->andWhere('a.type = :type')->setParameter('type', $filters['type']);
+        }
+        if (isset($filters['year']) && is_numeric($filters['year'])) {
+            $year = (int) $filters['year'];
+            $qb->andWhere('a.startDate <= :yearEnd')
+                ->andWhere('a.endDate >= :yearStart')
+                ->setParameter('yearStart', sprintf('%d-01-01', $year))
+                ->setParameter('yearEnd', sprintf('%d-12-31', $year))
+            ;
+        }
+        if ($isAdmin && isset($filters['user'])) {
+            $qb->andWhere('a.user = :filterUser')
+                ->setParameter('filterUser', self::extractId($filters['user']))
+            ;
+        }
+
+        return $qb->getQuery()->getResult();
+    }
+
+    private static function extractId(string $value): int
+    {
+        return is_numeric($value) ? (int) $value : (int) basename($value);
+    }
+}
diff --git a/src/State/AbsenceReviewProcessor.php b/src/State/AbsenceReviewProcessor.php
new file mode 100644
index 0000000..9e8a881
--- /dev/null
+++ b/src/State/AbsenceReviewProcessor.php
@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\State;
+
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProcessorInterface;
+use App\Entity\AbsenceRequest;
+use App\Entity\User;
+use App\Enum\AbsenceStatus;
+use App\Service\AbsenceBalanceService;
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpKernel\Exception\ConflictHttpException;
+use Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException;
+
+/**
+ * Admin approval / rejection of a pending absence request. The target status
+ * is derived from the operation URI (.../approve or .../reject).
+ *
+ * @implements ProcessorInterface<AbsenceRequest, AbsenceRequest>
+ */
+final readonly class AbsenceReviewProcessor implements ProcessorInterface
+{
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+        private Security $security,
+        private AbsenceBalanceService $balanceService,
+    ) {}
+
+    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): AbsenceRequest
+    {
+        assert($data instanceof AbsenceRequest);
+
+        $isApprove          = str_contains((string) $operation->getUriTemplate(), 'approve');
+        $newRejectionReason = $data->getRejectionReason();
+
+        // Reviewing must never alter the request content: restore everything
+        // from the persisted state, only status/review fields may change.
+        $previous = $context['previous_data'] ?? null;
+        if ($previous instanceof AbsenceRequest) {
+            $data->setType($previous->getType());
+            $data->setStartDate($previous->getStartDate());
+            $data->setEndDate($previous->getEndDate());
+            $data->setStartHalfDay($previous->getStartHalfDay());
+            $data->setEndHalfDay($previous->getEndHalfDay());
+            $data->setReason($previous->getReason());
+            $data->setCountedDays($previous->getCountedDays());
+        }
+
+        if (AbsenceStatus::Pending !== $data->getStatus()) {
+            throw new ConflictHttpException('Only a pending request can be reviewed.');
+        }
+
+        $admin = $this->security->getUser();
+        assert($admin instanceof User);
+
+        if ($isApprove) {
+            $data->setStatus(AbsenceStatus::Approved);
+            $data->setRejectionReason(null);
+            $this->balanceService->applyApproval($data);
+        } else {
+            if (null === $newRejectionReason || '' === trim($newRejectionReason)) {
+                throw new UnprocessableEntityHttpException('A reason is required when rejecting a request.');
+            }
+            $data->setStatus(AbsenceStatus::Rejected);
+            $data->setRejectionReason($newRejectionReason);
+            $this->balanceService->release($data, false);
+        }
+
+        $data->setReviewedAt(new DateTimeImmutable());
+        $data->setReviewedBy($admin);
+
+        $this->entityManager->flush();
+
+        return $data;
+    }
+}
diff --git a/tests/Unit/Service/AbsenceDayCalculatorTest.php b/tests/Unit/Service/AbsenceDayCalculatorTest.php
new file mode 100644
index 0000000..591763e
--- /dev/null
+++ b/tests/Unit/Service/AbsenceDayCalculatorTest.php
@@ -0,0 +1,92 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Service;
+
+use App\Enum\HalfDay;
+use App\Service\AbsenceDayCalculator;
+use App\Service\PublicHolidayProvider;
+use DateTimeImmutable;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @internal
+ */
+class AbsenceDayCalculatorTest extends TestCase
+{
+    private AbsenceDayCalculator $calculator;
+
+    protected function setUp(): void
+    {
+        $this->calculator = new AbsenceDayCalculator(new PublicHolidayProvider());
+    }
+
+    public function testFullWeekIsFiveWorkingDays(): void
+    {
+        // Mon 2026-06-01 to Fri 2026-06-05, no holidays that week
+        self::assertSame(5.0, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-01'),
+            new DateTimeImmutable('2026-06-05'),
+        ));
+    }
+
+    public function testWeekendIsSkipped(): void
+    {
+        // Fri 2026-06-05 to Mon 2026-06-08 => Fri + Mon = 2
+        self::assertSame(2.0, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-05'),
+            new DateTimeImmutable('2026-06-08'),
+        ));
+    }
+
+    public function testHolidayIsSkipped(): void
+    {
+        // Thu 2026-05-07 to Fri 2026-05-08 (Victoire 1945) => Thu only = 1
+        self::assertSame(1.0, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-05-07'),
+            new DateTimeImmutable('2026-05-08'),
+        ));
+    }
+
+    public function testHalfDayStartSubtractsHalf(): void
+    {
+        self::assertSame(4.5, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-01'),
+            new DateTimeImmutable('2026-06-05'),
+            HalfDay::Afternoon,
+        ));
+    }
+
+    public function testBothHalfDaysSubtractOne(): void
+    {
+        self::assertSame(4.0, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-01'),
+            new DateTimeImmutable('2026-06-05'),
+            HalfDay::Afternoon,
+            HalfDay::Morning,
+        ));
+    }
+
+    public function testSingleHalfDay(): void
+    {
+        self::assertSame(0.5, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-01'),
+            new DateTimeImmutable('2026-06-01'),
+            HalfDay::Morning,
+        ));
+    }
+
+    public function testWorkingDaysVsOpenDays(): void
+    {
+        // Fri 2026-06-05 to Mon 2026-06-08, "ouvrables" includes Saturday
+        // => Fri + Sat + Mon = 3 (Sunday always skipped)
+        self::assertSame(3.0, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-05'),
+            new DateTimeImmutable('2026-06-08'),
+            null,
+            null,
+            false,
+        ));
+    }
+}
diff --git a/tests/Unit/Service/PublicHolidayProviderTest.php b/tests/Unit/Service/PublicHolidayProviderTest.php
new file mode 100644
index 0000000..ff1716c
--- /dev/null
+++ b/tests/Unit/Service/PublicHolidayProviderTest.php
@@ -0,0 +1,72 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Service;
+
+use App\Service\PublicHolidayProvider;
+use DateTimeImmutable;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @internal
+ */
+class PublicHolidayProviderTest extends TestCase
+{
+    private PublicHolidayProvider $provider;
+
+    protected function setUp(): void
+    {
+        $this->provider = new PublicHolidayProvider();
+    }
+
+    public function testReturnsElevenHolidaysForMetropole(): void
+    {
+        self::assertCount(11, $this->provider->getHolidays(2026));
+    }
+
+    public function testFixedHolidaysHaveCorrectLabels(): void
+    {
+        $holidays = $this->provider->getHolidays(2026);
+
+        self::assertSame('Jour de l\'an', $holidays['2026-01-01']);
+        self::assertSame('Fête du Travail', $holidays['2026-05-01']);
+        self::assertSame('Victoire 1945', $holidays['2026-05-08']);
+        self::assertSame('Fête nationale', $holidays['2026-07-14']);
+        self::assertSame('Assomption', $holidays['2026-08-15']);
+        self::assertSame('Toussaint', $holidays['2026-11-01']);
+        self::assertSame('Armistice 1918', $holidays['2026-11-11']);
+        self::assertSame('Noël', $holidays['2026-12-25']);
+    }
+
+    /**
+     * Easter 2026 is April 5th, so Easter Monday is April 6th,
+     * Ascension is May 14th and Whit Monday is May 25th.
+     */
+    public function testEasterBasedHolidays2026(): void
+    {
+        $holidays = $this->provider->getHolidays(2026);
+
+        self::assertSame('Lundi de Pâques', $holidays['2026-04-06']);
+        self::assertSame('Ascension', $holidays['2026-05-14']);
+        self::assertSame('Lundi de Pentecôte', $holidays['2026-05-25']);
+    }
+
+    /**
+     * Easter 2025 is April 20th, so Easter Monday is April 21st.
+     */
+    public function testEasterBasedHolidays2025(): void
+    {
+        $holidays = $this->provider->getHolidays(2025);
+
+        self::assertSame('Lundi de Pâques', $holidays['2025-04-21']);
+    }
+
+    public function testIsHoliday(): void
+    {
+        self::assertTrue($this->provider->isHoliday(new DateTimeImmutable('2026-05-01')));
+        self::assertTrue($this->provider->isHoliday(new DateTimeImmutable('2026-05-14')));
+        self::assertFalse($this->provider->isHoliday(new DateTimeImmutable('2026-05-02')));
+        self::assertFalse($this->provider->isHoliday(new DateTimeImmutable('2026-06-01')));
+    }
+}

From 2a0b202d32cbc64e2132b07f5a826838d266ec66 Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Fri, 22 May 2026 11:31:31 +0200
Subject: [PATCH 2/9] feat(absences) : avancement module absences + suppression
 du portail client
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Deux lots regroupés sur la branche feat/absence-management.

Suppression complète du portail client :
- retire ROLE_CLIENT (security.yaml) ; User::getRoles() ajoute toujours ROLE_USER
- supprime l'entité ClientTicket (+ repo, states, relations), User.client et
  User.allowedProjects, NotificationService, ProjectAllowedExtension, le bloc
  ROLE_CLIENT de MailAccessChecker
- front : pages /portal, layout portal, composants client-ticket/,
  AdminClientTicketTab, services/dto/i18n/docs associés
- fixtures : retire les users client-liot / client-acme
- migration Version20260522110000 (drop client_ticket, user_allowed_projects,
  colonnes liées ; task_document.task_id -> NOT NULL)
- tests : retire les cas obsolètes testant le blocage des clients sur le mail

Module gestion des absences (WIP) :
- entités / migrations (Version20260521160000, Version20260522090000)
- pages absences.vue / team-absences.vue, composants frontend/components/absence/
- services front, AccrueLeaveCommand, PublicHolidayController

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 CLAUDE.md                                     |  23 +-
 config/packages/security.yaml                 |   4 +-
 .../2026-05-22-employee-management-reorg.md   | 571 ++++++++++++++++++
 ...21-absence-request-form-redesign-design.md | 119 ++++
 ...-05-22-employee-management-reorg-design.md |  96 +++
 .../absence/AbsenceBalanceAdjustDrawer.vue    |  69 +++
 .../absence/AbsenceBalanceCards.vue           | 119 ++++
 .../components/absence/AbsenceCalendar.vue    | 143 +++++
 .../components/absence/AbsenceDateField.vue   |  73 +++
 .../absence/AbsenceDetailDrawer.vue           | 193 ++++++
 .../absence/AbsenceRejectDrawer.vue           |  69 +++
 .../absence/AbsenceRequestDrawer.vue          | 296 +++++++++
 .../components/absence/EmployeeDrawer.vue     | 163 +++++
 .../admin/AdminAbsencePolicyTab.vue           |  76 +++
 .../components/admin/AdminClientTicketTab.vue | 382 ------------
 frontend/components/admin/WorkflowDrawer.vue  |   5 +-
 .../client-ticket/ClientTicketDetailModal.vue | 353 -----------
 .../client-ticket/ProjectClientTickets.vue    | 333 ----------
 frontend/components/client/ClientDrawer.vue   |   5 +-
 .../components/mail/MailCreateTaskModal.vue   |   8 +-
 .../components/mail/MailLinkTaskModal.vue     |   2 +-
 .../notification/NotificationBell.vue         |  14 +-
 frontend/components/project/ProjectDrawer.vue |  11 +-
 .../project/ProjectWorkflowSwitchModal.vue    |   2 +-
 frontend/components/task/TaskBulkActions.vue  |  10 +-
 frontend/components/task/TaskCard.vue         |   6 -
 .../components/task/TaskDocumentUpload.vue    |   7 +-
 frontend/components/task/TaskEffortDrawer.vue |   5 +-
 frontend/components/task/TaskGitSection.vue   |   2 +-
 frontend/components/task/TaskGroupDrawer.vue  |   5 +-
 frontend/components/task/TaskModal.vue        |  93 +--
 .../components/task/TaskPriorityDrawer.vue    |   5 +-
 frontend/components/task/TaskTagDrawer.vue    |   5 +-
 .../time-tracking/TimeEntryDrawer.vue         |   9 +-
 .../time-tracking/TimeTrackingCalendar.vue    |  30 +
 .../TimeTrackingExportDrawer.vue              |  13 +-
 frontend/components/ui/StatusBadge.vue        |  32 +
 frontend/components/user/UserDrawer.vue       | 103 +---
 frontend/composables/useAbsenceHelpers.ts     |  93 +++
 .../composables/useClientTicketHelpers.ts     |  48 --
 frontend/content/help/01-getting-started.md   |   5 +-
 frontend/content/help/05-tasks-detail.md      |   4 -
 frontend/content/help/06-client-portal.md     |  43 --
 frontend/content/help/07-admin.md             |   5 +-
 frontend/content/help/10-messaging.md         |   2 +-
 frontend/i18n/locales/fr.json                 | 247 ++++++--
 frontend/layouts/default.vue                  |  90 ++-
 frontend/layouts/portal.vue                   |  87 ---
 frontend/middleware/auth.global.ts            |  11 +-
 frontend/package-lock.json                    |   8 +-
 frontend/package.json                         |   2 +-
 frontend/pages/absences.vue                   | 168 ++++++
 frontend/pages/admin.vue                      |   2 +
 frontend/pages/help.vue                       |   2 -
 frontend/pages/index.vue                      |   6 +-
 frontend/pages/login.vue                      |   4 +-
 frontend/pages/mail.vue                       |  20 -
 frontend/pages/my-tasks.vue                   |  14 +-
 frontend/pages/portal/index.vue               |  84 ---
 frontend/pages/portal/projects/[id]/index.vue | 282 ---------
 .../pages/portal/projects/[id]/new-ticket.vue | 133 ----
 frontend/pages/profile.vue                    |  29 +-
 frontend/pages/projects/[id]/archives.vue     |   2 +-
 .../pages/projects/[id]/client-tickets.vue    | 269 ---------
 frontend/pages/projects/[id]/index.vue        |  12 +-
 frontend/pages/team-absences.vue              | 479 +++++++++++++++
 frontend/pages/time-tracking.vue              |   6 +-
 frontend/services/absences.ts                 | 137 +++++
 frontend/services/client-tickets.ts           |  46 --
 frontend/services/dto/absence.ts              |  93 +++
 frontend/services/dto/client-ticket.ts        |  34 --
 frontend/services/dto/notification.ts         |   1 -
 frontend/services/dto/task.ts                 |   8 -
 frontend/services/dto/user-data.ts            |  29 +-
 frontend/services/task-documents.ts           |  13 +-
 makefile                                      |   3 +
 migrations/Version20260521160000.php          |  30 +
 migrations/Version20260522090000.php          |  39 ++
 migrations/Version20260522110000.php          | 102 ++++
 src/Command/AccrueLeaveCommand.php            | 151 +++++
 .../Absence/PublicHolidayController.php       |  46 ++
 .../TaskDocumentDownloadController.php        |  11 -
 src/DataFixtures/AppFixtures.php              | 100 +--
 src/Doctrine/ProjectAllowedExtension.php      |  66 --
 src/Entity/AbsenceBalance.php                 |  47 +-
 src/Entity/ClientTicket.php                   | 282 ---------
 src/Entity/Notification.php                   |  17 -
 src/Entity/Project.php                        |   4 +-
 src/Entity/Task.php                           |  17 -
 src/Entity/TaskDocument.php                   |  41 +-
 src/Entity/TimeEntry.php                      |  17 -
 src/Entity/User.php                           |  65 +-
 src/Mcp/Tool/Serializer.php                   |  38 +-
 .../Tool/TimeEntry/CreateTimeEntryTool.php    |  10 -
 .../Tool/TimeEntry/ListTimeEntriesTool.php    |   5 -
 .../Tool/TimeEntry/UpdateTimeEntryTool.php    |  10 -
 src/Repository/ClientTicketRepository.php     |  45 --
 src/Repository/UserRepository.php             |  21 +
 src/Security/MailAccessChecker.php            |   5 -
 src/Service/NotificationService.php           |  74 ---
 src/State/ClientTicketNumberProcessor.php     |  70 ---
 src/State/ClientTicketProvider.php            |  80 ---
 src/State/ClientTicketStatusProcessor.php     |  74 ---
 src/State/TaskDocumentProcessor.php           |  38 +-
 src/State/TaskDocumentProvider.php            |  29 +-
 .../Mail/MailFoldersControllerTest.php        |  13 -
 .../Mail/MailMessagesControllerTest.php       |  13 -
 .../Mail/MailSyncTriggerControllerTest.php    |  13 -
 .../MailTaskIntegrationControllerTest.php     |  26 -
 109 files changed, 3918 insertions(+), 3656 deletions(-)
 create mode 100644 docs/superpowers/plans/2026-05-22-employee-management-reorg.md
 create mode 100644 docs/superpowers/specs/2026-05-21-absence-request-form-redesign-design.md
 create mode 100644 docs/superpowers/specs/2026-05-22-employee-management-reorg-design.md
 create mode 100644 frontend/components/absence/AbsenceBalanceAdjustDrawer.vue
 create mode 100644 frontend/components/absence/AbsenceBalanceCards.vue
 create mode 100644 frontend/components/absence/AbsenceCalendar.vue
 create mode 100644 frontend/components/absence/AbsenceDateField.vue
 create mode 100644 frontend/components/absence/AbsenceDetailDrawer.vue
 create mode 100644 frontend/components/absence/AbsenceRejectDrawer.vue
 create mode 100644 frontend/components/absence/AbsenceRequestDrawer.vue
 create mode 100644 frontend/components/absence/EmployeeDrawer.vue
 create mode 100644 frontend/components/admin/AdminAbsencePolicyTab.vue
 delete mode 100644 frontend/components/admin/AdminClientTicketTab.vue
 delete mode 100644 frontend/components/client-ticket/ClientTicketDetailModal.vue
 delete mode 100644 frontend/components/client-ticket/ProjectClientTickets.vue
 create mode 100644 frontend/components/ui/StatusBadge.vue
 create mode 100644 frontend/composables/useAbsenceHelpers.ts
 delete mode 100644 frontend/composables/useClientTicketHelpers.ts
 delete mode 100644 frontend/content/help/06-client-portal.md
 delete mode 100644 frontend/layouts/portal.vue
 create mode 100644 frontend/pages/absences.vue
 delete mode 100644 frontend/pages/portal/index.vue
 delete mode 100644 frontend/pages/portal/projects/[id]/index.vue
 delete mode 100644 frontend/pages/portal/projects/[id]/new-ticket.vue
 delete mode 100644 frontend/pages/projects/[id]/client-tickets.vue
 create mode 100644 frontend/pages/team-absences.vue
 create mode 100644 frontend/services/absences.ts
 delete mode 100644 frontend/services/client-tickets.ts
 create mode 100644 frontend/services/dto/absence.ts
 delete mode 100644 frontend/services/dto/client-ticket.ts
 create mode 100644 migrations/Version20260521160000.php
 create mode 100644 migrations/Version20260522090000.php
 create mode 100644 migrations/Version20260522110000.php
 create mode 100644 src/Command/AccrueLeaveCommand.php
 create mode 100644 src/Controller/Absence/PublicHolidayController.php
 delete mode 100644 src/Doctrine/ProjectAllowedExtension.php
 delete mode 100644 src/Entity/ClientTicket.php
 delete mode 100644 src/Repository/ClientTicketRepository.php
 delete mode 100644 src/Service/NotificationService.php
 delete mode 100644 src/State/ClientTicketNumberProcessor.php
 delete mode 100644 src/State/ClientTicketProvider.php
 delete mode 100644 src/State/ClientTicketStatusProcessor.php

diff --git a/CLAUDE.md b/CLAUDE.md
index 5d26d72..87575ec 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -14,10 +14,10 @@ Application de gestion de projet. Monorepo Symfony 8 (API Platform 4) + Nuxt 4.
 ## Structure
 
 ```
-src/Entity/          # Entités Doctrine (User, Client, Project, Task, TaskStatus, TaskEffort, TaskPriority, TaskTag, TaskGroup, TimeEntry, GiteaConfiguration, ClientTicket, Notification, TaskDocument, BookStackConfiguration, TaskBookStackLink, TaskRecurrence, ZimbraConfiguration)
+src/Entity/          # Entités Doctrine (User, Client, Project, Task, TaskStatus, TaskEffort, TaskPriority, TaskTag, TaskGroup, TimeEntry, GiteaConfiguration, Notification, TaskDocument, BookStackConfiguration, TaskBookStackLink, TaskRecurrence, ZimbraConfiguration)
 src/ApiResource/     # Ressources API Platform (si découplées des entités) (ZimbraSettings, ZimbraTestConnection)
 src/Enum/            # PHP enums (RecurrenceType)
-src/State/           # Providers et Processors API Platform (MeProvider, AppVersionProvider, ActiveTimeEntryProvider, UserPasswordHasherProcessor, TaskNumberProcessor, ClientTicket*Provider/Processor, NotificationProvider, Gitea*Provider, Gitea*Processor, ZimbraSettingsProvider/Processor, ZimbraTestConnectionProvider, TaskCalendarProcessor, RecurrenceHandler)
+src/State/           # Providers et Processors API Platform (MeProvider, AppVersionProvider, ActiveTimeEntryProvider, UserPasswordHasherProcessor, TaskNumberProcessor, NotificationProvider, Gitea*Provider, Gitea*Processor, ZimbraSettingsProvider/Processor, ZimbraTestConnectionProvider, TaskCalendarProcessor, RecurrenceHandler)
 src/Service/         # Services métier (NotificationService, CalDavService, RecurrenceCalculator)
 src/Controller/      # Controllers custom Symfony (NotificationUnreadCountController, MarkAllReadController, UserAvatarController, TaskDocumentDownloadController)
 src/Mcp/Tool/        # MCP tools organisés par domaine (Project/, Task/, TaskMeta/, TimeEntry/, Reference/)
@@ -31,12 +31,12 @@ migrations/          # Migrations Doctrine
 docs/plans/          # Plans d'implémentation
 docs/superpowers/    # Plans et specs superpowers
 frontend/            # App Nuxt 4
-frontend/pages/      # Pages (index, login, my-tasks, profile, projects, projects/[id], projects/[id]/groups, projects/[id]/archives, time-tracking, admin, portal/, portal/projects/[id], portal/projects/[id]/new-ticket)
-frontend/layouts/    # Layouts (default, portal)
-frontend/components/ # Composants Vue organisés en sous-dossiers (ui/, client/, project/, task/, user/, admin/, time-tracking/, client-ticket/, notification/) — inclut admin/AdminZimbraTab
-frontend/composables/# Composables (useApi, useAppVersion, useNotifications, useClientTicketHelpers, useAvatarService)
+frontend/pages/      # Pages (index, login, my-tasks, profile, projects, projects/[id], projects/[id]/groups, projects/[id]/archives, time-tracking, admin)
+frontend/layouts/    # Layouts (default)
+frontend/components/ # Composants Vue organisés en sous-dossiers (ui/, client/, project/, task/, user/, admin/, time-tracking/, notification/) — inclut admin/AdminZimbraTab
+frontend/composables/# Composables (useApi, useAppVersion, useNotifications, useAvatarService)
 frontend/stores/     # Stores Pinia (auth, ui, timer)
-frontend/services/   # Services API (auth, clients, gitea, projects, tasks, task-statuses, task-efforts, task-groups, task-priorities, task-tags, users, time-entries, client-tickets, notifications, task-documents, zimbra, task-recurrences)
+frontend/services/   # Services API (auth, clients, gitea, projects, tasks, task-statuses, task-efforts, task-groups, task-priorities, task-tags, users, time-entries, notifications, task-documents, zimbra, task-recurrences)
 frontend/services/dto/ # Types TypeScript
 frontend/i18n/locales/ # Fichiers de traduction (langDir résolu depuis i18n/)
 ```
@@ -85,13 +85,13 @@ Exemples : `feat : add login page`, `fix(auth) : prevent null token crash`
 - Routes API préfixées `/api` (via `config/routes/api_platform.yaml`)
 - Le login (`/login_check`) est hors prefix `/api`, nginx réécrit `REQUEST_URI` vers `/login_check`
 - PHP CS Fixer : règles Symfony + PSR-12 + strict types
-- Rôles : `ROLE_ADMIN`, `ROLE_USER`, `ROLE_CLIENT` — hiérarchie dans `security.yaml`
-- `User::getRoles()` n'ajoute PAS `ROLE_USER` si l'user a `ROLE_CLIENT` (isolation)
+- Rôles : `ROLE_ADMIN`, `ROLE_USER` — hiérarchie dans `security.yaml`
+- `User::getRoles()` ajoute toujours `ROLE_USER`
 - PostgreSQL : `LIKE` sur colonne JSON ne marche pas → utiliser `roles::text LIKE` via native SQL
 - Controllers custom sous `/api/` : ajouter `priority: 1` sur `#[Route]` pour éviter le conflit avec API Platform `{id}`
 - Serialization : pour embarquer une relation (pas IRI), ajouter le groupe du parent aux propriétés de l'entité cible
 - Upload fichiers : utiliser `$file->getMimeType()` (pas `getClientMimeType()`) pour valider côté serveur — nécessite `symfony/mime`
-- Auth endpoints mixtes (ROLE_USER + ROLE_CLIENT) : utiliser `#[IsGranted('IS_AUTHENTICATED_FULLY')]` au lieu d'un rôle spécifique
+- Endpoints ouverts à tout utilisateur authentifié : utiliser `#[IsGranted('IS_AUTHENTICATED_FULLY')]` au lieu d'un rôle spécifique
 
 ### Frontend
 
@@ -102,8 +102,6 @@ Exemples : `feat : add login page`, `fix(auth) : prevent null token crash`
 - Traductions dans `frontend/i18n/locales/` (le module résout `langDir` depuis `i18n/`)
 - 4 espaces d'indentation
 - MalioSelect : options `{ label: string, value: string | number | null }` — accepte les valeurs **string** (enums string OK, ex `category`/`StatusCategory`), pas seulement `number` (vérifié dans la source `Select.vue` : `modelValue: string | number | null`). L'option vide `null` n'est ajoutée que si `empty-option-label` est passé (ne pas le passer pour un champ requis). Largeur via `group-class` (pas de prop `minWidth`/`min-width`). ⚠️ Le `COMPONENTS.md` de la lib est inexact sur ce composant (il indique une clé `text` et une prop `minWidth` inexistantes) : la clé d'affichage réelle est `label`. Ne jamais modifier la lib `malio-layer-ui` depuis ce projet.
-- Portal client : pages sous `/portal/`, layout `portal.vue`, middleware redirige `ROLE_CLIENT` (sans `ROLE_ADMIN`) vers `/portal`
-- Users admin+client : ne pas bloquer — vérifier `ROLE_CLIENT && !ROLE_ADMIN` pour les restrictions
 
 ### Composants UI
 
@@ -138,7 +136,6 @@ La librairie `@malio/layer-ui` fournit les composants de formulaire et d'action.
 
 - User admin : `admin` / `admin` (ROLE_ADMIN)
 - Users internes : `alice` / `alice`, `bob` / `bob`, `charlie` / `charlie` (ROLE_USER)
-- Users client : `client-liot` / `client` (ROLE_CLIENT, client LIOT → SIRH), `client-acme` / `client` (ROLE_CLIENT, client ACME → CRM)
 - API token admin (dev) : `dev-mcp-token-for-testing-only-do-not-use-in-production`
 - ZimbraConfiguration : serverUrl `https://mail.ovh.com`, username `lesstime@ovh.fr`, enabled false
 - TaskRecurrence (hebdomadaire lun/mer/ven) attachée à la tâche "Réunion de suivi hebdomadaire" (SIRH)
diff --git a/config/packages/security.yaml b/config/packages/security.yaml
index 820b46a..35949cd 100644
--- a/config/packages/security.yaml
+++ b/config/packages/security.yaml
@@ -1,6 +1,6 @@
 security:
     role_hierarchy:
-        ROLE_ADMIN: [ROLE_USER, ROLE_CLIENT]
+        ROLE_ADMIN: [ROLE_USER]
 
     # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
     password_hashers:
@@ -64,7 +64,7 @@ security:
         - { path: ^/api/version, roles: PUBLIC_ACCESS, methods: [ GET ] }
         - { path: ^/_mcp, roles: PUBLIC_ACCESS, methods: [ GET ] }
         - { path: ^/_mcp, roles: IS_AUTHENTICATED_FULLY }
-        # Mail : requiert authentification (les checks ROLE_USER/ROLE_CLIENT sont dans MailAccessChecker)
+        # Mail : requiert authentification (le check ROLE_USER est dans MailAccessChecker)
         - { path: ^/api/mail, roles: IS_AUTHENTICATED_FULLY }
         - { path: ^/api, roles: IS_AUTHENTICATED_FULLY }
 
diff --git a/docs/superpowers/plans/2026-05-22-employee-management-reorg.md b/docs/superpowers/plans/2026-05-22-employee-management-reorg.md
new file mode 100644
index 0000000..ed84e08
--- /dev/null
+++ b/docs/superpowers/plans/2026-05-22-employee-management-reorg.md
@@ -0,0 +1,571 @@
+# Réorganisation gestion employés — Plan d'implémentation
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Sortir l'édition des informations RH du `UserDrawer` (qui ne garde que la case « Employé ») vers un onglet « Employés » dédié dans `team-absences`, avec une liste users⋈soldes et un drawer d'édition.
+
+**Architecture:** Réorganisation 100 % frontend. Les champs employé existent déjà sur l'entité `User` (backend) et le DTO `UserData`/`UserWrite` ; la persistance passe par `usersService.update()` (PATCH partiel, sans écrasement). La liste de l'onglet joint `usersService.getAll()` (filtré `isEmployee`) avec `absenceService.getBalances({ type: 'cp' })`.
+
+**Tech Stack:** Nuxt 4 / Vue 3 Composition API, TypeScript, composants `@malio/layer-ui` (MalioDate, MalioSelect, MalioInputText, MalioDataTable, MalioDrawer, MalioCheckbox), i18n `@nuxtjs/i18n`.
+
+**Conventions projet :**
+- 4 espaces d'indentation, TypeScript strict.
+- Pas de framework de test frontend → vérification au navigateur (serveur dev sur `http://localhost:3002`, Chrome DevTools MCP) + compilation HMR sans erreur console.
+- **Commits gérés par l'utilisateur** : ne committer qu'après son feu vert explicite (règle CLAUDE.md). Les étapes « Commit » sont fournies mais à déclencher sur demande. Format : `<type>(<scope>) : <message>`.
+
+---
+
+### Task 1 : Clés i18n
+
+**Files:**
+- Modify: `frontend/i18n/locales/fr.json` (objet `absences.admin`)
+
+- [ ] **Step 1 : Ajouter l'onglet et le bloc `employees`**
+
+Dans `absences.admin`, ajouter `"employees"` à `tabs`, et un nouveau bloc `employees`. Repérer le bloc existant :
+
+```json
+"tabs": { "requests": "Demandes", "calendar": "Calendrier", "balances": "Soldes" },
+```
+
+le remplacer par :
+
+```json
+"tabs": { "requests": "Demandes", "calendar": "Calendrier", "balances": "Soldes", "employees": "Employés" },
+```
+
+puis ajouter, à la suite des clés de `admin` (par ex. après `"adjust"`), le bloc :
+
+```json
+"employees": {
+    "columns": {
+        "name": "Nom",
+        "contract": "Contrat",
+        "cpTaken": "CP pris",
+        "cpRemaining": "CP restants"
+    },
+    "empty": "Aucun employé. Cochez « Employé » sur un utilisateur dans l'administration.",
+    "noContract": "—",
+    "drawer": {
+        "title": "Informations employé",
+        "save": "Enregistrer"
+    },
+    "fields": {
+        "hireDate": "Date d'embauche",
+        "endDate": "Date de sortie",
+        "contractType": "Type de contrat",
+        "familySituation": "Situation familiale",
+        "workTimeRatio": "Temps de travail (ex : 1.0)",
+        "annualLeaveDays": "CP annuels (jours)",
+        "referencePeriodStart": "Début période réf. (MM-DD)",
+        "initialLeaveBalance": "Solde CP initial",
+        "nbChildren": "Nombre d'enfants"
+    },
+    "contract": {
+        "cdi": "CDI",
+        "cdd": "CDD",
+        "stage": "Stage",
+        "alternance": "Alternance",
+        "autre": "Autre"
+    },
+    "family": {
+        "celibataire": "Célibataire",
+        "marie": "Marié(e)",
+        "pacse": "Pacsé(e)",
+        "divorce": "Divorcé(e)",
+        "veuf": "Veuf(ve)"
+    }
+}
+```
+
+- [ ] **Step 2 : Vérifier la validité JSON**
+
+Run: `cd frontend && python3 -c "import json; json.load(open('i18n/locales/fr.json')); print('OK')"`
+Expected: `OK`
+
+- [ ] **Step 3 : Commit** (sur feu vert utilisateur)
+
+```bash
+git add frontend/i18n/locales/fr.json
+git commit -m "feat(absences) : clés i18n onglet et drawer employés"
+```
+
+---
+
+### Task 2 : Composant `EmployeeDrawer.vue`
+
+**Files:**
+- Create: `frontend/components/absence/EmployeeDrawer.vue`
+
+- [ ] **Step 1 : Créer le composant**
+
+Crée `frontend/components/absence/EmployeeDrawer.vue` avec ce contenu exact :
+
+```vue
+<template>
+    <MalioDrawer v-model="open" drawer-class="max-w-lg">
+        <template #header>
+            <div>
+                <h2 class="text-xl font-bold">{{ $t('absences.admin.employees.drawer.title') }}</h2>
+                <p v-if="user" class="text-sm text-neutral-500">{{ user.username }}</p>
+            </div>
+        </template>
+        <form v-if="user" class="grid grid-cols-1 gap-4 sm:grid-cols-2" @submit.prevent="save">
+            <MalioDate
+                v-model="form.hireDate"
+                :label="$t('absences.admin.employees.fields.hireDate')"
+                group-class="w-full"
+            />
+            <MalioDate
+                v-model="form.endDate"
+                :label="$t('absences.admin.employees.fields.endDate')"
+                group-class="w-full"
+            />
+            <MalioSelect
+                v-model="form.contractType"
+                :label="$t('absences.admin.employees.fields.contractType')"
+                :options="contractOptions"
+                empty-option-label="—"
+                group-class="w-full"
+            />
+            <MalioSelect
+                v-model="form.familySituation"
+                :label="$t('absences.admin.employees.fields.familySituation')"
+                :options="familyOptions"
+                empty-option-label="—"
+                group-class="w-full"
+            />
+            <MalioInputText
+                v-model="form.workTimeRatio"
+                :label="$t('absences.admin.employees.fields.workTimeRatio')"
+                input-class="w-full"
+            />
+            <MalioInputText
+                v-model="form.annualLeaveDays"
+                :label="$t('absences.admin.employees.fields.annualLeaveDays')"
+                input-class="w-full"
+            />
+            <MalioInputText
+                v-model="form.referencePeriodStart"
+                :label="$t('absences.admin.employees.fields.referencePeriodStart')"
+                input-class="w-full"
+            />
+            <MalioInputText
+                v-model="form.initialLeaveBalance"
+                :label="$t('absences.admin.employees.fields.initialLeaveBalance')"
+                input-class="w-full"
+            />
+            <MalioInputText
+                v-model="form.nbChildren"
+                :label="$t('absences.admin.employees.fields.nbChildren')"
+                input-class="w-full"
+            />
+
+            <div class="col-span-full mt-2 flex justify-end">
+                <MalioButton
+                    :label="$t('absences.admin.employees.drawer.save')"
+                    button-class="w-auto px-6"
+                    :disabled="submitting"
+                    @click="save"
+                />
+            </div>
+        </form>
+    </MalioDrawer>
+</template>
+
+<script setup lang="ts">
+import type { ContractType, FamilySituation, UserData } from '~/services/dto/user-data'
+import { useUserService } from '~/services/users'
+
+const props = defineProps<{
+    modelValue: boolean
+    user: UserData | null
+}>()
+
+const emit = defineEmits<{
+    'update:modelValue': [value: boolean]
+    'saved': []
+}>()
+
+const { t } = useI18n()
+const { update } = useUserService()
+
+const open = computed({
+    get: () => props.modelValue,
+    set: (v) => emit('update:modelValue', v),
+})
+
+const submitting = ref(false)
+
+const contractOptions = [
+    { label: t('absences.admin.employees.contract.cdi'), value: 'CDI' },
+    { label: t('absences.admin.employees.contract.cdd'), value: 'CDD' },
+    { label: t('absences.admin.employees.contract.stage'), value: 'STAGE' },
+    { label: t('absences.admin.employees.contract.alternance'), value: 'ALTERNANCE' },
+    { label: t('absences.admin.employees.contract.autre'), value: 'AUTRE' },
+]
+
+const familyOptions = [
+    { label: t('absences.admin.employees.family.celibataire'), value: 'CELIBATAIRE' },
+    { label: t('absences.admin.employees.family.marie'), value: 'MARIE' },
+    { label: t('absences.admin.employees.family.pacse'), value: 'PACSE' },
+    { label: t('absences.admin.employees.family.divorce'), value: 'DIVORCE' },
+    { label: t('absences.admin.employees.family.veuf'), value: 'VEUF' },
+]
+
+const form = reactive({
+    hireDate: null as string | null,
+    endDate: null as string | null,
+    contractType: null as ContractType | null,
+    familySituation: null as FamilySituation | null,
+    workTimeRatio: '1.0',
+    annualLeaveDays: '25',
+    referencePeriodStart: '06-01',
+    initialLeaveBalance: '0',
+    nbChildren: '0',
+})
+
+function hydrate(u: UserData | null) {
+    if (!u) return
+    form.hireDate = u.hireDate ? u.hireDate.slice(0, 10) : null
+    form.endDate = u.endDate ? u.endDate.slice(0, 10) : null
+    form.contractType = u.contractType ?? null
+    form.familySituation = u.familySituation ?? null
+    form.workTimeRatio = String(u.workTimeRatio ?? 1)
+    form.annualLeaveDays = String(u.annualLeaveDays ?? 25)
+    form.referencePeriodStart = u.referencePeriodStart ?? '06-01'
+    form.initialLeaveBalance = String(u.initialLeaveBalance ?? 0)
+    form.nbChildren = String(u.nbChildren ?? 0)
+}
+
+watch(() => props.modelValue, (isOpen) => {
+    if (isOpen) hydrate(props.user)
+})
+
+async function save() {
+    if (!props.user) return
+    submitting.value = true
+    try {
+        await update(props.user.id, {
+            isEmployee: true,
+            hireDate: form.hireDate || null,
+            endDate: form.endDate || null,
+            contractType: form.contractType,
+            familySituation: form.familySituation,
+            workTimeRatio: Number(form.workTimeRatio) || 1,
+            annualLeaveDays: Number(form.annualLeaveDays) || 0,
+            referencePeriodStart: form.referencePeriodStart || '06-01',
+            initialLeaveBalance: Number(form.initialLeaveBalance) || 0,
+            nbChildren: Number(form.nbChildren) || 0,
+        })
+        emit('saved')
+        open.value = false
+    } finally {
+        submitting.value = false
+    }
+}
+</script>
+```
+
+- [ ] **Step 2 : Vérifier la compilation**
+
+Le serveur dev (`http://localhost:3002`) recompile à la sauvegarde. Vérifier qu'aucune erreur de compilation/HMR n'apparaît dans la console du terminal `make dev-nuxt` ni dans la console navigateur. (Le composant n'est pas encore monté ; cette étape ne fait que valider la syntaxe.)
+
+- [ ] **Step 3 : Commit** (sur feu vert utilisateur)
+
+```bash
+git add frontend/components/absence/EmployeeDrawer.vue
+git commit -m "feat(absences) : drawer d'édition des informations employé"
+```
+
+---
+
+### Task 3 : Onglet « Employés » dans `team-absences`
+
+**Files:**
+- Modify: `frontend/pages/team-absences.vue`
+
+- [ ] **Step 1 : Ajouter l'import du service users et le type**
+
+Après les imports existants (`useAbsenceHelpers`), ajouter :
+
+```ts
+import { useUserService } from "~/services/users";
+import type { UserData } from "~/services/dto/user-data";
+```
+
+Et après la déclaration `type BalanceRow = ...`, ajouter le type de ligne :
+
+```ts
+type EmployeeRow = UserData & {
+    contractText: string;
+    cpTakenText: string;
+    cpRemainingText: string;
+};
+```
+
+- [ ] **Step 2 : Ajouter l'onglet à `tabs`**
+
+Remplacer le tableau `tabs` (qui se termine par l'onglet `balances`) en ajoutant l'entrée employés :
+
+```ts
+const tabs = [
+    {
+        key: "requests",
+        label: t("absences.admin.tabs.requests"),
+        icon: "mdi:format-list-bulleted",
+    },
+    {
+        key: "calendar",
+        label: t("absences.admin.tabs.calendar"),
+        icon: "mdi:calendar-month",
+    },
+    {
+        key: "balances",
+        label: t("absences.admin.tabs.balances"),
+        icon: "mdi:scale-balance",
+    },
+    {
+        key: "employees",
+        label: t("absences.admin.tabs.employees"),
+        icon: "mdi:account-group",
+    },
+];
+```
+
+- [ ] **Step 3 : Ajouter l'état, les colonnes et les lignes de l'onglet**
+
+Après `const balances = ref<AbsenceBalance[]>([]);`, ajouter :
+
+```ts
+const employees = ref<UserData[]>([]);
+const employeeDrawerOpen = ref(false);
+const selectedEmployee = ref<UserData | null>(null);
+```
+
+Après `const balanceRows = computed(...)`, ajouter colonnes + lignes :
+
+```ts
+const employeeColumns = [
+    { key: "username", label: t("absences.admin.employees.columns.name") },
+    { key: "contractText", label: t("absences.admin.employees.columns.contract") },
+    { key: "cpTakenText", label: t("absences.admin.employees.columns.cpTaken") },
+    { key: "cpRemainingText", label: t("absences.admin.employees.columns.cpRemaining") },
+];
+
+const employeeRows = computed<EmployeeRow[]>(() => {
+    // Map user.id -> solde CP de la période courante.
+    const cpByUser = new Map<number, AbsenceBalance>();
+    for (const b of balances.value) {
+        if (b.type === "cp") cpByUser.set(b.user.id, b);
+    }
+    const dash = t("absences.admin.employees.noContract");
+    return employees.value.map((u) => {
+        const cp = cpByUser.get(u.id);
+        return {
+            ...u,
+            contractText: u.contractType ?? dash,
+            cpTakenText: cp ? formatDays(cp.taken) : dash,
+            cpRemainingText: cp ? formatDays(cp.available) : dash,
+        };
+    });
+});
+```
+
+- [ ] **Step 4 : Ajouter le chargement et l'ouverture du drawer**
+
+Après `async function loadBalances() {...}`, ajouter :
+
+```ts
+async function loadEmployees() {
+    const all = await useUserService().getAll();
+    employees.value = all.filter((u) => u.isEmployee);
+}
+
+function openEmployee(item: Record<string, unknown>) {
+    selectedEmployee.value = item as EmployeeRow;
+    employeeDrawerOpen.value = true;
+}
+```
+
+Puis inclure `loadEmployees()` au montage. Remplacer le `onMounted` existant :
+
+```ts
+onMounted(async () => {
+    await Promise.all([reloadRequests(), loadBalances()]);
+});
+```
+
+par :
+
+```ts
+onMounted(async () => {
+    await Promise.all([reloadRequests(), loadBalances(), loadEmployees()]);
+});
+```
+
+- [ ] **Step 5 : Ajouter le slot d'onglet dans le template**
+
+Juste après la fermeture du slot `</template>` de l'onglet `#balances` (avant `</MalioTabList>`), ajouter :
+
+```vue
+            <!-- Employees -->
+            <template #employees>
+                <div class="min-h-[30rem] pt-10">
+                    <MalioDataTable
+                        :columns="employeeColumns"
+                        :items="employeeRows"
+                        :total-items="employeeRows.length"
+                        :empty-message="$t('absences.admin.employees.empty')"
+                        @row-click="openEmployee"
+                    />
+                </div>
+            </template>
+```
+
+- [ ] **Step 6 : Monter le drawer employé**
+
+Après le composant `<AbsenceBalanceAdjustDrawer ... />` (avant `</div>` de fin de template), ajouter :
+
+```vue
+        <EmployeeDrawer
+            v-model="employeeDrawerOpen"
+            :user="selectedEmployee"
+            @saved="loadEmployees"
+        />
+```
+
+- [ ] **Step 7 : Vérification navigateur**
+
+Aller sur `http://localhost:3002/team-absences`, onglet « Employés ». Vérifier : liste des users `isEmployee` avec Nom / Contrat / CP pris / CP restants ; clic sur une ligne ouvre le drawer ; aucune erreur console.
+
+- [ ] **Step 8 : Commit** (sur feu vert utilisateur)
+
+```bash
+git add frontend/pages/team-absences.vue
+git commit -m "feat(absences) : onglet Employés (liste + ouverture drawer)"
+```
+
+---
+
+### Task 4 : Allègement du `UserDrawer`
+
+**Files:**
+- Modify: `frontend/components/user/UserDrawer.vue`
+
+- [ ] **Step 1 : Réduire le bloc RH du template à la seule case**
+
+Remplacer le bloc (lignes ~74-107) :
+
+```vue
+            <!-- RH / Absences -->
+            <div class="mt-6 border-t border-neutral-200 pt-4">
+                <MalioCheckbox v-model="form.isEmployee" label="Employé (soumis à la gestion des absences)" />
+
+                <div v-if="form.isEmployee" class="mt-4 grid grid-cols-1 gap-3 sm:grid-cols-2">
+                    <!-- ... tous les champs détaillés ... -->
+                </div>
+            </div>
+```
+
+par :
+
+```vue
+            <!-- RH / Absences -->
+            <div class="mt-6 border-t border-neutral-200 pt-4">
+                <MalioCheckbox v-model="form.isEmployee" label="Employé (soumis à la gestion des absences)" />
+                <p v-if="form.isEmployee" class="mt-2 text-xs text-neutral-500">
+                    Les informations RH (contrat, dates, CP…) se gèrent dans Absences équipe → onglet Employés.
+                </p>
+            </div>
+```
+
+- [ ] **Step 2 : Nettoyer l'état du formulaire**
+
+Dans `const form = reactive({...})`, supprimer les champs détaillés et ne garder que `isEmployee`. Résultat :
+
+```ts
+const form = reactive({
+    username: '',
+    password: '',
+    roles: [] as string[],
+    clientId: null as number | null,
+    allowedProjectIds: [] as number[],
+    isEmployee: false,
+})
+```
+
+- [ ] **Step 3 : Nettoyer l'hydratation à l'ouverture**
+
+Dans le `watch(() => props.modelValue, ...)`, supprimer toutes les lignes `form.hireDate = ...` → `form.nbChildren = ...` des deux branches (`props.item` et `else`). Conserver `form.isEmployee = props.item.isEmployee ?? false` (branche édition) et `form.isEmployee = false` (branche création).
+
+- [ ] **Step 4 : Ne plus envoyer les champs détaillés dans le payload**
+
+Dans `handleSubmit`, réduire le `payload` aux champs de compte + `isEmployee` :
+
+```ts
+        const payload: UserWrite = {
+            username: form.username.trim(),
+            roles: form.roles,
+            client: form.clientId !== null ? `/api/clients/${form.clientId}` : null,
+            allowedProjects: form.clientId !== null
+                ? form.allowedProjectIds.map((id) => `/api/projects/${id}`)
+                : [],
+            isEmployee: form.isEmployee,
+        }
+        if (form.password) {
+            payload.plainPassword = form.password
+        }
+```
+
+- [ ] **Step 5 : Supprimer les imports/constantes devenus inutiles**
+
+Dans le `<script setup>` : supprimer `contractOptions` et `familyOptions` (constantes locales) ; retirer `ContractType, FamilySituation` de l'import `~/services/dto/user-data` (garder `UserData, UserWrite`). Vérifier qu'aucune autre référence ne subsiste.
+
+Run: `cd frontend && grep -n "contractOptions\|familyOptions\|ContractType\|FamilySituation\|hireDate\|nbChildren" components/user/UserDrawer.vue`
+Expected: aucune ligne (sortie vide).
+
+- [ ] **Step 6 : Vérification navigateur**
+
+Aller sur `http://localhost:3002/admin`, ouvrir un utilisateur. Vérifier : seule la case « Employé » + la note ; cocher/décocher et enregistrer fonctionne ; rouvrir un employé déjà renseigné depuis l'onglet Employés → ses champs RH sont intacts (non écrasés par l'enregistrement du UserDrawer). Aucune erreur console.
+
+- [ ] **Step 7 : Commit** (sur feu vert utilisateur)
+
+```bash
+git add frontend/components/user/UserDrawer.vue
+git commit -m "refactor(users) : UserDrawer ne gère plus que le flag Employé"
+```
+
+---
+
+### Task 5 : Vérification de bout en bout
+
+**Files:** aucun (vérification navigateur via Chrome DevTools MCP)
+
+- [ ] **Step 1 : Flux complet**
+
+1. `admin` → ouvrir un user non-employé → cocher « Employé » → enregistrer.
+2. `team-absences` → onglet « Employés » → l'utilisateur apparaît.
+3. Clic sur sa ligne → `EmployeeDrawer` s'ouvre → renseigner dates (JJ/MM/AAAA), contrat, CP annuels → enregistrer.
+4. La liste se recharge ; rouvrir la ligne → valeurs persistées.
+5. Retour `admin` sur le même user → seule la case « Employé » (toujours cochée), pas de champ RH.
+
+- [ ] **Step 2 : Contrôle console**
+
+Vérifier l'absence d'erreurs/warnings Vue sur les trois écrans (admin, onglet Employés, drawer).
+
+- [ ] **Step 3 : Commit final éventuel** (sur feu vert utilisateur)
+
+Si des ajustements ont été faits pendant la vérification, les committer avec un message approprié.
+
+---
+
+## Self-review (couverture du spec)
+
+- UserDrawer réduit à la case « Employé » → Task 4. ✅
+- Onglet « Employés » admin-only (page déjà `middleware: ["admin"]`) → Task 3. ✅
+- Liste Nom · Contrat · CP pris · CP restants (users ⋈ soldes cp) → Task 3 (Steps 3-5). ✅
+- Drawer d'édition en composants Malio (MalioDate/MalioSelect/MalioInputText) → Task 2. ✅
+- Persistance via `usersService.update` (PATCH partiel) → Task 2 (Step 1, `save`). ✅
+- i18n regroupé sous `absences.admin.employees.*` + onglet → Task 1. ✅
+- Pas de placeholder, types cohérents (`EmployeeRow`, `UserData`, `ContractType`/`FamilySituation`), noms de méthodes alignés (`loadEmployees`, `openEmployee`, `save`). ✅
diff --git a/docs/superpowers/specs/2026-05-21-absence-request-form-redesign-design.md b/docs/superpowers/specs/2026-05-21-absence-request-form-redesign-design.md
new file mode 100644
index 0000000..1671018
--- /dev/null
+++ b/docs/superpowers/specs/2026-05-21-absence-request-form-redesign-design.md
@@ -0,0 +1,119 @@
+# Refonte UX du formulaire « Nouvelle demande d'absence »
+
+Date : 2026-05-21
+Composant : `frontend/components/absence/AbsenceRequestDrawer.vue`
+Branche : `feat/absence-management`
+
+## Contexte & problème
+
+Le formulaire actuel fonctionne mais est inutilisable côté UX :
+
+- `VueDatePicker` brut **non thématisé** (couleur violette par défaut, calendrier au rendu anglo-saxon / semaine au dimanche) → aspect « cassé », rien à voir avec PayFit.
+- `<label>` et `<input type="file">` bruts au lieu des composants Malio.
+- **Aucune erreur explicite** : le bouton « Valider » est simplement grisé via `canSubmit` quand un champ manque, sans dire pourquoi.
+- `preview` qui échoue en silence (`catch { preview.value = null }`).
+- Solde insuffisant signalé par un simple warning ambre.
+
+Cible : reproduire l'ergonomie PayFit (référence fournie par l'utilisateur) — apparition progressive des champs, deux champs date saisissables + popup, pills de demi-journée, lignes de solde, erreurs explicites.
+
+## Objectifs
+
+1. Look & ergonomie alignés sur PayFit, cohérents avec le design system Malio.
+2. Apparition **progressive** des champs au fil des choix.
+3. **Erreurs explicites** par champ, affichées au clic « Valider », qui se vident dès correction.
+4. Champs de date en français `JJ / MM / AAAA`, calendrier FR / semaine au lundi.
+5. Justificatif via `MalioInputUpload`, affiché seulement si le type l'exige.
+
+## Hors périmètre
+
+- Aucun changement backend : payload (`AbsenceRequestWrite`), endpoints `create` / `preview` / `uploadJustification` inchangés.
+- Aucune modification des autres composants du module (traités séparément dans les points #2 à #7 de la revue).
+
+## Layout cible (drawer `max-w-xl`, 1 colonne, apparition progressive)
+
+**Étape 1 — toujours visible**
+- `Type d'absence` : `MalioSelect` (options = policies actives). Erreur inline si vide au submit.
+
+**Étape 2 — apparaît dès qu'un type est choisi**
+- `Date de début` : champ texte `JJ / MM / AAAA` saisissable + icône calendrier (popup) + bouton effacer. `VueDatePicker` mono-date, thématisé (voir ci-dessous).
+- Pills demi-journée début : `Journée entière` | `Matin` | `Après-midi` (défaut : Journée entière).
+- Ligne `Solde au <date début> : X jours` (valeur = `preview.available`, alignée à droite, **non repliable**).
+
+**Étape 3 — apparaît dès que la date de début est renseignée**
+- `Date de fin` : même composant que la date de début.
+- Pills demi-journée fin : `Journée entière` | `Matin` (défaut : Journée entière).
+- Ligne `Durée de la demande : N jours` (valeur = `preview.countedDays`).
+- Ligne `Solde après validation : Y jours` (valeur = `preview.projectedAvailable`, non repliable). Si `< 0` → bandeau ambre **non bloquant** « solde après = … j, demande soumise pour validation ».
+
+**Étape 4**
+- `Justificatif` : `MalioInputUpload`, affiché **uniquement si** `selectedPolicy.justificationRequired`. Label avec `*`. Erreur inline si requis et absent.
+- `Commentaire` (optionnel) : `MalioInputTextArea`, placeholder « Écrire un commentaire… ».
+
+**Footer**
+- `[ Annuler (tertiary) ] [ Valider (primary) ]`, bouton **toujours actif**.
+
+## Datepicker — thématisation
+
+Reprendre le pattern de `frontend/components/ui/DateFilter.vue` :
+
+- `VueDatePicker` mono-date, `:enable-time-picker="false"`, `auto-apply`, `text-input` activé (saisie clavier), `format` → `JJ/MM/AAAA`.
+- `locale="fr"` (chaîne) + semaine au lundi (`week-start: 1`).
+- Variables CSS `--dp-primary-color: #222783`, `--dp-border-color`, `--dp-hover-color`, `--dp-font-size`, `font-family: inherit` (scopées au composant).
+- `:min-date` sur la date de fin = date de début ; `:max-date` sur la date de début = date de fin.
+
+## Pills demi-journée → payload
+
+Segment de boutons (style pill, bordure + fond bleu primaire quand sélectionné).
+
+| Pill début | `startHalfDay` | Pill fin | `endHalfDay` |
+|------------|----------------|----------|--------------|
+| Journée entière | `null` | Journée entière | `null` |
+| Matin | `matin` | Matin | `matin` |
+| Après-midi | `apres_midi` | — | — |
+
+Cas particulier — **demande sur une seule journée** (`startDate == endDate`) : seules les pills de début sont pertinentes (`Journée entière` / `Matin` / `Après-midi`) ; les pills de fin sont masquées et `endHalfDay` recopie `startHalfDay`. Le décompte reste calculé par `preview` côté backend.
+
+## Validation
+
+État réactif `errors: { type?: string; startDate?: string; endDate?: string; justification?: string }`.
+
+`validate()` (au clic « Valider ») remplit `errors` :
+- `type` manquant → `absences.form.errors.typeRequired`
+- `startDate` manquante → `absences.form.errors.startRequired`
+- `endDate` manquante → `absences.form.errors.endRequired`
+- `endDate < startDate` → `absences.form.errors.endBeforeStart`
+- `preview.countedDays <= 0` → `absences.form.errors.zeroDays`
+- justificatif requis et absent → `absences.form.errors.justificationRequired`
+
+Si `errors` non vide → on stoppe la soumission. Des `watch` vident chaque message dès que le champ correspondant redevient valide.
+
+Le solde insuffisant **n'est pas** une erreur bloquante (seul le bandeau ambre).
+
+### Erreurs serveur
+- `service.create` / `uploadJustification` : le toast d'erreur de `useApi` reste ; en plus, un bandeau d'erreur en tête de formulaire affiche le message renvoyé (422 de validation).
+- `preview` : conserver le `catch` pour les coupures réseau, mais ne plus masquer une erreur de validation de période (afficher le message si l'API en renvoie un).
+
+## Calcul live (preview)
+
+Inchangé sur le principe : `watch` debouncé (300 ms) sur `[type, startDate, endDate, startHalfDay, endHalfDay]` → `service.preview(payload)`. Les lignes de solde et de durée se mettent à jour à partir du résultat (`available`, `countedDays`, `projectedAvailable`).
+
+## i18n
+
+Nouvelles clés sous `absences.form.errors.*` dans `frontend/i18n/locales/fr.json` :
+`typeRequired`, `startRequired`, `endRequired`, `endBeforeStart`, `zeroDays`, `justificationRequired`, plus `absences.form.balanceAt` (« Solde au {date} ») et `absences.form.duration` (« Durée de la demande »).
+
+## Découpage du composant
+
+`AbsenceRequestDrawer.vue` orchestre l'état du formulaire. Pour garder le fichier focalisé, extraire :
+- `AbsenceDateField.vue` : champ date thématisé + pills demi-journée (props : `modelValue`, `halfValue`, `halfOptions`, `label`, `error`, `min`/`max`).
+
+Le reste (lignes de solde, bandeau, footer) reste inline dans le drawer.
+
+## Critères d'acceptation
+
+- Au chargement, seul « Type d'absence » est visible ; les sections suivantes apparaissent au fur et à mesure.
+- Les dates s'affichent et se saisissent en `JJ / MM / AAAA`, calendrier en français, semaine au lundi, thème bleu primaire.
+- Cliquer « Valider » sans remplir → messages d'erreur explicites sous les champs concernés ; ils disparaissent dès correction.
+- Un type à justificatif obligatoire affiche le champ d'upload et bloque la soumission tant qu'aucun fichier n'est fourni.
+- Une période dépassant le solde affiche le bandeau ambre mais reste soumissible.
+- Le payload envoyé au backend est identique à l'actuel.
diff --git a/docs/superpowers/specs/2026-05-22-employee-management-reorg-design.md b/docs/superpowers/specs/2026-05-22-employee-management-reorg-design.md
new file mode 100644
index 0000000..7929783
--- /dev/null
+++ b/docs/superpowers/specs/2026-05-22-employee-management-reorg-design.md
@@ -0,0 +1,96 @@
+# Réorganisation de la gestion des employés (module Absences)
+
+Date : 2026-05-22
+Branche : `feat/absence-management`
+Statut : design approuvé, prêt pour plan d'implémentation
+
+## Contexte
+
+Aujourd'hui, le `UserDrawer` (admin → utilisateurs) porte deux responsabilités mélangées :
+
+1. l'administration du compte (nom, mot de passe, rôles, client, projets) ;
+2. **tout le détail RH/employé** : case « Employé » + un bloc de champs (date d'embauche, date de sortie, type de contrat, situation familiale, temps de travail, CP annuels, début de période de référence, solde CP initial, nombre d'enfants).
+
+Ces champs existent déjà sur l'entité `User` (backend) et dans le DTO `UserData`/`UserWrite` (frontend). La persistance se fait via l'API user (`PATCH /api/users/{id}`).
+
+On veut séparer ces deux préoccupations : le `UserDrawer` ne décide plus que **si un utilisateur est un employé** ; l'édition des informations RH se fait dans un espace dédié, dans le module Absences.
+
+## Objectifs
+
+- `UserDrawer` : ne conserver que la case à cocher « Employé ».
+- `team-absences` : ajouter un onglet « Employés » (la page est déjà `middleware: ["admin"]`, donc admin-only).
+- L'onglet liste les utilisateurs marqués `isEmployee` avec leurs soldes de congés.
+- Un drawer dédié permet d'éditer les informations RH d'un employé.
+
+Hors périmètre : création d'utilisateur (reste dans l'admin), modification du flag `isEmployee` ailleurs que dans le `UserDrawer`, backend (déjà en place).
+
+## Composants
+
+### 1. `frontend/components/user/UserDrawer.vue`
+
+- Supprimer le bloc détaillé employé (`hireDate`, `endDate`, `contractType`, `familySituation`, `workTimeRatio`, `annualLeaveDays`, `referencePeriodStart`, `initialLeaveBalance`, `nbChildren`).
+- Conserver **uniquement** la case `isEmployee` (« Employé (soumis à la gestion des absences) »).
+- Le payload de sauvegarde du user **n'envoie plus** les champs détaillés, pour ne pas les écraser. Il continue d'envoyer `isEmployee` et les champs de compte existants.
+- Nettoyer l'état du formulaire et les imports devenus inutiles (options contrat / situation familiale si elles ne servent plus que là).
+
+### 2. `frontend/pages/team-absences.vue` — onglet « Employés »
+
+- Ajouter un 4ᵉ onglet dans `tabs` : `{ key: 'employees', label: t('absences.admin.tabs.employees'), icon: 'mdi:account-group' }`.
+- Slot `#employees` : `MalioDataTable` avec les colonnes **Nom · Contrat · CP pris · CP restants**.
+- Clic sur une ligne → ouvre `EmployeeDrawer` avec l'utilisateur sélectionné (cohérent avec l'onglet Demandes qui ouvre le détail au clic ligne).
+- Chargement des données :
+  - `usersService.getAll()` filtré sur `isEmployee === true` ;
+  - `absenceService.getBalances({ type: 'cp' })` → map par `user.id` pour récupérer `taken` (CP pris) et `available` (CP restants) ;
+  - fusion en lignes de tableau (`taken`/`available` à `—` si pas de solde CP pour l'employé).
+- Recharger la liste après `saved` du drawer.
+
+### 3. `frontend/components/absence/EmployeeDrawer.vue` (nouveau)
+
+- Props : `modelValue: boolean`, `user: UserData | null`.
+- Events : `update:modelValue`, `saved`.
+- Formulaire en **composants Malio** :
+  - `MalioDate` : `hireDate`, `endDate` (valeurs ISO `YYYY-MM-DD`) ;
+  - `MalioSelect` : `contractType` (CDI/CDD/Stage/Alternance/Autre), `familySituation` (Célibataire/Marié/Pacsé/Divorcé/Veuf) ;
+  - `MalioInputText` : `workTimeRatio`, `annualLeaveDays`, `referencePeriodStart` (MM-DD), `initialLeaveBalance`, `nbChildren`.
+- À l'ouverture, initialiser le formulaire depuis `props.user` ; remettre à jour si `user` change.
+- Sauvegarde : `usersService.update(user.id, { …champs employé })` ; à la réussite, émettre `saved` et fermer.
+- En-tête : nom de l'employé.
+
+### 4. i18n (`frontend/i18n/locales/fr.json`)
+
+Nouvelles clés regroupées sous `absences.admin.employees.*` (et l'onglet sous `absences.admin.tabs.employees`) :
+- onglet : `absences.admin.tabs.employees` = « Employés » ;
+- colonnes liste : `absences.admin.employees.columns.{name,contract,cpTaken,cpRemaining}` ;
+- drawer : `absences.admin.employees.drawer.title` + libellés de champs sous `absences.admin.employees.fields.*`.
+
+Les libellés de contrat et de situation familiale (CDI/CDD/…, Célibataire/Marié/…) actuellement codés en dur dans `UserDrawer` sont déplacés avec leur drawer ; on les passe en clés i18n à cette occasion.
+
+## Flux de données
+
+```
+UserDrawer  --PATCH isEmployee-->  User (backend)
+                                      |
+team-absences (onglet Employés)       |
+   getAll() ∩ isEmployee  <-----------+
+   getBalances({type:'cp'})  --> map user.id -> {taken, available}
+   => lignes tableau (nom, contrat, CP pris, CP restants)
+        |
+        clic ligne
+        v
+EmployeeDrawer(user)  --usersService.update--> User (backend)
+        |
+        @saved --> recharge liste
+```
+
+## Découpage / responsabilités
+
+- `UserDrawer` : compte + flag employé. Ne connaît plus le détail RH.
+- Onglet Employés : vue dérivée en lecture (jointure users ⋈ soldes), aiguille vers le drawer.
+- `EmployeeDrawer` : seule unité qui édite les champs RH ; interface claire (`user` en entrée, `saved` en sortie), testable isolément.
+
+## Vérification
+
+- `UserDrawer` : ouvrir un user, vérifier qu'il ne reste que la case « Employé », cocher/décocher et sauvegarder sans perte des autres champs RH (qui ne sont plus envoyés).
+- Onglet Employés : la liste affiche les users `isEmployee` avec CP pris/restants cohérents avec l'onglet Soldes.
+- `EmployeeDrawer` : éditer un employé (dates en JJ/MM/AAAA, selects FR), sauvegarder, vérifier la persistance (recharge) et l'absence d'erreurs console.
+- Vérification navigateur via Chrome DevTools sur les trois écrans.
diff --git a/frontend/components/absence/AbsenceBalanceAdjustDrawer.vue b/frontend/components/absence/AbsenceBalanceAdjustDrawer.vue
new file mode 100644
index 0000000..d85d9a0
--- /dev/null
+++ b/frontend/components/absence/AbsenceBalanceAdjustDrawer.vue
@@ -0,0 +1,69 @@
+<template>
+    <MalioDrawer v-model="open" drawer-class="max-w-md">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ $t('absences.admin.adjust.title') }}</h2>
+        </template>
+        <div v-if="balance" class="flex flex-col gap-4">
+            <p class="text-sm text-neutral-600">
+                {{ balance.user.username }} · {{ balance.label }} · {{ balance.period }}
+            </p>
+            <MalioInputNumber v-model="acquired" :label="$t('absences.admin.adjust.acquired')" />
+            <MalioInputNumber v-model="acquiring" :label="$t('absences.admin.adjust.acquiring')" />
+            <MalioInputNumber v-model="taken" :label="$t('absences.admin.adjust.taken')" />
+            <div class="flex justify-end gap-2 pt-2">
+                <MalioButton :label="$t('common.cancel')" variant="tertiary" @click="open = false" />
+                <MalioButton :label="$t('absences.admin.adjust.save')" :disabled="submitting" @click="submit" />
+            </div>
+        </div>
+    </MalioDrawer>
+</template>
+
+<script setup lang="ts">
+import type { AbsenceBalance } from '~/services/dto/absence'
+import { useAbsenceService } from '~/services/absences'
+
+const props = defineProps<{
+    modelValue: boolean
+    balance: AbsenceBalance | null
+}>()
+
+const emit = defineEmits<{
+    'update:modelValue': [value: boolean]
+    'adjusted': []
+}>()
+
+const service = useAbsenceService()
+
+const open = computed({
+    get: () => props.modelValue,
+    set: (v) => emit('update:modelValue', v),
+})
+
+// MalioInputNumber works with string values (v-model is string | null).
+const acquired = ref('0')
+const acquiring = ref('0')
+const taken = ref('0')
+const submitting = ref(false)
+
+watch(() => props.balance, (b) => {
+    acquired.value = String(b?.acquired ?? 0)
+    acquiring.value = String(b?.acquiring ?? 0)
+    taken.value = String(b?.taken ?? 0)
+}, { immediate: true })
+
+async function submit() {
+    if (!props.balance) return
+    submitting.value = true
+    try {
+        await service.adjustBalance(props.balance.id, {
+            acquired: Number(acquired.value) || 0,
+            acquiring: Number(acquiring.value) || 0,
+            taken: Number(taken.value) || 0,
+        })
+        emit('adjusted')
+        open.value = false
+    } finally {
+        submitting.value = false
+    }
+}
+</script>
diff --git a/frontend/components/absence/AbsenceBalanceCards.vue b/frontend/components/absence/AbsenceBalanceCards.vue
new file mode 100644
index 0000000..4d831d8
--- /dev/null
+++ b/frontend/components/absence/AbsenceBalanceCards.vue
@@ -0,0 +1,119 @@
+<template>
+    <div>
+        <div v-if="balances.length === 0" class="rounded-lg border border-neutral-200 bg-neutral-50 px-4 py-6 text-center text-sm text-neutral-500">
+            {{ $t('absences.noBalance') }}
+        </div>
+
+        <div v-else class="rounded-xl border border-neutral-200 bg-white p-5 shadow-sm">
+            <!-- Primary balance, highlighted -->
+            <div v-if="primary" class="flex items-start justify-between">
+                <div>
+                    <p class="text-sm font-medium text-neutral-500">{{ primary.label }}</p>
+                    <p class="mt-1 text-3xl font-bold text-neutral-900">
+                        {{ formatNumber(primary.available) }}
+                        <span class="text-lg font-normal text-neutral-400">/ {{ formatNumber(acquiredTotal(primary)) }}</span>
+                    </p>
+                    <p class="text-xs text-neutral-400">{{ $t('absences.remaining') }}</p>
+                </div>
+                <span
+                    class="rounded-full px-2.5 py-1 text-xs font-medium"
+                    :style="{ backgroundColor: typeColor(primary.type) + '22', color: typeColor(primary.type) }"
+                >
+                    {{ primary.period }}
+                </span>
+            </div>
+
+            <div v-if="primary" class="mt-3 h-2 w-full overflow-hidden rounded-full bg-neutral-100">
+                <div
+                    class="h-full rounded-full transition-all"
+                    :style="{ width: progress(primary) + '%', backgroundColor: typeColor(primary.type) }"
+                />
+            </div>
+
+            <!-- Acquired (N-1) vs in-progress (N), as on a French payslip -->
+            <div v-if="primary && primary.type === 'cp'" class="mt-3 grid grid-cols-2 gap-2">
+                <div class="rounded-lg bg-neutral-50 px-3 py-2">
+                    <p class="text-xs text-neutral-400">{{ $t('absences.acquiredN1') }}</p>
+                    <p class="text-sm font-semibold text-neutral-800">{{ formatNumber(primary.acquired) }}</p>
+                </div>
+                <div class="rounded-lg bg-neutral-50 px-3 py-2">
+                    <p class="text-xs text-neutral-400">{{ $t('absences.acquiringN') }}</p>
+                    <p class="text-sm font-semibold text-neutral-800">{{ formatNumber(primary.acquiring) }}</p>
+                    <p class="text-[10px] leading-tight text-neutral-400">{{ $t('absences.acquiringHint') }}</p>
+                </div>
+            </div>
+
+            <div v-if="primary" class="mt-2 flex justify-between text-xs text-neutral-500">
+                <span>{{ formatNumber(primary.taken) }} {{ $t('absences.taken') }}</span>
+                <span v-if="primary.pending > 0" class="text-amber-600">
+                    {{ formatNumber(primary.pending) }} {{ $t('absences.pending') }}
+                </span>
+            </div>
+
+            <!-- Other balances, compact rows -->
+            <div v-if="others.length" class="mt-4 flex flex-col divide-y divide-neutral-100 border-t border-neutral-100 pt-1">
+                <div
+                    v-for="balance in others"
+                    :key="balance.id"
+                    class="flex items-center justify-between py-2 text-sm"
+                >
+                    <span class="flex items-center gap-2 text-neutral-600">
+                        <span class="h-2.5 w-2.5 flex-shrink-0 rounded-full" :style="{ backgroundColor: typeColor(balance.type) }" />
+                        {{ balance.label }}
+                        <span class="text-xs text-neutral-400">{{ balance.period }}</span>
+                    </span>
+                    <span class="text-neutral-900">
+                        <span class="font-semibold">{{ formatNumber(balance.available) }}</span>
+                        <span class="text-neutral-400"> / {{ formatNumber(acquiredTotal(balance)) }}</span>
+                    </span>
+                </div>
+            </div>
+        </div>
+    </div>
+</template>
+
+<script setup lang="ts">
+import type { AbsenceBalance } from '~/services/dto/absence'
+import { useAbsenceHelpers } from '~/composables/useAbsenceHelpers'
+
+const props = defineProps<{
+    balances: AbsenceBalance[]
+}>()
+
+const { typeColor } = useAbsenceHelpers()
+
+// Current paid-leave reference period, mirroring AbsenceBalanceService::periodFor.
+const currentCpPeriod = computed<string>(() => {
+    const start = useAuthStore().user?.referencePeriodStart ?? '06-01'
+    const now = new Date()
+    const md = `${String(now.getMonth() + 1).padStart(2, '0')}-${String(now.getDate()).padStart(2, '0')}`
+    const startYear = md >= start ? now.getFullYear() : now.getFullYear() - 1
+    return `${startYear}-${startYear + 1}`
+})
+
+// The current "congés payés" balance is the headline; fall back to any CP, then any balance.
+const primary = computed<AbsenceBalance | null>(() => {
+    const cps = props.balances.filter(b => b.type === 'cp')
+    return cps.find(b => b.period === currentCpPeriod.value) ?? cps[0] ?? props.balances[0] ?? null
+})
+
+const others = computed<AbsenceBalance[]>(() =>
+    props.balances.filter(b => b.id !== primary.value?.id),
+)
+
+function formatNumber(n: number): string {
+    return (Math.round(n * 2) / 2).toString()
+}
+
+// Total entitlement = acquired (N-1) + in-progress (N); falls back to the
+// backend-computed field when present.
+function acquiredTotal(balance: AbsenceBalance): number {
+    return balance.acquiredTotal ?? balance.acquired + balance.acquiring
+}
+
+function progress(balance: AbsenceBalance): number {
+    const total = acquiredTotal(balance)
+    if (total <= 0) return 0
+    return Math.min(100, Math.max(0, (balance.taken / total) * 100))
+}
+</script>
diff --git a/frontend/components/absence/AbsenceCalendar.vue b/frontend/components/absence/AbsenceCalendar.vue
new file mode 100644
index 0000000..604bf76
--- /dev/null
+++ b/frontend/components/absence/AbsenceCalendar.vue
@@ -0,0 +1,143 @@
+<template>
+    <div class="rounded-lg border border-neutral-200 bg-white">
+        <!-- Header -->
+        <div class="flex items-center justify-between border-b border-neutral-200 px-4 py-3">
+            <button class="rounded-md p-1.5 text-neutral-500 hover:bg-neutral-100" @click="shiftMonth(-1)">
+                <Icon name="mdi:chevron-left" size="22" />
+            </button>
+            <p class="text-lg font-semibold capitalize text-neutral-900">{{ monthLabel }}</p>
+            <button class="rounded-md p-1.5 text-neutral-500 hover:bg-neutral-100" @click="shiftMonth(1)">
+                <Icon name="mdi:chevron-right" size="22" />
+            </button>
+        </div>
+
+        <!-- Weekday headers -->
+        <div class="grid grid-cols-7 border-b border-neutral-100 text-center text-xs font-medium text-neutral-400">
+            <div v-for="d in weekdays" :key="d" class="py-2">{{ d }}</div>
+        </div>
+
+        <!-- Grid -->
+        <div class="grid grid-cols-7">
+            <div
+                v-for="cell in cells"
+                :key="cell.key"
+                class="min-h-[92px] border-b border-r border-neutral-100 p-1.5"
+                :class="cell.holiday ? 'bg-amber-50' : (cell.inMonth ? 'bg-white' : 'bg-neutral-50')"
+                :title="cell.holiday ?? undefined"
+            >
+                <div class="mb-1 flex items-center gap-1">
+                    <span v-if="cell.holiday" class="flex min-w-0 flex-1 items-center gap-1 text-[10px] font-medium text-amber-700">
+                        <Icon name="mdi:star-four-points-outline" size="11" class="flex-shrink-0" />
+                        <span class="truncate">{{ cell.holiday }}</span>
+                    </span>
+                    <span v-else class="flex-1" />
+                    <span class="flex-shrink-0 text-xs" :class="cell.isToday ? 'font-bold text-orange-500' : 'text-neutral-400'">
+                        {{ cell.day }}
+                    </span>
+                </div>
+                <div class="flex flex-col gap-1">
+                    <span
+                        v-for="abs in cell.absences"
+                        :key="abs.id"
+                        class="truncate rounded px-1 py-0.5 text-[11px] font-medium text-white"
+                        :style="{ backgroundColor: abs.status === 'pending' ? typeColor(abs.type) + 'aa' : typeColor(abs.type) }"
+                        :title="`${abs.user.username} · ${abs.label} (${statusLabel(abs.status)})`"
+                    >
+                        {{ abs.user.username }}
+                    </span>
+                </div>
+            </div>
+        </div>
+    </div>
+</template>
+
+<script setup lang="ts">
+import type { AbsenceRequest } from '~/services/dto/absence'
+import { useAbsenceService } from '~/services/absences'
+import { useAbsenceHelpers } from '~/composables/useAbsenceHelpers'
+
+const props = defineProps<{
+    absences: AbsenceRequest[]
+}>()
+
+const emit = defineEmits<{
+    'range-change': [from: string, to: string]
+}>()
+
+const service = useAbsenceService()
+const { typeColor, statusLabel } = useAbsenceHelpers()
+
+const holidays = ref<Record<string, string>>({})
+
+const weekdays = ['Lun', 'Mar', 'Mer', 'Jeu', 'Ven', 'Sam', 'Dim']
+
+const cursor = ref(startOfMonth(new Date()))
+
+const monthLabel = computed(() =>
+    cursor.value.toLocaleDateString('fr-FR', { month: 'long', year: 'numeric' }),
+)
+
+type Cell = { key: string; day: number; date: Date; inMonth: boolean; isToday: boolean; holiday: string | null; absences: AbsenceRequest[] }
+
+function startOfMonth(d: Date): Date {
+    return new Date(d.getFullYear(), d.getMonth(), 1)
+}
+
+function ymd(d: Date): string {
+    return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`
+}
+
+// First Monday on/before the 1st of the month
+function gridStart(month: Date): Date {
+    const first = startOfMonth(month)
+    const dow = (first.getDay() + 6) % 7 // 0 = Monday
+    const start = new Date(first)
+    start.setDate(first.getDate() - dow)
+    return start
+}
+
+const visibleRange = computed(() => {
+    const start = gridStart(cursor.value)
+    const end = new Date(start)
+    end.setDate(start.getDate() + 41) // 6 weeks grid
+    return { start, end }
+})
+
+const cells = computed<Cell[]>(() => {
+    const { start } = visibleRange.value
+    const today = ymd(new Date())
+    const result: Cell[] = []
+    for (let i = 0; i < 42; i++) {
+        const date = new Date(start)
+        date.setDate(start.getDate() + i)
+        const key = ymd(date)
+        result.push({
+            key,
+            day: date.getDate(),
+            date,
+            inMonth: date.getMonth() === cursor.value.getMonth(),
+            isToday: key === today,
+            holiday: holidays.value[key] ?? null,
+            absences: props.absences.filter(a => key >= a.startDate.slice(0, 10) && key <= a.endDate.slice(0, 10)),
+        })
+    }
+    return result
+})
+
+async function emitRange() {
+    const { start, end } = visibleRange.value
+    emit('range-change', ymd(start), ymd(end))
+    try {
+        holidays.value = await service.getPublicHolidays(ymd(start), ymd(end))
+    } catch {
+        holidays.value = {}
+    }
+}
+
+function shiftMonth(delta: number) {
+    cursor.value = new Date(cursor.value.getFullYear(), cursor.value.getMonth() + delta, 1)
+    emitRange()
+}
+
+onMounted(emitRange)
+</script>
diff --git a/frontend/components/absence/AbsenceDateField.vue b/frontend/components/absence/AbsenceDateField.vue
new file mode 100644
index 0000000..fbf31e9
--- /dev/null
+++ b/frontend/components/absence/AbsenceDateField.vue
@@ -0,0 +1,73 @@
+<template>
+    <div class="absence-date-field">
+        <label class="mb-1 block text-sm font-medium text-neutral-700">{{ label }}</label>
+        <MalioDate
+            :model-value="modelValue"
+            :min="min ?? undefined"
+            :max="max ?? undefined"
+            :error="error"
+            :clearable="true"
+            group-class="w-full"
+            @update:model-value="$emit('update:modelValue', $event)"
+        />
+
+        <div v-if="showPills" class="mt-2 flex flex-wrap gap-2">
+            <button
+                v-for="opt in pillOptions"
+                :key="String(opt.value)"
+                type="button"
+                class="rounded-full border px-4 py-1.5 text-sm font-medium transition"
+                :class="half === opt.value
+                    ? 'border-primary-500 bg-primary-50 text-primary-600'
+                    : 'border-neutral-300 text-neutral-600 hover:border-neutral-400'"
+                @click="$emit('update:half', opt.value)"
+            >
+                {{ opt.label }}
+            </button>
+        </div>
+    </div>
+</template>
+
+<script setup lang="ts">
+import type { HalfDay } from '~/services/dto/absence'
+
+const props = withDefaults(defineProps<{
+    /** ISO date string "YYYY-MM-DD" or null. */
+    modelValue: string | null
+    half: HalfDay | null
+    label: string
+    /** 'start' shows full/morning/afternoon, 'end' shows full/morning only. */
+    mode?: 'start' | 'end'
+    error?: string
+    /** ISO date string "YYYY-MM-DD" or null. */
+    min?: string | null
+    max?: string | null
+    showPills?: boolean
+}>(), {
+    mode: 'start',
+    error: '',
+    min: null,
+    max: null,
+    showPills: true,
+})
+
+defineEmits<{
+    'update:modelValue': [value: string | null]
+    'update:half': [value: HalfDay | null]
+}>()
+
+const { t } = useI18n()
+
+type PillOption = { label: string; value: HalfDay | null }
+
+const pillOptions = computed<PillOption[]>(() => {
+    const base: PillOption[] = [
+        { label: t('absences.form.fullDay'), value: null },
+        { label: t('absences.halfDay.matin'), value: 'matin' },
+    ]
+    if (props.mode === 'start') {
+        base.push({ label: t('absences.halfDay.apres_midi'), value: 'apres_midi' })
+    }
+    return base
+})
+</script>
diff --git a/frontend/components/absence/AbsenceDetailDrawer.vue b/frontend/components/absence/AbsenceDetailDrawer.vue
new file mode 100644
index 0000000..1ba3820
--- /dev/null
+++ b/frontend/components/absence/AbsenceDetailDrawer.vue
@@ -0,0 +1,193 @@
+<template>
+    <MalioDrawer v-model="open" drawer-class="max-w-lg">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ $t('absences.detail.title') }}</h2>
+        </template>
+        <div v-if="request" class="flex flex-col gap-5">
+            <!-- Hero -->
+            <div class="overflow-hidden rounded-xl border border-neutral-200 shadow-sm">
+                <div
+                    class="flex items-start gap-3 p-4"
+                    :style="{ borderLeft: `4px solid ${typeColor(request.type)}` }"
+                >
+                    <span
+                        class="mt-0.5 flex h-11 w-11 flex-shrink-0 items-center justify-center rounded-full"
+                        :style="{ backgroundColor: tint(request.type), color: typeColor(request.type) }"
+                    >
+                        <Icon name="mdi:calendar-account" size="22" />
+                    </span>
+                    <div class="min-w-0 flex-1">
+                        <p class="truncate text-lg font-semibold text-neutral-900">{{ request.label }}</p>
+                        <p class="mt-0.5 flex items-center gap-1.5 text-sm text-neutral-500">
+                            <Icon name="mdi:calendar-range" size="15" />
+                            {{ formatRange(request) }}
+                        </p>
+                    </div>
+                    <StatusBadge
+                        class="flex-shrink-0"
+                        :label="statusLabel(request.status)"
+                        :variant="statusVariant(request.status)"
+                        :icon="statusIcon(request.status)"
+                    />
+                </div>
+
+                <dl class="grid grid-cols-2 divide-x divide-neutral-200 border-t border-neutral-200 bg-neutral-50">
+                    <div class="flex items-center gap-2.5 p-3">
+                        <span
+                            v-if="request.user.avatarUrl"
+                            class="h-9 w-9 flex-shrink-0 overflow-hidden rounded-full"
+                        >
+                            <img :src="request.user.avatarUrl" alt="" class="h-full w-full object-cover">
+                        </span>
+                        <span
+                            v-else
+                            class="flex h-9 w-9 flex-shrink-0 items-center justify-center rounded-full bg-primary-100 text-xs font-semibold text-primary-600"
+                        >
+                            {{ initials }}
+                        </span>
+                        <div class="min-w-0">
+                            <dt class="text-xs text-neutral-400">{{ $t('absences.table.employee') }}</dt>
+                            <dd class="truncate text-sm font-medium text-neutral-800">{{ request.user.username }}</dd>
+                        </div>
+                    </div>
+                    <div class="flex flex-col justify-center p-3">
+                        <dt class="text-xs text-neutral-400">{{ $t('absences.table.days') }}</dt>
+                        <dd class="text-sm font-semibold text-neutral-900">{{ formatDays(request.countedDays) }}</dd>
+                    </div>
+                </dl>
+            </div>
+
+            <!-- Reason -->
+            <div v-if="request.reason" class="rounded-lg border border-neutral-200 p-3">
+                <p class="mb-1 flex items-center gap-1.5 text-xs font-medium uppercase tracking-wide text-neutral-400">
+                    <Icon name="mdi:comment-text-outline" size="14" />
+                    {{ $t('absences.form.reason') }}
+                </p>
+                <p class="whitespace-pre-line text-sm text-neutral-800">{{ request.reason }}</p>
+            </div>
+
+            <!-- Rejection -->
+            <div
+                v-if="request.status === 'rejected' && request.rejectionReason"
+                class="rounded-lg border border-red-200 bg-red-50 p-3"
+            >
+                <p class="mb-1 flex items-center gap-1.5 text-xs font-medium uppercase tracking-wide text-red-500">
+                    <Icon name="mdi:close-circle-outline" size="14" />
+                    {{ $t('absences.detail.rejectionReason') }}
+                </p>
+                <p class="text-sm text-red-700">{{ request.rejectionReason }}</p>
+            </div>
+
+            <!-- Justification -->
+            <a
+                v-if="request.justificationUrl"
+                :href="request.justificationUrl"
+                target="_blank"
+                rel="noopener"
+                class="flex items-center gap-2 rounded-lg border border-neutral-200 p-3 text-sm font-medium text-neutral-700 transition hover:border-primary-300 hover:bg-primary-50"
+            >
+                <Icon name="mdi:file-document-outline" size="20" class="text-primary-500" />
+                <span class="flex-1 truncate">{{ request.justificationFileName || $t('absences.detail.downloadJustification') }}</span>
+                <Icon name="mdi:download" size="16" class="text-neutral-400" />
+            </a>
+
+            <!-- Timeline -->
+            <div>
+                <p class="mb-3 text-xs font-medium uppercase tracking-wide text-neutral-400">
+                    {{ $t('absences.detail.timeline') }}
+                </p>
+                <ol class="relative ml-1 border-l border-neutral-200 pl-5">
+                    <li class="mb-4 last:mb-0">
+                        <span class="absolute -left-[7px] mt-0.5 h-3.5 w-3.5 rounded-full border-2 border-white bg-primary-500 ring-1 ring-primary-200" />
+                        <p class="text-sm font-medium text-neutral-800">{{ $t('absences.detail.created') }}</p>
+                        <p class="text-xs text-neutral-400">{{ formatDateTime(request.createdAt) }}</p>
+                    </li>
+                    <li v-if="request.reviewedAt" class="last:mb-0">
+                        <span
+                            class="absolute -left-[7px] mt-0.5 h-3.5 w-3.5 rounded-full border-2 border-white ring-1"
+                            :class="request.status === 'rejected'
+                                ? 'bg-red-500 ring-red-200'
+                                : 'bg-green-500 ring-green-200'"
+                        />
+                        <p class="text-sm font-medium text-neutral-800">
+                            {{ statusLabel(request.status) }}
+                            <span v-if="request.reviewedBy" class="font-normal text-neutral-500">
+                                · {{ $t('absences.detail.reviewed', { name: request.reviewedBy.username }) }}
+                            </span>
+                        </p>
+                        <p class="text-xs text-neutral-400">{{ formatDateTime(request.reviewedAt) }}</p>
+                    </li>
+                </ol>
+            </div>
+
+            <div v-if="canCancel" class="flex justify-end border-t border-neutral-100 pt-4">
+                <MalioButton
+                    :label="$t('absences.detail.cancel')"
+                    variant="danger"
+                    icon-name="mdi:cancel"
+                    icon-position="left"
+                    :disabled="cancelling"
+                    @click="onCancel"
+                />
+            </div>
+        </div>
+    </MalioDrawer>
+</template>
+
+<script setup lang="ts">
+import type { AbsenceRequest } from '~/services/dto/absence'
+import { useAbsenceService } from '~/services/absences'
+import { useAbsenceHelpers } from '~/composables/useAbsenceHelpers'
+
+const props = defineProps<{
+    modelValue: boolean
+    request: AbsenceRequest | null
+    canCancel?: boolean
+}>()
+
+const emit = defineEmits<{
+    'update:modelValue': [value: boolean]
+    'cancelled': []
+}>()
+
+const { t } = useI18n()
+const service = useAbsenceService()
+const { statusLabel, statusVariant, statusIcon, formatRange, formatDays, typeColor } = useAbsenceHelpers()
+
+const open = computed({
+    get: () => props.modelValue,
+    set: (v) => emit('update:modelValue', v),
+})
+
+const cancelling = ref(false)
+
+const initials = computed(() => {
+    const name = props.request?.user.username ?? ''
+    return name.slice(0, 2).toUpperCase() || '?'
+})
+
+/** Type colour at ~12% opacity for soft backgrounds. */
+function tint(type: AbsenceRequest['type']): string {
+    return `${typeColor(type)}1f`
+}
+
+function formatDateTime(iso: string | null): string {
+    if (!iso) return ''
+    const d = new Date(iso)
+    if (isNaN(d.getTime())) return ''
+    return d.toLocaleString('fr-FR', { day: '2-digit', month: '2-digit', year: 'numeric', hour: '2-digit', minute: '2-digit' })
+}
+
+async function onCancel() {
+    if (!props.request) return
+    if (!confirm(t('absences.detail.cancelConfirm'))) return
+    cancelling.value = true
+    try {
+        await service.cancel(props.request.id)
+        emit('cancelled')
+        open.value = false
+    } finally {
+        cancelling.value = false
+    }
+}
+</script>
diff --git a/frontend/components/absence/AbsenceRejectDrawer.vue b/frontend/components/absence/AbsenceRejectDrawer.vue
new file mode 100644
index 0000000..1828743
--- /dev/null
+++ b/frontend/components/absence/AbsenceRejectDrawer.vue
@@ -0,0 +1,69 @@
+<template>
+    <MalioDrawer v-model="open" drawer-class="max-w-md">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ $t('absences.review.rejectTitle') }}</h2>
+        </template>
+        <div v-if="request" class="flex flex-col gap-4">
+            <p class="text-sm text-neutral-600">
+                {{ request.user.username }} · {{ request.label }} · {{ formatRange(request) }}
+            </p>
+            <MalioInputTextArea
+                v-model="reason"
+                :label="$t('absences.review.rejectReasonLabel')"
+                :placeholder="$t('absences.review.rejectReasonPlaceholder')"
+            />
+            <div class="flex justify-end gap-2 pt-2">
+                <MalioButton :label="$t('common.cancel')" variant="tertiary" @click="open = false" />
+                <MalioButton
+                    :label="$t('absences.review.confirm')"
+                    variant="danger"
+                    :disabled="!reason.trim() || submitting"
+                    @click="submit"
+                />
+            </div>
+        </div>
+    </MalioDrawer>
+</template>
+
+<script setup lang="ts">
+import type { AbsenceRequest } from '~/services/dto/absence'
+import { useAbsenceService } from '~/services/absences'
+import { useAbsenceHelpers } from '~/composables/useAbsenceHelpers'
+
+const props = defineProps<{
+    modelValue: boolean
+    request: AbsenceRequest | null
+}>()
+
+const emit = defineEmits<{
+    'update:modelValue': [value: boolean]
+    'rejected': []
+}>()
+
+const service = useAbsenceService()
+const { formatRange } = useAbsenceHelpers()
+
+const open = computed({
+    get: () => props.modelValue,
+    set: (v) => emit('update:modelValue', v),
+})
+
+const reason = ref('')
+const submitting = ref(false)
+
+watch(open, (v) => {
+    if (v) reason.value = ''
+})
+
+async function submit() {
+    if (!props.request || !reason.value.trim()) return
+    submitting.value = true
+    try {
+        await service.reject(props.request.id, reason.value.trim())
+        emit('rejected')
+        open.value = false
+    } finally {
+        submitting.value = false
+    }
+}
+</script>
diff --git a/frontend/components/absence/AbsenceRequestDrawer.vue b/frontend/components/absence/AbsenceRequestDrawer.vue
new file mode 100644
index 0000000..35b4ce0
--- /dev/null
+++ b/frontend/components/absence/AbsenceRequestDrawer.vue
@@ -0,0 +1,296 @@
+<template>
+    <MalioDrawer v-model="open" drawer-class="max-w-xl">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ $t('absences.newRequest') }}</h2>
+        </template>
+        <div class="flex flex-col gap-5">
+            <!-- Server-side error banner -->
+            <div v-if="serverError" class="flex items-start gap-2 rounded-lg bg-red-50 p-3 text-sm text-red-700">
+                <Icon name="mdi:alert-circle-outline" size="18" class="mt-0.5 flex-shrink-0" />
+                <span>{{ serverError }}</span>
+            </div>
+
+            <!-- Step 1 — type (always visible) -->
+            <MalioSelect
+                v-model="form.type"
+                :label="$t('absences.form.type')"
+                :options="typeOptions"
+                :empty-option-label="$t('absences.filters.allTypes')"
+                :error="errors.type"
+                group-class="w-full"
+            />
+
+            <!-- Step 2 — start date (revealed once a type is chosen) -->
+            <AbsenceDateField
+                v-if="showDates"
+                v-model="form.startDate"
+                v-model:half="form.startHalf"
+                :label="$t('absences.form.startDate')"
+                mode="start"
+                :error="errors.startDate"
+                :max="form.endDate"
+            />
+
+            <!-- Balance at start date -->
+            <div v-if="preview && preview.available !== null" class="flex items-center justify-between border-t border-neutral-100 pt-3 text-sm">
+                <span class="font-medium text-neutral-700">{{ $t('absences.form.balanceAt', { date: startDateLabel }) }}</span>
+                <span class="text-neutral-900">{{ formatDays(preview.available) }}</span>
+            </div>
+
+            <!-- Step 3 — end date (revealed once a start date is set) -->
+            <AbsenceDateField
+                v-if="showEnd"
+                v-model="form.endDate"
+                v-model:half="form.endHalf"
+                :label="$t('absences.form.endDate')"
+                mode="end"
+                :error="errors.endDate"
+                :min="form.startDate"
+                :show-pills="!isSingleDay"
+            />
+
+            <!-- Duration & projected balance -->
+            <div v-if="preview" class="flex flex-col gap-1 rounded-lg bg-neutral-50 p-3">
+                <div class="flex items-center justify-between text-sm">
+                    <span class="text-neutral-600">{{ $t('absences.form.duration') }}</span>
+                    <span class="font-semibold text-neutral-900">{{ formatDays(preview.countedDays) }}</span>
+                </div>
+                <div v-if="preview.projectedAvailable !== null" class="flex items-center justify-between border-t border-neutral-200 pt-1 text-sm">
+                    <span class="font-medium text-neutral-700">{{ $t('absences.form.balanceAfterValidation') }}</span>
+                    <span :class="preview.projectedAvailable < 0 ? 'font-semibold text-amber-600' : 'text-neutral-900'">
+                        {{ formatDays(preview.projectedAvailable) }}
+                    </span>
+                </div>
+            </div>
+            <div
+                v-if="preview && preview.projectedAvailable !== null && preview.projectedAvailable < 0"
+                class="rounded-lg bg-amber-50 p-3 text-sm text-amber-700"
+            >
+                {{ $t('absences.form.negativeWarning') }}
+            </div>
+
+            <!-- Step 4 — justification (only when the policy requires it) -->
+            <MalioInputUpload
+                v-if="showJustification"
+                :model-value="form.file?.name ?? null"
+                :label="`${$t('absences.form.justification')} *`"
+                accept="application/pdf,image/png,image/jpeg,image/webp"
+                :error="errors.justification"
+                @file-selected="onFileSelected"
+            />
+
+            <!-- Comment (optional) -->
+            <div v-if="showComment" class="flex items-start gap-2">
+                <span class="mt-1 flex h-8 w-8 flex-shrink-0 items-center justify-center rounded-full bg-primary-100 text-xs font-semibold text-primary-600">
+                    {{ initials }}
+                </span>
+                <MalioInputTextArea
+                    v-model="form.reason"
+                    group-class="flex-1"
+                    :placeholder="$t('absences.form.commentPlaceholder')"
+                />
+            </div>
+
+            <!-- Footer -->
+            <div class="flex justify-end gap-3 pt-2">
+                <MalioButton :label="$t('common.cancel')" variant="tertiary" @click="open = false" />
+                <MalioButton
+                    :label="$t('absences.form.submit')"
+                    :disabled="submitting"
+                    @click="submit"
+                />
+            </div>
+        </div>
+    </MalioDrawer>
+</template>
+
+<script setup lang="ts">
+import type { AbsencePolicy, AbsencePreviewResult, AbsenceType, HalfDay } from '~/services/dto/absence'
+import { useAbsenceService } from '~/services/absences'
+import { useAbsenceHelpers } from '~/composables/useAbsenceHelpers'
+
+const props = defineProps<{
+    modelValue: boolean
+    policies: AbsencePolicy[]
+}>()
+
+const emit = defineEmits<{
+    'update:modelValue': [value: boolean]
+    'created': []
+}>()
+
+const { t } = useI18n()
+const { formatDays, formatDate } = useAbsenceHelpers()
+const service = useAbsenceService()
+const auth = useAuthStore()
+
+const open = computed({
+    get: () => props.modelValue,
+    set: (v) => emit('update:modelValue', v),
+})
+
+type FormState = {
+    type: AbsenceType | null
+    // ISO date strings "YYYY-MM-DD" (lexicographic order == chronological order).
+    startDate: string | null
+    startHalf: HalfDay | null
+    endDate: string | null
+    endHalf: HalfDay | null
+    reason: string
+    file: File | null
+}
+
+const form = reactive<FormState>({
+    type: null,
+    startDate: null,
+    startHalf: null,
+    endDate: null,
+    endHalf: null,
+    reason: '',
+    file: null,
+})
+
+const errors = reactive<{ type: string; startDate: string; endDate: string; justification: string }>({
+    type: '',
+    startDate: '',
+    endDate: '',
+    justification: '',
+})
+
+const serverError = ref('')
+const preview = ref<AbsencePreviewResult | null>(null)
+const submitting = ref(false)
+
+const typeOptions = computed(() =>
+    props.policies
+        .filter(p => p.active)
+        .map(p => ({ label: p.label, value: p.type })),
+)
+
+const selectedPolicy = computed(() => props.policies.find(p => p.type === form.type) ?? null)
+const justificationRequired = computed(() => selectedPolicy.value?.justificationRequired ?? false)
+
+const showDates = computed(() => form.type !== null)
+const showEnd = computed(() => form.startDate !== null)
+const showJustification = computed(() => form.type !== null && justificationRequired.value)
+const showComment = computed(() => form.startDate !== null)
+
+const isSingleDay = computed(() =>
+    form.startDate !== null
+    && form.endDate !== null
+    && form.startDate === form.endDate,
+)
+
+const startDateLabel = computed(() => formatDate(form.startDate))
+
+const initials = computed(() => {
+    const name = auth.user?.username ?? ''
+    return name.slice(0, 2).toUpperCase() || '?'
+})
+
+function onFileSelected(file: File) {
+    form.file = file
+    errors.justification = ''
+}
+
+function buildPayload() {
+    // On a single-day request the end half-day mirrors the start.
+    const endHalf = isSingleDay.value ? form.startHalf : form.endHalf
+    return {
+        type: form.type as AbsenceType,
+        startDate: form.startDate as string,
+        endDate: form.endDate as string,
+        startHalfDay: form.startHalf,
+        endHalfDay: endHalf,
+        reason: form.reason || null,
+    }
+}
+
+function validate(): boolean {
+    errors.type = form.type ? '' : t('absences.form.errors.typeRequired')
+    errors.startDate = form.startDate ? '' : t('absences.form.errors.startRequired')
+
+    if (form.endDate === null) {
+        errors.endDate = t('absences.form.errors.endRequired')
+    } else if (form.startDate && form.endDate < form.startDate) {
+        errors.endDate = t('absences.form.errors.endBeforeStart')
+    } else if (form.type && form.startDate && (preview.value?.countedDays ?? 0) <= 0) {
+        errors.endDate = t('absences.form.errors.zeroDays')
+    } else {
+        errors.endDate = ''
+    }
+
+    errors.justification = justificationRequired.value && !form.file
+        ? t('absences.form.errors.justificationRequired')
+        : ''
+
+    return !errors.type && !errors.startDate && !errors.endDate && !errors.justification
+}
+
+// Clear field errors as soon as the user corrects them.
+watch(() => form.type, (v) => { if (v) errors.type = '' })
+watch(() => form.startDate, (v) => { if (v) errors.startDate = '' })
+watch(() => [form.endDate, form.startDate], () => {
+    if (form.endDate && (!form.startDate || form.endDate >= form.startDate)) errors.endDate = ''
+})
+
+let debounceTimer: ReturnType<typeof setTimeout> | null = null
+
+watch(
+    () => [form.type, form.startDate, form.endDate, form.startHalf, form.endHalf],
+    () => {
+        if (debounceTimer) clearTimeout(debounceTimer)
+        if (!form.type || !form.startDate || !form.endDate) {
+            preview.value = null
+            return
+        }
+        debounceTimer = setTimeout(async () => {
+            try {
+                preview.value = await service.preview(buildPayload())
+            } catch {
+                preview.value = null
+            }
+        }, 300)
+    },
+    { deep: true },
+)
+
+async function submit() {
+    serverError.value = ''
+    if (!validate()) return
+    submitting.value = true
+    try {
+        const created = await service.create(buildPayload())
+        if (form.file) {
+            await service.uploadJustification(created.id, form.file)
+        }
+        emit('created')
+        open.value = false
+        resetForm()
+    } catch (e) {
+        serverError.value = (e instanceof Error && e.message) ? e.message : t('absences.form.serverError')
+    } finally {
+        submitting.value = false
+    }
+}
+
+function resetForm() {
+    form.type = null
+    form.startDate = null
+    form.startHalf = null
+    form.endDate = null
+    form.endHalf = null
+    form.reason = ''
+    form.file = null
+    errors.type = ''
+    errors.startDate = ''
+    errors.endDate = ''
+    errors.justification = ''
+    serverError.value = ''
+    preview.value = null
+}
+
+watch(open, (v) => {
+    if (v) resetForm()
+})
+</script>
diff --git a/frontend/components/absence/EmployeeDrawer.vue b/frontend/components/absence/EmployeeDrawer.vue
new file mode 100644
index 0000000..ae1029e
--- /dev/null
+++ b/frontend/components/absence/EmployeeDrawer.vue
@@ -0,0 +1,163 @@
+<template>
+    <MalioDrawer v-model="open" drawer-class="max-w-lg">
+        <template #header>
+            <div>
+                <h2 class="text-xl font-bold">{{ $t('absences.admin.employees.drawer.title') }}</h2>
+                <p v-if="user" class="text-sm text-neutral-500">{{ user.username }}</p>
+            </div>
+        </template>
+        <form v-if="user" class="grid grid-cols-1 gap-4 sm:grid-cols-2" @submit.prevent="save">
+            <MalioDate
+                v-model="form.hireDate"
+                :label="$t('absences.admin.employees.fields.hireDate')"
+                group-class="w-full"
+            />
+            <MalioDate
+                v-model="form.endDate"
+                :label="$t('absences.admin.employees.fields.endDate')"
+                group-class="w-full"
+            />
+            <MalioSelect
+                v-model="form.contractType"
+                :label="$t('absences.admin.employees.fields.contractType')"
+                :options="contractOptions"
+                empty-option-label="—"
+                group-class="w-full"
+            />
+            <MalioSelect
+                v-model="form.familySituation"
+                :label="$t('absences.admin.employees.fields.familySituation')"
+                :options="familyOptions"
+                empty-option-label="—"
+                group-class="w-full"
+            />
+            <MalioInputText
+                v-model="form.workTimeRatio"
+                :label="$t('absences.admin.employees.fields.workTimeRatio')"
+                input-class="w-full"
+            />
+            <MalioInputText
+                v-model="form.annualLeaveDays"
+                :label="$t('absences.admin.employees.fields.annualLeaveDays')"
+                input-class="w-full"
+            />
+            <MalioInputText
+                v-model="form.referencePeriodStart"
+                :label="$t('absences.admin.employees.fields.referencePeriodStart')"
+                input-class="w-full"
+            />
+            <MalioInputText
+                v-model="form.initialLeaveBalance"
+                :label="$t('absences.admin.employees.fields.initialLeaveBalance')"
+                input-class="w-full"
+            />
+            <MalioInputText
+                v-model="form.nbChildren"
+                :label="$t('absences.admin.employees.fields.nbChildren')"
+                input-class="w-full"
+            />
+
+            <div class="col-span-full mt-2 flex justify-end">
+                <MalioButton
+                    :label="$t('absences.admin.employees.drawer.save')"
+                    button-class="w-auto px-6"
+                    :disabled="submitting"
+                    @click="save"
+                />
+            </div>
+        </form>
+    </MalioDrawer>
+</template>
+
+<script setup lang="ts">
+import type { ContractType, FamilySituation, UserData } from '~/services/dto/user-data'
+import { useUserService } from '~/services/users'
+
+const props = defineProps<{
+    modelValue: boolean
+    user: UserData | null
+}>()
+
+const emit = defineEmits<{
+    'update:modelValue': [value: boolean]
+    'saved': []
+}>()
+
+const { t } = useI18n()
+const { update } = useUserService()
+
+const open = computed({
+    get: () => props.modelValue,
+    set: (v) => emit('update:modelValue', v),
+})
+
+const submitting = ref(false)
+
+const contractOptions = [
+    { label: t('absences.admin.employees.contract.cdi'), value: 'CDI' },
+    { label: t('absences.admin.employees.contract.cdd'), value: 'CDD' },
+    { label: t('absences.admin.employees.contract.stage'), value: 'STAGE' },
+    { label: t('absences.admin.employees.contract.alternance'), value: 'ALTERNANCE' },
+    { label: t('absences.admin.employees.contract.autre'), value: 'AUTRE' },
+]
+
+const familyOptions = [
+    { label: t('absences.admin.employees.family.celibataire'), value: 'CELIBATAIRE' },
+    { label: t('absences.admin.employees.family.marie'), value: 'MARIE' },
+    { label: t('absences.admin.employees.family.pacse'), value: 'PACSE' },
+    { label: t('absences.admin.employees.family.divorce'), value: 'DIVORCE' },
+    { label: t('absences.admin.employees.family.veuf'), value: 'VEUF' },
+]
+
+const form = reactive({
+    hireDate: null as string | null,
+    endDate: null as string | null,
+    contractType: null as ContractType | null,
+    familySituation: null as FamilySituation | null,
+    workTimeRatio: '1.0',
+    annualLeaveDays: '25',
+    referencePeriodStart: '06-01',
+    initialLeaveBalance: '0',
+    nbChildren: '0',
+})
+
+function hydrate(u: UserData | null) {
+    if (!u) return
+    form.hireDate = u.hireDate ? u.hireDate.slice(0, 10) : null
+    form.endDate = u.endDate ? u.endDate.slice(0, 10) : null
+    form.contractType = u.contractType ?? null
+    form.familySituation = u.familySituation ?? null
+    form.workTimeRatio = String(u.workTimeRatio ?? 1)
+    form.annualLeaveDays = String(u.annualLeaveDays ?? 25)
+    form.referencePeriodStart = u.referencePeriodStart ?? '06-01'
+    form.initialLeaveBalance = String(u.initialLeaveBalance ?? 0)
+    form.nbChildren = String(u.nbChildren ?? 0)
+}
+
+watch(() => props.modelValue, (isOpen) => {
+    if (isOpen) hydrate(props.user)
+})
+
+async function save() {
+    if (!props.user) return
+    submitting.value = true
+    try {
+        await update(props.user.id, {
+            isEmployee: true,
+            hireDate: form.hireDate || null,
+            endDate: form.endDate || null,
+            contractType: form.contractType,
+            familySituation: form.familySituation,
+            workTimeRatio: Number(form.workTimeRatio) || 1,
+            annualLeaveDays: Number(form.annualLeaveDays) || 0,
+            referencePeriodStart: form.referencePeriodStart || '06-01',
+            initialLeaveBalance: Number(form.initialLeaveBalance) || 0,
+            nbChildren: Number(form.nbChildren) || 0,
+        })
+        emit('saved')
+        open.value = false
+    } finally {
+        submitting.value = false
+    }
+}
+</script>
diff --git a/frontend/components/admin/AdminAbsencePolicyTab.vue b/frontend/components/admin/AdminAbsencePolicyTab.vue
new file mode 100644
index 0000000..290df97
--- /dev/null
+++ b/frontend/components/admin/AdminAbsencePolicyTab.vue
@@ -0,0 +1,76 @@
+<template>
+    <div class="flex flex-col gap-4 pt-2">
+        <div>
+            <h2 class="text-lg font-semibold text-neutral-900">{{ $t('absences.policies.title') }}</h2>
+            <p class="text-sm text-neutral-500">{{ $t('absences.policies.subtitle') }}</p>
+        </div>
+
+        <div class="overflow-x-auto">
+            <table class="w-full border-collapse text-sm">
+                <thead>
+                    <tr class="border-b border-neutral-200 text-left text-neutral-500">
+                        <th class="py-2 pr-3">{{ $t('absences.policies.type') }}</th>
+                        <th class="py-2 px-2">{{ $t('absences.policies.daysPerYear') }}</th>
+                        <th class="py-2 px-2">{{ $t('absences.policies.daysPerEvent') }}</th>
+                        <th class="py-2 px-2">{{ $t('absences.policies.noticeDays') }}</th>
+                        <th class="py-2 px-2 text-center">{{ $t('absences.policies.justificationRequired') }}</th>
+                        <th class="py-2 px-2 text-center">{{ $t('absences.policies.countWorkingDaysOnly') }}</th>
+                        <th class="py-2 px-2 text-center">{{ $t('absences.policies.active') }}</th>
+                        <th class="py-2 pl-2" />
+                    </tr>
+                </thead>
+                <tbody>
+                    <tr v-for="row in rows" :key="row.id" class="border-b border-neutral-100">
+                        <td class="py-2 pr-3 font-medium text-neutral-800">{{ row.label }}</td>
+                        <td class="py-2 px-2">
+                            <input v-model.number="row.daysPerYear" type="number" step="0.5" class="w-20 rounded border border-neutral-300 px-2 py-1">
+                        </td>
+                        <td class="py-2 px-2">
+                            <input v-model.number="row.daysPerEvent" type="number" step="0.5" class="w-20 rounded border border-neutral-300 px-2 py-1">
+                        </td>
+                        <td class="py-2 px-2">
+                            <input v-model.number="row.noticeDays" type="number" class="w-16 rounded border border-neutral-300 px-2 py-1">
+                        </td>
+                        <td class="py-2 px-2 text-center">
+                            <input v-model="row.justificationRequired" type="checkbox" class="h-4 w-4">
+                        </td>
+                        <td class="py-2 px-2 text-center">
+                            <input v-model="row.countWorkingDaysOnly" type="checkbox" class="h-4 w-4">
+                        </td>
+                        <td class="py-2 px-2 text-center">
+                            <input v-model="row.active" type="checkbox" class="h-4 w-4">
+                        </td>
+                        <td class="py-2 pl-2 text-right">
+                            <MalioButton :label="$t('absences.policies.save')" variant="secondary" @click="save(row)" />
+                        </td>
+                    </tr>
+                </tbody>
+            </table>
+        </div>
+    </div>
+</template>
+
+<script setup lang="ts">
+import type { AbsencePolicy } from '~/services/dto/absence'
+import { useAbsenceService } from '~/services/absences'
+
+const service = useAbsenceService()
+const rows = ref<AbsencePolicy[]>([])
+
+async function load() {
+    rows.value = await service.getPolicies()
+}
+
+async function save(row: AbsencePolicy) {
+    await service.updatePolicy(row.id, {
+        daysPerYear: row.daysPerYear === null || Number.isNaN(row.daysPerYear) ? null : Number(row.daysPerYear),
+        daysPerEvent: row.daysPerEvent === null || Number.isNaN(row.daysPerEvent) ? null : Number(row.daysPerEvent),
+        noticeDays: Number(row.noticeDays),
+        justificationRequired: row.justificationRequired,
+        countWorkingDaysOnly: row.countWorkingDaysOnly,
+        active: row.active,
+    })
+}
+
+onMounted(load)
+</script>
diff --git a/frontend/components/admin/AdminClientTicketTab.vue b/frontend/components/admin/AdminClientTicketTab.vue
deleted file mode 100644
index 85f7b54..0000000
--- a/frontend/components/admin/AdminClientTicketTab.vue
+++ /dev/null
@@ -1,382 +0,0 @@
-<template>
-    <div>
-        <div class="flex items-center justify-between">
-            <h2 class="text-lg font-bold text-neutral-900">{{ $t('clientTicket.adminTab') }}</h2>
-        </div>
-
-        <!-- Filters -->
-        <div class="mt-4 flex flex-wrap gap-3">
-            <MalioSelect
-                v-model="filterProjectId"
-                :options="projectOptions"
-                label="Projet"
-                :empty-option-label="$t('clientTicket.allProjects')"
-                min-width="!w-40"
-                text-field="text-sm"
-                text-value="text-sm"
-            />
-            <div>
-                <label class="mb-1 block text-sm font-medium text-neutral-700">Statut</label>
-                <select
-                    v-model="filterStatus"
-                    class="rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500"
-                >
-                    <option :value="null">{{ $t('clientTicket.allStatuses') }}</option>
-                    <option value="new">{{ $t('clientTicket.status.new') }}</option>
-                    <option value="in_progress">{{ $t('clientTicket.status.in_progress') }}</option>
-                    <option value="done">{{ $t('clientTicket.status.done') }}</option>
-                    <option value="rejected">{{ $t('clientTicket.status.rejected') }}</option>
-                </select>
-            </div>
-        </div>
-
-        <!-- Ticket list -->
-        <div v-if="isLoading" class="py-8 text-center text-sm text-neutral-400">
-            {{ $t('common.loading') }}
-        </div>
-
-        <div v-else-if="filteredTickets.length === 0" class="py-8 text-center text-sm text-neutral-400">
-            {{ $t('clientTicket.noTickets') }}
-        </div>
-
-        <div v-else class="mt-4 overflow-x-auto">
-            <table class="w-full text-left text-sm">
-                <thead>
-                    <tr class="border-b border-neutral-200 text-xs font-semibold uppercase text-neutral-500">
-                        <th class="px-3 py-3">#</th>
-                        <th class="px-3 py-3">Type</th>
-                        <th class="px-3 py-3">{{ $t('clientTicket.title') }}</th>
-                        <th class="px-3 py-3">Statut</th>
-                        <th class="px-3 py-3">Projet</th>
-                        <th class="px-3 py-3">{{ $t('clientTicket.submittedBy') }}</th>
-                        <th class="px-3 py-3">{{ $t('clientTicket.createdAt') }}</th>
-                        <th class="px-3 py-3">Actions</th>
-                    </tr>
-                </thead>
-                <tbody>
-                    <tr
-                        v-for="ticket in filteredTickets"
-                        :key="ticket.id"
-                        class="cursor-pointer border-b border-neutral-100 transition-colors hover:bg-neutral-50"
-                        @click="openDetail(ticket)"
-                    >
-                        <td class="px-3 py-3 font-bold text-primary-500">CT-{{ String(ticket.number).padStart(3, '0') }}</td>
-                        <td class="px-3 py-3">
-                            <span
-                                class="rounded-full px-2 py-0.5 text-xs font-semibold text-white"
-                                :class="typeBadgeClass(ticket.type)"
-                            >
-                                {{ $t(`clientTicket.type.${ticket.type}`) }}
-                            </span>
-                        </td>
-                        <td class="px-3 py-3 font-medium text-neutral-900">{{ ticket.title }}</td>
-                        <td class="px-3 py-3">
-                            <span
-                                class="rounded-full px-2 py-0.5 text-xs font-semibold"
-                                :class="statusBadgeClass(ticket.status)"
-                            >
-                                {{ $t(`clientTicket.status.${ticket.status}`) }}
-                            </span>
-                        </td>
-                        <td class="px-3 py-3 text-neutral-600">{{ getProjectName(ticket.project) }}</td>
-                        <td class="px-3 py-3 text-neutral-600">
-                            <div class="flex items-center gap-2">
-                                <UserAvatar
-                                    v-if="getSubmitterUser(ticket.submittedBy)"
-                                    :user="getSubmitterUser(ticket.submittedBy)!"
-                                    size="sm"
-                                />
-                                {{ getSubmitterName(ticket.submittedBy) }}
-                            </div>
-                        </td>
-                        <td class="px-3 py-3 text-neutral-400">{{ formatDate(ticket.createdAt) }}</td>
-                        <td class="px-3 py-3">
-                            <div class="flex items-center gap-2">
-                                <MalioButtonIcon
-                                    icon="mdi:swap-horizontal"
-                                    :aria-label="$t('clientTicket.changeStatus')"
-                                    variant="ghost"
-                                    icon-size="18"
-                                    @click.stop="openStatusChange(ticket)"
-                                />
-                                <MalioButtonIcon
-                                    icon="mdi:delete-outline"
-                                    aria-label="Supprimer"
-                                    variant="ghost"
-                                    icon-size="18"
-                                    button-class="text-neutral-400 hover:bg-red-50 hover:text-red-500"
-                                    @click.stop="openDeleteConfirm(ticket)"
-                                />
-                            </div>
-                        </td>
-                    </tr>
-                </tbody>
-            </table>
-        </div>
-
-        <!-- Status change modal -->
-        <Teleport v-if="statusModalOpen" to="body">
-            <Transition name="status-modal" appear>
-                <div class="fixed inset-0 z-50 flex items-center justify-center p-4">
-                    <div
-                        class="absolute inset-0 bg-slate-900/40 backdrop-blur-sm"
-                        @click="statusModalOpen = false"
-                    />
-                    <div class="relative z-10 w-full max-w-md rounded-2xl bg-white p-6 shadow-2xl">
-                        <h3 class="text-lg font-bold text-neutral-900">{{ $t('clientTicket.changeStatus') }}</h3>
-                        <p v-if="statusTarget" class="mt-1 text-sm text-neutral-500">
-                            CT-{{ String(statusTarget.number).padStart(3, '0') }} — {{ statusTarget.title }}
-                        </p>
-
-                        <div class="mt-4">
-                            <label class="mb-1 block text-sm font-medium text-neutral-700">Nouveau statut</label>
-                            <select
-                                v-model="newStatus"
-                                class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500"
-                            >
-                                <option :value="null" disabled>—</option>
-                                <option
-                                    v-for="s in availableStatusTransitions"
-                                    :key="s.value"
-                                    :value="s.value"
-                                >
-                                    {{ s.label }}
-                                </option>
-                            </select>
-                        </div>
-
-                        <div v-if="newStatus === 'rejected'" class="mt-4">
-                            <MalioInputTextArea
-                                v-model="statusComment"
-                                :label="$t('clientTicket.statusComment')"
-                                :size="3"
-                            />
-                            <p v-if="rejectionError" class="mt-1 text-xs text-red-500">
-                                {{ $t('clientTicket.rejectionRequired') }}
-                            </p>
-                        </div>
-
-                        <div class="mt-6 flex justify-end gap-3">
-                            <MalioButton
-                                variant="tertiary"
-                                :label="$t('common.cancel')"
-                                button-class="w-auto px-4"
-                                @click="statusModalOpen = false"
-                            />
-                            <MalioButton
-                                label="Confirmer"
-                                button-class="w-auto px-6"
-                                :disabled="isUpdatingStatus"
-                                @click="confirmStatusChange"
-                            />
-                        </div>
-                    </div>
-                </div>
-            </Transition>
-        </Teleport>
-
-        <!-- Delete confirm modal -->
-        <Teleport v-if="deleteModalOpen" to="body">
-            <Transition name="status-modal" appear>
-                <div class="fixed inset-0 z-50 flex items-center justify-center p-4">
-                    <div
-                        class="absolute inset-0 bg-slate-900/40 backdrop-blur-sm"
-                        @click="deleteModalOpen = false"
-                    />
-                    <div class="relative z-10 w-full max-w-sm rounded-2xl bg-white p-6 shadow-2xl">
-                        <h3 class="text-lg font-bold text-neutral-900">{{ $t('clientTicket.confirmDelete') }}</h3>
-                        <p class="mt-2 text-sm text-neutral-600">{{ $t('clientTicket.confirmDeleteMessage') }}</p>
-                        <div class="mt-6 flex justify-end gap-3">
-                            <MalioButton
-                                variant="tertiary"
-                                :label="$t('common.cancel')"
-                                button-class="w-auto px-4"
-                                @click="deleteModalOpen = false"
-                            />
-                            <MalioButton
-                                variant="danger"
-                                label="Supprimer"
-                                button-class="w-auto px-6"
-                                :disabled="isDeleting"
-                                @click="confirmDelete"
-                            />
-                        </div>
-                    </div>
-                </div>
-            </Transition>
-        </Teleport>
-
-        <!-- Ticket detail modal (read-only) -->
-        <ClientTicketDetailModal
-            v-model="detailOpen"
-            :ticket="detailTicket"
-        />
-    </div>
-</template>
-
-<script setup lang="ts">
-import type { ClientTicket, ClientTicketStatus } from '~/services/dto/client-ticket'
-import type { Project } from '~/services/dto/project'
-import type { UserData } from '~/services/dto/user-data'
-import { useClientTicketService } from '~/services/client-tickets'
-import { useProjectService } from '~/services/projects'
-import { useUserService } from '~/services/users'
-
-const { t } = useI18n()
-const clientTicketService = useClientTicketService()
-const projectService = useProjectService()
-const userService = useUserService()
-const { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions } = useClientTicketHelpers()
-
-const tickets = ref<ClientTicket[]>([])
-const projects = ref<Project[]>([])
-const users = ref<UserData[]>([])
-const isLoading = ref(true)
-
-// Filters
-const filterProjectId = ref<number | null>(null)
-const filterStatus = ref<string | null>(null)
-
-const projectOptions = computed(() =>
-    projects.value.map(p => ({ label: p.name, value: p.id }))
-)
-
-const filteredTickets = computed(() => {
-    let result = tickets.value
-    if (filterProjectId.value) {
-        result = result.filter(t => t.project === `/api/projects/${filterProjectId.value}`)
-    }
-    if (filterStatus.value) {
-        result = result.filter(t => t.status === filterStatus.value)
-    }
-    return result
-})
-
-// Status change modal
-const statusModalOpen = ref(false)
-const statusTarget = ref<ClientTicket | null>(null)
-const newStatus = ref<string | null>(null)
-const statusComment = ref('')
-const rejectionError = ref(false)
-const isUpdatingStatus = ref(false)
-
-// Delete modal
-const deleteModalOpen = ref(false)
-const deleteTarget = ref<ClientTicket | null>(null)
-const isDeleting = ref(false)
-
-// Detail modal
-const detailOpen = ref(false)
-const detailTicket = ref<ClientTicket | null>(null)
-
-const availableStatusTransitions = computed(() => {
-    if (!statusTarget.value) return []
-    return getAvailableStatusTransitions(statusTarget.value.status, t)
-})
-
-function getProjectName(iri: string): string {
-    const id = extractIdFromIri(iri)
-    if (!id) return ''
-    return projects.value.find(p => p.id === id)?.name ?? ''
-}
-
-function getSubmitterName(iri: string | null): string {
-    if (!iri) return '-'
-    const id = extractIdFromIri(iri)
-    if (!id) return ''
-    return users.value.find(u => u.id === id)?.username ?? ''
-}
-
-function getSubmitterUser(iri: string | null): UserData | undefined {
-    if (!iri) return undefined
-    const id = extractIdFromIri(iri)
-    if (!id) return undefined
-    return users.value.find(u => u.id === id)
-}
-
-function openDetail(ticket: ClientTicket) {
-    detailTicket.value = ticket
-    detailOpen.value = true
-}
-
-function openStatusChange(ticket: ClientTicket) {
-    statusTarget.value = ticket
-    newStatus.value = null
-    statusComment.value = ''
-    rejectionError.value = false
-    statusModalOpen.value = true
-}
-
-function openDeleteConfirm(ticket: ClientTicket) {
-    deleteTarget.value = ticket
-    deleteModalOpen.value = true
-}
-
-async function confirmStatusChange() {
-    if (!statusTarget.value || !newStatus.value) return
-
-    if (newStatus.value === 'rejected' && !statusComment.value.trim()) {
-        rejectionError.value = true
-        return
-    }
-
-    isUpdatingStatus.value = true
-    try {
-        await clientTicketService.updateStatus(statusTarget.value.id, {
-            status: newStatus.value as ClientTicketStatus,
-            statusComment: newStatus.value === 'rejected' ? statusComment.value.trim() : null,
-        })
-        statusModalOpen.value = false
-        await loadTickets()
-    } finally {
-        isUpdatingStatus.value = false
-    }
-}
-
-async function confirmDelete() {
-    if (!deleteTarget.value) return
-    isDeleting.value = true
-    try {
-        await clientTicketService.remove(deleteTarget.value.id)
-        deleteModalOpen.value = false
-        await loadTickets()
-    } finally {
-        isDeleting.value = false
-    }
-}
-
-async function loadTickets() {
-    tickets.value = await clientTicketService.getAll()
-}
-
-async function loadData() {
-    isLoading.value = true
-    try {
-        const [ticketsResult, projectsResult, usersResult] = await Promise.all([
-            clientTicketService.getAll(),
-            projectService.getAll(),
-            userService.getAll(),
-        ])
-        tickets.value = ticketsResult
-        projects.value = projectsResult
-        users.value = usersResult
-    } finally {
-        isLoading.value = false
-    }
-}
-
-onMounted(() => {
-    loadData()
-})
-</script>
-
-<style scoped>
-.status-modal-enter-active,
-.status-modal-leave-active {
-    transition: opacity 0.2s ease;
-}
-.status-modal-enter-from,
-.status-modal-leave-to {
-    opacity: 0;
-}
-</style>
diff --git a/frontend/components/admin/WorkflowDrawer.vue b/frontend/components/admin/WorkflowDrawer.vue
index bf2b206..3ffd57d 100644
--- a/frontend/components/admin/WorkflowDrawer.vue
+++ b/frontend/components/admin/WorkflowDrawer.vue
@@ -1,5 +1,8 @@
 <template>
-    <MalioDrawer v-model="isOpen" :title="isEditing ? $t('workflows.editWorkflow') : $t('workflows.addWorkflow')">
+    <MalioDrawer v-model="isOpen">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ isEditing ? $t('workflows.editWorkflow') : $t('workflows.addWorkflow') }}</h2>
+        </template>
         <form class="flex flex-col gap-4" @submit.prevent="handleSubmit">
             <MalioInputText
                 v-model="form.name"
diff --git a/frontend/components/client-ticket/ClientTicketDetailModal.vue b/frontend/components/client-ticket/ClientTicketDetailModal.vue
deleted file mode 100644
index ae66779..0000000
--- a/frontend/components/client-ticket/ClientTicketDetailModal.vue
+++ /dev/null
@@ -1,353 +0,0 @@
-<template>
-    <Teleport v-if="isOpen" to="body">
-        <Transition name="ticket-modal" appear>
-            <div class="fixed inset-0 z-50 flex items-center justify-center p-4">
-                <!-- Backdrop -->
-                <div
-                    class="absolute inset-0 bg-slate-900/40 backdrop-blur-sm"
-                    @click="close"
-                />
-
-                <!-- Modal -->
-                <div
-                    class="relative z-10 flex w-full max-w-2xl flex-col overflow-hidden rounded-2xl bg-white shadow-2xl ring-1 ring-black/5"
-                    style="max-height: min(90vh, 900px)"
-                >
-                    <!-- Header -->
-                    <div class="border-b border-neutral-100 bg-neutral-50/80 px-4 py-4 sm:px-8 sm:py-5">
-                        <div class="flex items-center justify-between">
-                            <div class="flex items-center gap-3">
-                                <span
-                                    v-if="ticket"
-                                    class="rounded-md bg-primary-500 px-2.5 py-1 text-xs font-bold tracking-wide text-white"
-                                >
-                                    CT-{{ String(ticket.number).padStart(3, '0') }}
-                                </span>
-                                <h2 class="text-lg font-bold tracking-tight text-neutral-900">
-                                    {{ $t('portal.ticketDetail') }}
-                                </h2>
-                            </div>
-                            <div class="flex items-center gap-2">
-                                <!-- Edit button (only for open tickets submitted by current user) -->
-                                <MalioButton
-                                    v-if="canEdit && !isEditing"
-                                    variant="tertiary"
-                                    icon-name="mdi:pencil-outline"
-                                    icon-position="left"
-                                    button-class="w-auto px-3"
-                                    :label="$t('common.edit')"
-                                    @click="startEdit"
-                                />
-                                <MalioButtonIcon
-                                    icon="mdi:close"
-                                    aria-label="Fermer"
-                                    variant="ghost"
-                                    icon-size="20"
-                                    @click="close"
-                                />
-                            </div>
-                        </div>
-                    </div>
-
-                    <!-- Body -->
-                    <div v-if="ticket" class="overflow-y-auto px-4 py-4 sm:px-8 sm:py-6">
-
-                        <!-- Edit mode -->
-                        <template v-if="isEditing">
-                            <div>
-                                <label class="mb-1 block text-sm font-medium text-neutral-700">
-                                    {{ $t('clientTicket.fields.title') }}
-                                </label>
-                                <input
-                                    v-model="editForm.title"
-                                    type="text"
-                                    class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
-                                />
-                            </div>
-
-                            <div class="mt-4">
-                                <MalioInputRichText
-                                    v-model="editForm.description"
-                                    :label="$t('clientTicket.description')"
-                                    min-height="180px"
-                                />
-                            </div>
-
-                            <div v-if="ticket.type === 'bug'" class="mt-4">
-                                <label class="mb-1 block text-sm font-medium text-neutral-700">
-                                    {{ $t('clientTicket.fields.url') }}
-                                </label>
-                                <input
-                                    v-model="editForm.url"
-                                    type="url"
-                                    class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
-                                    :placeholder="$t('clientTicket.fields.urlPlaceholder')"
-                                />
-                            </div>
-
-                            <div class="mt-6 flex justify-end gap-3">
-                                <MalioButton
-                                    variant="tertiary"
-                                    :label="$t('common.cancel')"
-                                    button-class="w-auto px-4"
-                                    @click="cancelEdit"
-                                />
-                                <MalioButton
-                                    :label="$t('common.save')"
-                                    button-class="w-auto px-6"
-                                    :disabled="isSaving"
-                                    @click="saveEdit"
-                                />
-                            </div>
-                        </template>
-
-                        <!-- View mode -->
-                        <template v-else>
-                            <!-- Title -->
-                            <h3 class="text-base font-bold text-neutral-900">{{ ticket.title }}</h3>
-
-                            <!-- Badges -->
-                            <div class="mt-3 flex items-center gap-2">
-                                <span
-                                    class="rounded-full px-2 py-0.5 text-xs font-semibold text-white"
-                                    :class="typeBadgeClass(ticket.type)"
-                                >
-                                    {{ $t(`clientTicket.type.${ticket.type}`) }}
-                                </span>
-                                <span
-                                    class="rounded-full px-3 py-1 text-xs font-semibold"
-                                    :class="statusBadgeClass(ticket.status)"
-                                >
-                                    {{ $t(`clientTicket.status.${ticket.status}`) }}
-                                </span>
-                            </div>
-
-                            <!-- Description -->
-                            <div class="mt-4">
-                                <p class="text-sm font-medium text-neutral-700">{{ $t('clientTicket.description') }}</p>
-                                <MalioInputRichText
-                                    v-if="ticket.description"
-                                    :model-value="ticket.description"
-                                    :editable="false"
-                                    group-class="mt-1"
-                                />
-                                <p v-else class="mt-1 text-sm italic text-neutral-400">—</p>
-                            </div>
-
-                            <!-- URL (if bug) -->
-                            <div v-if="ticket.url" class="mt-4">
-                                <p class="text-sm font-medium text-neutral-700">{{ $t('clientTicket.url') }}</p>
-                                <a
-                                    :href="ticket.url"
-                                    target="_blank"
-                                    class="mt-1 text-sm text-primary-500 underline hover:text-primary-600"
-                                >
-                                    {{ ticket.url }}
-                                </a>
-                            </div>
-
-                            <!-- Status comment -->
-                            <div v-if="ticket.statusComment" class="mt-4">
-                                <p class="text-sm font-medium text-neutral-700">{{ $t('clientTicket.statusComment') }}</p>
-                                <p class="mt-1 whitespace-pre-wrap rounded-lg bg-neutral-50 p-3 text-sm text-neutral-600">{{ ticket.statusComment }}</p>
-                            </div>
-
-                            <!-- Documents -->
-                            <TaskDocumentList
-                                v-if="localDocuments.length"
-                                :documents="localDocuments"
-                                :is-admin="canEdit"
-                                @preview="openPreview"
-                                @delete="handleDeleteDocument"
-                            />
-
-                            <!-- Document preview -->
-                            <TaskDocumentPreview
-                                :document="previewDoc"
-                                :has-prev="previewIndex > 0"
-                                :has-next="previewIndex < localDocuments.length - 1"
-                                @close="previewDoc = null"
-                                @prev="prevPreview"
-                                @next="nextPreview"
-                            />
-
-                            <!-- Upload zone -->
-                            <TaskDocumentUpload
-                                v-if="ticket"
-                                :client-ticket-id="ticket.id"
-                                @uploaded="refreshDocuments"
-                            />
-
-                            <!-- Date -->
-                            <p class="mt-6 text-xs text-neutral-400">
-                                {{ $t('clientTicket.createdAt') }} : {{ formatDate(ticket.createdAt) }}
-                            </p>
-                        </template>
-                    </div>
-                </div>
-            </div>
-        </Transition>
-    </Teleport>
-</template>
-
-<script setup lang="ts">
-import type { ClientTicket, ClientTicketWrite } from '~/services/dto/client-ticket'
-import type { TaskDocument } from '~/services/dto/task-document'
-import { useTaskDocumentService } from '~/services/task-documents'
-import { useClientTicketService } from '~/services/client-tickets'
-
-const props = defineProps<{
-    modelValue: boolean
-    ticket: ClientTicket | null
-}>()
-
-const emit = defineEmits<{
-    (e: 'update:modelValue', value: boolean): void
-    (e: 'refresh'): void
-}>()
-
-const isOpen = computed({
-    get: () => props.modelValue,
-    set: (v) => emit('update:modelValue', v),
-})
-
-function close() {
-    isEditing.value = false
-    isOpen.value = false
-}
-
-const auth = useAuthStore()
-const { getByTicket, remove: removeDocument } = useTaskDocumentService()
-const clientTicketService = useClientTicketService()
-const { typeBadgeClass, statusBadgeClass, formatDate } = useClientTicketHelpers()
-
-// Edit mode
-const isEditing = ref(false)
-const isSaving = ref(false)
-const editForm = reactive({
-    title: '',
-    description: '',
-    url: '',
-})
-
-const isAdmin = computed(() => auth.user?.roles?.includes('ROLE_ADMIN') ?? false)
-
-const canEdit = computed(() => {
-    if (!props.ticket) return false
-    if (isAdmin.value) return true
-    const status = props.ticket.status
-    if (status === 'done' || status === 'rejected') return false
-    const userId = auth.user?.id
-    if (!userId) return false
-    const sub = props.ticket.submittedBy
-    if (!sub) return false
-    // submittedBy can be an IRI string or an embedded object
-    if (typeof sub === 'string') return sub === `/api/users/${userId}`
-    if (typeof sub === 'object' && 'id' in sub) return (sub as { id: number }).id === userId
-    return false
-})
-
-function startEdit() {
-    if (!props.ticket) return
-    editForm.title = props.ticket.title
-    editForm.description = props.ticket.description
-    editForm.url = props.ticket.url ?? ''
-    isEditing.value = true
-}
-
-function cancelEdit() {
-    isEditing.value = false
-}
-
-async function saveEdit() {
-    if (!props.ticket) return
-    isSaving.value = true
-    try {
-        const data: Record<string, unknown> = {
-            title: editForm.title,
-            description: editForm.description,
-        }
-        if (props.ticket.type === 'bug') {
-            data.url = editForm.url || null
-        }
-        await clientTicketService.update(props.ticket.id, data as Partial<ClientTicketWrite>)
-        isEditing.value = false
-        emit('refresh')
-    } finally {
-        isSaving.value = false
-    }
-}
-
-// Reset edit mode when ticket changes
-watch(() => props.ticket?.id, () => {
-    isEditing.value = false
-})
-
-async function handleDeleteDocument(doc: TaskDocument) {
-    await removeDocument(doc.id)
-    await refreshDocuments()
-}
-
-async function refreshDocuments() {
-    if (!props.ticket) return
-    localDocuments.value = await getByTicket(props.ticket.id)
-}
-
-// Document list (local copy to allow refresh)
-const localDocuments = ref<TaskDocument[]>([])
-
-watch(() => props.ticket?.documents, (docs) => {
-    localDocuments.value = docs ? [...docs] : []
-}, { immediate: true })
-
-// Document preview
-const previewDoc = ref<TaskDocument | null>(null)
-
-const previewIndex = computed(() => {
-    if (!previewDoc.value) return -1
-    return localDocuments.value.findIndex(d => d.id === previewDoc.value!.id)
-})
-
-function openPreview(doc: TaskDocument) {
-    previewDoc.value = doc
-}
-
-function prevPreview() {
-    if (previewIndex.value > 0) {
-        previewDoc.value = localDocuments.value[previewIndex.value - 1]
-    }
-}
-
-function nextPreview() {
-    if (previewIndex.value < localDocuments.value.length - 1) {
-        previewDoc.value = localDocuments.value[previewIndex.value + 1]
-    }
-}
-</script>
-
-<style scoped>
-.ticket-modal-enter-active,
-.ticket-modal-leave-active {
-    transition: opacity 0.2s ease;
-}
-
-.ticket-modal-enter-active > div:last-child,
-.ticket-modal-leave-active > div:last-child {
-    transition: transform 0.2s cubic-bezier(0.16, 1, 0.3, 1), opacity 0.2s ease;
-}
-
-.ticket-modal-enter-from,
-.ticket-modal-leave-to {
-    opacity: 0;
-}
-
-.ticket-modal-enter-from > div:last-child {
-    transform: scale(0.95) translateY(8px);
-    opacity: 0;
-}
-
-.ticket-modal-leave-to > div:last-child {
-    transform: scale(0.97);
-    opacity: 0;
-}
-</style>
diff --git a/frontend/components/client-ticket/ProjectClientTickets.vue b/frontend/components/client-ticket/ProjectClientTickets.vue
deleted file mode 100644
index 83995d3..0000000
--- a/frontend/components/client-ticket/ProjectClientTickets.vue
+++ /dev/null
@@ -1,333 +0,0 @@
-<template>
-    <div>
-        <!-- Trigger button -->
-        <MalioButton
-            variant="tertiary"
-            icon-name="mdi:ticket-outline"
-            icon-position="left"
-            button-class="w-auto px-3 sm:px-4 shrink-0"
-            @click="open"
-        >
-            <span class="hidden sm:inline">{{ $t('clientTicket.adminTab') }}</span>
-            <span
-                v-if="totalCount > 0"
-                class="flex h-5 min-w-5 items-center justify-center rounded-full bg-primary-500 px-1 text-xs font-bold text-white"
-            >
-                {{ totalCount }}
-            </span>
-        </MalioButton>
-
-        <!-- Panel -->
-        <Teleport v-if="isOpen" to="body">
-            <Transition name="ct-panel" appear>
-                <div class="fixed inset-0 z-50 flex justify-end">
-                    <!-- Backdrop -->
-                    <div
-                        class="absolute inset-0 bg-slate-900/40 backdrop-blur-sm"
-                        @click="close"
-                    />
-
-                    <!-- Slide panel -->
-                    <div class="relative z-10 flex h-full w-full max-w-lg flex-col bg-white shadow-2xl">
-                        <!-- Header -->
-                        <div class="flex items-center justify-between border-b border-neutral-200 px-5 py-4">
-                            <div>
-                                <h2 class="text-base font-bold text-neutral-900">{{ $t('clientTicket.adminTab') }}</h2>
-                                <p class="mt-0.5 text-xs text-neutral-400">{{ projectName }}</p>
-                            </div>
-                            <MalioButtonIcon
-                                icon="mdi:close"
-                                aria-label="Fermer"
-                                variant="ghost"
-                                icon-size="20"
-                                @click="close"
-                            />
-                        </div>
-
-                        <!-- Filters -->
-                        <div class="flex items-center gap-3 border-b border-neutral-100 px-5 py-3">
-                            <select
-                                v-model="filterStatus"
-                                class="rounded-lg border border-neutral-300 px-3 py-1.5 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
-                            >
-                                <option :value="null">{{ $t('clientTicket.allStatuses') }}</option>
-                                <option value="new">{{ $t('clientTicket.status.new') }}</option>
-                                <option value="in_progress">{{ $t('clientTicket.status.in_progress') }}</option>
-                                <option value="done">{{ $t('clientTicket.status.done') }}</option>
-                                <option value="rejected">{{ $t('clientTicket.status.rejected') }}</option>
-                            </select>
-                        </div>
-
-                        <!-- Content -->
-                        <div class="flex-1 overflow-y-auto px-5 py-4">
-                            <div v-if="isLoading" class="py-8 text-center text-sm text-neutral-400">
-                                {{ $t('common.loading') }}
-                            </div>
-
-                            <div v-else-if="filteredTickets.length === 0" class="py-8 text-center text-sm text-neutral-400">
-                                {{ $t('clientTicket.noTickets') }}
-                            </div>
-
-                            <div v-else class="space-y-2">
-                                <div
-                                    v-for="ticket in filteredTickets"
-                                    :key="ticket.id"
-                                    class="rounded-lg border border-neutral-200 bg-white"
-                                >
-                                    <!-- Ticket row -->
-                                    <div
-                                        class="flex cursor-pointer items-start justify-between gap-3 p-3 transition-colors hover:bg-neutral-50"
-                                        @click="toggleExpand(ticket.id)"
-                                    >
-                                        <div class="min-w-0 flex-1">
-                                            <div class="flex items-center gap-2">
-                                                <span class="text-xs font-bold text-primary-500">CT-{{ String(ticket.number).padStart(3, '0') }}</span>
-                                                <span
-                                                    class="rounded-full px-2 py-0.5 text-xs font-semibold text-white"
-                                                    :class="typeBadgeClass(ticket.type)"
-                                                >
-                                                    {{ $t(`clientTicket.type.${ticket.type}`) }}
-                                                </span>
-                                                <span
-                                                    class="rounded-full px-2 py-0.5 text-xs font-semibold"
-                                                    :class="statusBadgeClass(ticket.status)"
-                                                >
-                                                    {{ $t(`clientTicket.status.${ticket.status}`) }}
-                                                </span>
-                                            </div>
-                                            <p class="mt-1 text-sm font-semibold text-neutral-900 leading-snug">{{ ticket.title }}</p>
-                                            <p class="mt-0.5 text-xs text-neutral-400">{{ formatDate(ticket.createdAt) }}</p>
-                                        </div>
-                                        <div class="flex items-center gap-1">
-                                            <MalioButtonIcon
-                                                icon="mdi:swap-horizontal"
-                                                :aria-label="$t('clientTicket.changeStatus')"
-                                                variant="ghost"
-                                                icon-size="16"
-                                                @click.stop="openStatusChange(ticket)"
-                                            />
-                                            <Icon
-                                                :name="expandedId === ticket.id ? 'mdi:chevron-up' : 'mdi:chevron-down'"
-                                                size="18"
-                                                class="text-neutral-400"
-                                            />
-                                        </div>
-                                    </div>
-
-                                    <!-- Expanded details -->
-                                    <div v-if="expandedId === ticket.id" class="border-t border-neutral-100 px-3 py-3">
-                                        <MalioInputRichText
-                                            v-if="ticket.description"
-                                            :model-value="ticket.description"
-                                            :editable="false"
-                                        />
-                                        <p v-else class="text-sm italic text-neutral-400">—</p>
-                                        <div v-if="ticket.url" class="mt-2">
-                                            <a
-                                                :href="ticket.url"
-                                                target="_blank"
-                                                class="text-xs text-primary-500 underline hover:text-primary-600"
-                                            >
-                                                {{ ticket.url }}
-                                            </a>
-                                        </div>
-                                        <div v-if="ticket.statusComment" class="mt-2 rounded-lg bg-neutral-50 p-2 text-xs text-neutral-500">
-                                            {{ ticket.statusComment }}
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-            </Transition>
-        </Teleport>
-
-        <!-- Status change modal -->
-        <Teleport v-if="statusModalOpen" to="body">
-            <Transition name="ct-modal" appear>
-                <div class="fixed inset-0 z-[60] flex items-center justify-center p-4">
-                    <div
-                        class="absolute inset-0 bg-slate-900/40 backdrop-blur-sm"
-                        @click="statusModalOpen = false"
-                    />
-                    <div class="relative z-10 w-full max-w-md rounded-2xl bg-white p-6 shadow-2xl">
-                        <h3 class="text-lg font-bold text-neutral-900">{{ $t('clientTicket.changeStatus') }}</h3>
-                        <p v-if="statusTarget" class="mt-1 text-sm text-neutral-500">
-                            CT-{{ String(statusTarget.number).padStart(3, '0') }} — {{ statusTarget.title }}
-                        </p>
-
-                        <div class="mt-4">
-                            <label class="mb-1 block text-sm font-medium text-neutral-700">Nouveau statut</label>
-                            <select
-                                v-model="newStatus"
-                                class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
-                            >
-                                <option :value="null" disabled>—</option>
-                                <option
-                                    v-for="s in availableStatusTransitions"
-                                    :key="s.value"
-                                    :value="s.value"
-                                >
-                                    {{ s.label }}
-                                </option>
-                            </select>
-                        </div>
-
-                        <div v-if="newStatus === 'rejected'" class="mt-4">
-                            <MalioInputTextArea
-                                v-model="statusComment"
-                                :label="$t('clientTicket.statusComment')"
-                                :size="3"
-                            />
-                            <p v-if="rejectionError" class="mt-1 text-xs text-red-500">
-                                {{ $t('clientTicket.rejectionRequired') }}
-                            </p>
-                        </div>
-
-                        <div class="mt-6 flex justify-end gap-3">
-                            <MalioButton
-                                variant="tertiary"
-                                :label="$t('common.cancel')"
-                                button-class="w-auto px-4"
-                                @click="statusModalOpen = false"
-                            />
-                            <MalioButton
-                                label="Confirmer"
-                                button-class="w-auto px-6"
-                                :disabled="isUpdatingStatus"
-                                @click="confirmStatusChange"
-                            />
-                        </div>
-                    </div>
-                </div>
-            </Transition>
-        </Teleport>
-    </div>
-</template>
-
-<script setup lang="ts">
-import type { ClientTicket, ClientTicketStatus } from '~/services/dto/client-ticket'
-import { useClientTicketService } from '~/services/client-tickets'
-
-const props = defineProps<{
-    projectId: number
-    projectName: string
-}>()
-
-const { t } = useI18n()
-const clientTicketService = useClientTicketService()
-const { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions } = useClientTicketHelpers()
-
-const isOpen = ref(false)
-const isLoading = ref(false)
-const tickets = ref<ClientTicket[]>([])
-const filterStatus = ref<string | null>(null)
-const expandedId = ref<number | null>(null)
-
-const totalCount = computed(() =>
-    tickets.value.filter(t => t.status === 'new' || t.status === 'in_progress').length
-)
-
-const filteredTickets = computed(() => {
-    if (!filterStatus.value) return tickets.value
-    return tickets.value.filter(t => t.status === filterStatus.value)
-})
-
-// Status change
-const statusModalOpen = ref(false)
-const statusTarget = ref<ClientTicket | null>(null)
-const newStatus = ref<string | null>(null)
-const statusComment = ref('')
-const rejectionError = ref(false)
-const isUpdatingStatus = ref(false)
-
-const availableStatusTransitions = computed(() => {
-    if (!statusTarget.value) return []
-    return getAvailableStatusTransitions(statusTarget.value.status, t)
-})
-
-async function loadTickets() {
-    isLoading.value = true
-    try {
-        tickets.value = await clientTicketService.getAll({ project: props.projectId })
-    } finally {
-        isLoading.value = false
-    }
-}
-
-function open() {
-    isOpen.value = true
-    loadTickets()
-}
-
-function close() {
-    isOpen.value = false
-    expandedId.value = null
-}
-
-function toggleExpand(id: number) {
-    expandedId.value = expandedId.value === id ? null : id
-}
-
-function openStatusChange(ticket: ClientTicket) {
-    statusTarget.value = ticket
-    newStatus.value = null
-    statusComment.value = ''
-    rejectionError.value = false
-    statusModalOpen.value = true
-}
-
-async function confirmStatusChange() {
-    if (!statusTarget.value || !newStatus.value) return
-
-    if (newStatus.value === 'rejected' && !statusComment.value.trim()) {
-        rejectionError.value = true
-        return
-    }
-
-    isUpdatingStatus.value = true
-    try {
-        await clientTicketService.updateStatus(statusTarget.value.id, {
-            status: newStatus.value as ClientTicketStatus,
-            statusComment: newStatus.value === 'rejected' ? statusComment.value.trim() : null,
-        })
-        statusModalOpen.value = false
-        await loadTickets()
-    } finally {
-        isUpdatingStatus.value = false
-    }
-}
-</script>
-
-<style scoped>
-.ct-panel-enter-active,
-.ct-panel-leave-active {
-    transition: opacity 0.2s ease;
-}
-
-.ct-panel-enter-active > div:last-child,
-.ct-panel-leave-active > div:last-child {
-    transition: transform 0.25s cubic-bezier(0.16, 1, 0.3, 1);
-}
-
-.ct-panel-enter-from,
-.ct-panel-leave-to {
-    opacity: 0;
-}
-
-.ct-panel-enter-from > div:last-child,
-.ct-panel-leave-to > div:last-child {
-    transform: translateX(100%);
-}
-
-.ct-modal-enter-active,
-.ct-modal-leave-active {
-    transition: opacity 0.15s ease;
-}
-
-.ct-modal-enter-from,
-.ct-modal-leave-to {
-    opacity: 0;
-}
-</style>
diff --git a/frontend/components/client/ClientDrawer.vue b/frontend/components/client/ClientDrawer.vue
index 1c1a536..918b188 100644
--- a/frontend/components/client/ClientDrawer.vue
+++ b/frontend/components/client/ClientDrawer.vue
@@ -1,5 +1,8 @@
 <template>
-    <MalioDrawer v-model="isOpen" :title="isEditing ? $t('clients.editClient') : $t('clients.addClient')">
+    <MalioDrawer v-model="isOpen">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ isEditing ? $t('clients.editClient') : $t('clients.addClient') }}</h2>
+        </template>
         <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
             <MalioInputText
                 v-model="form.name"
diff --git a/frontend/components/mail/MailCreateTaskModal.vue b/frontend/components/mail/MailCreateTaskModal.vue
index bc7f44c..64e3fa4 100644
--- a/frontend/components/mail/MailCreateTaskModal.vue
+++ b/frontend/components/mail/MailCreateTaskModal.vue
@@ -119,20 +119,20 @@ async function handleSubmit(): Promise<void> {
             </div>
 
             <div>
-                <MalioSelect v-model="projectId" :options="projectOptions" :label="t('mail.createTaskModal.projectLabel')" :empty-option-label="t('mail.createTaskModal.projectPlaceholder')" min-width="w-full" />
+                <MalioSelect v-model="projectId" :options="projectOptions" :label="t('mail.createTaskModal.projectLabel')" :empty-option-label="t('mail.createTaskModal.projectPlaceholder')" group-class="w-full" />
                 <p v-if="touchedProject && !projectId" class="mt-1 text-xs text-red-500">{{ t('mail.createTaskModal.projectLabel').replace(' *', '') }} requis</p>
             </div>
 
             <div v-if="projectId">
-                <MalioSelect v-model="taskGroupId" :options="groupOptions" :label="t('mail.createTaskModal.groupLabel')" :empty-option-label="t('mail.createTaskModal.groupPlaceholder')" min-width="w-full" :disabled="loadingGroups" />
+                <MalioSelect v-model="taskGroupId" :options="groupOptions" :label="t('mail.createTaskModal.groupLabel')" :empty-option-label="t('mail.createTaskModal.groupPlaceholder')" group-class="w-full" :disabled="loadingGroups" />
             </div>
 
             <div v-if="projectId">
-                <MalioSelect v-model="statusId" :options="statusOptions" :label="t('mail.createTaskModal.statusLabel')" min-width="w-full" />
+                <MalioSelect v-model="statusId" :options="statusOptions" :label="t('mail.createTaskModal.statusLabel')" group-class="w-full" />
             </div>
 
             <div>
-                <MalioSelect v-model="assigneeId" :options="userOptions" :label="t('mail.createTaskModal.assigneeLabel')" :empty-option-label="t('mail.createTaskModal.assigneePlaceholder')" min-width="w-full" />
+                <MalioSelect v-model="assigneeId" :options="userOptions" :label="t('mail.createTaskModal.assigneeLabel')" :empty-option-label="t('mail.createTaskModal.assigneePlaceholder')" group-class="w-full" />
             </div>
         </div>
 
diff --git a/frontend/components/mail/MailLinkTaskModal.vue b/frontend/components/mail/MailLinkTaskModal.vue
index 78c2180..9749099 100644
--- a/frontend/components/mail/MailLinkTaskModal.vue
+++ b/frontend/components/mail/MailLinkTaskModal.vue
@@ -147,7 +147,7 @@ async function handleSubmit(): Promise<void> {
                             :options="projectFilterOptions"
                             :label="t('mail.linkTaskModal.projectFilter')"
                             :empty-option-label="t('mail.linkTaskModal.projectAll')"
-                            min-width="w-full"
+                            group-class="w-full"
                         />
 
                         <!-- Recherche tâche -->
diff --git a/frontend/components/notification/NotificationBell.vue b/frontend/components/notification/NotificationBell.vue
index c7b3eca..38383e9 100644
--- a/frontend/components/notification/NotificationBell.vue
+++ b/frontend/components/notification/NotificationBell.vue
@@ -106,19 +106,7 @@ function handleClick(notif: Notification) {
     if (!notif.isRead) {
         markAsRead(notif.id)
     }
-
-    if (notif.relatedTicket) {
-        const auth = useAuthStore()
-        const isClient = auth.user?.roles?.includes('ROLE_CLIENT')
-
-        if (isClient) {
-            navigateTo(`/portal`)
-        } else {
-            navigateTo(`/admin?tab=tickets`)
-        }
-
-        isOpen.value = false
-    }
+    isOpen.value = false
 }
 
 async function handleMarkAllRead() {
diff --git a/frontend/components/project/ProjectDrawer.vue b/frontend/components/project/ProjectDrawer.vue
index 7410d7f..27d639b 100644
--- a/frontend/components/project/ProjectDrawer.vue
+++ b/frontend/components/project/ProjectDrawer.vue
@@ -1,5 +1,8 @@
 <template>
-    <MalioDrawer v-model="isOpen" :title="isEditing ? $t('projects.editProject') : $t('projects.addProject')">
+    <MalioDrawer v-model="isOpen">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ isEditing ? $t('projects.editProject') : $t('projects.addProject') }}</h2>
+        </template>
         <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
             <MalioInputText
                 v-model="codeProxy"
@@ -27,7 +30,7 @@
                 :options="clientOptions"
                 label="Client"
                 empty-option-label="Aucun client"
-                min-width="w-full"
+                group-class="w-full"
             />
             <div class="mt-4">
                 <ColorPicker v-model="form.color" />
@@ -39,7 +42,7 @@
                     :options="giteaRepoOptions"
                     label="Dépôt Gitea"
                     empty-option-label="Aucun dépôt"
-                    min-width="w-full"
+                    group-class="w-full"
                 />
             </div>
 
@@ -49,7 +52,7 @@
                     :options="bookstackShelfOptions"
                     label="Étagère BookStack"
                     empty-option-label="Aucune étagère"
-                    min-width="w-full"
+                    group-class="w-full"
                 />
             </div>
 
diff --git a/frontend/components/project/ProjectWorkflowSwitchModal.vue b/frontend/components/project/ProjectWorkflowSwitchModal.vue
index 0fee759..3b5a3a6 100644
--- a/frontend/components/project/ProjectWorkflowSwitchModal.vue
+++ b/frontend/components/project/ProjectWorkflowSwitchModal.vue
@@ -12,7 +12,7 @@
                             :options="targetOptions"
                             :label="$t('workflows.switchTargetLabel')"
                             empty-option-label="—"
-                            min-width="!w-full"
+                            group-class="!w-full"
                         />
 
                         <div v-if="targetWorkflow" class="flex flex-col gap-2">
diff --git a/frontend/components/task/TaskBulkActions.vue b/frontend/components/task/TaskBulkActions.vue
index 617aa19..264b671 100644
--- a/frontend/components/task/TaskBulkActions.vue
+++ b/frontend/components/task/TaskBulkActions.vue
@@ -21,7 +21,7 @@
                 :options="statusOptions"
                 label="Status"
                 empty-option-label="Status"
-                min-width="!w-32"
+                group-class="!w-32"
                 text-field="text-xs"
                 text-value="text-xs"
                 @update:model-value="(v: number | null) => v && emit('bulk-update', 'status', v)"
@@ -39,7 +39,7 @@
                 :options="userOptions"
                 label="User"
                 empty-option-label="User"
-                min-width="!w-32"
+                group-class="!w-32"
                 text-field="text-xs"
                 text-value="text-xs"
                 @update:model-value="(v: number | null) => v && emit('bulk-update', 'assignee', v)"
@@ -50,7 +50,7 @@
                 :options="priorityOptions"
                 label="Priorité"
                 empty-option-label="Priorité"
-                min-width="!w-32"
+                group-class="!w-32"
                 text-field="text-xs"
                 text-value="text-xs"
                 @update:model-value="(v: number | null) => v && emit('bulk-update', 'priority', v)"
@@ -61,7 +61,7 @@
                 :options="effortOptions"
                 label="Effort"
                 empty-option-label="Effort"
-                min-width="!w-32"
+                group-class="!w-32"
                 text-field="text-xs"
                 text-value="text-xs"
                 @update:model-value="(v: number | null) => v && emit('bulk-update', 'effort', v)"
@@ -73,7 +73,7 @@
                 :options="groupOptions"
                 label="Groupe"
                 empty-option-label="Groupe"
-                min-width="!w-32"
+                group-class="!w-32"
                 text-field="text-xs"
                 text-value="text-xs"
                 @update:model-value="(v: number | null) => v && emit('bulk-update', 'group', v)"
diff --git a/frontend/components/task/TaskCard.vue b/frontend/components/task/TaskCard.vue
index b9b5616..595b319 100644
--- a/frontend/components/task/TaskCard.vue
+++ b/frontend/components/task/TaskCard.vue
@@ -20,12 +20,6 @@
                         name="mdi:flag-variant"
                         class="h-3.5 w-3.5 text-red-600"
                     />
-                    <Icon
-                        v-if="task.clientTicket"
-                        name="heroicons:user-circle"
-                        class="h-4 w-4 text-blue-400"
-                        :title="$t('clientTicket.linkedTooltip', { number: 'CT-' + String(task.clientTicket.number).padStart(3, '0') })"
-                    />
                 </div>
                 <h4 class="line-clamp-2 text-sm font-semibold text-neutral-900">{{ task.title }}</h4>
             </div>
diff --git a/frontend/components/task/TaskDocumentUpload.vue b/frontend/components/task/TaskDocumentUpload.vue
index d78d854..853850a 100644
--- a/frontend/components/task/TaskDocumentUpload.vue
+++ b/frontend/components/task/TaskDocumentUpload.vue
@@ -50,14 +50,13 @@ import { useTaskDocumentService } from '~/services/task-documents'
 
 const props = defineProps<{
     taskId?: number
-    clientTicketId?: number
 }>()
 
 const emit = defineEmits<{
     uploaded: []
 }>()
 
-const { upload: uploadFile, uploadForTicket } = useTaskDocumentService()
+const { upload: uploadFile } = useTaskDocumentService()
 const toast = useToast()
 const { t } = useI18n()
 
@@ -110,9 +109,7 @@ async function processFiles(files: File[]) {
         uploads.value.push(state)
 
         try {
-            if (props.clientTicketId) {
-                await uploadForTicket(props.clientTicketId, file)
-            } else if (props.taskId) {
+            if (props.taskId) {
                 await uploadFile(props.taskId, file)
             }
             state.uploading = false
diff --git a/frontend/components/task/TaskEffortDrawer.vue b/frontend/components/task/TaskEffortDrawer.vue
index ffe93bd..ac186be 100644
--- a/frontend/components/task/TaskEffortDrawer.vue
+++ b/frontend/components/task/TaskEffortDrawer.vue
@@ -1,5 +1,8 @@
 <template>
-    <MalioDrawer v-model="isOpen" :title="isEditing ? $t('taskEfforts.editEffort') : $t('taskEfforts.addEffort')">
+    <MalioDrawer v-model="isOpen">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ isEditing ? $t('taskEfforts.editEffort') : $t('taskEfforts.addEffort') }}</h2>
+        </template>
         <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
             <MalioInputText
                 v-model="form.label"
diff --git a/frontend/components/task/TaskGitSection.vue b/frontend/components/task/TaskGitSection.vue
index 1ea4716..ae4012a 100644
--- a/frontend/components/task/TaskGitSection.vue
+++ b/frontend/components/task/TaskGitSection.vue
@@ -70,7 +70,7 @@
                         v-model="branchForm.type"
                         :options="typeOptions"
                         :label="$t('gitea.branch.type')"
-                        min-width="w-full"
+                        group-class="w-full"
                     />
                     <MalioInputText
                         v-model="branchForm.baseBranch"
diff --git a/frontend/components/task/TaskGroupDrawer.vue b/frontend/components/task/TaskGroupDrawer.vue
index c018435..2d64266 100644
--- a/frontend/components/task/TaskGroupDrawer.vue
+++ b/frontend/components/task/TaskGroupDrawer.vue
@@ -1,5 +1,8 @@
 <template>
-    <MalioDrawer v-model="isOpen" :title="isEditing ? $t('taskGroups.editGroup') : $t('taskGroups.addGroup')">
+    <MalioDrawer v-model="isOpen">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ isEditing ? $t('taskGroups.editGroup') : $t('taskGroups.addGroup') }}</h2>
+        </template>
         <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
             <MalioInputText
                 v-model="form.title"
diff --git a/frontend/components/task/TaskModal.vue b/frontend/components/task/TaskModal.vue
index 5bae45b..55e83d4 100644
--- a/frontend/components/task/TaskModal.vue
+++ b/frontend/components/task/TaskModal.vue
@@ -35,23 +35,6 @@
                                 @click="close"
                             />
                         </div>
-
-                        <!-- Client ticket link -->
-                        <div
-                            v-if="isEditing && task?.clientTicket"
-                            class="mt-2 flex items-center gap-2 rounded-lg bg-blue-50 px-3 py-2"
-                        >
-                            <Icon name="heroicons:user-circle" class="h-5 w-5 text-blue-500" />
-                            <span class="text-sm font-medium text-blue-700">
-                                {{ $t('clientTicket.linkedTooltip', { number: 'CT-' + String(task.clientTicket.number).padStart(3, '0') }) }}
-                            </span>
-                            <span
-                                class="ml-auto rounded-full px-2 py-0.5 text-xs font-semibold"
-                                :class="ticketStatusClass(task.clientTicket.status)"
-                            >
-                                {{ $t(`clientTicket.status.${task.clientTicket.status}`) }}
-                            </span>
-                        </div>
                     </div>
 
                     <!-- Body -->
@@ -91,7 +74,7 @@
                                 :options="projectOptions"
                                 label="Projet *"
                                 empty-option-label="Sélectionner un projet"
-                                min-width="w-full"
+                                group-class="w-full"
                             />
                             <p v-if="touched.project && !form.projectId" class="mt-1 text-xs text-red-500">
                                 Le projet est requis
@@ -105,43 +88,35 @@
                                 :options="statusOptions"
                                 label="Statut"
                                 empty-option-label="Aucun statut"
-                                min-width="w-full"
+                                group-class="w-full"
                             />
                             <MalioSelect
                                 v-model="form.assigneeId"
                                 :options="userOptions"
                                 label="User"
                                 empty-option-label="Aucun utilisateur"
-                                min-width="w-full"
+                                group-class="w-full"
                             />
                             <MalioSelect
                                 v-model="form.effortId"
                                 :options="effortOptions"
                                 label="Effort"
                                 empty-option-label="Aucun effort"
-                                min-width="w-full"
+                                group-class="w-full"
                             />
                             <MalioSelect
                                 v-model="form.priorityId"
                                 :options="priorityOptions"
                                 label="Priorité"
                                 empty-option-label="Aucune priorité"
-                                min-width="w-full"
+                                group-class="w-full"
                             />
                             <MalioSelect
                                 v-model="form.groupId"
                                 :options="groupOptions"
                                 label="Groupe"
                                 empty-option-label="Aucun groupe"
-                                min-width="w-full"
-                            />
-                            <MalioSelect
-                                v-if="clientTicketOptions.length"
-                                v-model="form.clientTicketId"
-                                :options="clientTicketOptions"
-                                label="Ticket client"
-                                empty-option-label="Aucun ticket client"
-                                min-width="w-full"
+                                group-class="w-full"
                             />
                         </div>
 
@@ -549,10 +524,8 @@
 <script setup lang="ts">
 import type { Task, TaskWrite } from '~/services/dto/task'
 import type { TaskDocument } from '~/services/dto/task-document'
-import type { ClientTicket } from '~/services/dto/client-ticket'
 import { useGiteaService } from '~/services/gitea'
 import { useTaskDocumentService } from '~/services/task-documents'
-import { useClientTicketService } from '~/services/client-tickets'
 import ConfirmDeleteDocumentModal from '~/components/ui/ConfirmDeleteDocumentModal.vue'
 import type { TaskStatus } from '~/services/dto/task-status'
 import type { TaskEffort } from '~/services/dto/task-effort'
@@ -627,7 +600,6 @@ const form = reactive({
     collaboratorIds: [] as number[],
     groupId: null as number | null,
     tagIds: [] as number[],
-    clientTicketId: null as number | null,
     projectId: null as number | null,
     scheduledStart: '',
     scheduledEnd: '',
@@ -757,7 +729,6 @@ function populateForm(task: Task | null) {
         form.collaboratorIds = task.collaborators?.map(c => c.id) ?? []
         form.groupId = task.group?.id ?? null
         form.tagIds = task.tags.map(t => t.id)
-        form.clientTicketId = task.clientTicket?.id ?? null
         form.scheduledStart = task.scheduledStart ? task.scheduledStart.slice(0, 16) : ''
         form.scheduledEnd = task.scheduledEnd ? task.scheduledEnd.slice(0, 16) : ''
         form.deadline = task.deadline ? task.deadline.slice(0, 10) : ''
@@ -804,7 +775,6 @@ function populateForm(task: Task | null) {
         form.collaboratorIds = []
         form.groupId = null
         form.tagIds = []
-        form.clientTicketId = null
         form.projectId = null
         form.scheduledStart = ''
         form.scheduledEnd = ''
@@ -833,16 +803,6 @@ watch(() => props.modelValue, async (open) => {
         documentToDelete.value = null
         linkedMails.value = []
         populateForm(props.task)
-        const pid = resolvedProjectId.value
-        if (pid) {
-            try {
-                clientTickets.value = await clientTicketService.getAll({ project: pid })
-            } catch {
-                clientTickets.value = []
-            }
-        } else {
-            clientTickets.value = []
-        }
         if (props.task?.project?.giteaOwner && props.task?.project?.giteaRepo && !giteaUrl.value) {
             try {
                 const settings = await getGiteaSettings()
@@ -862,48 +822,26 @@ watch(() => props.task, (task) => {
 
 const { create, update, remove } = useTaskService()
 const { remove: removeDocument, getByTask: getDocumentsByTask } = useTaskDocumentService()
-const clientTicketService = useClientTicketService()
 const { create: createRecurrence, update: updateRecurrence, remove: removeRecurrence } = useTaskRecurrenceService()
 const { t } = useI18n()
 
-const clientTickets = ref<ClientTicket[]>([])
-const clientTicketOptions = computed(() =>
-    clientTickets.value.map(ct => ({ label: `CT-${String(ct.number).padStart(3, '0')} — ${ct.title}`, value: ct.id }))
-)
-
-// Reset group and reload client tickets when project changes in create mode
-watch(() => form.projectId, async (pid) => {
+// Reset group when project changes in create mode
+watch(() => form.projectId, () => {
     if (!showProjectSelect.value) return
     form.groupId = null
-    form.clientTicketId = null
-    if (pid) {
-        try {
-            clientTickets.value = await clientTicketService.getAll({ project: pid })
-        } catch {
-            clientTickets.value = []
-        }
-    } else {
-        clientTickets.value = []
-    }
 })
 
 const authStore = useAuthStore()
 const isAdmin = computed(() => authStore.user?.roles?.includes('ROLE_ADMIN') ?? false)
 
-const isClientOnly = computed(() =>
-    authStore.user?.roles?.includes('ROLE_CLIENT') === true
-    && authStore.user?.roles?.includes('ROLE_ADMIN') !== true,
-)
-const isMailUser = computed(() => !isClientOnly.value)
-
 const availableTabs = computed(() => {
     const base: Array<'details' | 'planning' | 'mails'> = ['details', 'planning']
-    if (isEditing.value && isMailUser.value) base.push('mails')
+    if (isEditing.value) base.push('mails')
     return base
 })
 
 async function loadLinkedMails(): Promise<void> {
-    if (!props.task || !isMailUser.value) return
+    if (!props.task) return
     mailsLoading.value = true
     try {
         linkedMails.value = await mailService.listMailsForTask(props.task.id)
@@ -928,16 +866,6 @@ function formatMailDate(iso: string | null): string {
     })
 }
 
-function ticketStatusClass(status: string): string {
-    switch (status) {
-        case 'new': return 'bg-blue-100 text-blue-700'
-        case 'in_progress': return 'bg-yellow-100 text-yellow-700'
-        case 'done': return 'bg-green-100 text-green-700'
-        case 'rejected': return 'bg-red-100 text-red-700'
-        default: return 'bg-neutral-100 text-neutral-700'
-    }
-}
-
 const localDocuments = ref<TaskDocument[]>([])
 const previewDoc = ref<TaskDocument | null>(null)
 
@@ -1057,7 +985,6 @@ async function handleSubmit() {
             group: form.groupId ? `/api/task_groups/${form.groupId}` : null,
             project: `/api/projects/${resolvedProjectId.value}`,
             tags: form.tagIds.map(id => `/api/task_tags/${id}`),
-            clientTicket: form.clientTicketId ? `/api/client_tickets/${form.clientTicketId}` : null,
             scheduledStart: form.scheduledStart || null,
             scheduledEnd: form.scheduledEnd || null,
             deadline: form.deadline || null,
diff --git a/frontend/components/task/TaskPriorityDrawer.vue b/frontend/components/task/TaskPriorityDrawer.vue
index dfcad3d..627abe4 100644
--- a/frontend/components/task/TaskPriorityDrawer.vue
+++ b/frontend/components/task/TaskPriorityDrawer.vue
@@ -1,5 +1,8 @@
 <template>
-    <MalioDrawer v-model="isOpen" :title="isEditing ? $t('taskPriorities.editPriority') : $t('taskPriorities.addPriority')">
+    <MalioDrawer v-model="isOpen">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ isEditing ? $t('taskPriorities.editPriority') : $t('taskPriorities.addPriority') }}</h2>
+        </template>
         <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
             <MalioInputText
                 v-model="form.label"
diff --git a/frontend/components/task/TaskTagDrawer.vue b/frontend/components/task/TaskTagDrawer.vue
index 81c9715..01ec2e1 100644
--- a/frontend/components/task/TaskTagDrawer.vue
+++ b/frontend/components/task/TaskTagDrawer.vue
@@ -1,5 +1,8 @@
 <template>
-    <MalioDrawer v-model="isOpen" :title="isEditing ? $t('taskTags.editTag') : $t('taskTags.addTag')">
+    <MalioDrawer v-model="isOpen">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ isEditing ? $t('taskTags.editTag') : $t('taskTags.addTag') }}</h2>
+        </template>
         <form @submit.prevent="handleSubmit" class="flex flex-col gap-2">
             <MalioInputText
                 v-model="form.label"
diff --git a/frontend/components/time-tracking/TimeEntryDrawer.vue b/frontend/components/time-tracking/TimeEntryDrawer.vue
index e19e527..f9660b5 100644
--- a/frontend/components/time-tracking/TimeEntryDrawer.vue
+++ b/frontend/components/time-tracking/TimeEntryDrawer.vue
@@ -1,5 +1,8 @@
 <template>
-    <MalioDrawer v-model="isOpen" :title="isEditing ? $t('timeEntries.editEntry') : $t('timeEntries.addEntry')">
+    <MalioDrawer v-model="isOpen">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ isEditing ? $t('timeEntries.editEntry') : $t('timeEntries.addEntry') }}</h2>
+        </template>
         <form class="space-y-4" @submit.prevent="onSubmit">
             <div>
                 <label class="mb-1 block text-sm font-semibold text-neutral-700">Titre</label>
@@ -58,7 +61,7 @@
                 v-model="form.userId"
                 :options="userOptions"
                 label="Utilisateur"
-                min-width="w-full"
+                group-class="w-full"
             />
 
             <MalioSelect
@@ -66,7 +69,7 @@
                 :options="projectOptions"
                 label="Projet"
                 empty-option-label="— Aucun —"
-                min-width="w-full"
+                group-class="w-full"
             />
 
             <div>
diff --git a/frontend/components/time-tracking/TimeTrackingCalendar.vue b/frontend/components/time-tracking/TimeTrackingCalendar.vue
index d23a81e..4b32e29 100644
--- a/frontend/components/time-tracking/TimeTrackingCalendar.vue
+++ b/frontend/components/time-tracking/TimeTrackingCalendar.vue
@@ -9,6 +9,7 @@
                     v-for="day in days"
                     :key="'header-' + day.dateStr"
                     class="flex-1 border-r border-neutral-100 py-2 text-center"
+                    :class="{ 'bg-orange-50': day.holiday }"
                 >
                     <div class="text-lg font-bold" :class="isToday(day.date) ? 'text-orange-500' : 'text-neutral-900'">
                         {{ day.dayNum }}
@@ -16,6 +17,14 @@
                     <div class="text-xs" :class="isToday(day.date) ? 'text-orange-500' : 'text-neutral-500'">
                         {{ day.label }}
                     </div>
+                    <div
+                        v-if="day.holiday"
+                        class="flex items-center justify-center gap-0.5 truncate px-1 text-[10px] font-medium text-amber-600"
+                        :title="day.holiday"
+                    >
+                        <Icon name="mdi:star-four-points-outline" size="10" class="flex-shrink-0" />
+                        <span class="truncate">{{ day.holiday }}</span>
+                    </div>
                     <div class="text-[10px] text-neutral-400">{{ day.totalFormatted }}</div>
                 </div>
             </div>
@@ -40,6 +49,7 @@
                 :key="day.dateStr"
                 :ref="(el) => { dayColumnEls[dayIndex] = el as HTMLElement }"
                 class="relative flex-1 border-r border-neutral-100"
+                :class="{ 'bg-orange-50': day.holiday }"
                 @click="onClickGrid($event, day)"
                 @contextmenu.prevent="onContextMenuGrid($event, day)"
             >
@@ -141,8 +151,10 @@
 
 <script setup lang="ts">
 import type { TimeEntry } from '~/services/dto/time-entry'
+import { useAbsenceService } from '~/services/absences'
 
 const { t } = useI18n()
+const absenceService = useAbsenceService()
 
 const props = defineProps<{
     entries: TimeEntry[]
@@ -209,6 +221,23 @@ onMounted(() => {
     })
 })
 
+// --- Public holidays (computed server-side, shared with the absence calendar) ---
+const holidays = ref<Record<string, string>>({})
+
+async function loadHolidays() {
+    const count = props.viewMode === 'week' ? 7 : 1
+    const start = new Date(props.startDate)
+    const end = new Date(start)
+    end.setDate(end.getDate() + count - 1)
+    try {
+        holidays.value = await absenceService.getPublicHolidays(toDateStr(start), toDateStr(end))
+    } catch {
+        holidays.value = {}
+    }
+}
+
+watch(() => [props.startDate, props.viewMode], loadHolidays, { immediate: true })
+
 // --- Days computation ---
 const days = computed(() => {
     const count = props.viewMode === 'week' ? 7 : 1
@@ -231,6 +260,7 @@ const days = computed(() => {
             dateStr,
             dayNum: d.getDate(),
             label: dayLabels[d.getDay()],
+            holiday: holidays.value[dateStr] ?? null,
             totalFormatted: `${String(totalH).padStart(2, '0')}:${String(totalM).padStart(2, '0')}:${String(totalS).padStart(2, '0')}`,
         })
     }
diff --git a/frontend/components/time-tracking/TimeTrackingExportDrawer.vue b/frontend/components/time-tracking/TimeTrackingExportDrawer.vue
index 0270182..abeeb8e 100644
--- a/frontend/components/time-tracking/TimeTrackingExportDrawer.vue
+++ b/frontend/components/time-tracking/TimeTrackingExportDrawer.vue
@@ -1,5 +1,8 @@
 <template>
-    <MalioDrawer v-model="isOpen" :title="$t('timeEntries.exportTitle')" drawer-class="max-w-lg">
+    <MalioDrawer v-model="isOpen" drawer-class="max-w-lg">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ $t('timeEntries.exportTitle') }}</h2>
+        </template>
         <div class="flex flex-col gap-6 p-4">
             <!-- Period presets -->
             <div>
@@ -52,7 +55,7 @@
                     :label="$t('timeEntries.exportUsers')"
                     :display-tag="true"
                     :display-select-all="true"
-                    min-width="!w-full"
+                    group-class="!w-full"
                 />
             </div>
 
@@ -63,7 +66,7 @@
                     :options="clientOptions"
                     :label="$t('timeEntries.exportClient')"
                     :empty-option-label="$t('timeEntries.exportAllClients')"
-                    min-width="!w-full"
+                    group-class="!w-full"
                 />
             </div>
 
@@ -75,7 +78,7 @@
                     :label="$t('timeEntries.exportProjects')"
                     :display-tag="true"
                     :display-select-all="true"
-                    min-width="!w-full"
+                    group-class="!w-full"
                 />
             </div>
 
@@ -87,7 +90,7 @@
                     :label="$t('timeEntries.exportTags')"
                     :display-tag="true"
                     :display-select-all="true"
-                    min-width="!w-full"
+                    group-class="!w-full"
                 />
             </div>
 
diff --git a/frontend/components/ui/StatusBadge.vue b/frontend/components/ui/StatusBadge.vue
new file mode 100644
index 0000000..8abc003
--- /dev/null
+++ b/frontend/components/ui/StatusBadge.vue
@@ -0,0 +1,32 @@
+<template>
+    <span
+        class="inline-flex items-center gap-1 rounded-full px-2.5 py-0.5 text-xs font-medium whitespace-nowrap"
+        :class="variantClass"
+    >
+        <Icon v-if="icon" :name="icon" size="14" />
+        {{ label }}
+    </span>
+</template>
+
+<script setup lang="ts">
+type Variant = 'neutral' | 'info' | 'success' | 'warning' | 'danger'
+
+const props = withDefaults(defineProps<{
+    label: string
+    variant?: Variant
+    icon?: string
+}>(), {
+    variant: 'neutral',
+    icon: '',
+})
+
+const VARIANT_CLASSES: Record<Variant, string> = {
+    neutral: 'bg-neutral-100 text-neutral-700',
+    info: 'bg-blue-100 text-blue-800',
+    success: 'bg-green-100 text-green-800',
+    warning: 'bg-amber-100 text-amber-800',
+    danger: 'bg-red-100 text-red-800',
+}
+
+const variantClass = computed(() => VARIANT_CLASSES[props.variant])
+</script>
diff --git a/frontend/components/user/UserDrawer.vue b/frontend/components/user/UserDrawer.vue
index 739492e..0f7fcf1 100644
--- a/frontend/components/user/UserDrawer.vue
+++ b/frontend/components/user/UserDrawer.vue
@@ -1,5 +1,8 @@
 <template>
-    <MalioDrawer v-model="isOpen" :title="isEditing ? $t('users.editUser') : $t('users.addUser')">
+    <MalioDrawer v-model="isOpen">
+        <template #header>
+            <h2 class="text-xl font-bold">{{ isEditing ? $t('users.editUser') : $t('users.addUser') }}</h2>
+        </template>
         <form class="flex flex-col gap-2" @submit.prevent="handleSubmit">
             <MalioInputText
                 v-model="form.username"
@@ -35,37 +38,12 @@
                 </div>
             </div>
 
-            <div class="mt-4">
-                <MalioSelect
-                    v-model="form.clientId"
-                    label="Client"
-                    :options="clientOptions"
-                    placeholder="Aucun client"
-                    class="w-full"
-                    @update:model-value="onClientChange"
-                />
-            </div>
-
-            <div v-if="form.clientId !== null" class="mt-2">
-                <label class="text-sm font-semibold text-neutral-700">Projets autorisés</label>
-                <div class="mt-2 flex flex-col gap-2">
-                    <label
-                        v-for="project in filteredProjects"
-                        :key="project.id"
-                        class="flex items-center gap-2 text-sm text-neutral-700"
-                    >
-                        <input
-                            v-model="form.allowedProjectIds"
-                            type="checkbox"
-                            :value="project.id"
-                            class="rounded border-neutral-300"
-                        />
-                        {{ project.name }}
-                    </label>
-                    <span v-if="filteredProjects.length === 0" class="text-sm text-neutral-400">
-                        Aucun projet pour ce client.
-                    </span>
-                </div>
+            <!-- RH / Absences -->
+            <div class="mt-6 border-t border-neutral-200 pt-4">
+                <MalioCheckbox v-model="form.isEmployee" label="Employé (soumis à la gestion des absences)" />
+                <p v-if="form.isEmployee" class="mt-2 text-xs text-neutral-500">
+                    Les informations RH (contrat, dates, CP…) se gèrent dans Absences équipe → onglet Employés.
+                </p>
             </div>
 
             <div class="mt-6 flex justify-end">
@@ -83,12 +61,6 @@
 <script setup lang="ts">
 import type { UserData, UserWrite } from '~/services/dto/user-data'
 import { useUserService } from '~/services/users'
-import { useClientService } from '~/services/clients'
-import { useProjectService } from '~/services/projects'
-import type { Client } from '~/services/dto/client'
-import type { Project } from '~/services/dto/project'
-
-const { t } = useI18n()
 
 const props = defineProps<{
     modelValue: boolean
@@ -105,32 +77,16 @@ const isOpen = computed({
     set: (v) => emit('update:modelValue', v),
 })
 
-const availableRoles = ['ROLE_ADMIN', 'ROLE_USER', 'ROLE_CLIENT']
+const availableRoles = ['ROLE_ADMIN', 'ROLE_USER']
 
 const isEditing = computed(() => !!props.item)
 const isSubmitting = ref(false)
 
-const clients = ref<Client[]>([])
-const allProjects = ref<Project[]>([])
-
-const clientOptions = computed(() => [
-    { label: t('common.noClient'), value: null as number | null },
-    ...clients.value.map((c) => ({ label: c.name, value: c.id as number | null })),
-])
-
-const filteredProjects = computed(() => {
-    if (form.clientId === null) return []
-    return allProjects.value.filter(
-        (p) => p.client && typeof p.client === 'object' && 'id' in p.client && p.client.id === form.clientId,
-    )
-})
-
 const form = reactive({
     username: '',
     password: '',
     roles: [] as string[],
-    clientId: null as number | null,
-    allowedProjectIds: [] as number[],
+    isEmployee: false,
 })
 
 const touched = reactive({
@@ -138,45 +94,21 @@ const touched = reactive({
     password: false,
 })
 
-function onClientChange(value: number | null) {
-    form.clientId = value
-    form.allowedProjectIds = []
-    if (value !== null && !form.roles.includes('ROLE_CLIENT')) {
-        form.roles = [...form.roles.filter((r) => r !== 'ROLE_USER'), 'ROLE_CLIENT']
-    }
-}
-
-watch(() => form.roles, (roles) => {
-    if (!roles.includes('ROLE_CLIENT')) {
-        form.clientId = null
-        form.allowedProjectIds = []
-    }
-})
-
-watch(() => props.modelValue, async (open) => {
+watch(() => props.modelValue, (open) => {
     if (open) {
         if (props.item) {
             form.username = props.item.username ?? ''
             form.password = ''
             form.roles = [...props.item.roles]
-            form.clientId = props.item.client?.id ?? null
-            form.allowedProjectIds = props.item.allowedProjects?.map((p) => p.id) ?? []
+            form.isEmployee = props.item.isEmployee ?? false
         } else {
             form.username = ''
             form.password = ''
             form.roles = ['ROLE_USER']
-            form.clientId = null
-            form.allowedProjectIds = []
+            form.isEmployee = false
         }
         touched.username = false
         touched.password = false
-
-        const [loadedClients, loadedProjects] = await Promise.all([
-            useClientService().getAll(),
-            useProjectService().getAll({ archived: false }),
-        ])
-        clients.value = loadedClients
-        allProjects.value = loadedProjects
     }
 })
 
@@ -193,10 +125,7 @@ async function handleSubmit() {
         const payload: UserWrite = {
             username: form.username.trim(),
             roles: form.roles,
-            client: form.clientId !== null ? `/api/clients/${form.clientId}` : null,
-            allowedProjects: form.clientId !== null
-                ? form.allowedProjectIds.map((id) => `/api/projects/${id}`)
-                : [],
+            isEmployee: form.isEmployee,
         }
         if (form.password) {
             payload.plainPassword = form.password
diff --git a/frontend/composables/useAbsenceHelpers.ts b/frontend/composables/useAbsenceHelpers.ts
new file mode 100644
index 0000000..c8bc305
--- /dev/null
+++ b/frontend/composables/useAbsenceHelpers.ts
@@ -0,0 +1,93 @@
+import type { AbsenceRequest, AbsenceStatus, AbsenceType, HalfDay } from '~/services/dto/absence'
+
+export type BadgeVariant = 'neutral' | 'info' | 'success' | 'warning' | 'danger'
+
+const STATUS_VARIANTS: Record<AbsenceStatus, BadgeVariant> = {
+    pending: 'warning',
+    approved: 'success',
+    rejected: 'danger',
+    cancelled: 'neutral',
+}
+
+const STATUS_ICONS: Record<AbsenceStatus, string> = {
+    pending: 'mdi:clock-outline',
+    approved: 'mdi:check-circle-outline',
+    rejected: 'mdi:close-circle-outline',
+    cancelled: 'mdi:cancel',
+}
+
+// Colours used for the calendar bars, keyed by absence type.
+const TYPE_COLORS: Record<AbsenceType, string> = {
+    cp: '#4A90D9',
+    mariage_pacs: '#E91E63',
+    conge_parental: '#9C27B0',
+    deces: '#607D8B',
+    maladie: '#C62828',
+}
+
+export function useAbsenceHelpers() {
+    const { t } = useI18n()
+
+    function statusLabel(status: AbsenceStatus): string {
+        return t(`absences.status.${status}`)
+    }
+
+    function statusVariant(status: AbsenceStatus): BadgeVariant {
+        return STATUS_VARIANTS[status] ?? 'neutral'
+    }
+
+    function statusIcon(status: AbsenceStatus): string {
+        return STATUS_ICONS[status] ?? 'mdi:help-circle-outline'
+    }
+
+    function typeLabel(type: AbsenceType): string {
+        return t(`absences.types.${type}`)
+    }
+
+    function typeColor(type: AbsenceType): string {
+        return TYPE_COLORS[type] ?? '#9CA3AF'
+    }
+
+    function halfDayLabel(half: HalfDay): string {
+        return t(`absences.halfDay.${half}`)
+    }
+
+    function formatDate(iso: string | null): string {
+        if (!iso) return ''
+        const d = new Date(iso)
+        if (isNaN(d.getTime())) return ''
+        const day = String(d.getDate()).padStart(2, '0')
+        const month = String(d.getMonth() + 1).padStart(2, '0')
+        return `${day}/${month}/${d.getFullYear()}`
+    }
+
+    /** Human-readable period with half-day annotations. */
+    function formatRange(req: Pick<AbsenceRequest, 'startDate' | 'endDate' | 'startHalfDay' | 'endHalfDay'>): string {
+        const start = formatDate(req.startDate)
+        const end = formatDate(req.endDate)
+        const startSuffix = req.startHalfDay ? ` (${halfDayLabel(req.startHalfDay)})` : ''
+        const endSuffix = req.endHalfDay ? ` (${halfDayLabel(req.endHalfDay)})` : ''
+        if (start === end) {
+            return `${start}${startSuffix}`
+        }
+        return `${start}${startSuffix} → ${end}${endSuffix}`
+    }
+
+    function formatDays(days: number): string {
+        const rounded = Math.round(days * 2) / 2
+        const unit = rounded > 1 ? t('absences.daysPlural') : t('absences.daySingular')
+        return `${rounded} ${unit}`
+    }
+
+    return {
+        statusLabel,
+        statusVariant,
+        statusIcon,
+        typeLabel,
+        typeColor,
+        halfDayLabel,
+        formatDate,
+        formatRange,
+        formatDays,
+    }
+}
diff --git a/frontend/composables/useClientTicketHelpers.ts b/frontend/composables/useClientTicketHelpers.ts
deleted file mode 100644
index feab80f..0000000
--- a/frontend/composables/useClientTicketHelpers.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import type { ClientTicketStatus } from '~/services/dto/client-ticket'
-
-export function useClientTicketHelpers() {
-    function typeBadgeClass(type: string): string {
-        switch (type) {
-            case 'bug': return 'bg-red-500'
-            case 'improvement': return 'bg-blue-500'
-            default: return 'bg-neutral-500'
-        }
-    }
-
-    function statusBadgeClass(status: string): string {
-        switch (status) {
-            case 'new': return 'bg-blue-100 text-blue-700'
-            case 'in_progress': return 'bg-yellow-100 text-yellow-700'
-            case 'done': return 'bg-green-100 text-green-700'
-            case 'rejected': return 'bg-red-100 text-red-700'
-            default: return 'bg-neutral-100 text-neutral-700'
-        }
-    }
-
-    function formatDate(iso: string): string {
-        return new Date(iso).toLocaleDateString('fr-FR', {
-            day: 'numeric',
-            month: 'short',
-            year: 'numeric',
-        })
-    }
-
-    function getAvailableStatusTransitions(
-        current: ClientTicketStatus,
-        t: (key: string) => string,
-    ): { label: string; value: ClientTicketStatus }[] {
-        const allStatuses: { label: string; value: ClientTicketStatus }[] = [
-            { label: t('clientTicket.status.new'), value: 'new' },
-            { label: t('clientTicket.status.in_progress'), value: 'in_progress' },
-            { label: t('clientTicket.status.done'), value: 'done' },
-            { label: t('clientTicket.status.rejected'), value: 'rejected' },
-        ]
-        return allStatuses.filter(s => {
-            if (s.value === current) return false
-            if ((current === 'done' || current === 'rejected') && s.value === 'new') return false
-            return true
-        })
-    }
-
-    return { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions }
-}
diff --git a/frontend/content/help/01-getting-started.md b/frontend/content/help/01-getting-started.md
index f224a0a..360cc8d 100644
--- a/frontend/content/help/01-getting-started.md
+++ b/frontend/content/help/01-getting-started.md
@@ -1,11 +1,10 @@
 # Bienvenue dans Lesstime
 
-Lesstime est un outil de **gestion de projets** qui combine 4 grandes capacités :
+Lesstime est un outil de **gestion de projets** qui combine plusieurs grandes capacités :
 
 - 🗂️ **Gestion de projets** avec kanban personnalisable (workflows)
 - ✅ **Suivi de tâches** avec assignations, priorités, efforts, deadlines, tags
 - ⏱️ **Time tracking** intégré, lié aux projets et aux tâches
-- 🎫 **Portail client** pour que tes clients déposent leurs tickets
 
 ## Comprendre les rôles
 
@@ -13,7 +12,6 @@ Lesstime est un outil de **gestion de projets** qui combine 4 grandes capacités
 |---|---|
 | **Admin** | Tout : projets, utilisateurs, intégrations, workflows |
 | **User** | Ses tâches, time tracking, projets auxquels il a accès |
-| **Client** | Portal dédié — tickets sur ses projets uniquement |
 
 ## Vues principales
 
@@ -22,6 +20,5 @@ Lesstime est un outil de **gestion de projets** qui combine 4 grandes capacités
 - **Projets** : un kanban par projet, statuts du workflow associé
 - **Time tracking** : timer, time entries, vue mois
 - **Admin** : gestion globale (visible uniquement par les admins)
-- **Portal** : interface dédiée aux utilisateurs ROLE_CLIENT
 
 > 💡 **Astuce** : utilise l'avatar en haut à droite pour accéder à ton profil et y générer un **token MCP** (cf. section *Token MCP & API*) pour piloter Lesstime depuis Claude / Cursor.
diff --git a/frontend/content/help/05-tasks-detail.md b/frontend/content/help/05-tasks-detail.md
index 9010804..f4d4bba 100644
--- a/frontend/content/help/05-tasks-detail.md
+++ b/frontend/content/help/05-tasks-detail.md
@@ -51,10 +51,6 @@ Si le projet a un repo Gitea lié, tu peux :
 - Convention de nommage : `<type>/<CODE>-<NUMBER>-<slug>` (ex: `feature/SIRH-12-add-login`)
 - **Voir les PRs** liées (état CI inclus)
 
-## Liaison ticket client
-
-Si la tâche découle d'un ticket client, l'icône 👤 (`heroicons:user-circle`) bleue apparaît avec le numéro du ticket (ex: `CT-001`).
-
 ## Commentaires & notifications
 
 - Ajouter un commentaire notifie les watchers (assigné, collaborateurs)
diff --git a/frontend/content/help/06-client-portal.md b/frontend/content/help/06-client-portal.md
deleted file mode 100644
index 4bc0dce..0000000
--- a/frontend/content/help/06-client-portal.md
+++ /dev/null
@@ -1,43 +0,0 @@
-# Portal client
-
-> 🎫 Section dédiée aux utilisateurs avec le rôle **ROLE_CLIENT**.
-
-## Accès
-
-Les utilisateurs *client* sont **automatiquement redirigés vers `/portal`** après login. Ils ne voient pas les vues internes (projets, time tracking, admin).
-
-## Ce que voit un client
-
-- 📋 La liste de ses **projets autorisés** (définis par l'admin dans le user)
-- 🎫 Sur chaque projet, la liste de ses **tickets** (ses créations uniquement)
-- ➕ Le bouton **Nouveau ticket** sur chaque projet
-
-## Soumettre un ticket
-
-Depuis `/portal/projects/<id>/new-ticket` :
-
-| Champ | Description |
-|---|---|
-| **Type** | `bug` / `improvement` / `other` |
-| **Titre** | Court et descriptif |
-| **Description** | Détails — markdown supporté |
-| **URL** | Optionnel — page où le problème se manifeste |
-
-Le ticket est automatiquement numéroté **par projet** (ex: `CT-001`).
-
-## Statuts d'un ticket
-
-| Statut | Visible côté client | Signification |
-|---|---|---|
-| `new` | Oui | Reçu, pas encore traité |
-| `in_progress` | Oui | Une tâche interne y est liée |
-| `done` | Oui | Résolu et clôturé |
-| `rejected` | Oui | Non retenu (avec commentaire explicatif) |
-
-Le `statusComment` est visible par le client quand fourni.
-
-## Côté équipe interne
-
-- Les tickets apparaissent dans **Admin → Tickets client**
-- On peut **transformer un ticket en tâche** (la tâche garde une référence au ticket — icône 👤 bleue sur la card)
-- Le client voit l'avancement passer en `in_progress` automatiquement quand une tâche est liée
diff --git a/frontend/content/help/07-admin.md b/frontend/content/help/07-admin.md
index 5f32a64..6ed7192 100644
--- a/frontend/content/help/07-admin.md
+++ b/frontend/content/help/07-admin.md
@@ -40,12 +40,9 @@ L'admin (`/admin`) est divisé en plusieurs onglets, chacun gérant une ressourc
 ## Onglet *Utilisateurs*
 
 - Créer / éditer / désactiver
-- Rôles : `ROLE_ADMIN`, `ROLE_USER`, `ROLE_CLIENT`
-- **ROLE_CLIENT** : associer un *client* et une liste de *projets autorisés*
+- Rôles : `ROLE_ADMIN`, `ROLE_USER`
 - Reset password depuis l'admin
 
-> 🔐 Un user *admin+client* (les deux rôles) **n'est pas bloqué** par le middleware portal — le check est sur `ROLE_CLIENT && !ROLE_ADMIN`.
-
 ## Onglet *Gitea*
 
 - URL serveur + token API
diff --git a/frontend/content/help/10-messaging.md b/frontend/content/help/10-messaging.md
index 350f99a..2371c39 100644
--- a/frontend/content/help/10-messaging.md
+++ b/frontend/content/help/10-messaging.md
@@ -4,7 +4,7 @@ Lesstime intègre une **boîte mail partagée** (OVH, protocole IMAP) directemen
 
 > 📥 La messagerie est accessible depuis l'entrée **Messagerie** de la barre latérale (icône enveloppe). Un **badge** y affiche le nombre de mails non lus, toutes boîtes confondues.
 
-> 🛡️ Réservée aux rôles **ROLE_ADMIN** et **ROLE_USER**. Les utilisateurs *client* sont redirigés vers leur portail.
+> 🛡️ Réservée aux rôles **ROLE_ADMIN** et **ROLE_USER**.
 
 ## L'interface
 
diff --git a/frontend/i18n/locales/fr.json b/frontend/i18n/locales/fr.json
index 9dbfba6..1f27edc 100644
--- a/frontend/i18n/locales/fr.json
+++ b/frontend/i18n/locales/fr.json
@@ -351,63 +351,6 @@
         "error": "Erreur de connexion à Gitea.",
         "notConfigured": "Gitea non configuré pour ce projet."
     },
-    "portal": {
-        "title": "Portail client",
-        "projects": "Vos projets",
-        "noProjects": "Aucun projet disponible.",
-        "openTickets": "tickets ouverts",
-        "newTicket": "Nouveau ticket",
-        "ticketDetail": "Détail du ticket",
-        "backToProject": "Retour au projet",
-        "submitTicket": "Soumettre le ticket",
-        "ticketCreated": "Ticket soumis avec succès."
-    },
-    "clientTicket": {
-        "title": "Tickets",
-        "new": "Nouveau ticket",
-        "created": "Ticket créé avec succès.",
-        "deleted": "Ticket supprimé avec succès.",
-        "updated": "Ticket mis à jour avec succès.",
-        "statusUpdated": "Statut du ticket mis à jour.",
-        "type": {
-            "bug": "Bug",
-            "improvement": "Amélioration",
-            "other": "Autre"
-        },
-        "status": {
-            "new": "Nouveau",
-            "in_progress": "En cours",
-            "done": "Terminé",
-            "rejected": "Rejeté"
-        },
-        "fields": {
-            "title": "Titre",
-            "description": "Description",
-            "url": "URL de la page",
-            "urlPlaceholder": "https://example.com/page-concernee",
-            "type": "Type",
-            "project": "Projet"
-        },
-        "confirmDelete": "Êtes-vous sûr de vouloir supprimer ce ticket ?",
-        "rejectComment": "Commentaire de rejet",
-        "rejectCommentRequired": "Un commentaire est requis pour rejeter un ticket.",
-        "linkedTicket": "Lié au ticket client CT-{number}",
-        "description": "Description",
-        "url": "URL (page concernée)",
-        "statusComment": "Commentaire de statut",
-        "statusChanged": "Statut mis à jour",
-        "confirmDeleteMessage": "Êtes-vous sûr de vouloir supprimer ce ticket ? Cette action est irréversible.",
-        "linkedTooltip": "Lié au ticket client {number}",
-        "rejectionRequired": "Un commentaire est requis pour rejeter un ticket",
-        "noTickets": "Aucun ticket.",
-        "allStatuses": "Tous les statuts",
-        "allProjects": "Tous les projets",
-        "submittedBy": "Soumis par",
-        "createdAt": "Créé le",
-        "adminTab": "Tickets client",
-        "selectType": "Type de ticket",
-        "changeStatus": "Changer le statut"
-    },
     "notification": {
         "title": "Notifications",
         "markAllRead": "Tout marquer comme lu",
@@ -614,5 +557,195 @@
         "hasAttachments": "Pièces jointes",
         "unread": "non lu | non lus",
         "remoteImagesBlocked": "Les images distantes sont masquées pour votre sécurité."
+    },
+    "absences": {
+        "title": "Mes absences",
+        "teamTitle": "Absences de l'équipe",
+        "newRequest": "Nouvelle demande",
+        "daySingular": "jour",
+        "daysPlural": "jours",
+        "noBalance": "Aucun solde à afficher.",
+        "noRequests": "Aucune demande.",
+        "remaining": "restants",
+        "acquired": "acquis",
+        "acquiredN1": "Acquis (N-1)",
+        "acquiringN": "En cours d'acquisition (N)",
+        "acquiringHint": "posables par anticipation",
+        "taken": "pris",
+        "pending": "en attente",
+        "available": "disponible",
+        "types": {
+            "cp": "Congés payés",
+            "mariage_pacs": "Mariage / PACS",
+            "conge_parental": "Congé parental",
+            "deces": "Décès proche",
+            "maladie": "Arrêt maladie"
+        },
+        "status": {
+            "pending": "En attente",
+            "approved": "Approuvée",
+            "rejected": "Refusée",
+            "cancelled": "Annulée"
+        },
+        "halfDay": {
+            "matin": "Matin",
+            "apres_midi": "Après-midi"
+        },
+        "table": {
+            "type": "Type",
+            "period": "Période",
+            "days": "Jours",
+            "status": "Statut",
+            "employee": "Salarié",
+            "year": "Année",
+            "requestedAt": "Demandé le",
+            "actions": "Actions"
+        },
+        "filters": {
+            "allStatuses": "Tous les statuts",
+            "allTypes": "Tous les types",
+            "allYears": "Toutes les années",
+            "allEmployees": "Tous les salariés"
+        },
+        "form": {
+            "type": "Type d'absence",
+            "startDate": "Date de début",
+            "endDate": "Date de fin",
+            "startHalfDay": "Demi-journée (début)",
+            "endHalfDay": "Demi-journée (fin)",
+            "halfDayCheckbox": "Demi-journée",
+            "reason": "Motif",
+            "reasonPlaceholder": "Précisez le motif si nécessaire…",
+            "justification": "Justificatif",
+            "computed": "{days} décompté(s)",
+            "balanceAfter": "Solde restant après cette demande : {value}",
+            "negativeWarning": "Cette demande dépasse votre solde disponible.",
+            "noticeWarning": "Le délai de prévenance ({days} jours) n'est pas respecté.",
+            "submit": "Soumettre la demande",
+            "justificationRequired": "Un justificatif est requis pour ce type d'absence.",
+            "fullDay": "Journée entière",
+            "balanceAt": "Solde au {date}",
+            "balanceAfterValidation": "Solde après validation",
+            "duration": "Durée de la demande",
+            "commentPlaceholder": "Écrire un commentaire…",
+            "serverError": "La demande n'a pas pu être enregistrée.",
+            "errors": {
+                "typeRequired": "Veuillez choisir un type d'absence.",
+                "startRequired": "Veuillez indiquer une date de début.",
+                "endRequired": "Veuillez indiquer une date de fin.",
+                "endBeforeStart": "La date de fin doit être après la date de début.",
+                "zeroDays": "La période sélectionnée ne décompte aucun jour.",
+                "justificationRequired": "Un justificatif est obligatoire pour ce type d'absence."
+            }
+        },
+        "detail": {
+            "title": "Détail de la demande",
+            "timeline": "Historique",
+            "created": "Demande créée",
+            "reviewed": "Traitée par {name}",
+            "rejectionReason": "Motif du refus",
+            "downloadJustification": "Télécharger le justificatif",
+            "cancel": "Annuler ma demande",
+            "cancelConfirm": "Annuler cette demande ?"
+        },
+        "review": {
+            "approve": "Valider",
+            "reject": "Refuser",
+            "rejectTitle": "Refuser la demande",
+            "rejectReasonLabel": "Motif du refus",
+            "rejectReasonPlaceholder": "Expliquez la raison du refus…",
+            "confirm": "Confirmer"
+        },
+        "admin": {
+            "tabs": {
+                "requests": "Demandes",
+                "calendar": "Calendrier",
+                "balances": "Soldes",
+                "employees": "Employés"
+            },
+            "kpis": {
+                "pending": "En attente",
+                "todayAbsent": "Absents aujourd'hui",
+                "weekAbsent": "Absents cette semaine"
+            },
+            "balancesTable": {
+                "employee": "Salarié",
+                "type": "Type",
+                "period": "Période",
+                "acquired": "Acquis (N-1)",
+                "acquiring": "En cours (N)",
+                "taken": "Pris",
+                "pending": "En attente",
+                "available": "Disponible",
+                "adjust": "Ajuster"
+            },
+            "adjust": {
+                "title": "Ajuster le solde",
+                "acquired": "Acquis (N-1)",
+                "acquiring": "En cours d'acquisition (N)",
+                "taken": "Pris",
+                "save": "Enregistrer"
+            },
+            "employees": {
+                "columns": {
+                    "name": "Nom",
+                    "contract": "Contrat",
+                    "cpTaken": "CP pris",
+                    "cpRemaining": "CP restants"
+                },
+                "empty": "Aucun employé. Cochez « Employé » sur un utilisateur dans l'administration.",
+                "noContract": "—",
+                "drawer": {
+                    "title": "Informations employé",
+                    "save": "Enregistrer"
+                },
+                "fields": {
+                    "hireDate": "Date d'embauche",
+                    "endDate": "Date de sortie",
+                    "contractType": "Type de contrat",
+                    "familySituation": "Situation familiale",
+                    "workTimeRatio": "Temps de travail (ex : 1.0)",
+                    "annualLeaveDays": "CP annuels (jours)",
+                    "referencePeriodStart": "Début période réf. (MM-DD)",
+                    "initialLeaveBalance": "Solde CP initial",
+                    "nbChildren": "Nombre d'enfants"
+                },
+                "contract": {
+                    "cdi": "CDI",
+                    "cdd": "CDD",
+                    "stage": "Stage",
+                    "alternance": "Alternance",
+                    "autre": "Autre"
+                },
+                "family": {
+                    "celibataire": "Célibataire",
+                    "marie": "Marié(e)",
+                    "pacse": "Pacsé(e)",
+                    "divorce": "Divorcé(e)",
+                    "veuf": "Veuf(ve)"
+                }
+            }
+        },
+        "policies": {
+            "title": "Politiques d'absence",
+            "subtitle": "Réglez les défauts par type d'absence (convention collective).",
+            "type": "Type",
+            "daysPerYear": "Jours / an",
+            "daysPerEvent": "Jours / événement",
+            "justificationRequired": "Justificatif requis",
+            "noticeDays": "Délai prévenance (j)",
+            "countWorkingDaysOnly": "Jours ouvrés",
+            "active": "Actif",
+            "save": "Enregistrer"
+        },
+        "toast": {
+            "created": "Demande d'absence créée.",
+            "approved": "Demande validée.",
+            "rejected": "Demande refusée.",
+            "cancelled": "Demande annulée.",
+            "justificationUploaded": "Justificatif ajouté.",
+            "balanceAdjusted": "Solde ajusté.",
+            "policyUpdated": "Politique mise à jour."
+        }
     }
 }
diff --git a/frontend/layouts/default.vue b/frontend/layouts/default.vue
index f3e6b53..aa08550 100644
--- a/frontend/layouts/default.vue
+++ b/frontend/layouts/default.vue
@@ -46,6 +46,12 @@
                         :class="sidebarIsCollapsed ? 'mt-4' : 'border-t border-secondary-500 pt-6'"
                         @click="ui.closeMobileSidebar()"
                     />
+
+                    <!-- Section : Gestion de projet -->
+                    <p v-if="!sidebarIsCollapsed" class="px-4 pt-5 pb-1 text-xs font-semibold uppercase tracking-wider text-neutral-400">
+                        Gestion de projet
+                    </p>
+                    <div v-else class="mx-2 my-3 border-t border-secondary-500" />
                     <SidebarLink
                         to="/my-tasks"
                         icon="mdi:clipboard-check-outline"
@@ -53,23 +59,6 @@
                         :collapsed="sidebarIsCollapsed"
                         @click="ui.closeMobileSidebar()"
                     />
-                    <div v-if="isMailVisible" class="relative">
-                        <SidebarLink
-                            to="/mail"
-                            icon="mdi:email-outline"
-                            :label="$t('mail.sidebar.title')"
-                            :collapsed="sidebarIsCollapsed"
-                            @click="ui.closeMobileSidebar()"
-                        />
-                        <span
-                            v-if="mailStore.globalUnreadCount > 0"
-                            class="pointer-events-none absolute right-3 top-1/2 flex h-5 min-w-5 -translate-y-1/2 items-center justify-center rounded-full bg-red-500 px-1 text-xs font-bold text-white"
-                            :class="{ 'right-1 top-1 translate-y-0': sidebarIsCollapsed }"
-                            :aria-label="`${mailStore.globalUnreadCount} messages non lus`"
-                        >
-                            {{ mailStore.globalUnreadCount > 99 ? '99+' : mailStore.globalUnreadCount }}
-                        </span>
-                    </div>
                     <SidebarLink
                         to="/projects"
                         icon="mdi:folder-outline"
@@ -103,14 +92,6 @@
                             sub
                             @click="ui.closeMobileSidebar()"
                         />
-                        <SidebarLink
-                            :to="`/projects/${currentProjectId}/client-tickets`"
-                            icon="mdi:ticket-outline"
-                            label="Tickets client"
-                            :collapsed="sidebarIsCollapsed"
-                            sub
-                            @click="ui.closeMobileSidebar()"
-                        />
                     </template>
                     <SidebarLink
                         to="/time-tracking"
@@ -119,13 +100,59 @@
                         :collapsed="sidebarIsCollapsed"
                         @click="ui.closeMobileSidebar()"
                     />
+                    <div v-if="isMailVisible" class="relative">
+                        <SidebarLink
+                            to="/mail"
+                            icon="mdi:email-outline"
+                            :label="$t('mail.sidebar.title')"
+                            :collapsed="sidebarIsCollapsed"
+                            @click="ui.closeMobileSidebar()"
+                        />
+                        <span
+                            v-if="mailStore.globalUnreadCount > 0"
+                            class="pointer-events-none absolute right-3 top-1/2 flex h-5 min-w-5 -translate-y-1/2 items-center justify-center rounded-full bg-red-500 px-1 text-xs font-bold text-white"
+                            :class="{ 'right-1 top-1 translate-y-0': sidebarIsCollapsed }"
+                            :aria-label="`${mailStore.globalUnreadCount} messages non lus`"
+                        >
+                            {{ mailStore.globalUnreadCount > 99 ? '99+' : mailStore.globalUnreadCount }}
+                        </span>
+                    </div>
+
+                    <!-- Section : Absences -->
+                    <p v-if="!sidebarIsCollapsed" class="px-4 pt-5 pb-1 text-xs font-semibold uppercase tracking-wider text-neutral-400">
+                        Absences
+                    </p>
+                    <div v-else class="mx-2 my-3 border-t border-secondary-500" />
                     <SidebarLink
-                        to="/admin"
-                        icon="mdi:cog-outline"
-                        label="Administration"
+                        to="/absences"
+                        icon="mdi:umbrella-beach-outline"
+                        label="Mes absences"
                         :collapsed="sidebarIsCollapsed"
                         @click="ui.closeMobileSidebar()"
                     />
+                    <SidebarLink
+                        v-if="isAdmin"
+                        to="/team-absences"
+                        icon="mdi:calendar-account-outline"
+                        label="Absences équipe"
+                        :collapsed="sidebarIsCollapsed"
+                        @click="ui.closeMobileSidebar()"
+                    />
+
+                    <!-- Section : Administration (admin only) -->
+                    <template v-if="isAdmin">
+                        <p v-if="!sidebarIsCollapsed" class="px-4 pt-5 pb-1 text-xs font-semibold uppercase tracking-wider text-neutral-400">
+                            Administration
+                        </p>
+                        <div v-else class="mx-2 my-3 border-t border-secondary-500" />
+                        <SidebarLink
+                            to="/admin"
+                            icon="mdi:cog-outline"
+                            label="Administration"
+                            :collapsed="sidebarIsCollapsed"
+                            @click="ui.closeMobileSidebar()"
+                        />
+                    </template>
                 </nav>
 
                 <div class="px-4 py-3">
@@ -183,12 +210,11 @@ const mailStore = useMailStore()
 const {version} = useAppVersion()
 const route = useRoute()
 
+const isAdmin = computed(() => (auth.user?.roles ?? []).includes('ROLE_ADMIN'))
+
 const isMailVisible = computed(() => {
     const roles: string[] = auth.user?.roles ?? []
-    const isClientOnly = roles.includes('ROLE_CLIENT')
-        && !roles.includes('ROLE_ADMIN')
-        && !roles.includes('ROLE_USER')
-    return !isClientOnly && (roles.includes('ROLE_USER') || roles.includes('ROLE_ADMIN'))
+    return roles.includes('ROLE_USER') || roles.includes('ROLE_ADMIN')
 })
 
 // On mobile, sidebar is always expanded (not collapsed icon mode)
diff --git a/frontend/layouts/portal.vue b/frontend/layouts/portal.vue
deleted file mode 100644
index 5c43ca4..0000000
--- a/frontend/layouts/portal.vue
+++ /dev/null
@@ -1,87 +0,0 @@
-<template>
-    <div class="h-screen overflow-hidden">
-        <div class="flex h-full">
-            <!-- Mobile sidebar overlay -->
-            <Transition name="sidebar-overlay">
-                <div
-                    v-if="ui.sidebarOpen"
-                    class="fixed inset-0 z-40 bg-black/50 lg:hidden"
-                    @click="ui.closeMobileSidebar()"
-                />
-            </Transition>
-
-            <aside
-                class="fixed inset-y-0 left-0 z-50 flex h-full w-64 flex-shrink-0 flex-col border-r border-neutral-200 bg-tertiary-500 transition-transform duration-300 lg:static lg:z-auto lg:translate-x-0"
-                :class="ui.sidebarOpen ? 'translate-x-0' : '-translate-x-full'"
-            >
-                <div class="flex items-center justify-between">
-                    <img src="/malio.png" alt="Logo" class="w-auto" />
-                    <button
-                        class="mr-2 rounded-md p-2 text-neutral-500 hover:bg-neutral-200 hover:text-neutral-700 transition-colors lg:hidden"
-                        @click="ui.closeMobileSidebar()"
-                    >
-                        <Icon name="mdi:close" size="20" />
-                    </button>
-                </div>
-                <nav class="flex-1 px-4 pb-6">
-                    <SidebarLink
-                        to="/portal"
-                        icon="mdi:folder-outline"
-                        label="Mes projets"
-                        :collapsed="false"
-                        class="border-t border-secondary-500 pt-6"
-                        @click="ui.closeMobileSidebar()"
-                    />
-                    <SidebarLink
-                        v-if="isAdmin"
-                        to="/"
-                        icon="mdi:shield-crown-outline"
-                        label="Administration"
-                        :collapsed="false"
-                        class="mt-2"
-                        @click="ui.closeMobileSidebar()"
-                    />
-                </nav>
-
-                <div class="flex flex-col gap-2 items-center p-4">
-                    <p class="font-bold">v {{ version }}</p>
-                </div>
-            </aside>
-
-            <div class="h-full flex-1 flex flex-col min-h-0">
-                <AppTopNav :user="auth.user" />
-                <main class="flex flex-1 flex-col overflow-y-auto bg-white px-4 pb-24 sm:px-8 lg:px-16">
-                    <div aria-hidden="true" class="pointer-events-none sticky top-0 z-30 h-8 flex-shrink-0 bg-white sm:h-12" />
-                    <slot />
-                </main>
-            </div>
-        </div>
-    </div>
-</template>
-
-<script setup lang="ts">
-import { useAppVersion } from '~/composables/useAppVersion'
-
-const auth = useAuthStore()
-const ui = useUiStore()
-const route = useRoute()
-const { version } = useAppVersion()
-
-const isAdmin = computed(() => auth.user?.roles?.includes('ROLE_ADMIN') ?? false)
-
-// Close mobile sidebar on route change
-watch(() => route.path, () => {
-    ui.closeMobileSidebar()
-})
-</script>
-
-<style scoped>
-.sidebar-overlay-enter-active,
-.sidebar-overlay-leave-active {
-    transition: opacity 0.3s ease;
-}
-.sidebar-overlay-enter-from,
-.sidebar-overlay-leave-to {
-    opacity: 0;
-}
-</style>
diff --git a/frontend/middleware/auth.global.ts b/frontend/middleware/auth.global.ts
index 76af8ef..18799ca 100644
--- a/frontend/middleware/auth.global.ts
+++ b/frontend/middleware/auth.global.ts
@@ -10,16 +10,7 @@ export default defineNuxtRouteMiddleware(async (to) => {
         return navigateTo('/login')
     }
 
-    const isClientOnly = auth.isAuthenticated
-        && auth.user?.roles?.includes('ROLE_CLIENT')
-        && !auth.user?.roles?.includes('ROLE_ADMIN')
-
     if (isLogin && auth.isAuthenticated) {
-        return navigateTo(isClientOnly ? '/portal' : '/')
-    }
-
-    const isProfileRoute = to.path === '/profile'
-    if (isClientOnly && !to.path.startsWith('/portal') && !isProfileRoute) {
-        return navigateTo('/portal')
+        return navigateTo('/')
     }
 })
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 5ef248b..0bc2609 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -7,7 +7,7 @@
             "name": "nuxt-app",
             "hasInstallScript": true,
             "dependencies": {
-                "@malio/layer-ui": "^1.4.8",
+                "@malio/layer-ui": "^1.6.0",
                 "@nuxt/icon": "^2.2.1",
                 "@nuxtjs/i18n": "^10.2.3",
                 "@nuxtjs/tailwindcss": "^6.14.0",
@@ -2210,9 +2210,9 @@
             "license": "MIT"
         },
         "node_modules/@malio/layer-ui": {
-            "version": "1.4.8",
-            "resolved": "https://gitea.malio.fr/api/packages/MALIO-DEV/npm/%40malio%2Flayer-ui/-/1.4.8/layer-ui-1.4.8.tgz",
-            "integrity": "sha512-ABQmfMqJqKGGnx6kf5KK/XVuKAPWSpRHmLpS9XMg6pUH8kww8o3JoywlrlFkk9xA30zNFaehAtzV7S19E4JTlg==",
+            "version": "1.6.0",
+            "resolved": "https://gitea.malio.fr/api/packages/MALIO-DEV/npm/%40malio%2Flayer-ui/-/1.6.0/layer-ui-1.6.0.tgz",
+            "integrity": "sha512-2sN4mL1Jf984oeE4N4yEv6XFgSz0Gc+uSG+HLGfRrdzjAsMcU9hbb7HSAo3Q6MBvQHZn3ZBr1cK+VUM0kXY4NA==",
             "dependencies": {
                 "@nuxt/icon": "^2.2.1",
                 "@nuxtjs/tailwindcss": "^6.14.0",
diff --git a/frontend/package.json b/frontend/package.json
index b8cc7e2..a9c9ca0 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -11,7 +11,7 @@
         "build:dist": "nuxt generate && rm -rf dist && cp -R .output/public dist"
     },
     "dependencies": {
-        "@malio/layer-ui": "^1.4.8",
+        "@malio/layer-ui": "^1.6.0",
         "@nuxt/icon": "^2.2.1",
         "@nuxtjs/i18n": "^10.2.3",
         "@nuxtjs/tailwindcss": "^6.14.0",
diff --git a/frontend/pages/absences.vue b/frontend/pages/absences.vue
new file mode 100644
index 0000000..8604922
--- /dev/null
+++ b/frontend/pages/absences.vue
@@ -0,0 +1,168 @@
+<template>
+    <div class="flex flex-col gap-6">
+        <div class="flex items-center justify-between">
+            <h1 class="text-2xl font-bold text-neutral-900">{{ $t('absences.title') }}</h1>
+            <MalioButton
+                :label="$t('absences.newRequest')"
+                icon-name="mdi:plus"
+                icon-position="left"
+                @click="requestDrawerOpen = true"
+            />
+        </div>
+
+        <AbsenceBalanceCards :balances="balances" />
+
+        <!-- Filters -->
+        <div class="flex flex-wrap gap-3">
+            <MalioSelect
+                v-model="filters.status"
+                :label="$t('absences.table.status')"
+                :options="statusOptions"
+                :empty-option-label="$t('absences.filters.allStatuses')"
+                group-class="w-52"
+            />
+            <MalioSelect
+                v-model="filters.type"
+                :label="$t('absences.table.type')"
+                :options="typeOptions"
+                :empty-option-label="$t('absences.filters.allTypes')"
+                group-class="w-52"
+            />
+            <MalioSelect
+                v-model="filters.year"
+                :label="$t('absences.table.year')"
+                :options="yearOptions"
+                :empty-option-label="$t('absences.filters.allYears')"
+                group-class="w-40"
+            />
+        </div>
+
+        <MalioDataTable
+            :columns="columns"
+            :items="rows"
+            :total-items="rows.length"
+            :row-clickable="true"
+            :empty-message="$t('absences.noRequests')"
+            @row-click="openDetail"
+        >
+            <template #cell-status="{ item }">
+                <StatusBadge
+                    :label="statusLabel((item as Row).status)"
+                    :variant="statusVariant((item as Row).status)"
+                    :icon="statusIcon((item as Row).status)"
+                />
+            </template>
+        </MalioDataTable>
+
+        <AbsenceRequestDrawer
+            v-model="requestDrawerOpen"
+            :policies="policies"
+            @created="reload"
+        />
+        <AbsenceDetailDrawer
+            v-model="detailDrawerOpen"
+            :request="selected"
+            :can-cancel="selected?.status === 'pending'"
+            @cancelled="reload"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+import type { AbsenceBalance, AbsencePolicy, AbsenceRequest, AbsenceStatus, AbsenceType } from '~/services/dto/absence'
+import { useAbsenceService, type AbsenceRequestFilters } from '~/services/absences'
+import { useAbsenceHelpers } from '~/composables/useAbsenceHelpers'
+
+type Row = AbsenceRequest & { typeLabelText: string; periodText: string; daysText: string; createdAtText: string }
+
+const { t } = useI18n()
+const service = useAbsenceService()
+const { statusLabel, statusVariant, statusIcon, formatRange, formatDays, formatDate } = useAbsenceHelpers()
+
+useHead({ title: t('absences.title') })
+
+const balances = ref<AbsenceBalance[]>([])
+const requests = ref<AbsenceRequest[]>([])
+const policies = ref<AbsencePolicy[]>([])
+
+const requestDrawerOpen = ref(false)
+const detailDrawerOpen = ref(false)
+const selected = ref<AbsenceRequest | null>(null)
+
+// Empty option of MalioSelect has value null, so filters default to null.
+const filters = reactive<{ status: AbsenceStatus | null; type: AbsenceType | null; year: number | null }>({
+    status: null,
+    type: null,
+    year: null,
+})
+
+const columns = [
+    { key: 'typeLabelText', label: t('absences.table.type') },
+    { key: 'periodText', label: t('absences.table.period') },
+    { key: 'daysText', label: t('absences.table.days') },
+    { key: 'status', label: t('absences.table.status') },
+    { key: 'createdAtText', label: t('absences.table.requestedAt') },
+]
+
+const statusOptions = [
+    { label: t('absences.status.pending'), value: 'pending' },
+    { label: t('absences.status.approved'), value: 'approved' },
+    { label: t('absences.status.rejected'), value: 'rejected' },
+    { label: t('absences.status.cancelled'), value: 'cancelled' },
+]
+
+const typeOptions = computed(() => policies.value.map(p => ({ label: p.label, value: p.type })))
+
+const yearOptions = computed(() => {
+    const current = new Date().getFullYear()
+    return [current + 1, current, current - 1, current - 2].map(y => ({ label: String(y), value: y }))
+})
+
+const rows = computed<Row[]>(() =>
+    requests.value.map(r => ({
+        ...r,
+        typeLabelText: r.label,
+        periodText: formatRange(r),
+        daysText: formatDays(r.countedDays),
+        createdAtText: formatDate(r.createdAt),
+    })),
+)
+
+function openDetail(item: Record<string, unknown>) {
+    selected.value = item as Row
+    detailDrawerOpen.value = true
+}
+
+async function loadRequests() {
+    // Scope to the current user: the collection endpoint returns every user's
+    // requests for admins, which would leak the whole team into "Mes absences".
+    const userId = useAuthStore().user?.id
+    if (!userId) {
+        requests.value = []
+        return
+    }
+    const f: AbsenceRequestFilters = { user: userId }
+    if (filters.status) f.status = filters.status
+    if (filters.type) f.type = filters.type
+    if (filters.year) f.year = filters.year
+    requests.value = await service.getRequests(f)
+}
+
+async function reload() {
+    // Scope balances to the current user: the collection endpoint returns every
+    // user's balance for admins, which would pollute the personal "Mes absences" view.
+    const userId = useAuthStore().user?.id
+    const [bal] = await Promise.all([
+        userId ? service.getBalances({ user: userId }) : Promise.resolve([]),
+        loadRequests(),
+    ])
+    balances.value = bal
+}
+
+watch(() => [filters.status, filters.type, filters.year], loadRequests)
+
+onMounted(async () => {
+    policies.value = await service.getPolicies()
+    await reload()
+})
+</script>
diff --git a/frontend/pages/admin.vue b/frontend/pages/admin.vue
index 7ad5831..c1a5402 100644
--- a/frontend/pages/admin.vue
+++ b/frontend/pages/admin.vue
@@ -31,6 +31,7 @@
             <AdminBookStackTab v-if="activeTab === 'bookstack'" />
             <AdminZimbraTab v-if="activeTab === 'zimbra'" />
             <AdminMailTab v-if="activeTab === 'mail'" />
+            <AdminAbsencePolicyTab v-if="activeTab === 'absences'" />
         </div>
     </div>
 </template>
@@ -50,6 +51,7 @@ const tabs = [
     { key: 'bookstack', label: 'BookStack' },
     { key: 'zimbra', label: 'Zimbra' },
     { key: 'mail', label: 'Mail' },
+    { key: 'absences', label: 'Absences' },
 ] as const
 
 type TabKey = typeof tabs[number]['key']
diff --git a/frontend/pages/help.vue b/frontend/pages/help.vue
index 26ed15b..bd00046 100644
--- a/frontend/pages/help.vue
+++ b/frontend/pages/help.vue
@@ -20,7 +20,6 @@ const META: Record<string, { title: string, icon: string, accent: string, roles:
     '03-my-tasks':           { title: 'Mes tâches',           icon: 'mdi:checkbox-marked-circle-outline', accent: 'from-sky-500 to-cyan-500',        roles: ['admin', 'user'] },
     '04-time-tracking':      { title: 'Time tracking',        icon: 'mdi:timer-outline',                   accent: 'from-emerald-500 to-teal-500',    roles: ['admin', 'user'] },
     '05-tasks-detail':       { title: 'Tâches en détail',     icon: 'mdi:file-document-edit-outline',      accent: 'from-violet-500 to-purple-600',  roles: ['admin', 'user'] },
-    '06-client-portal':      { title: 'Portal client',        icon: 'mdi:account-tie-outline',             accent: 'from-orange-500 to-amber-500',   roles: ['admin', 'client'] },
     '07-admin':              { title: 'Administration',       icon: 'mdi:shield-crown-outline',            accent: 'from-rose-500 to-pink-600',      roles: ['admin'] },
     '08-integrations':       { title: 'Intégrations',         icon: 'mdi:puzzle-outline',                  accent: 'from-blue-500 to-indigo-500',    roles: ['admin', 'user'] },
     '09-mcp-api':            { title: 'Token MCP & API',      icon: 'mdi:robot-outline',                   accent: 'from-slate-700 to-slate-900',    roles: ['admin', 'user'] },
@@ -40,7 +39,6 @@ const auth = useAuthStore()
 const userRole = computed<'admin' | 'user' | 'client'>(() => {
     const roles = auth.user?.roles ?? []
     if (roles.includes('ROLE_ADMIN')) return 'admin'
-    if (roles.includes('ROLE_CLIENT')) return 'client'
     return 'user'
 })
 
diff --git a/frontend/pages/index.vue b/frontend/pages/index.vue
index ab06f94..684631b 100644
--- a/frontend/pages/index.vue
+++ b/frontend/pages/index.vue
@@ -515,7 +515,7 @@ const lineOptions = {
                     v-model="selectedPeriod"
                     :options="periodOptions"
                     :label="$t('dashboard.filters.period')"
-                    min-width="!w-48"
+                    group-class="!w-48"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -524,7 +524,7 @@ const lineOptions = {
                     :options="projectOptions"
                     :label="$t('dashboard.filters.project')"
                     :empty-option-label="$t('dashboard.filters.allProjects')"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -533,7 +533,7 @@ const lineOptions = {
                     :options="userOptions"
                     :label="$t('dashboard.filters.user')"
                     :empty-option-label="$t('dashboard.filters.allUsers')"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
diff --git a/frontend/pages/login.vue b/frontend/pages/login.vue
index 9edaeb4..2e8aee3 100644
--- a/frontend/pages/login.vue
+++ b/frontend/pages/login.vue
@@ -54,9 +54,7 @@ async function handleSubmit() {
     isSubmitting.value = true
     try {
         await auth.login(username.value, password.value)
-
-        const isClient = auth.user?.roles?.includes('ROLE_CLIENT') ?? false
-        await navigateTo(isClient ? '/portal' : '/')
+        await navigateTo('/')
     } finally {
         isSubmitting.value = false
     }
diff --git a/frontend/pages/mail.vue b/frontend/pages/mail.vue
index bc3ddf6..6f79de7 100644
--- a/frontend/pages/mail.vue
+++ b/frontend/pages/mail.vue
@@ -1,28 +1,13 @@
 <script setup lang="ts">
 import type { Task } from '~/services/dto/task'
 import { useMailStore } from '~/stores/mail'
-import { useAuthStore } from '~/stores/auth'
 
 const { t } = useI18n()
 const router = useRouter()
 const route = useRoute()
-const auth = useAuthStore()
 
 useHead({ title: t('mail.title') })
 
-// ─── Contrôle d'accès ROLE_CLIENT ─────────────────────────────────────────
-// Le middleware global gère auth + ROLE_CLIENT → /portal. Ici : double check
-// en SPA car la session peut être hydratée après le rendu initial.
-
-const isClientOnly = computed(() =>
-    auth.user?.roles?.includes('ROLE_CLIENT') === true
-    && auth.user?.roles?.includes('ROLE_ADMIN') !== true,
-)
-
-if (isClientOnly.value) {
-    await navigateTo('/portal')
-}
-
 // ─── Store ────────────────────────────────────────────────────────────────
 
 const store = useMailStore()
@@ -40,11 +25,6 @@ const {
 // ─── Init : charge les dossiers + deep-link ───────────────────────────────
 
 onMounted(async () => {
-    if (isClientOnly.value) {
-        router.replace('/portal')
-        return
-    }
-
     if (folderTree.value.length === 0) {
         await store.fetchFolders()
     }
diff --git a/frontend/pages/my-tasks.vue b/frontend/pages/my-tasks.vue
index 95f80fc..9027249 100644
--- a/frontend/pages/my-tasks.vue
+++ b/frontend/pages/my-tasks.vue
@@ -372,7 +372,7 @@ onMounted(async () => {
                     :options="projectOptions"
                     label="Projet"
                     :empty-option-label="$t('myTasks.allProjects')"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -381,7 +381,7 @@ onMounted(async () => {
                     :options="groupOptions"
                     label="Groupe"
                     :empty-option-label="$t('myTasks.allGroups')"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -390,7 +390,7 @@ onMounted(async () => {
                     :options="tagOptions"
                     label="Type"
                     :empty-option-label="$t('myTasks.allTypes')"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -399,7 +399,7 @@ onMounted(async () => {
                     :options="priorityOptions"
                     label="Priorité"
                     :empty-option-label="$t('myTasks.allPriorities')"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -408,7 +408,7 @@ onMounted(async () => {
                     :options="effortOptions"
                     label="Effort"
                     :empty-option-label="$t('myTasks.allEfforts')"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -417,7 +417,7 @@ onMounted(async () => {
                     :options="assigneeOptions"
                     label="Assigné"
                     :empty-option-label="$t('myTasks.allAssignees')"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -426,7 +426,7 @@ onMounted(async () => {
                     :options="sortOptions"
                     :label="$t('myTasks.sortBy')"
                     :empty-option-label="$t('myTasks.sortDefault')"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
diff --git a/frontend/pages/portal/index.vue b/frontend/pages/portal/index.vue
deleted file mode 100644
index def6960..0000000
--- a/frontend/pages/portal/index.vue
+++ /dev/null
@@ -1,84 +0,0 @@
-<template>
-    <div>
-        <div class="sticky top-8 z-20 bg-white pb-4 sm:top-12">
-            <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">{{ $t('portal.projects') }}</h1>
-        </div>
-
-        <div v-if="isLoading" class="py-8 text-center text-sm text-neutral-400">
-            {{ $t('common.loading') }}
-        </div>
-
-        <div v-else-if="projects.length === 0" class="py-8 text-center text-sm text-neutral-400">
-            {{ $t('portal.noProjects') }}
-        </div>
-
-        <div v-else class="mt-4 grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3">
-            <NuxtLink
-                v-for="project in projects"
-                :key="project.id"
-                :to="`/portal/projects/${project.id}`"
-                class="rounded-lg border border-neutral-200 bg-white p-5 shadow-sm transition hover:shadow-md"
-            >
-                <h3 class="text-lg font-bold text-neutral-900">{{ project.name }}</h3>
-                <p class="mt-2 text-sm text-neutral-500">
-                    {{ ticketCountByProject[project.id] ?? 0 }} {{ $t('portal.openTickets') }}
-                </p>
-            </NuxtLink>
-        </div>
-    </div>
-</template>
-
-<script setup lang="ts">
-import type { Project } from '~/services/dto/project'
-import type { ClientTicket } from '~/services/dto/client-ticket'
-import { useClientTicketService } from '~/services/client-tickets'
-import { useProjectService } from '~/services/projects'
-
-definePageMeta({
-    layout: 'portal',
-})
-
-const { t } = useI18n()
-useHead({ title: t('portal.title') })
-
-const auth = useAuthStore()
-const clientTicketService = useClientTicketService()
-const projectService = useProjectService()
-
-const projects = ref<Project[]>([])
-const tickets = ref<ClientTicket[]>([])
-const isLoading = ref(true)
-
-const ticketCountByProject = computed(() => {
-    const counts: Record<number, number> = {}
-    for (const ticket of tickets.value) {
-        if (ticket.status === 'new' || ticket.status === 'in_progress') {
-            const projectId = extractIdFromIri(ticket.project)
-            if (projectId) {
-                counts[projectId] = (counts[projectId] ?? 0) + 1
-            }
-        }
-    }
-    return counts
-})
-
-async function loadData() {
-    isLoading.value = true
-    try {
-        if (auth.user?.roles?.includes('ROLE_ADMIN')) {
-            projects.value = await projectService.getAll({ archived: false })
-        } else {
-            // allowedProjects are embedded objects from /api/me (with me:read group)
-            projects.value = (auth.user?.allowedProjects ?? []) as Project[]
-        }
-
-        tickets.value = await clientTicketService.getAll()
-    } finally {
-        isLoading.value = false
-    }
-}
-
-onMounted(() => {
-    loadData()
-})
-</script>
diff --git a/frontend/pages/portal/projects/[id]/index.vue b/frontend/pages/portal/projects/[id]/index.vue
deleted file mode 100644
index a588ebb..0000000
--- a/frontend/pages/portal/projects/[id]/index.vue
+++ /dev/null
@@ -1,282 +0,0 @@
-<template>
-    <div>
-        <div class="sticky top-8 z-20 bg-white pb-4 sm:top-12">
-            <div class="flex items-center justify-between gap-3">
-                <div class="min-w-0">
-                    <NuxtLink
-                        to="/portal"
-                        class="text-sm text-neutral-400 hover:text-primary-500"
-                    >
-                        {{ $t('portal.backToProject') }}
-                    </NuxtLink>
-                    <h1 class="mt-1 text-xl font-bold text-primary-500 sm:text-2xl">{{ projectName }}</h1>
-                </div>
-                <NuxtLink
-                    v-if="isClient"
-                    :to="`/portal/projects/${projectId}/new-ticket`"
-                    class="shrink-0 rounded-md bg-primary-500 px-3 py-2 text-xs font-semibold text-white hover:bg-secondary-500 sm:px-4 sm:text-sm"
-                >
-                    <span class="hidden sm:inline">+ {{ $t('portal.newTicket') }}</span>
-                    <span class="sm:hidden">+ Ticket</span>
-                </NuxtLink>
-            </div>
-        </div>
-
-        <div v-if="isLoading" class="py-8 text-center text-sm text-neutral-400">
-            {{ $t('common.loading') }}
-        </div>
-
-        <div v-else-if="tickets.length === 0" class="py-8 text-center text-sm text-neutral-400">
-            {{ $t('clientTicket.noTickets') }}
-        </div>
-
-        <!-- Kanban board -->
-        <div v-else class="mt-4 flex h-[calc(100vh-200px)] flex-col gap-4 sm:flex-row sm:overflow-x-auto sm:pb-4">
-            <div
-                v-for="col in columns"
-                :key="col.status"
-                class="flex min-w-0 flex-1 flex-col sm:min-w-[280px]"
-            >
-                <div class="mb-3 flex shrink-0 items-center gap-2">
-                    <div class="h-2 w-2 rounded-full" :class="col.dotClass" />
-                    <h3 class="text-sm font-bold text-neutral-700">{{ col.label }}</h3>
-                    <span class="ml-auto rounded-full bg-neutral-100 px-2 py-0.5 text-xs font-semibold text-neutral-500">
-                        {{ col.tickets.length }}
-                    </span>
-                </div>
-                <div
-                    class="min-h-0 flex-1 space-y-2 overflow-y-auto rounded-lg border-2 border-transparent p-1 transition-colors"
-                    :class="dragOverStatus === col.status ? 'border-primary-300 bg-primary-50/50' : ''"
-                    @dragover.prevent="onDragOver(col.status)"
-                    @dragleave="onDragLeave"
-                    @drop.prevent="onDrop(col.status)"
-                >
-                    <div
-                        v-for="ticket in col.tickets"
-                        :key="ticket.id"
-                        class="cursor-pointer rounded-lg border border-neutral-200 bg-white p-3 shadow-sm transition hover:shadow-md"
-                        :class="isAdmin ? 'cursor-grab active:cursor-grabbing' : ''"
-                        :draggable="isAdmin"
-                        @dragstart="onDragStart(ticket)"
-                        @dragend="onDragEnd"
-                        @click="openDetail(ticket)"
-                    >
-                        <div class="flex items-center gap-2">
-                            <span class="text-xs font-bold text-primary-500">CT-{{ String(ticket.number).padStart(3, '0') }}</span>
-                            <span
-                                class="rounded-full px-2 py-0.5 text-xs font-semibold text-white"
-                                :class="typeBadgeClass(ticket.type)"
-                            >
-                                {{ $t(`clientTicket.type.${ticket.type}`) }}
-                            </span>
-                        </div>
-                        <h4 class="mt-1.5 text-sm font-semibold leading-snug text-neutral-900">{{ ticket.title }}</h4>
-                        <p class="mt-1.5 text-xs text-neutral-400">{{ formatDate(ticket.createdAt) }}</p>
-                    </div>
-                    <p
-                        v-if="col.tickets.length === 0"
-                        class="py-4 text-center text-xs text-neutral-400"
-                    >
-                        {{ $t('clientTicket.noTickets') }}
-                    </p>
-                </div>
-            </div>
-        </div>
-
-        <!-- Ticket detail modal -->
-        <ClientTicketDetailModal
-            v-model="detailOpen"
-            :ticket="selectedTicket"
-            @refresh="loadTickets"
-        />
-
-        <!-- Reject comment modal -->
-        <Teleport v-if="rejectModalOpen" to="body">
-            <div class="fixed inset-0 z-[60] flex items-center justify-center p-4">
-                <div class="absolute inset-0 bg-slate-900/40 backdrop-blur-sm" @click="cancelReject" />
-                <div class="relative z-10 w-full max-w-md rounded-2xl bg-white p-6 shadow-2xl">
-                    <h3 class="text-lg font-bold text-neutral-900">{{ $t('clientTicket.changeStatus') }}</h3>
-                    <p class="mt-2 text-sm text-neutral-600">{{ $t('clientTicket.rejectionRequired') }}</p>
-                    <textarea
-                        v-model="rejectComment"
-                        rows="3"
-                        class="mt-3 w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
-                        :placeholder="$t('clientTicket.rejectComment')"
-                    />
-                    <div class="mt-4 flex justify-end gap-3">
-                        <MalioButton
-                            variant="tertiary"
-                            :label="$t('common.cancel')"
-                            button-class="w-auto px-4"
-                            @click="cancelReject"
-                        />
-                        <MalioButton
-                            variant="danger"
-                            :label="$t('clientTicket.status.rejected')"
-                            button-class="w-auto px-4"
-                            :disabled="!rejectComment.trim()"
-                            @click="confirmReject"
-                        />
-                    </div>
-                </div>
-            </div>
-        </Teleport>
-    </div>
-</template>
-
-<script setup lang="ts">
-import type { ClientTicket, ClientTicketStatus } from '~/services/dto/client-ticket'
-import { useClientTicketService } from '~/services/client-tickets'
-import { useProjectService } from '~/services/projects'
-
-definePageMeta({
-    layout: 'portal',
-})
-
-const route = useRoute()
-const { t } = useI18n()
-const projectId = computed(() => Number(route.params.id))
-
-useHead({ title: t('portal.title') })
-
-const clientTicketService = useClientTicketService()
-const projectService = useProjectService()
-const auth = useAuthStore()
-
-const tickets = ref<ClientTicket[]>([])
-const projectName = ref('')
-const isLoading = ref(true)
-const detailOpen = ref(false)
-const selectedTicket = ref<ClientTicket | null>(null)
-
-const isClient = computed(() => auth.user?.roles?.includes('ROLE_CLIENT') && !auth.user?.roles?.includes('ROLE_ADMIN'))
-const isAdmin = computed(() => auth.user?.roles?.includes('ROLE_ADMIN') ?? false)
-const { typeBadgeClass, formatDate } = useClientTicketHelpers()
-
-const allStatuses: ClientTicketStatus[] = ['new', 'in_progress', 'done', 'rejected']
-
-function statusDotClass(status: string): string {
-    switch (status) {
-        case 'new': return 'bg-blue-500'
-        case 'in_progress': return 'bg-yellow-500'
-        case 'done': return 'bg-green-500'
-        case 'rejected': return 'bg-red-500'
-        default: return 'bg-neutral-400'
-    }
-}
-
-const columns = computed(() => allStatuses.map(status => ({
-    status,
-    label: t(`clientTicket.status.${status}`),
-    dotClass: statusDotClass(status),
-    tickets: tickets.value.filter(tk => tk.status === status),
-})))
-
-// Drag & drop (admin only)
-const draggedTicket = ref<ClientTicket | null>(null)
-const dragOverStatus = ref<ClientTicketStatus | null>(null)
-
-function onDragStart(ticket: ClientTicket) {
-    draggedTicket.value = ticket
-}
-
-function onDragEnd() {
-    draggedTicket.value = null
-    dragOverStatus.value = null
-}
-
-function onDragOver(status: ClientTicketStatus) {
-    if (!draggedTicket.value) return
-    dragOverStatus.value = status
-}
-
-function onDragLeave() {
-    dragOverStatus.value = null
-}
-
-async function onDrop(newStatus: ClientTicketStatus) {
-    dragOverStatus.value = null
-    const ticket = draggedTicket.value
-    draggedTicket.value = null
-
-    if (!ticket || ticket.status === newStatus) return
-
-    // Rejected requires a comment
-    if (newStatus === 'rejected') {
-        pendingRejectTicket.value = ticket
-        rejectComment.value = ''
-        rejectModalOpen.value = true
-        return
-    }
-
-    // Optimistic update
-    const oldStatus = ticket.status
-    ticket.status = newStatus
-    try {
-        await clientTicketService.updateStatus(ticket.id, { status: newStatus })
-        await loadTickets()
-    } catch {
-        ticket.status = oldStatus
-    }
-}
-
-// Reject modal
-const rejectModalOpen = ref(false)
-const rejectComment = ref('')
-const pendingRejectTicket = ref<ClientTicket | null>(null)
-
-function cancelReject() {
-    rejectModalOpen.value = false
-    pendingRejectTicket.value = null
-    rejectComment.value = ''
-}
-
-async function confirmReject() {
-    const ticket = pendingRejectTicket.value
-    if (!ticket || !rejectComment.value.trim()) return
-
-    const oldStatus = ticket.status
-    ticket.status = 'rejected'
-    rejectModalOpen.value = false
-
-    try {
-        await clientTicketService.updateStatus(ticket.id, {
-            status: 'rejected',
-            statusComment: rejectComment.value.trim(),
-        })
-        await loadTickets()
-    } catch {
-        ticket.status = oldStatus
-    }
-
-    pendingRejectTicket.value = null
-    rejectComment.value = ''
-}
-
-function openDetail(ticket: ClientTicket) {
-    selectedTicket.value = ticket
-    detailOpen.value = true
-}
-
-async function loadData() {
-    isLoading.value = true
-    try {
-        const [ticketList, project] = await Promise.all([
-            clientTicketService.getAll({ project: projectId.value }),
-            projectService.getById(projectId.value),
-        ])
-        tickets.value = ticketList
-        projectName.value = project.name
-    } finally {
-        isLoading.value = false
-    }
-}
-
-async function loadTickets() {
-    tickets.value = await clientTicketService.getAll({ project: projectId.value })
-}
-
-onMounted(() => {
-    loadData()
-})
-</script>
diff --git a/frontend/pages/portal/projects/[id]/new-ticket.vue b/frontend/pages/portal/projects/[id]/new-ticket.vue
deleted file mode 100644
index 4820770..0000000
--- a/frontend/pages/portal/projects/[id]/new-ticket.vue
+++ /dev/null
@@ -1,133 +0,0 @@
-<template>
-    <div>
-        <div class="sticky top-8 z-20 bg-white pb-4 sm:top-12">
-            <NuxtLink
-                :to="`/portal/projects/${projectId}`"
-                class="text-sm text-neutral-400 hover:text-primary-500"
-            >
-                {{ $t('portal.backToProject') }}
-            </NuxtLink>
-            <h1 class="mt-1 text-xl font-bold text-primary-500 sm:text-2xl">{{ $t('portal.newTicket') }}</h1>
-        </div>
-
-        <form class="mt-4 max-w-2xl" @submit.prevent="handleSubmit">
-            <!-- Type -->
-            <div>
-                <label class="mb-1 block text-sm font-medium text-neutral-700">{{ $t('clientTicket.selectType') }}</label>
-                <select
-                    v-model="form.type"
-                    class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500"
-                >
-                    <option value="bug">{{ $t('clientTicket.type.bug') }}</option>
-                    <option value="improvement">{{ $t('clientTicket.type.improvement') }}</option>
-                    <option value="other">{{ $t('clientTicket.type.other') }}</option>
-                </select>
-            </div>
-
-            <!-- Title -->
-            <div class="mt-4">
-                <MalioInputText
-                    v-model="form.title"
-                    :label="$t('clientTicket.title')"
-                    input-class="w-full"
-                    :error="touched.title && !form.title.trim() ? $t('clientTicket.title') + ' requis' : ''"
-                    @blur="touched.title = true"
-                />
-            </div>
-
-            <!-- Description -->
-            <div class="mt-4">
-                <MalioInputRichText
-                    v-model="form.description"
-                    :label="$t('clientTicket.description')"
-                    min-height="180px"
-                />
-            </div>
-
-            <!-- URL (only for bug type) -->
-            <div v-if="form.type === 'bug'" class="mt-4">
-                <MalioInputText
-                    v-model="form.url"
-                    :label="$t('clientTicket.url')"
-                    input-class="w-full"
-                />
-            </div>
-
-            <!-- Document upload (only after ticket is created) -->
-            <div class="mt-4 rounded-lg border border-dashed border-neutral-300 p-4">
-                <p class="text-sm text-neutral-500">
-                    <Icon name="heroicons:information-circle" class="mr-1 inline h-4 w-4" />
-                    Les documents pourront être ajoutés après la soumission du ticket.
-                </p>
-            </div>
-
-            <!-- Submit -->
-            <div class="mt-6 flex items-center gap-3">
-                <NuxtLink
-                    :to="`/portal/projects/${projectId}`"
-                    class="rounded-lg border border-neutral-300 px-4 py-2 text-sm font-semibold text-neutral-700 transition-colors hover:bg-neutral-50"
-                >
-                    {{ $t('common.cancel') }}
-                </NuxtLink>
-                <MalioButton
-                    :label="$t('portal.submitTicket')"
-                    button-class="w-auto px-6"
-                    :disabled="isSubmitting"
-                    @click="handleSubmit"
-                />
-            </div>
-        </form>
-    </div>
-</template>
-
-<script setup lang="ts">
-import type { ClientTicketType } from '~/services/dto/client-ticket'
-import { useClientTicketService } from '~/services/client-tickets'
-
-definePageMeta({
-    layout: 'portal',
-})
-
-const route = useRoute()
-const { t } = useI18n()
-const projectId = computed(() => Number(route.params.id))
-
-useHead({ title: t('portal.newTicket') })
-
-const clientTicketService = useClientTicketService()
-
-const form = reactive({
-    type: 'bug' as ClientTicketType | string,
-    title: '',
-    description: '',
-    url: '',
-})
-
-const touched = reactive({
-    title: false,
-})
-
-const isSubmitting = ref(false)
-
-async function handleSubmit() {
-    touched.title = true
-    if (!form.title.trim()) return
-    if (!form.description.trim()) return
-
-    isSubmitting.value = true
-    try {
-        await clientTicketService.create({
-            type: form.type as ClientTicketType,
-            title: form.title.trim(),
-            description: form.description.trim(),
-            url: form.type === 'bug' && form.url.trim() ? form.url.trim() : null,
-            project: `/api/projects/${projectId.value}`,
-        })
-        await navigateTo(`/portal/projects/${projectId.value}`)
-    } catch {
-        // Toast already shown by useApi
-    } finally {
-        isSubmitting.value = false
-    }
-}
-</script>
diff --git a/frontend/pages/profile.vue b/frontend/pages/profile.vue
index 93ed090..2119c80 100644
--- a/frontend/pages/profile.vue
+++ b/frontend/pages/profile.vue
@@ -1,5 +1,5 @@
 <template>
-    <NuxtLayout :name="isClientOnly ? 'portal' : 'default'">
+    <NuxtLayout name="default">
     <div class="mx-auto max-w-lg px-4 py-10">
         <h1 class="mb-8 text-2xl font-bold text-neutral-900">{{ $t('profile.title') }}</h1>
 
@@ -14,17 +14,18 @@
             <p class="text-lg font-semibold text-neutral-800">{{ auth.user?.username }}</p>
 
             <div class="flex gap-3">
-                <label
-                    class="cursor-pointer rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-secondary-500"
+                <MalioButton
+                    button-class="w-auto px-4"
+                    :label="$t('profile.changeAvatar')"
+                    @click="avatarInput?.click()"
+                />
+                <input
+                    ref="avatarInput"
+                    type="file"
+                    accept="image/jpeg,image/png,image/webp,image/gif"
+                    class="hidden"
+                    @change="onFileSelect"
                 >
-                    {{ $t('profile.changeAvatar') }}
-                    <input
-                        type="file"
-                        accept="image/jpeg,image/png,image/webp,image/gif"
-                        class="hidden"
-                        @change="onFileSelect"
-                    />
-                </label>
 
                 <MalioButton
                     v-if="auth.user?.avatarUrl"
@@ -39,7 +40,6 @@
 
         <!-- API Token MCP (interne uniquement) -->
         <div
-            v-if="!isClientOnly"
             class="mt-8 rounded-xl border border-neutral-200 bg-white p-6 shadow-sm"
         >
             <h2 class="mb-1 text-lg font-bold text-neutral-900">{{ $t('profile.apiToken.title') }}</h2>
@@ -134,10 +134,6 @@ const auth = useAuthStore()
 const toast = useToast()
 const { t } = useI18n()
 
-const isClientOnly = computed(() =>
-    auth.user?.roles?.includes('ROLE_CLIENT') && !auth.user?.roles?.includes('ROLE_ADMIN')
-)
-
 definePageMeta({
     layout: false,
 })
@@ -145,6 +141,7 @@ const { upload, remove } = useAvatarService()
 const { regenerate } = useApiTokenService()
 
 const selectedFile = ref<File | null>(null)
+const avatarInput = ref<HTMLInputElement | null>(null)
 const removing = ref(false)
 const regenerating = ref(false)
 const showConfirm = ref(false)
diff --git a/frontend/pages/projects/[id]/archives.vue b/frontend/pages/projects/[id]/archives.vue
index e41df4a..f8994d6 100644
--- a/frontend/pages/projects/[id]/archives.vue
+++ b/frontend/pages/projects/[id]/archives.vue
@@ -11,7 +11,7 @@
                     :options="groupFilterOptions"
                     label="Groupe"
                     empty-option-label="Tous les groupes"
-                    min-width="w-64"
+                    group-class="w-64"
                 />
             </div>
         </div>
diff --git a/frontend/pages/projects/[id]/client-tickets.vue b/frontend/pages/projects/[id]/client-tickets.vue
deleted file mode 100644
index f2d5890..0000000
--- a/frontend/pages/projects/[id]/client-tickets.vue
+++ /dev/null
@@ -1,269 +0,0 @@
-<template>
-    <div>
-        <div class="sticky top-8 z-20 bg-white pb-4 sm:top-12">
-            <div class="flex items-center justify-between gap-3">
-                <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">
-                    Tickets client
-                    <span v-if="project" class="text-neutral-400">— {{ project.name }}</span>
-                </h1>
-            </div>
-
-            <div class="mt-4 flex flex-wrap items-center gap-3">
-                <select
-                    v-model="filterStatus"
-                    class="rounded-md border border-neutral-300 px-3 py-2 text-sm focus:border-primary-500 focus:outline-none"
-                >
-                    <option :value="null">Tous les statuts</option>
-                    <option value="new">{{ $t('clientTicket.status.new') }}</option>
-                    <option value="in_progress">{{ $t('clientTicket.status.in_progress') }}</option>
-                    <option value="done">{{ $t('clientTicket.status.done') }}</option>
-                    <option value="rejected">{{ $t('clientTicket.status.rejected') }}</option>
-                </select>
-            </div>
-        </div>
-
-        <div v-if="isLoading" class="py-12 text-center text-sm text-neutral-400">
-            {{ $t('common.loading') }}
-        </div>
-
-        <div v-else-if="filteredTickets.length === 0" class="py-12 text-center text-sm text-neutral-400">
-            {{ $t('clientTicket.noTickets') }}
-        </div>
-
-        <div v-else class="mt-4 space-y-3">
-            <div
-                v-for="ticket in filteredTickets"
-                :key="ticket.id"
-                class="rounded-lg border border-neutral-200 bg-white"
-            >
-                <div
-                    class="flex cursor-pointer items-start justify-between gap-3 p-4 transition-colors hover:bg-neutral-50"
-                    @click="toggleExpand(ticket.id)"
-                >
-                    <div class="min-w-0 flex-1">
-                        <div class="flex flex-wrap items-center gap-2">
-                            <span class="text-xs font-bold text-primary-500">CT-{{ String(ticket.number).padStart(3, '0') }}</span>
-                            <span
-                                class="rounded-full px-2 py-0.5 text-xs font-semibold text-white"
-                                :class="typeBadgeClass(ticket.type)"
-                            >
-                                {{ $t(`clientTicket.type.${ticket.type}`) }}
-                            </span>
-                            <span
-                                class="rounded-full px-2 py-0.5 text-xs font-semibold"
-                                :class="statusBadgeClass(ticket.status)"
-                            >
-                                {{ $t(`clientTicket.status.${ticket.status}`) }}
-                            </span>
-                        </div>
-                        <p class="mt-1 text-sm font-semibold text-neutral-900">{{ ticket.title }}</p>
-                        <p class="mt-0.5 text-xs text-neutral-400">{{ formatDate(ticket.createdAt) }}</p>
-                    </div>
-                    <div class="flex items-center gap-1">
-                        <MalioButtonIcon
-                            icon="mdi:swap-horizontal"
-                            :aria-label="$t('clientTicket.changeStatus')"
-                            variant="ghost"
-                            icon-size="18"
-                            @click.stop="openStatusChange(ticket)"
-                        />
-                        <MalioButtonIcon
-                            icon="mdi:delete-outline"
-                            aria-label="Supprimer"
-                            variant="ghost"
-                            icon-size="18"
-                            @click.stop="onDelete(ticket)"
-                        />
-                        <Icon
-                            :name="expandedId === ticket.id ? 'mdi:chevron-up' : 'mdi:chevron-down'"
-                            size="20"
-                            class="text-neutral-400"
-                        />
-                    </div>
-                </div>
-
-                <!-- Expanded details -->
-                <div v-if="expandedId === ticket.id" class="border-t border-neutral-100 px-4 py-3">
-                    <MalioInputRichText
-                        v-if="ticket.description"
-                        :model-value="ticket.description"
-                        :editable="false"
-                    />
-                    <p v-else class="text-sm italic text-neutral-400">—</p>
-                    <div v-if="ticket.url" class="mt-2">
-                        <a
-                            :href="ticket.url"
-                            target="_blank"
-                            class="text-xs text-primary-500 underline hover:text-primary-600"
-                        >
-                            {{ ticket.url }}
-                        </a>
-                    </div>
-                    <div v-if="ticket.statusComment" class="mt-2 rounded-lg bg-neutral-50 p-2 text-xs text-neutral-500">
-                        {{ ticket.statusComment }}
-                    </div>
-                </div>
-            </div>
-        </div>
-
-        <!-- Status change modal -->
-        <Teleport v-if="statusModalOpen" to="body">
-            <div class="fixed inset-0 z-[60] flex items-center justify-center p-4">
-                <div
-                    class="absolute inset-0 bg-slate-900/40 backdrop-blur-sm"
-                    @click="statusModalOpen = false"
-                />
-                <div class="relative z-10 w-full max-w-md rounded-2xl bg-white p-6 shadow-2xl">
-                    <h3 class="text-lg font-bold text-neutral-900">{{ $t('clientTicket.changeStatus') }}</h3>
-                    <p v-if="statusTarget" class="mt-1 text-sm text-neutral-500">
-                        CT-{{ String(statusTarget.number).padStart(3, '0') }} — {{ statusTarget.title }}
-                    </p>
-
-                    <div class="mt-4">
-                        <label class="mb-1 block text-sm font-medium text-neutral-700">Nouveau statut</label>
-                        <select
-                            v-model="newStatus"
-                            class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
-                        >
-                            <option :value="null" disabled>—</option>
-                            <option
-                                v-for="s in availableStatusTransitions"
-                                :key="s.value"
-                                :value="s.value"
-                            >
-                                {{ s.label }}
-                            </option>
-                        </select>
-                    </div>
-
-                    <div v-if="newStatus === 'rejected'" class="mt-4">
-                        <MalioInputTextArea
-                            v-model="statusComment"
-                            :label="$t('clientTicket.statusComment')"
-                            :size="3"
-                        />
-                        <p v-if="rejectionError" class="mt-1 text-xs text-red-500">
-                            {{ $t('clientTicket.rejectionRequired') }}
-                        </p>
-                    </div>
-
-                    <div class="mt-6 flex justify-end gap-3">
-                        <MalioButton
-                            variant="tertiary"
-                            :label="$t('common.cancel')"
-                            button-class="w-auto px-4"
-                            @click="statusModalOpen = false"
-                        />
-                        <MalioButton
-                            label="Confirmer"
-                            button-class="w-auto px-6"
-                            :disabled="isUpdatingStatus"
-                            @click="confirmStatusChange"
-                        />
-                    </div>
-                </div>
-            </div>
-        </Teleport>
-    </div>
-</template>
-
-<script setup lang="ts">
-import type { ClientTicket, ClientTicketStatus } from '~/services/dto/client-ticket'
-import type { Project } from '~/services/dto/project'
-import { useClientTicketService } from '~/services/client-tickets'
-import { useProjectService } from '~/services/projects'
-
-const route = useRoute()
-const { t } = useI18n()
-const projectId = computed(() => Number(route.params.id))
-
-useHead({ title: 'Tickets client' })
-
-const clientTicketService = useClientTicketService()
-const projectService = useProjectService()
-const { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions } = useClientTicketHelpers()
-
-const project = ref<Project | null>(null)
-const tickets = ref<ClientTicket[]>([])
-const isLoading = ref(true)
-const filterStatus = ref<string | null>(null)
-const expandedId = ref<number | null>(null)
-
-const filteredTickets = computed(() => {
-    if (!filterStatus.value) return tickets.value
-    return tickets.value.filter(t => t.status === filterStatus.value)
-})
-
-// Status change
-const statusModalOpen = ref(false)
-const statusTarget = ref<ClientTicket | null>(null)
-const newStatus = ref<string | null>(null)
-const statusComment = ref('')
-const rejectionError = ref(false)
-const isUpdatingStatus = ref(false)
-
-const availableStatusTransitions = computed(() => {
-    if (!statusTarget.value) return []
-    return getAvailableStatusTransitions(statusTarget.value.status, t)
-})
-
-function toggleExpand(id: number) {
-    expandedId.value = expandedId.value === id ? null : id
-}
-
-function openStatusChange(ticket: ClientTicket) {
-    statusTarget.value = ticket
-    newStatus.value = null
-    statusComment.value = ''
-    rejectionError.value = false
-    statusModalOpen.value = true
-}
-
-async function confirmStatusChange() {
-    if (!statusTarget.value || !newStatus.value) return
-
-    if (newStatus.value === 'rejected' && !statusComment.value.trim()) {
-        rejectionError.value = true
-        return
-    }
-
-    isUpdatingStatus.value = true
-    try {
-        await clientTicketService.updateStatus(statusTarget.value.id, {
-            status: newStatus.value as ClientTicketStatus,
-            statusComment: newStatus.value === 'rejected' ? statusComment.value.trim() : null,
-        })
-        statusModalOpen.value = false
-        await loadTickets()
-    } finally {
-        isUpdatingStatus.value = false
-    }
-}
-
-async function onDelete(ticket: ClientTicket) {
-    await clientTicketService.remove(ticket.id)
-    await loadTickets()
-}
-
-async function loadTickets() {
-    tickets.value = await clientTicketService.getAll({ project: projectId.value })
-}
-
-async function loadData() {
-    isLoading.value = true
-    try {
-        const [p, t] = await Promise.all([
-            projectService.getById(projectId.value),
-            clientTicketService.getAll({ project: projectId.value }),
-        ])
-        project.value = p
-        tickets.value = t
-    } finally {
-        isLoading.value = false
-    }
-}
-
-onMounted(() => {
-    loadData()
-})
-</script>
diff --git a/frontend/pages/projects/[id]/index.vue b/frontend/pages/projects/[id]/index.vue
index 10490ab..610db7f 100644
--- a/frontend/pages/projects/[id]/index.vue
+++ b/frontend/pages/projects/[id]/index.vue
@@ -38,7 +38,7 @@
                     :options="groupFilterOptions"
                     label="Groupe"
                     empty-option-label="Tous les groupes"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -47,7 +47,7 @@
                     :options="tagFilterOptions"
                     label="Tags"
                     empty-option-label="Tous les tags"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -56,7 +56,7 @@
                     :options="userFilterOptions"
                     label="User"
                     empty-option-label="Tous les users"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -66,7 +66,7 @@
                     :options="statusFilterOptions"
                     label="Status"
                     empty-option-label="Tous les status"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -75,7 +75,7 @@
                     :options="priorityFilterOptions"
                     label="Priorité"
                     empty-option-label="Toutes"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
@@ -84,7 +84,7 @@
                     :options="effortFilterOptions"
                     label="Effort"
                     empty-option-label="Tous"
-                    min-width="!w-40"
+                    group-class="!w-40"
                     text-field="text-sm"
                     text-value="text-sm"
                 />
diff --git a/frontend/pages/team-absences.vue b/frontend/pages/team-absences.vue
new file mode 100644
index 0000000..389e55e
--- /dev/null
+++ b/frontend/pages/team-absences.vue
@@ -0,0 +1,479 @@
+<template>
+    <div class="flex flex-col gap-6">
+        <h1 class="text-2xl font-bold text-neutral-900">
+            {{ $t("absences.teamTitle") }}
+        </h1>
+
+        <!-- KPIs -->
+        <div class="grid grid-cols-1 gap-4 sm:grid-cols-3">
+            <div class="rounded-lg border border-neutral-200 bg-white p-4">
+                <p class="text-sm text-neutral-500">
+                    {{ $t("absences.admin.kpis.pending") }}
+                </p>
+                <p class="mt-1 text-3xl font-bold text-amber-600">
+                    {{ kpis.pending }}
+                </p>
+            </div>
+            <div class="rounded-lg border border-neutral-200 bg-white p-4">
+                <p class="text-sm text-neutral-500">
+                    {{ $t("absences.admin.kpis.todayAbsent") }}
+                </p>
+                <p class="mt-1 text-3xl font-bold text-primary-500">
+                    {{ kpis.today }}
+                </p>
+            </div>
+            <div class="rounded-lg border border-neutral-200 bg-white p-4">
+                <p class="text-sm text-neutral-500">
+                    {{ $t("absences.admin.kpis.weekAbsent") }}
+                </p>
+                <p class="mt-1 text-3xl font-bold text-primary-500">
+                    {{ kpis.week }}
+                </p>
+            </div>
+        </div>
+
+        <MalioTabList v-model="activeTab" :tabs="tabs">
+            <!-- Requests -->
+            <template #requests>
+                <div class="flex min-h-[30rem] flex-col gap-4 pt-10">
+                    <div class="flex flex-wrap gap-3">
+                        <MalioSelect
+                            v-model="filters.status"
+                            :label="$t('absences.table.status')"
+                            :options="statusOptions"
+                            :empty-option-label="
+                                $t('absences.filters.allStatuses')
+                            "
+                            group-class="w-48"
+                        />
+                        <MalioSelect
+                            v-model="filters.type"
+                            :label="$t('absences.table.type')"
+                            :options="typeOptions"
+                            :empty-option-label="
+                                $t('absences.filters.allTypes')
+                            "
+                            group-class="w-48"
+                        />
+                        <MalioSelect
+                            v-model="filters.user"
+                            :label="$t('absences.table.employee')"
+                            :options="employeeOptions"
+                            :empty-option-label="
+                                $t('absences.filters.allEmployees')
+                            "
+                            group-class="w-48"
+                        />
+                    </div>
+
+                    <MalioDataTable
+                        :columns="requestColumns"
+                        :items="requestRows"
+                        :total-items="requestRows.length"
+                        :empty-message="$t('absences.noRequests')"
+                        @row-click="openDetail"
+                    >
+                        <template #cell-status="{ item }">
+                            <StatusBadge
+                                :label="
+                                    statusLabel((item as RequestRow).status)
+                                "
+                                :variant="
+                                    statusVariant((item as RequestRow).status)
+                                "
+                                :icon="statusIcon((item as RequestRow).status)"
+                            />
+                        </template>
+                        <template #cell-actions="{ item }">
+                            <div
+                                v-if="(item as RequestRow).status === 'pending'"
+                                class="flex gap-1"
+                                @click.stop
+                            >
+                                <MalioButtonIcon
+                                    icon="mdi:check"
+                                    :aria-label="$t('absences.review.approve')"
+                                    button-class="!bg-green-100 !text-green-700"
+                                    :icon-size="18"
+                                    @click="approve(item as RequestRow)"
+                                />
+                                <MalioButtonIcon
+                                    icon="mdi:close"
+                                    :aria-label="$t('absences.review.reject')"
+                                    button-class="!bg-red-100 !text-red-700"
+                                    :icon-size="18"
+                                    @click="openReject(item as RequestRow)"
+                                />
+                            </div>
+                            <span v-else class="text-neutral-300">—</span>
+                        </template>
+                    </MalioDataTable>
+                </div>
+            </template>
+
+            <!-- Calendar -->
+            <template #calendar>
+                <div class="min-h-[30rem] pt-10">
+                    <AbsenceCalendar
+                        :absences="calendarAbsences"
+                        @range-change="loadCalendar"
+                    />
+                </div>
+            </template>
+
+            <!-- Balances -->
+            <template #balances>
+                <div class="min-h-[30rem] pt-10">
+                    <MalioDataTable
+                        :columns="balanceColumns"
+                        :items="balanceRows"
+                        :total-items="balanceRows.length"
+                        :row-clickable="false"
+                        :empty-message="$t('absences.noBalance')"
+                    >
+                        <template #cell-actions="{ item }">
+                            <div class="flex justify-end">
+                                <MalioButton
+                                    :label="
+                                        $t(
+                                            'absences.admin.balancesTable.adjust',
+                                        )
+                                    "
+                                    variant="secondary"
+                                    icon-name="mdi:pencil"
+                                    icon-position="left"
+                                    button-class="w-auto"
+                                    @click="openAdjust(item as BalanceRow)"
+                                />
+                            </div>
+                        </template>
+                    </MalioDataTable>
+                </div>
+            </template>
+
+            <!-- Employees -->
+            <template #employees>
+                <div class="min-h-[30rem] pt-10">
+                    <MalioDataTable
+                        :columns="employeeColumns"
+                        :items="employeeRows"
+                        :total-items="employeeRows.length"
+                        :empty-message="$t('absences.admin.employees.empty')"
+                        @row-click="openEmployee"
+                    />
+                </div>
+            </template>
+        </MalioTabList>
+
+        <AbsenceDetailDrawer
+            v-model="detailOpen"
+            :request="selectedRequest"
+            :can-cancel="
+                selectedRequest?.status === 'pending' ||
+                selectedRequest?.status === 'approved'
+            "
+            @cancelled="reloadRequests"
+        />
+        <AbsenceRejectDrawer
+            v-model="rejectOpen"
+            :request="selectedRequest"
+            @rejected="reloadRequests"
+        />
+        <AbsenceBalanceAdjustDrawer
+            v-model="adjustOpen"
+            :balance="selectedBalance"
+            @adjusted="loadBalances"
+        />
+        <EmployeeDrawer
+            v-model="employeeDrawerOpen"
+            :user="selectedEmployee"
+            @saved="loadEmployees"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+import type {
+    AbsenceBalance,
+    AbsenceRequest,
+    AbsenceStatus,
+    AbsenceType,
+} from "~/services/dto/absence";
+import {
+    useAbsenceService,
+    type AbsenceRequestFilters,
+} from "~/services/absences";
+import { useAbsenceHelpers } from "~/composables/useAbsenceHelpers";
+import { useUserService } from "~/services/users";
+import type { UserData } from "~/services/dto/user-data";
+
+definePageMeta({ middleware: ["admin"] });
+
+type RequestRow = AbsenceRequest & {
+    employeeText: string;
+    typeLabelText: string;
+    periodText: string;
+    daysText: string;
+    createdAtText: string;
+};
+type BalanceRow = AbsenceBalance & {
+    employeeText: string;
+    availableText: string;
+};
+type EmployeeRow = UserData & {
+    contractText: string;
+    cpTakenText: string;
+    cpRemainingText: string;
+};
+
+const { t } = useI18n();
+const service = useAbsenceService();
+const {
+    statusLabel,
+    statusVariant,
+    statusIcon,
+    formatRange,
+    formatDays,
+    formatDate,
+} = useAbsenceHelpers();
+
+useHead({ title: t("absences.teamTitle") });
+
+const activeTab = ref("requests");
+const tabs = [
+    {
+        key: "requests",
+        label: t("absences.admin.tabs.requests"),
+        icon: "mdi:format-list-bulleted",
+    },
+    {
+        key: "calendar",
+        label: t("absences.admin.tabs.calendar"),
+        icon: "mdi:calendar-month",
+    },
+    {
+        key: "balances",
+        label: t("absences.admin.tabs.balances"),
+        icon: "mdi:scale-balance",
+    },
+    {
+        key: "employees",
+        label: t("absences.admin.tabs.employees"),
+        icon: "mdi:account-group",
+    },
+];
+
+const requests = ref<AbsenceRequest[]>([]);
+const balances = ref<AbsenceBalance[]>([]);
+const calendarAbsences = ref<AbsenceRequest[]>([]);
+
+const employees = ref<UserData[]>([]);
+const employeeDrawerOpen = ref(false);
+const selectedEmployee = ref<UserData | null>(null);
+
+const detailOpen = ref(false);
+const rejectOpen = ref(false);
+const adjustOpen = ref(false);
+const selectedRequest = ref<AbsenceRequest | null>(null);
+const selectedBalance = ref<AbsenceBalance | null>(null);
+
+// Empty option of MalioSelect has value null, so filters default to null.
+const filters = reactive<{
+    status: AbsenceStatus | null;
+    type: AbsenceType | null;
+    user: number | null;
+}>({
+    status: null,
+    type: null,
+    user: null,
+});
+
+const statusOptions = [
+    { label: t("absences.status.pending"), value: "pending" },
+    { label: t("absences.status.approved"), value: "approved" },
+    { label: t("absences.status.rejected"), value: "rejected" },
+    { label: t("absences.status.cancelled"), value: "cancelled" },
+];
+
+const typeOptions = [
+    { label: t("absences.types.cp"), value: "cp" },
+    { label: t("absences.types.mariage_pacs"), value: "mariage_pacs" },
+    { label: t("absences.types.conge_parental"), value: "conge_parental" },
+    { label: t("absences.types.deces"), value: "deces" },
+    { label: t("absences.types.maladie"), value: "maladie" },
+];
+
+const employeeOptions = computed(() => {
+    const map = new Map<number, string>();
+    for (const r of requests.value) map.set(r.user.id, r.user.username);
+    for (const b of balances.value) map.set(b.user.id, b.user.username);
+    return [...map.entries()].map(([value, label]) => ({ value, label }));
+});
+
+const requestColumns = [
+    { key: "employeeText", label: t("absences.table.employee") },
+    { key: "typeLabelText", label: t("absences.table.type") },
+    { key: "periodText", label: t("absences.table.period") },
+    { key: "daysText", label: t("absences.table.days") },
+    { key: "status", label: t("absences.table.status") },
+    { key: "createdAtText", label: t("absences.table.requestedAt") },
+    { key: "actions", label: t("absences.table.actions") },
+];
+
+const requestRows = computed<RequestRow[]>(() =>
+    requests.value.map((r) => ({
+        ...r,
+        employeeText: r.user.username,
+        typeLabelText: r.label,
+        periodText: formatRange(r),
+        daysText: formatDays(r.countedDays),
+        createdAtText: formatDate(r.createdAt),
+    })),
+);
+
+const balanceColumns = [
+    { key: "employeeText", label: t("absences.admin.balancesTable.employee") },
+    { key: "label", label: t("absences.admin.balancesTable.type") },
+    { key: "period", label: t("absences.admin.balancesTable.period") },
+    { key: "acquired", label: t("absences.admin.balancesTable.acquired") },
+    { key: "acquiring", label: t("absences.admin.balancesTable.acquiring") },
+    { key: "taken", label: t("absences.admin.balancesTable.taken") },
+    { key: "pending", label: t("absences.admin.balancesTable.pending") },
+    {
+        key: "availableText",
+        label: t("absences.admin.balancesTable.available"),
+    },
+    { key: "actions", label: "" },
+];
+
+const balanceRows = computed<BalanceRow[]>(() =>
+    balances.value.map((b) => ({
+        ...b,
+        employeeText: b.user.username,
+        availableText: formatDays(b.available),
+    })),
+);
+
+const employeeColumns = [
+    { key: "username", label: t("absences.admin.employees.columns.name") },
+    { key: "contractText", label: t("absences.admin.employees.columns.contract") },
+    { key: "cpTakenText", label: t("absences.admin.employees.columns.cpTaken") },
+    { key: "cpRemainingText", label: t("absences.admin.employees.columns.cpRemaining") },
+];
+
+const employeeRows = computed<EmployeeRow[]>(() => {
+    // Map user.id -> solde CP de la période courante.
+    const cpByUser = new Map<number, AbsenceBalance>();
+    for (const b of balances.value) {
+        if (b.type === "cp") cpByUser.set(b.user.id, b);
+    }
+    const dash = t("absences.admin.employees.noContract");
+    return employees.value.map((u) => {
+        const cp = cpByUser.get(u.id);
+        return {
+            ...u,
+            contractText: u.contractType ?? dash,
+            cpTakenText: cp ? formatDays(cp.taken) : dash,
+            cpRemainingText: cp ? formatDays(cp.available) : dash,
+        };
+    });
+});
+
+const kpis = computed(() => {
+    const today = new Date().toISOString().slice(0, 10);
+    const now = new Date();
+    const day = (now.getDay() + 6) % 7;
+    const monday = new Date(now);
+    monday.setDate(now.getDate() - day);
+    const sunday = new Date(monday);
+    sunday.setDate(monday.getDate() + 6);
+    const mondayStr = monday.toISOString().slice(0, 10);
+    const sundayStr = sunday.toISOString().slice(0, 10);
+
+    const approved = requests.value.filter((r) => r.status === "approved");
+    const todayUsers = new Set(
+        approved
+            .filter(
+                (r) =>
+                    r.startDate.slice(0, 10) <= today &&
+                    r.endDate.slice(0, 10) >= today,
+            )
+            .map((r) => r.user.id),
+    );
+    const weekUsers = new Set(
+        approved
+            .filter(
+                (r) =>
+                    r.startDate.slice(0, 10) <= sundayStr &&
+                    r.endDate.slice(0, 10) >= mondayStr,
+            )
+            .map((r) => r.user.id),
+    );
+
+    return {
+        pending: requests.value.filter((r) => r.status === "pending").length,
+        today: todayUsers.size,
+        week: weekUsers.size,
+    };
+});
+
+function openDetail(item: Record<string, unknown>) {
+    selectedRequest.value = item as RequestRow;
+    detailOpen.value = true;
+}
+
+function openReject(row: RequestRow) {
+    selectedRequest.value = row;
+    rejectOpen.value = true;
+}
+
+function openAdjust(row: BalanceRow) {
+    selectedBalance.value = row;
+    adjustOpen.value = true;
+}
+
+async function approve(row: RequestRow) {
+    await service.approve(row.id);
+    await reloadRequests();
+}
+
+async function reloadRequests() {
+    const f: AbsenceRequestFilters = {};
+    if (filters.status) f.status = filters.status;
+    if (filters.type) f.type = filters.type;
+    if (filters.user) f.user = filters.user;
+    requests.value = await service.getRequests(f);
+}
+
+async function loadBalances() {
+    balances.value = await service.getBalances();
+}
+
+async function loadEmployees() {
+    const all = await useUserService().getAll();
+    employees.value = all.filter((u) => u.isEmployee);
+}
+
+function openEmployee(item: Record<string, unknown>) {
+    selectedEmployee.value = item as EmployeeRow;
+    employeeDrawerOpen.value = true;
+}
+
+async function loadCalendar(from: string, to: string) {
+    calendarAbsences.value = await service.getCalendar(from, to);
+}
+
+watch(() => [filters.status, filters.type, filters.user], reloadRequests);
+
+onMounted(async () => {
+    await Promise.all([reloadRequests(), loadBalances(), loadEmployees()]);
+});
+</script>
+
+<style scoped>
+/* MalioTabList (lib) : aère les onglets verticalement (espace haut/bas du texte) */
+:deep([role="tab"]) {
+    padding-top: 0.9rem;
+    padding-bottom: 0.25rem;
+}
+</style>
diff --git a/frontend/pages/time-tracking.vue b/frontend/pages/time-tracking.vue
index ade0e97..d740b12 100644
--- a/frontend/pages/time-tracking.vue
+++ b/frontend/pages/time-tracking.vue
@@ -52,7 +52,7 @@
                     <MalioSelect
                         v-model="selectedUserId"
                         :options="userOptions"
-                        min-width="!w-36 sm:!w-44"
+                        group-class="!w-36 sm:!w-44"
                         text-field="text-sm"
                         text-value="text-sm"
                         label="User"
@@ -66,7 +66,7 @@
                         :options="projectOptions"
                         empty-option-label="Tous"
                         label="Projet"
-                        min-width="!w-36 sm:!w-44"
+                        group-class="!w-36 sm:!w-44"
                         text-field="text-sm"
                         text-value="text-sm"
                     />
@@ -78,7 +78,7 @@
                         :options="tagOptions"
                         empty-option-label="Tous"
                         label="Tag"
-                        min-width="!w-36 sm:!w-44"
+                        group-class="!w-36 sm:!w-44"
                         text-field="text-sm"
                         text-value="text-sm"
                     />
diff --git a/frontend/services/absences.ts b/frontend/services/absences.ts
new file mode 100644
index 0000000..c62d5c3
--- /dev/null
+++ b/frontend/services/absences.ts
@@ -0,0 +1,137 @@
+import type {
+    AbsenceBalance,
+    AbsencePolicy,
+    AbsencePolicyWrite,
+    AbsencePreviewPayload,
+    AbsencePreviewResult,
+    AbsenceRequest,
+    AbsenceRequestWrite,
+    AbsenceStatus,
+    AbsenceType,
+} from './dto/absence'
+import type { HydraCollection } from '~/utils/api'
+import { extractHydraMembers } from '~/utils/api'
+
+export type AbsenceRequestFilters = {
+    status?: AbsenceStatus
+    type?: AbsenceType
+    year?: number
+    user?: number
+}
+
+export function useAbsenceService() {
+    const api = useApi()
+
+    // --- Requests ---
+
+    async function getRequests(filters: AbsenceRequestFilters = {}): Promise<AbsenceRequest[]> {
+        const query: Record<string, unknown> = {}
+        if (filters.status) query.status = filters.status
+        if (filters.type) query.type = filters.type
+        if (filters.year) query.year = filters.year
+        if (filters.user) query.user = `/api/users/${filters.user}`
+        const data = await api.get<HydraCollection<AbsenceRequest>>('/absence_requests', query)
+        return extractHydraMembers(data)
+    }
+
+    async function getRequest(id: number): Promise<AbsenceRequest> {
+        return api.get<AbsenceRequest>(`/absence_requests/${id}`)
+    }
+
+    async function create(payload: AbsenceRequestWrite): Promise<AbsenceRequest> {
+        return api.post<AbsenceRequest>('/absence_requests', payload as Record<string, unknown>, {
+            toastSuccessKey: 'absences.toast.created',
+        })
+    }
+
+    async function preview(payload: AbsencePreviewPayload): Promise<AbsencePreviewResult> {
+        return api.post<AbsencePreviewResult>('/absence_requests/preview', payload as Record<string, unknown>, {
+            toast: false,
+        })
+    }
+
+    async function approve(id: number): Promise<AbsenceRequest> {
+        return api.patch<AbsenceRequest>(`/absence_requests/${id}/approve`, {}, {
+            toastSuccessKey: 'absences.toast.approved',
+        })
+    }
+
+    async function reject(id: number, rejectionReason: string): Promise<AbsenceRequest> {
+        return api.patch<AbsenceRequest>(`/absence_requests/${id}/reject`, { rejectionReason }, {
+            toastSuccessKey: 'absences.toast.rejected',
+        })
+    }
+
+    async function cancel(id: number): Promise<AbsenceRequest> {
+        return api.patch<AbsenceRequest>(`/absence_requests/${id}/cancel`, {}, {
+            toastSuccessKey: 'absences.toast.cancelled',
+        })
+    }
+
+    async function uploadJustification(id: number, file: File): Promise<AbsenceRequest> {
+        const form = new FormData()
+        form.append('file', file)
+        return api.post<AbsenceRequest>(`/absence_requests/${id}/justificatif`, form as unknown as Record<string, unknown>, {
+            toastSuccessKey: 'absences.toast.justificationUploaded',
+        })
+    }
+
+    // --- Balances ---
+
+    async function getBalances(filters: { user?: number; period?: string; type?: AbsenceType } = {}): Promise<AbsenceBalance[]> {
+        const query: Record<string, unknown> = {}
+        if (filters.user) query.user = `/api/users/${filters.user}`
+        if (filters.period) query.period = filters.period
+        if (filters.type) query.type = filters.type
+        const data = await api.get<HydraCollection<AbsenceBalance>>('/absence_balances', query)
+        return extractHydraMembers(data)
+    }
+
+    async function adjustBalance(id: number, payload: { acquired?: number; acquiring?: number; taken?: number }): Promise<AbsenceBalance> {
+        return api.patch<AbsenceBalance>(`/absence_balances/${id}`, payload as Record<string, unknown>, {
+            toastSuccessKey: 'absences.toast.balanceAdjusted',
+        })
+    }
+
+    // --- Policies ---
+
+    async function getPolicies(): Promise<AbsencePolicy[]> {
+        const data = await api.get<HydraCollection<AbsencePolicy>>('/absence_policies')
+        return extractHydraMembers(data)
+    }
+
+    async function updatePolicy(id: number, payload: AbsencePolicyWrite): Promise<AbsencePolicy> {
+        return api.patch<AbsencePolicy>(`/absence_policies/${id}`, payload as Record<string, unknown>, {
+            toastSuccessKey: 'absences.toast.policyUpdated',
+        })
+    }
+
+    // --- Admin calendar ---
+
+    async function getCalendar(from: string, to: string): Promise<AbsenceRequest[]> {
+        return api.get<AbsenceRequest[]>('/admin/absences/calendar', { from, to })
+    }
+
+    // --- Public holidays (computed server-side) ---
+
+    async function getPublicHolidays(from: string, to: string): Promise<Record<string, string>> {
+        return api.get<Record<string, string>>('/public_holidays', { from, to }, { toast: false })
+    }
+
+    return {
+        getRequests,
+        getRequest,
+        create,
+        preview,
+        approve,
+        reject,
+        cancel,
+        uploadJustification,
+        getBalances,
+        adjustBalance,
+        getPolicies,
+        updatePolicy,
+        getCalendar,
+        getPublicHolidays,
+    }
+}
diff --git a/frontend/services/client-tickets.ts b/frontend/services/client-tickets.ts
deleted file mode 100644
index 5097fbe..0000000
--- a/frontend/services/client-tickets.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-import type { ClientTicket, ClientTicketWrite, ClientTicketStatusUpdate } from './dto/client-ticket'
-import type { HydraCollection } from '~/utils/api'
-import { extractHydraMembers } from '~/utils/api'
-
-export function useClientTicketService() {
-    const api = useApi()
-
-    async function getAll(params?: { project?: number; status?: string; submittedBy?: number }): Promise<ClientTicket[]> {
-        const query: Record<string, unknown> = {}
-        if (params?.project) query.project = `/api/projects/${params.project}`
-        if (params?.status) query.status = params.status
-        if (params?.submittedBy) query.submittedBy = `/api/users/${params.submittedBy}`
-        const data = await api.get<HydraCollection<ClientTicket>>('/client_tickets', query)
-        return extractHydraMembers(data)
-    }
-
-    async function getById(id: number): Promise<ClientTicket> {
-        return api.get<ClientTicket>(`/client_tickets/${id}`)
-    }
-
-    async function create(payload: ClientTicketWrite): Promise<ClientTicket> {
-        return api.post<ClientTicket>('/client_tickets', payload as Record<string, unknown>, {
-            toastSuccessKey: 'portal.ticketCreated',
-        })
-    }
-
-    async function updateStatus(id: number, payload: ClientTicketStatusUpdate): Promise<ClientTicket> {
-        return api.patch<ClientTicket>(`/client_tickets/${id}`, payload as Record<string, unknown>, {
-            toastSuccessKey: 'clientTicket.statusUpdated',
-        })
-    }
-
-    async function update(id: number, data: Partial<ClientTicketWrite>): Promise<ClientTicket> {
-        return api.patch<ClientTicket>(`/client_tickets/${id}`, data as Record<string, unknown>, {
-            toastSuccessKey: 'clientTicket.updated',
-        })
-    }
-
-    async function remove(id: number): Promise<void> {
-        await api.delete(`/client_tickets/${id}`, {}, {
-            toastSuccessKey: 'clientTicket.deleted',
-        })
-    }
-
-    return { getAll, getById, create, update, updateStatus, remove }
-}
diff --git a/frontend/services/dto/absence.ts b/frontend/services/dto/absence.ts
new file mode 100644
index 0000000..fb1a2cb
--- /dev/null
+++ b/frontend/services/dto/absence.ts
@@ -0,0 +1,93 @@
+export type AbsenceType = 'cp' | 'mariage_pacs' | 'conge_parental' | 'deces' | 'maladie'
+export type AbsenceStatus = 'pending' | 'approved' | 'rejected' | 'cancelled'
+export type HalfDay = 'matin' | 'apres_midi'
+
+export type AbsenceUserRef = {
+    '@id'?: string
+    id: number
+    username: string
+    avatarUrl: string | null
+}
+
+export type AbsenceRequest = {
+    '@id'?: string
+    id: number
+    user: AbsenceUserRef
+    type: AbsenceType
+    label: string
+    startDate: string
+    endDate: string
+    startHalfDay: HalfDay | null
+    endHalfDay: HalfDay | null
+    countedDays: number
+    reason: string | null
+    justificationFileName: string | null
+    justificationUrl: string | null
+    status: AbsenceStatus
+    rejectionReason: string | null
+    createdAt: string
+    reviewedAt: string | null
+    reviewedBy: AbsenceUserRef | null
+}
+
+export type AbsenceRequestWrite = {
+    type: AbsenceType
+    startDate: string
+    endDate: string
+    startHalfDay?: HalfDay | null
+    endHalfDay?: HalfDay | null
+    reason?: string | null
+}
+
+export type AbsenceBalance = {
+    '@id'?: string
+    id: number
+    user: AbsenceUserRef
+    type: AbsenceType
+    label: string
+    period: string
+    acquired: number
+    acquiring: number
+    acquiredTotal: number
+    taken: number
+    pending: number
+    available: number
+}
+
+export type AbsencePolicy = {
+    '@id'?: string
+    id: number
+    type: AbsenceType
+    label: string
+    daysPerYear: number | null
+    daysPerEvent: number | null
+    justificationRequired: boolean
+    noticeDays: number
+    countWorkingDaysOnly: boolean
+    active: boolean
+}
+
+export type AbsencePolicyWrite = {
+    daysPerYear?: number | null
+    daysPerEvent?: number | null
+    justificationRequired?: boolean
+    noticeDays?: number
+    countWorkingDaysOnly?: boolean
+    active?: boolean
+}
+
+export type AbsencePreviewPayload = {
+    type: AbsenceType
+    startDate: string
+    endDate: string
+    startHalfDay?: HalfDay | null
+    endHalfDay?: HalfDay | null
+}
+
+export type AbsencePreviewResult = {
+    countedDays: number
+    period: string | null
+    available: number | null
+    projectedAvailable: number | null
+    justificationRequired: boolean
+}
diff --git a/frontend/services/dto/client-ticket.ts b/frontend/services/dto/client-ticket.ts
deleted file mode 100644
index 542f8bb..0000000
--- a/frontend/services/dto/client-ticket.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import type { TaskDocument } from './task-document'
-
-export type ClientTicketType = 'bug' | 'improvement' | 'other'
-export type ClientTicketStatus = 'new' | 'in_progress' | 'done' | 'rejected'
-
-export type ClientTicket = {
-    '@id'?: string
-    id: number
-    number: number
-    type: ClientTicketType
-    title: string
-    description: string
-    url: string | null
-    status: ClientTicketStatus
-    statusComment: string | null
-    project: string
-    submittedBy: string | null
-    createdAt: string
-    updatedAt: string
-    documents?: TaskDocument[]
-}
-
-export type ClientTicketWrite = {
-    type: ClientTicketType
-    title: string
-    description: string
-    url?: string | null
-    project: string
-}
-
-export type ClientTicketStatusUpdate = {
-    status: ClientTicketStatus
-    statusComment?: string | null
-}
diff --git a/frontend/services/dto/notification.ts b/frontend/services/dto/notification.ts
index 4c8e293..9b8fe43 100644
--- a/frontend/services/dto/notification.ts
+++ b/frontend/services/dto/notification.ts
@@ -7,7 +7,6 @@ export type Notification = {
     type: NotificationType
     title: string
     message: string
-    relatedTicket: string | null
     isRead: boolean
     createdAt: string
 }
diff --git a/frontend/services/dto/task.ts b/frontend/services/dto/task.ts
index 6ab499e..d2a8114 100644
--- a/frontend/services/dto/task.ts
+++ b/frontend/services/dto/task.ts
@@ -23,13 +23,6 @@ export type Task = {
     tags: TaskTag[]
     documents: TaskDocument[]
     archived: boolean
-    clientTicket: {
-        id: number
-        number: number
-        type: string
-        status: string
-        title: string
-    } | null
     scheduledStart: string | null
     scheduledEnd: string | null
     deadline: string | null
@@ -61,7 +54,6 @@ export type TaskWrite = {
     project: string
     tags: string[]
     archived?: boolean
-    clientTicket?: string | null
     scheduledStart?: string | null
     scheduledEnd?: string | null
     deadline?: string | null
diff --git a/frontend/services/dto/user-data.ts b/frontend/services/dto/user-data.ts
index bddd1d5..43265b5 100644
--- a/frontend/services/dto/user-data.ts
+++ b/frontend/services/dto/user-data.ts
@@ -1,20 +1,39 @@
-import type { Project } from './project'
+export type ContractType = 'CDI' | 'CDD' | 'STAGE' | 'ALTERNANCE' | 'AUTRE'
+export type FamilySituation = 'CELIBATAIRE' | 'MARIE' | 'PACSE' | 'DIVORCE' | 'VEUF'
 
 export type UserData = {
     id: number
     '@id'?: string
     username: string
     roles: string[]
-    client?: { id: number; name: string } | null
-    allowedProjects?: Project[]
     avatarUrl?: string | null
     apiToken?: string | null
+    // HR / absence management
+    isEmployee?: boolean
+    hireDate?: string | null
+    endDate?: string | null
+    contractType?: ContractType | null
+    workTimeRatio?: number
+    annualLeaveDays?: number
+    referencePeriodStart?: string
+    initialLeaveBalance?: number
+    familySituation?: FamilySituation | null
+    nbChildren?: number
 }
 
 export type UserWrite = {
     username: string
     plainPassword?: string
     roles: string[]
-    client?: string | null
-    allowedProjects?: string[]
+    // HR / absence management
+    isEmployee?: boolean
+    hireDate?: string | null
+    endDate?: string | null
+    contractType?: ContractType | null
+    workTimeRatio?: number
+    annualLeaveDays?: number
+    referencePeriodStart?: string
+    initialLeaveBalance?: number
+    familySituation?: FamilySituation | null
+    nbChildren?: number
 }
diff --git a/frontend/services/task-documents.ts b/frontend/services/task-documents.ts
index 3bc9336..6560e8d 100644
--- a/frontend/services/task-documents.ts
+++ b/frontend/services/task-documents.ts
@@ -31,17 +31,6 @@ export function useTaskDocumentService() {
         return uploadWithRelation('task', `/api/tasks/${taskId}`, file)
     }
 
-    async function uploadForTicket(clientTicketId: number, file: File): Promise<TaskDocument> {
-        return uploadWithRelation('clientTicket', `/api/client_tickets/${clientTicketId}`, file)
-    }
-
-    async function getByTicket(clientTicketId: number): Promise<TaskDocument[]> {
-        const data = await api.get<HydraCollection<TaskDocument>>('/task_documents', {
-            clientTicket: `/api/client_tickets/${clientTicketId}`,
-        })
-        return extractHydraMembers(data)
-    }
-
     async function remove(id: number): Promise<void> {
         await api.delete(`/task_documents/${id}`, {}, {
             toastSuccessKey: 'taskDocuments.deleted',
@@ -52,5 +41,5 @@ export function useTaskDocumentService() {
         return `${baseURL}/task_documents/${id}/download`
     }
 
-    return { getByTask, upload, uploadForTicket, getByTicket, remove, getDownloadUrl }
+    return { getByTask, upload, remove, getDownloadUrl }
 }
diff --git a/makefile b/makefile
index af6184b..9cc9803 100644
--- a/makefile
+++ b/makefile
@@ -49,6 +49,9 @@ composer-install:
 
 build-nuxtJS:
 #	$(EXEC_PHP) cp -n frontend/.env.dist frontend/.env.local
+# Nettoie dist en root au cas où un ancien build l'aurait laissé en root:root
+# (sinon le `rm -rf dist` de `build:dist`, exécuté en www-data, échoue avec "Permission denied")
+	-$(EXEC_PHP_ROOT) rm -rf frontend/dist
 	$(EXEC_PHP) sh -lc "cd frontend && npm install && npm run build:dist"
 
 dev-nuxt:
diff --git a/migrations/Version20260521160000.php b/migrations/Version20260521160000.php
new file mode 100644
index 0000000..2ee510d
--- /dev/null
+++ b/migrations/Version20260521160000.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Absence management: track the last accrued month on absence_balance to make
+ * the monthly paid-leave accrual idempotent.
+ */
+final class Version20260521160000 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add last_accrued_month to absence_balance';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE absence_balance ADD last_accrued_month VARCHAR(7) DEFAULT NULL');
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE absence_balance DROP last_accrued_month');
+    }
+}
diff --git a/migrations/Version20260522090000.php b/migrations/Version20260522090000.php
new file mode 100644
index 0000000..d051b5d
--- /dev/null
+++ b/migrations/Version20260522090000.php
@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Absence management: split the paid-leave balance into "acquired" (Congés N-1,
+ * finalized and available) and "acquiring" (Congés N, "en cours d'acquisition"),
+ * mirroring the two columns on a French payslip.
+ *
+ * Existing paid-leave balances were filled solely by the monthly accrual, which
+ * credited `acquired`; those days actually belong to the current period's
+ * "en cours d'acquisition", so they are moved to `acquiring` on the way up.
+ */
+final class Version20260522090000 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add acquiring (en cours d\'acquisition) to absence_balance and reclassify existing paid-leave days';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE absence_balance ADD acquiring DOUBLE PRECISION DEFAULT 0 NOT NULL');
+        $this->addSql("UPDATE absence_balance SET acquiring = acquired, acquired = 0 WHERE type = 'cp'");
+        $this->addSql('ALTER TABLE absence_balance ALTER acquiring DROP DEFAULT');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // Fold the in-progress days back into acquired before dropping the column.
+        $this->addSql("UPDATE absence_balance SET acquired = acquired + acquiring WHERE type = 'cp'");
+        $this->addSql('ALTER TABLE absence_balance DROP acquiring');
+    }
+}
diff --git a/migrations/Version20260522110000.php b/migrations/Version20260522110000.php
new file mode 100644
index 0000000..90d4501
--- /dev/null
+++ b/migrations/Version20260522110000.php
@@ -0,0 +1,102 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Suppression de la feature « portail client » : table client_ticket,
+ * table user_allowed_projects, colonne user.client_id, et toutes les
+ * relations vers client_ticket (task, task_document, time_entry, notification).
+ */
+final class Version20260522110000 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Drop client portal feature (client_ticket, user_allowed_projects, related columns)';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // time_entry → client_ticket
+        $this->addSql('ALTER TABLE time_entry DROP CONSTRAINT IF EXISTS FK_6E537C0C9B2097DD');
+        $this->addSql('DROP INDEX IF EXISTS IDX_6E537C0C9B2097DD');
+        $this->addSql('ALTER TABLE time_entry DROP COLUMN IF EXISTS client_ticket_id');
+
+        // task → client_ticket
+        $this->addSql('ALTER TABLE task DROP CONSTRAINT IF EXISTS FK_527EDB259B2097DD');
+        $this->addSql('DROP INDEX IF EXISTS IDX_527EDB259B2097DD');
+        $this->addSql('ALTER TABLE task DROP COLUMN IF EXISTS client_ticket_id');
+
+        // notification → client_ticket
+        $this->addSql('ALTER TABLE notification DROP CONSTRAINT IF EXISTS FK_BF5476CAD8C11BC9');
+        $this->addSql('DROP INDEX IF EXISTS IDX_BF5476CAD8C11BC9');
+        $this->addSql('ALTER TABLE notification DROP COLUMN IF EXISTS related_ticket_id');
+
+        // task_document → client_ticket : les documents rattachés uniquement à un
+        // ticket (sans tâche) disparaissent avec la feature.
+        $this->addSql('ALTER TABLE task_document DROP CONSTRAINT IF EXISTS FK_98A9603A9B2097DD');
+        $this->addSql('DROP INDEX IF EXISTS IDX_98A9603A9B2097DD');
+        $this->addSql('ALTER TABLE task_document DROP CONSTRAINT IF EXISTS chk_document_owner');
+        $this->addSql('DELETE FROM task_document WHERE task_id IS NULL');
+        $this->addSql('ALTER TABLE task_document DROP COLUMN IF EXISTS client_ticket_id');
+        $this->addSql('ALTER TABLE task_document ALTER COLUMN task_id SET NOT NULL');
+
+        // user → client
+        $this->addSql('ALTER TABLE "user" DROP CONSTRAINT IF EXISTS FK_8D93D64919EB6921');
+        $this->addSql('DROP INDEX IF EXISTS IDX_8D93D64919EB6921');
+        $this->addSql('ALTER TABLE "user" DROP COLUMN IF EXISTS client_id');
+
+        // tables dédiées au portail
+        $this->addSql('DROP TABLE IF EXISTS user_allowed_projects');
+        $this->addSql('DROP TABLE IF EXISTS client_ticket');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // Recreate client_ticket
+        $this->addSql('CREATE TABLE client_ticket (id INT GENERATED BY DEFAULT AS IDENTITY NOT NULL, number INT NOT NULL, type VARCHAR(20) NOT NULL, title VARCHAR(255) NOT NULL, description TEXT NOT NULL, url VARCHAR(255) DEFAULT NULL, status VARCHAR(20) NOT NULL, status_comment TEXT DEFAULT NULL, created_at TIMESTAMP(0) WITHOUT TIME ZONE NOT NULL, updated_at TIMESTAMP(0) WITHOUT TIME ZONE NOT NULL, project_id INT NOT NULL, submitted_by_id INT DEFAULT NULL, PRIMARY KEY (id))');
+        $this->addSql('CREATE INDEX IDX_C206E610166D1F9C ON client_ticket (project_id)');
+        $this->addSql('CREATE INDEX IDX_C206E61079F7D87D ON client_ticket (submitted_by_id)');
+        $this->addSql('CREATE UNIQUE INDEX uniq_client_ticket_project_number ON client_ticket (project_id, number)');
+        $this->addSql('ALTER TABLE client_ticket ADD CONSTRAINT FK_C206E610166D1F9C FOREIGN KEY (project_id) REFERENCES project (id) ON DELETE CASCADE NOT DEFERRABLE');
+        $this->addSql('ALTER TABLE client_ticket ADD CONSTRAINT FK_C206E61079F7D87D FOREIGN KEY (submitted_by_id) REFERENCES "user" (id) ON DELETE SET NULL NOT DEFERRABLE');
+
+        // Recreate user_allowed_projects
+        $this->addSql('CREATE TABLE user_allowed_projects (user_id INT NOT NULL, project_id INT NOT NULL, PRIMARY KEY (user_id, project_id))');
+        $this->addSql('CREATE INDEX IDX_B3E0FC97A76ED395 ON user_allowed_projects (user_id)');
+        $this->addSql('CREATE INDEX IDX_B3E0FC97166D1F9C ON user_allowed_projects (project_id)');
+        $this->addSql('ALTER TABLE user_allowed_projects ADD CONSTRAINT FK_B3E0FC97A76ED395 FOREIGN KEY (user_id) REFERENCES "user" (id) ON DELETE CASCADE');
+        $this->addSql('ALTER TABLE user_allowed_projects ADD CONSTRAINT FK_B3E0FC97166D1F9C FOREIGN KEY (project_id) REFERENCES project (id) ON DELETE CASCADE');
+
+        // user.client_id
+        $this->addSql('ALTER TABLE "user" ADD client_id INT DEFAULT NULL');
+        $this->addSql('ALTER TABLE "user" ADD CONSTRAINT FK_8D93D64919EB6921 FOREIGN KEY (client_id) REFERENCES client (id) ON DELETE SET NULL NOT DEFERRABLE');
+        $this->addSql('CREATE INDEX IDX_8D93D64919EB6921 ON "user" (client_id)');
+
+        // task_document.client_ticket_id
+        $this->addSql('ALTER TABLE task_document ALTER COLUMN task_id DROP NOT NULL');
+        $this->addSql('ALTER TABLE task_document ADD client_ticket_id INT DEFAULT NULL');
+        $this->addSql('ALTER TABLE task_document ADD CONSTRAINT FK_98A9603A9B2097DD FOREIGN KEY (client_ticket_id) REFERENCES client_ticket (id) ON DELETE CASCADE NOT DEFERRABLE');
+        $this->addSql('CREATE INDEX IDX_98A9603A9B2097DD ON task_document (client_ticket_id)');
+        $this->addSql('ALTER TABLE task_document ADD CONSTRAINT chk_document_owner CHECK (task_id IS NOT NULL OR client_ticket_id IS NOT NULL)');
+
+        // notification.related_ticket_id
+        $this->addSql('ALTER TABLE notification ADD related_ticket_id INT DEFAULT NULL');
+        $this->addSql('ALTER TABLE notification ADD CONSTRAINT FK_BF5476CAD8C11BC9 FOREIGN KEY (related_ticket_id) REFERENCES client_ticket (id) ON DELETE SET NULL NOT DEFERRABLE');
+        $this->addSql('CREATE INDEX IDX_BF5476CAD8C11BC9 ON notification (related_ticket_id)');
+
+        // task.client_ticket_id
+        $this->addSql('ALTER TABLE task ADD client_ticket_id INT DEFAULT NULL');
+        $this->addSql('ALTER TABLE task ADD CONSTRAINT FK_527EDB259B2097DD FOREIGN KEY (client_ticket_id) REFERENCES client_ticket (id) ON DELETE SET NULL NOT DEFERRABLE');
+        $this->addSql('CREATE INDEX IDX_527EDB259B2097DD ON task (client_ticket_id)');
+
+        // time_entry.client_ticket_id
+        $this->addSql('ALTER TABLE time_entry ADD client_ticket_id INT DEFAULT NULL');
+        $this->addSql('ALTER TABLE time_entry ADD CONSTRAINT FK_6E537C0C9B2097DD FOREIGN KEY (client_ticket_id) REFERENCES client_ticket (id) ON DELETE SET NULL NOT DEFERRABLE');
+        $this->addSql('CREATE INDEX IDX_6E537C0C9B2097DD ON time_entry (client_ticket_id)');
+    }
+}
diff --git a/src/Command/AccrueLeaveCommand.php b/src/Command/AccrueLeaveCommand.php
new file mode 100644
index 0000000..e241e64
--- /dev/null
+++ b/src/Command/AccrueLeaveCommand.php
@@ -0,0 +1,151 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Command;
+
+use App\Enum\AbsenceType;
+use App\Repository\AbsenceBalanceRepository;
+use App\Repository\UserRepository;
+use App\Service\AbsenceBalanceService;
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use Exception;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+use function preg_match;
+use function sprintf;
+
+/**
+ * Monthly paid-leave accrual. For each active employee it credits one twelfth
+ * of their yearly entitlement (prorated by work-time ratio) to the current
+ * reference-period balance. Idempotent per month thanks to lastAccruedMonth,
+ * and it seeds the initial balance when the period balance is first created.
+ *
+ * Intended to run on the 1st of each month (cron). Notifications are out of
+ * scope for now.
+ */
+#[AsCommand(
+    name: 'app:absences:accrue-leave',
+    description: 'Credit the monthly paid-leave accrual to every active employee',
+)]
+class AccrueLeaveCommand extends Command
+{
+    public function __construct(
+        private readonly UserRepository $userRepository,
+        private readonly AbsenceBalanceRepository $balanceRepository,
+        private readonly AbsenceBalanceService $balanceService,
+        private readonly EntityManagerInterface $entityManager,
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->addOption('month', null, InputOption::VALUE_REQUIRED, 'Target month (YYYY-MM), defaults to the current month')
+            ->addOption('dry-run', null, InputOption::VALUE_NONE, 'Compute and display without persisting')
+        ;
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+
+        $monthOpt = $input->getOption('month');
+        $dryRun   = (bool) $input->getOption('dry-run');
+
+        try {
+            $firstDay = $monthOpt
+                ? new DateTimeImmutable($monthOpt.'-01')
+                : new DateTimeImmutable('first day of this month');
+        } catch (Exception) {
+            $io->error('Invalid --month, expected format YYYY-MM.');
+
+            return Command::FAILURE;
+        }
+
+        $firstDay = $firstDay->setTime(0, 0);
+        $lastDay  = $firstDay->modify('last day of this month');
+        $monthKey = $firstDay->format('Y-m');
+
+        $io->title(sprintf('Acquisition CP — %s%s', $monthKey, $dryRun ? ' (dry-run)' : ''));
+
+        $employees = $this->userRepository->findActiveEmployees($lastDay);
+        if ([] === $employees) {
+            $io->warning('Aucun salarié actif pour ce mois.');
+
+            return Command::SUCCESS;
+        }
+
+        $rows    = [];
+        $accrued = 0;
+        $skipped = 0;
+
+        foreach ($employees as $user) {
+            $rate   = ($user->getAnnualLeaveDays() / 12) * $user->getWorkTimeRatio();
+            $period = $this->balanceService->periodFor($user, AbsenceType::PaidLeave, $firstDay);
+
+            $balance = $this->balanceRepository->findOneForPeriod($user, AbsenceType::PaidLeave, $period);
+            $isNew   = null === $balance;
+
+            if ($isNew) {
+                $balance = $this->balanceService->getOrCreateBalance($user, AbsenceType::PaidLeave, $period);
+                // On a new period, the previous period's "en cours d'acquisition" (N)
+                // becomes this period's acquired (N-1). At roll-out (no prior balance)
+                // seed the configured initial balance instead.
+                $previousPeriod  = self::previousPeriod($period);
+                $previousBalance = null !== $previousPeriod
+                    ? $this->balanceRepository->findOneForPeriod($user, AbsenceType::PaidLeave, $previousPeriod)
+                    : null;
+                $balance->setAcquired(
+                    null !== $previousBalance ? $previousBalance->getAcquiring() : $user->getInitialLeaveBalance(),
+                );
+            }
+
+            if ($monthKey === $balance->getLastAccruedMonth()) {
+                ++$skipped;
+                $rows[] = [$user->getUsername(), $period, number_format($balance->getAcquired(), 2), number_format($balance->getAcquiring(), 2), 'déjà fait'];
+
+                continue;
+            }
+
+            $balance->setAcquiring($balance->getAcquiring() + $rate);
+            $balance->setLastAccruedMonth($monthKey);
+            ++$accrued;
+
+            $seeded = $isNew && (null !== self::previousPeriod($period) || $user->getInitialLeaveBalance() > 0);
+            $rows[] = [
+                $user->getUsername(),
+                $period,
+                number_format($balance->getAcquired(), 2),
+                number_format($balance->getAcquiring(), 2),
+                sprintf('+%s%s', number_format($rate, 2), $seeded && $balance->getAcquired() > 0 ? ' (N-1 reporté)' : ''),
+            ];
+        }
+
+        if (!$dryRun) {
+            $this->entityManager->flush();
+        }
+
+        $io->table(['Salarié', 'Période', 'Acquis (N-1)', 'En cours (N)', 'Action'], $rows);
+        $io->success(sprintf('%d crédité(s), %d ignoré(s)%s.', $accrued, $skipped, $dryRun ? ' (dry-run, rien enregistré)' : ''));
+
+        return Command::SUCCESS;
+    }
+
+    /** Previous reference period for a "YYYY-YYYY" paid-leave period, or null. */
+    private static function previousPeriod(string $period): ?string
+    {
+        if (1 !== preg_match('/^(\d{4})-(\d{4})$/', $period, $m)) {
+            return null;
+        }
+
+        return sprintf('%d-%d', (int) $m[1] - 1, (int) $m[2] - 1);
+    }
+}
diff --git a/src/Controller/Absence/PublicHolidayController.php b/src/Controller/Absence/PublicHolidayController.php
new file mode 100644
index 0000000..5c308fa
--- /dev/null
+++ b/src/Controller/Absence/PublicHolidayController.php
@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Absence;
+
+use App\Service\PublicHolidayProvider;
+use DateTimeImmutable;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+
+/**
+ * Exposes French public holidays so the front (calendar, date pickers) can
+ * display them — the dates are computed server-side in pure PHP.
+ */
+class PublicHolidayController extends AbstractController
+{
+    public function __construct(
+        private readonly PublicHolidayProvider $holidayProvider,
+    ) {}
+
+    #[Route('/api/public_holidays', name: 'public_holidays', methods: ['GET'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function __invoke(Request $request): JsonResponse
+    {
+        $fromRaw = (string) $request->query->get('from', '');
+        $toRaw   = (string) $request->query->get('to', '');
+
+        if ('' !== $fromRaw && '' !== $toRaw) {
+            $fromYear = (int) new DateTimeImmutable($fromRaw)->format('Y');
+            $toYear   = (int) new DateTimeImmutable($toRaw)->format('Y');
+        } else {
+            $fromYear = $toYear = (int) ($request->query->get('year') ?: date('Y'));
+        }
+
+        $holidays = [];
+        for ($year = $fromYear; $year <= $toYear; ++$year) {
+            $holidays += $this->holidayProvider->getHolidays($year);
+        }
+
+        return $this->json($holidays);
+    }
+}
diff --git a/src/Controller/TaskDocumentDownloadController.php b/src/Controller/TaskDocumentDownloadController.php
index a5ecd23..10e8f47 100644
--- a/src/Controller/TaskDocumentDownloadController.php
+++ b/src/Controller/TaskDocumentDownloadController.php
@@ -7,10 +7,8 @@ namespace App\Controller;
 use App\Entity\TaskDocument;
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
-use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
 use Symfony\Component\HttpFoundation\ResponseHeaderBag;
-use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
@@ -19,7 +17,6 @@ class TaskDocumentDownloadController extends AbstractController
 {
     public function __construct(
         private readonly EntityManagerInterface $entityManager,
-        private readonly Security $security,
         private readonly string $uploadDir,
     ) {}
 
@@ -33,14 +30,6 @@ class TaskDocumentDownloadController extends AbstractController
             throw new NotFoundHttpException('Document not found.');
         }
 
-        // ROLE_CLIENT can only download documents from their own tickets
-        if (!$this->security->isGranted('ROLE_ADMIN') && !$this->security->isGranted('ROLE_USER')) {
-            $ticket = $document->getClientTicket();
-            if (null === $ticket || $ticket->getSubmittedBy() !== $this->security->getUser()) {
-                throw new AccessDeniedHttpException('You do not have access to this document.');
-            }
-        }
-
         $filePath = $this->uploadDir.'/'.$document->getFileName();
 
         if (!file_exists($filePath)) {
diff --git a/src/DataFixtures/AppFixtures.php b/src/DataFixtures/AppFixtures.php
index 90efbe8..c17c489 100644
--- a/src/DataFixtures/AppFixtures.php
+++ b/src/DataFixtures/AppFixtures.php
@@ -8,7 +8,6 @@ use App\Entity\AbsenceBalance;
 use App\Entity\AbsencePolicy;
 use App\Entity\AbsenceRequest;
 use App\Entity\Client;
-use App\Entity\ClientTicket;
 use App\Entity\MailConfiguration;
 use App\Entity\Project;
 use App\Entity\Task;
@@ -593,94 +592,6 @@ class AppFixtures extends Fixture
             $manager->persist($entry);
         }
 
-        // =============================================
-        // Client Users
-        // =============================================
-        $clientUserLiot = new User();
-        $clientUserLiot->setUsername('client-liot');
-        $clientUserLiot->setRoles(['ROLE_CLIENT']);
-        $clientUserLiot->setPassword($this->passwordHasher->hashPassword($clientUserLiot, 'client'));
-        $clientUserLiot->setClient($clientLiot);
-        $clientUserLiot->addAllowedProject($projectSirh);
-        $manager->persist($clientUserLiot);
-
-        $clientUserAcme = new User();
-        $clientUserAcme->setUsername('client-acme');
-        $clientUserAcme->setRoles(['ROLE_CLIENT']);
-        $clientUserAcme->setPassword($this->passwordHasher->hashPassword($clientUserAcme, 'client'));
-        $clientUserAcme->setClient($clientAcme);
-        $clientUserAcme->addAllowedProject($projectCrm);
-        $manager->persist($clientUserAcme);
-
-        // =============================================
-        // Client Tickets
-        // =============================================
-        $ticket1 = new ClientTicket();
-        $ticket1->setNumber(1);
-        $ticket1->setType('bug');
-        $ticket1->setTitle('Erreur 500 sur la page de login');
-        $ticket1->setDescription('Quand je clique sur "Se connecter" avec un mot de passe vide, j\'obtiens une page blanche avec une erreur 500.');
-        $ticket1->setUrl('https://sirh.liot.fr/login');
-        $ticket1->setStatus('new');
-        $ticket1->setProject($projectSirh);
-        $ticket1->setSubmittedBy($clientUserLiot);
-        $ticket1->setCreatedAt(new DateTimeImmutable('-3 days'));
-        $ticket1->setUpdatedAt(new DateTimeImmutable('-3 days'));
-        $manager->persist($ticket1);
-
-        $ticket2 = new ClientTicket();
-        $ticket2->setNumber(2);
-        $ticket2->setType('improvement');
-        $ticket2->setTitle('Ajouter un export PDF des fiches employés');
-        $ticket2->setDescription('Il serait utile de pouvoir exporter les fiches employés au format PDF pour les archiver.');
-        $ticket2->setStatus('in_progress');
-        $ticket2->setProject($projectSirh);
-        $ticket2->setSubmittedBy($clientUserLiot);
-        $ticket2->setCreatedAt(new DateTimeImmutable('-7 days'));
-        $ticket2->setUpdatedAt(new DateTimeImmutable('-2 days'));
-        $manager->persist($ticket2);
-
-        $ticket3 = new ClientTicket();
-        $ticket3->setNumber(3);
-        $ticket3->setType('other');
-        $ticket3->setTitle('Demande de formation sur le module congés');
-        $ticket3->setDescription('Notre équipe RH souhaiterait une formation sur le nouveau module de gestion des congés.');
-        $ticket3->setStatus('done');
-        $ticket3->setStatusComment('Formation planifiée le 20/03. Ticket clos.');
-        $ticket3->setProject($projectSirh);
-        $ticket3->setSubmittedBy($clientUserLiot);
-        $ticket3->setCreatedAt(new DateTimeImmutable('-14 days'));
-        $ticket3->setUpdatedAt(new DateTimeImmutable('-5 days'));
-        $manager->persist($ticket3);
-
-        $ticket4 = new ClientTicket();
-        $ticket4->setNumber(1);
-        $ticket4->setType('bug');
-        $ticket4->setTitle('Doublons dans la liste des contacts');
-        $ticket4->setDescription('Certains contacts apparaissent en double après l\'import CSV. Le problème semble lié aux accents dans les noms.');
-        $ticket4->setStatus('new');
-        $ticket4->setProject($projectCrm);
-        $ticket4->setSubmittedBy($clientUserAcme);
-        $ticket4->setCreatedAt(new DateTimeImmutable('-1 day'));
-        $ticket4->setUpdatedAt(new DateTimeImmutable('-1 day'));
-        $manager->persist($ticket4);
-
-        $ticket5 = new ClientTicket();
-        $ticket5->setNumber(2);
-        $ticket5->setType('improvement');
-        $ticket5->setTitle('Filtre par date sur le pipeline de vente');
-        $ticket5->setDescription('Pouvoir filtrer le pipeline de vente par période (mois, trimestre, année).');
-        $ticket5->setStatus('rejected');
-        $ticket5->setStatusComment('Cette fonctionnalité est déjà prévue dans la prochaine version. Pas besoin de ticket spécifique.');
-        $ticket5->setProject($projectCrm);
-        $ticket5->setSubmittedBy($clientUserAcme);
-        $ticket5->setCreatedAt(new DateTimeImmutable('-10 days'));
-        $ticket5->setUpdatedAt(new DateTimeImmutable('-8 days'));
-        $manager->persist($ticket5);
-
-        // Link a task to a client ticket
-        $task3->setClientTicket($ticket1);
-
         // =============================================
         // Zimbra Configuration
         // =============================================
@@ -777,18 +688,19 @@ class AppFixtures extends Fixture
         // Paid-leave balances for the current reference period (June 1st → May 31st)
         $cpPeriod    = '2025-2026';
         $balanceData = [
-            // [user, acquired, taken, pending]
-            [$admin, 22.5, 5.0, 0.0],
-            [$userAlice, 18.0, 2.0, 5.0],
-            [$userBob, 14.0, 0.0, 0.0],
+            // [user, acquired (N-1), acquiring (N, en cours), taken, pending]
+            [$admin, 10.0, 22.5, 5.0, 0.0],
+            [$userAlice, 8.0, 18.0, 2.0, 5.0],
+            [$userBob, 0.0, 14.0, 0.0, 0.0],
         ];
 
-        foreach ($balanceData as [$bUser, $acquired, $taken, $pending]) {
+        foreach ($balanceData as [$bUser, $acquired, $acquiring, $taken, $pending]) {
             $balance = new AbsenceBalance();
             $balance->setUser($bUser);
             $balance->setType(AbsenceType::PaidLeave);
             $balance->setPeriod($cpPeriod);
             $balance->setAcquired($acquired);
+            $balance->setAcquiring($acquiring);
             $balance->setTaken($taken);
             $balance->setPending($pending);
             $manager->persist($balance);
diff --git a/src/Doctrine/ProjectAllowedExtension.php b/src/Doctrine/ProjectAllowedExtension.php
deleted file mode 100644
index 710bacf..0000000
--- a/src/Doctrine/ProjectAllowedExtension.php
+++ /dev/null
@@ -1,66 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Doctrine;
-
-use ApiPlatform\Doctrine\Orm\Extension\QueryCollectionExtensionInterface;
-use ApiPlatform\Doctrine\Orm\Extension\QueryItemExtensionInterface;
-use ApiPlatform\Doctrine\Orm\Util\QueryNameGeneratorInterface;
-use ApiPlatform\Metadata\Operation;
-use App\Entity\Project;
-use App\Entity\User;
-use Doctrine\ORM\QueryBuilder;
-use Symfony\Bundle\SecurityBundle\Security;
-
-final readonly class ProjectAllowedExtension implements QueryCollectionExtensionInterface, QueryItemExtensionInterface
-{
-    public function __construct(
-        private Security $security,
-    ) {}
-
-    public function applyToCollection(QueryBuilder $queryBuilder, QueryNameGeneratorInterface $queryNameGenerator, string $resourceClass, ?Operation $operation = null, array $context = []): void
-    {
-        $this->addWhere($queryBuilder, $resourceClass);
-    }
-
-    public function applyToItem(QueryBuilder $queryBuilder, QueryNameGeneratorInterface $queryNameGenerator, string $resourceClass, array $identifiers, ?Operation $operation = null, array $context = []): void
-    {
-        $this->addWhere($queryBuilder, $resourceClass);
-    }
-
-    private function addWhere(QueryBuilder $queryBuilder, string $resourceClass): void
-    {
-        if (Project::class !== $resourceClass) {
-            return;
-        }
-
-        $user = $this->security->getUser();
-
-        if (!$user instanceof User) {
-            return;
-        }
-
-        // Only restrict for ROLE_CLIENT users who are NOT admins
-        if (!in_array('ROLE_CLIENT', $user->getRoles(), true) || in_array('ROLE_ADMIN', $user->getRoles(), true)) {
-            return;
-        }
-
-        $rootAlias = $queryBuilder->getRootAliases()[0];
-
-        $allowedProjectIds = $user->getAllowedProjects()->map(
-            fn (Project $project) => $project->getId(),
-        )->toArray();
-
-        if ([] === $allowedProjectIds) {
-            $queryBuilder->andWhere('1 = 0');
-
-            return;
-        }
-
-        $queryBuilder
-            ->andWhere($rootAlias.'.id IN (:allowed_project_ids)')
-            ->setParameter('allowed_project_ids', $allowedProjectIds)
-        ;
-    }
-}
diff --git a/src/Entity/AbsenceBalance.php b/src/Entity/AbsenceBalance.php
index 32977a6..97efea9 100644
--- a/src/Entity/AbsenceBalance.php
+++ b/src/Entity/AbsenceBalance.php
@@ -59,10 +59,16 @@ class AbsenceBalance
     #[Groups(['absence_balance:read'])]
     private ?string $period = null;
 
+    /** Days acquired during the *previous* reference period (Congés N-1): fully available to take. */
     #[ORM\Column(type: Types::FLOAT)]
     #[Groups(['absence_balance:read', 'absence_balance:write'])]
     private float $acquired = 0.0;
 
+    /** Days being accrued during the *current* reference period (Congés N): "en cours d'acquisition". */
+    #[ORM\Column(type: Types::FLOAT)]
+    #[Groups(['absence_balance:read', 'absence_balance:write'])]
+    private float $acquiring = 0.0;
+
     #[ORM\Column(type: Types::FLOAT)]
     #[Groups(['absence_balance:read', 'absence_balance:write'])]
     private float $taken = 0.0;
@@ -72,10 +78,25 @@ class AbsenceBalance
     #[Groups(['absence_balance:read'])]
     private float $pending = 0.0;
 
+    /** Last month (format YYYY-MM) for which the monthly accrual was applied. */
+    #[ORM\Column(length: 7, nullable: true)]
+    private ?string $lastAccruedMonth = null;
+
+    /** Total entitlement for the period, both finalized (N-1) and in-progress (N). */
+    #[Groups(['absence_balance:read'])]
+    public function getAcquiredTotal(): float
+    {
+        return $this->acquired + $this->acquiring;
+    }
+
+    /**
+     * Days the employee can still take: in this organisation the days being
+     * accrued (N) are posable too, so they count towards what is available.
+     */
     #[Groups(['absence_balance:read'])]
     public function getAvailable(): float
     {
-        return $this->acquired - $this->taken;
+        return $this->acquired + $this->acquiring - $this->taken;
     }
 
     #[Groups(['absence_balance:read'])]
@@ -137,6 +158,18 @@ class AbsenceBalance
         return $this;
     }
 
+    public function getAcquiring(): float
+    {
+        return $this->acquiring;
+    }
+
+    public function setAcquiring(float $acquiring): static
+    {
+        $this->acquiring = $acquiring;
+
+        return $this;
+    }
+
     public function getTaken(): float
     {
         return $this->taken;
@@ -160,4 +193,16 @@ class AbsenceBalance
 
         return $this;
     }
+
+    public function getLastAccruedMonth(): ?string
+    {
+        return $this->lastAccruedMonth;
+    }
+
+    public function setLastAccruedMonth(?string $lastAccruedMonth): static
+    {
+        $this->lastAccruedMonth = $lastAccruedMonth;
+
+        return $this;
+    }
 }
diff --git a/src/Entity/ClientTicket.php b/src/Entity/ClientTicket.php
deleted file mode 100644
index b825c2f..0000000
--- a/src/Entity/ClientTicket.php
+++ /dev/null
@@ -1,282 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Entity;
-
-use ApiPlatform\Metadata\ApiResource;
-use ApiPlatform\Metadata\Delete;
-use ApiPlatform\Metadata\Get;
-use ApiPlatform\Metadata\GetCollection;
-use ApiPlatform\Metadata\Patch;
-use ApiPlatform\Metadata\Post;
-use App\Repository\ClientTicketRepository;
-use App\State\ClientTicketNumberProcessor;
-use App\State\ClientTicketProvider;
-use App\State\ClientTicketStatusProcessor;
-use DateTimeImmutable;
-use Doctrine\Common\Collections\ArrayCollection;
-use Doctrine\Common\Collections\Collection;
-use Doctrine\ORM\Mapping as ORM;
-use Symfony\Component\Serializer\Attribute\Groups;
-use Symfony\Component\Validator\Constraints as Assert;
-
-#[ApiResource(
-    operations: [
-        new GetCollection(
-            paginationEnabled: false,
-            security: "is_granted('ROLE_CLIENT') or is_granted('ROLE_ADMIN')",
-            provider: ClientTicketProvider::class,
-        ),
-        new Get(
-            security: "is_granted('ROLE_CLIENT') or is_granted('ROLE_ADMIN')",
-            provider: ClientTicketProvider::class,
-        ),
-        new Post(
-            security: "is_granted('ROLE_CLIENT')",
-            processor: ClientTicketNumberProcessor::class,
-        ),
-        new Patch(
-            security: "is_granted('ROLE_ADMIN') or (is_granted('ROLE_CLIENT') and object.getSubmittedBy() == user)",
-            processor: ClientTicketStatusProcessor::class,
-        ),
-        new Delete(security: "is_granted('ROLE_ADMIN')"),
-    ],
-    normalizationContext: ['groups' => ['client_ticket:read']],
-    denormalizationContext: ['groups' => ['client_ticket:write']],
-    order: ['createdAt' => 'DESC'],
-)]
-#[ORM\Entity(repositoryClass: ClientTicketRepository::class)]
-#[ORM\Table(name: 'client_ticket')]
-#[ORM\UniqueConstraint(name: 'uniq_client_ticket_project_number', columns: ['project_id', 'number'])]
-class ClientTicket
-{
-    public const string TYPE_BUG         = 'bug';
-    public const string TYPE_IMPROVEMENT = 'improvement';
-    public const string TYPE_OTHER       = 'other';
-
-    public const array TYPES = [
-        self::TYPE_BUG,
-        self::TYPE_IMPROVEMENT,
-        self::TYPE_OTHER,
-    ];
-
-    public const string STATUS_NEW         = 'new';
-    public const string STATUS_IN_PROGRESS = 'in_progress';
-    public const string STATUS_DONE        = 'done';
-    public const string STATUS_REJECTED    = 'rejected';
-
-    public const array STATUSES = [
-        self::STATUS_NEW,
-        self::STATUS_IN_PROGRESS,
-        self::STATUS_DONE,
-        self::STATUS_REJECTED,
-    ];
-    #[ORM\Id]
-    #[ORM\GeneratedValue]
-    #[ORM\Column]
-    #[Groups(['client_ticket:read', 'task:read'])]
-    private ?int $id = null;
-
-    #[ORM\Column(type: 'integer')]
-    #[Groups(['client_ticket:read', 'task:read'])]
-    private ?int $number = null;
-
-    #[ORM\Column(length: 20)]
-    #[Groups(['client_ticket:read', 'client_ticket:write', 'task:read'])]
-    #[Assert\Choice(choices: self::TYPES)]
-    private ?string $type = null;
-
-    #[ORM\Column(length: 255)]
-    #[Groups(['client_ticket:read', 'client_ticket:write', 'task:read'])]
-    private ?string $title = null;
-
-    #[ORM\Column(type: 'text')]
-    #[Groups(['client_ticket:read', 'client_ticket:write'])]
-    private ?string $description = null;
-
-    #[ORM\Column(length: 255, nullable: true)]
-    #[Groups(['client_ticket:read', 'client_ticket:write'])]
-    #[Assert\Url]
-    private ?string $url = null;
-
-    #[ORM\Column(length: 20)]
-    #[Groups(['client_ticket:read', 'client_ticket:write', 'task:read'])]
-    #[Assert\Choice(choices: self::STATUSES)]
-    private ?string $status = 'new';
-
-    #[ORM\Column(type: 'text', nullable: true)]
-    #[Groups(['client_ticket:read', 'client_ticket:write'])]
-    private ?string $statusComment = null;
-
-    #[ORM\ManyToOne(targetEntity: Project::class)]
-    #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
-    #[Groups(['client_ticket:read', 'client_ticket:write'])]
-    private ?Project $project = null;
-
-    #[ORM\ManyToOne(targetEntity: User::class)]
-    #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
-    #[Groups(['client_ticket:read'])]
-    private ?User $submittedBy = null;
-
-    /** @var Collection<int, TaskDocument> */
-    #[ORM\OneToMany(targetEntity: TaskDocument::class, mappedBy: 'clientTicket', cascade: ['remove'])]
-    #[Groups(['client_ticket:read'])]
-    private Collection $documents;
-
-    #[ORM\Column(type: 'datetime_immutable')]
-    #[Groups(['client_ticket:read'])]
-    private ?DateTimeImmutable $createdAt = null;
-
-    #[ORM\Column(type: 'datetime_immutable')]
-    #[Groups(['client_ticket:read'])]
-    private ?DateTimeImmutable $updatedAt = null;
-
-    public function __construct()
-    {
-        $this->documents = new ArrayCollection();
-    }
-
-    public function getId(): ?int
-    {
-        return $this->id;
-    }
-
-    public function getNumber(): ?int
-    {
-        return $this->number;
-    }
-
-    public function setNumber(int $number): static
-    {
-        $this->number = $number;
-
-        return $this;
-    }
-
-    public function getType(): ?string
-    {
-        return $this->type;
-    }
-
-    public function setType(string $type): static
-    {
-        $this->type = $type;
-
-        return $this;
-    }
-
-    public function getTitle(): ?string
-    {
-        return $this->title;
-    }
-
-    public function setTitle(string $title): static
-    {
-        $this->title = $title;
-
-        return $this;
-    }
-
-    public function getDescription(): ?string
-    {
-        return $this->description;
-    }
-
-    public function setDescription(string $description): static
-    {
-        $this->description = $description;
-
-        return $this;
-    }
-
-    public function getUrl(): ?string
-    {
-        return $this->url;
-    }
-
-    public function setUrl(?string $url): static
-    {
-        $this->url = $url;
-
-        return $this;
-    }
-
-    public function getStatus(): ?string
-    {
-        return $this->status;
-    }
-
-    public function setStatus(string $status): static
-    {
-        $this->status = $status;
-
-        return $this;
-    }
-
-    public function getStatusComment(): ?string
-    {
-        return $this->statusComment;
-    }
-
-    public function setStatusComment(?string $statusComment): static
-    {
-        $this->statusComment = $statusComment;
-
-        return $this;
-    }
-
-    public function getProject(): ?Project
-    {
-        return $this->project;
-    }
-
-    public function setProject(?Project $project): static
-    {
-        $this->project = $project;
-
-        return $this;
-    }
-
-    public function getSubmittedBy(): ?User
-    {
-        return $this->submittedBy;
-    }
-
-    public function setSubmittedBy(?User $submittedBy): static
-    {
-        $this->submittedBy = $submittedBy;
-
-        return $this;
-    }
-
-    /** @return Collection<int, TaskDocument> */
-    public function getDocuments(): Collection
-    {
-        return $this->documents;
-    }
-
-    public function getCreatedAt(): ?DateTimeImmutable
-    {
-        return $this->createdAt;
-    }
-
-    public function setCreatedAt(DateTimeImmutable $createdAt): static
-    {
-        $this->createdAt = $createdAt;
-
-        return $this;
-    }
-
-    public function getUpdatedAt(): ?DateTimeImmutable
-    {
-        return $this->updatedAt;
-    }
-
-    public function setUpdatedAt(DateTimeImmutable $updatedAt): static
-    {
-        $this->updatedAt = $updatedAt;
-
-        return $this;
-    }
-}
diff --git a/src/Entity/Notification.php b/src/Entity/Notification.php
index 36aefb8..2253335 100644
--- a/src/Entity/Notification.php
+++ b/src/Entity/Notification.php
@@ -56,11 +56,6 @@ class Notification
     #[Groups(['notification:read'])]
     private ?string $message = null;
 
-    #[ORM\ManyToOne(targetEntity: ClientTicket::class)]
-    #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
-    #[Groups(['notification:read'])]
-    private ?ClientTicket $relatedTicket = null;
-
     #[ORM\Column]
     #[Groups(['notification:read', 'notification:write'])]
     private bool $isRead = false;
@@ -122,18 +117,6 @@ class Notification
         return $this;
     }
 
-    public function getRelatedTicket(): ?ClientTicket
-    {
-        return $this->relatedTicket;
-    }
-
-    public function setRelatedTicket(?ClientTicket $relatedTicket): static
-    {
-        $this->relatedTicket = $relatedTicket;
-
-        return $this;
-    }
-
     public function isRead(): bool
     {
         return $this->isRead;
diff --git a/src/Entity/Project.php b/src/Entity/Project.php
index 04ce728..5d58c84 100644
--- a/src/Entity/Project.php
+++ b/src/Entity/Project.php
@@ -25,8 +25,8 @@ use Symfony\Component\Validator\Constraints as Assert;
 
 #[ApiResource(
     operations: [
-        new GetCollection(security: "is_granted('ROLE_USER') or is_granted('ROLE_CLIENT')"),
-        new Get(security: "is_granted('ROLE_USER') or is_granted('ROLE_CLIENT')"),
+        new GetCollection(security: "is_granted('ROLE_USER')"),
+        new Get(security: "is_granted('ROLE_USER')"),
         new Post(
             security: "is_granted('ROLE_ADMIN')",
             denormalizationContext: ['groups' => ['project:write', 'project:create']],
diff --git a/src/Entity/Task.php b/src/Entity/Task.php
index 486371f..984dc15 100644
--- a/src/Entity/Task.php
+++ b/src/Entity/Task.php
@@ -124,11 +124,6 @@ class Task
     #[Groups(['task:read'])]
     private Collection $documents;
 
-    #[ORM\ManyToOne(targetEntity: ClientTicket::class)]
-    #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
-    #[Groups(['task:read', 'task:write'])]
-    private ?ClientTicket $clientTicket = null;
-
     #[ORM\Column(type: 'datetime_immutable', nullable: true)]
     #[Groups(['task:read', 'task:write'])]
     private ?DateTimeImmutable $scheduledStart = null;
@@ -342,18 +337,6 @@ class Task
         return $this->documents;
     }
 
-    public function getClientTicket(): ?ClientTicket
-    {
-        return $this->clientTicket;
-    }
-
-    public function setClientTicket(?ClientTicket $clientTicket): static
-    {
-        $this->clientTicket = $clientTicket;
-
-        return $this;
-    }
-
     public function getScheduledStart(): ?DateTimeImmutable
     {
         return $this->scheduledStart;
diff --git a/src/Entity/TaskDocument.php b/src/Entity/TaskDocument.php
index 905bd9a..0cab31f 100644
--- a/src/Entity/TaskDocument.php
+++ b/src/Entity/TaskDocument.php
@@ -20,14 +20,14 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER') or is_granted('ROLE_CLIENT')", provider: TaskDocumentProvider::class),
-        new Get(security: "is_granted('ROLE_USER') or is_granted('ROLE_CLIENT')", provider: TaskDocumentProvider::class),
+        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')", provider: TaskDocumentProvider::class),
+        new Get(security: "is_granted('ROLE_USER')", provider: TaskDocumentProvider::class),
         new Post(
-            security: "is_granted('ROLE_ADMIN') or is_granted('ROLE_CLIENT')",
+            security: "is_granted('ROLE_ADMIN')",
             processor: TaskDocumentProcessor::class,
             deserialize: false,
         ),
-        new Delete(security: "is_granted('ROLE_ADMIN') or is_granted('ROLE_CLIENT')"),
+        new Delete(security: "is_granted('ROLE_ADMIN')"),
     ],
     normalizationContext: ['groups' => ['task_document:read']],
     denormalizationContext: ['groups' => ['task_document:write']],
@@ -41,42 +41,37 @@ class TaskDocument
     #[ORM\Id]
     #[ORM\GeneratedValue]
     #[ORM\Column]
-    #[Groups(['task_document:read', 'task:read', 'client_ticket:read'])]
+    #[Groups(['task_document:read', 'task:read'])]
     private ?int $id = null;
 
     #[ORM\ManyToOne(targetEntity: Task::class, inversedBy: 'documents')]
-    #[ORM\JoinColumn(nullable: true, onDelete: 'CASCADE')]
+    #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
     #[Groups(['task_document:read', 'task_document:write'])]
     private ?Task $task = null;
 
-    #[ORM\ManyToOne(targetEntity: ClientTicket::class, inversedBy: 'documents')]
-    #[ORM\JoinColumn(nullable: true, onDelete: 'CASCADE')]
-    #[Groups(['task_document:read', 'task_document:write'])]
-    private ?ClientTicket $clientTicket = null;
-
     #[ORM\Column(length: 255)]
-    #[Groups(['task_document:read', 'task:read', 'client_ticket:read'])]
+    #[Groups(['task_document:read', 'task:read'])]
     private ?string $originalName = null;
 
     #[ORM\Column(length: 255)]
-    #[Groups(['task_document:read', 'task:read', 'client_ticket:read'])]
+    #[Groups(['task_document:read', 'task:read'])]
     private ?string $fileName = null;
 
     #[ORM\Column(length: 100)]
-    #[Groups(['task_document:read', 'task:read', 'client_ticket:read'])]
+    #[Groups(['task_document:read', 'task:read'])]
     private ?string $mimeType = null;
 
     #[ORM\Column]
-    #[Groups(['task_document:read', 'task:read', 'client_ticket:read'])]
+    #[Groups(['task_document:read', 'task:read'])]
     private ?int $size = null;
 
     #[ORM\Column(type: 'datetime_immutable')]
-    #[Groups(['task_document:read', 'task:read', 'client_ticket:read'])]
+    #[Groups(['task_document:read', 'task:read'])]
     private ?DateTimeImmutable $createdAt = null;
 
     #[ORM\ManyToOne(targetEntity: User::class)]
     #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
-    #[Groups(['task_document:read', 'task:read', 'client_ticket:read'])]
+    #[Groups(['task_document:read', 'task:read'])]
     private ?User $uploadedBy = null;
 
     public function getId(): ?int
@@ -167,16 +162,4 @@ class TaskDocument
 
         return $this;
     }
-
-    public function getClientTicket(): ?ClientTicket
-    {
-        return $this->clientTicket;
-    }
-
-    public function setClientTicket(?ClientTicket $clientTicket): static
-    {
-        $this->clientTicket = $clientTicket;
-
-        return $this;
-    }
 }
diff --git a/src/Entity/TimeEntry.php b/src/Entity/TimeEntry.php
index 3f4449f..2c5332d 100644
--- a/src/Entity/TimeEntry.php
+++ b/src/Entity/TimeEntry.php
@@ -85,11 +85,6 @@ class TimeEntry
     #[Groups(['time_entry:read', 'time_entry:write'])]
     private ?Task $task = null;
 
-    #[ORM\ManyToOne(targetEntity: ClientTicket::class)]
-    #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
-    #[Groups(['time_entry:read', 'time_entry:write'])]
-    private ?ClientTicket $clientTicket = null;
-
     /** @var Collection<int, TaskTag> */
     #[ORM\ManyToMany(targetEntity: TaskTag::class)]
     #[ORM\JoinTable(
@@ -194,18 +189,6 @@ class TimeEntry
         return $this;
     }
 
-    public function getClientTicket(): ?ClientTicket
-    {
-        return $this->clientTicket;
-    }
-
-    public function setClientTicket(?ClientTicket $clientTicket): static
-    {
-        $this->clientTicket = $clientTicket;
-
-        return $this;
-    }
-
     /** @return Collection<int, TaskTag> */
     public function getTags(): Collection
     {
diff --git a/src/Entity/User.php b/src/Entity/User.php
index e796ae4..80f4504 100644
--- a/src/Entity/User.php
+++ b/src/Entity/User.php
@@ -16,8 +16,6 @@ use App\Repository\UserRepository;
 use App\State\MeProvider;
 use App\State\UserPasswordHasherProcessor;
 use DateTimeImmutable;
-use Doctrine\Common\Collections\ArrayCollection;
-use Doctrine\Common\Collections\Collection;
 use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
@@ -50,11 +48,11 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
     #[ORM\Id]
     #[ORM\GeneratedValue]
     #[ORM\Column]
-    #[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'client_ticket:read', 'absence_request:read', 'absence_balance:read'])]
+    #[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'absence_request:read', 'absence_balance:read'])]
     private ?int $id = null;
 
     #[ORM\Column(length: 180, unique: true)]
-    #[Groups(['me:read', 'task:read', 'user:list', 'user:write', 'time_entry:read', 'client_ticket:read', 'absence_request:read', 'absence_balance:read'])]
+    #[Groups(['me:read', 'task:read', 'user:list', 'user:write', 'time_entry:read', 'absence_request:read', 'absence_balance:read'])]
     private ?string $username = null;
 
     /** @var list<string> */
@@ -78,17 +76,6 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
     #[ORM\Column(length: 255, nullable: true)]
     private ?string $avatarFileName = null;
 
-    #[ORM\ManyToOne(targetEntity: Client::class)]
-    #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
-    #[Groups(['me:read', 'user:list', 'user:write'])]
-    private ?Client $client = null;
-
-    /** @var Collection<int, Project> */
-    #[ORM\ManyToMany(targetEntity: Project::class)]
-    #[ORM\JoinTable(name: 'user_allowed_projects')]
-    #[Groups(['me:read', 'user:list', 'user:write'])]
-    private Collection $allowedProjects;
-
     // --- HR / absence management fields ---
 
     /** Whether this user is an employee subject to absence management. */
@@ -139,8 +126,7 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
 
     public function __construct()
     {
-        $this->createdAt       = new DateTimeImmutable();
-        $this->allowedProjects = new ArrayCollection();
+        $this->createdAt = new DateTimeImmutable();
     }
 
     public function getId(): ?int
@@ -168,11 +154,8 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
     /** @return list<string> */
     public function getRoles(): array
     {
-        $roles = $this->roles;
-
-        if (!in_array('ROLE_CLIENT', $roles, true)) {
-            $roles[] = 'ROLE_USER';
-        }
+        $roles   = $this->roles;
+        $roles[] = 'ROLE_USER';
 
         return array_values(array_unique($roles));
     }
@@ -209,40 +192,6 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
         return $this;
     }
 
-    public function getClient(): ?Client
-    {
-        return $this->client;
-    }
-
-    public function setClient(?Client $client): static
-    {
-        $this->client = $client;
-
-        return $this;
-    }
-
-    /** @return Collection<int, Project> */
-    public function getAllowedProjects(): Collection
-    {
-        return $this->allowedProjects;
-    }
-
-    public function addAllowedProject(Project $project): static
-    {
-        if (!$this->allowedProjects->contains($project)) {
-            $this->allowedProjects->add($project);
-        }
-
-        return $this;
-    }
-
-    public function removeAllowedProject(Project $project): static
-    {
-        $this->allowedProjects->removeElement($project);
-
-        return $this;
-    }
-
     public function getApiToken(): ?string
     {
         return $this->apiToken;
@@ -267,7 +216,7 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
         return $this;
     }
 
-    #[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'client_ticket:read', 'absence_request:read', 'absence_balance:read'])]
+    #[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'absence_request:read', 'absence_balance:read'])]
     public function getAvatarUrl(): ?string
     {
         if (null === $this->avatarFileName) {
@@ -294,7 +243,7 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
         $this->plainPassword = null;
     }
 
-    public function isEmployee(): bool
+    public function getIsEmployee(): bool
     {
         return $this->isEmployee;
     }
diff --git a/src/Mcp/Tool/Serializer.php b/src/Mcp/Tool/Serializer.php
index 69cb338..c45d8fd 100644
--- a/src/Mcp/Tool/Serializer.php
+++ b/src/Mcp/Tool/Serializer.php
@@ -4,7 +4,6 @@ declare(strict_types=1);
 
 namespace App\Mcp\Tool;
 
-use App\Entity\ClientTicket;
 use App\Entity\Project;
 use App\Entity\Task;
 use App\Entity\TaskDocument;
@@ -253,39 +252,22 @@ final class Serializer
         ];
     }
 
-    /**
-     * @return null|array{id: ?int, number: ?int, title: ?string}
-     */
-    public static function clientTicketRef(?ClientTicket $ticket): ?array
-    {
-        if (null === $ticket) {
-            return null;
-        }
-
-        return [
-            'id'     => $ticket->getId(),
-            'number' => $ticket->getNumber(),
-            'title'  => $ticket->getTitle(),
-        ];
-    }
-
     /**
      * @return array<string, mixed>
      */
     public static function timeEntry(TimeEntry $entry): array
     {
         return [
-            'id'           => $entry->getId(),
-            'title'        => $entry->getTitle(),
-            'description'  => $entry->getDescription(),
-            'startedAt'    => $entry->getStartedAt()?->format('c'),
-            'stoppedAt'    => $entry->getStoppedAt()?->format('c'),
-            'duration'     => self::durationMinutes($entry),
-            'user'         => self::user($entry->getUser()),
-            'project'      => $entry->getProject() ? self::projectRef($entry->getProject()) : null,
-            'task'         => self::taskRef($entry->getTask()),
-            'clientTicket' => self::clientTicketRef($entry->getClientTicket()),
-            'tags'         => self::tags($entry->getTags()),
+            'id'          => $entry->getId(),
+            'title'       => $entry->getTitle(),
+            'description' => $entry->getDescription(),
+            'startedAt'   => $entry->getStartedAt()?->format('c'),
+            'stoppedAt'   => $entry->getStoppedAt()?->format('c'),
+            'duration'    => self::durationMinutes($entry),
+            'user'        => self::user($entry->getUser()),
+            'project'     => $entry->getProject() ? self::projectRef($entry->getProject()) : null,
+            'task'        => self::taskRef($entry->getTask()),
+            'tags'        => self::tags($entry->getTags()),
         ];
     }
 
diff --git a/src/Mcp/Tool/TimeEntry/CreateTimeEntryTool.php b/src/Mcp/Tool/TimeEntry/CreateTimeEntryTool.php
index 84b702f..31b5832 100644
--- a/src/Mcp/Tool/TimeEntry/CreateTimeEntryTool.php
+++ b/src/Mcp/Tool/TimeEntry/CreateTimeEntryTool.php
@@ -6,7 +6,6 @@ namespace App\Mcp\Tool\TimeEntry;
 
 use App\Entity\TimeEntry;
 use App\Mcp\Tool\Serializer;
-use App\Repository\ClientTicketRepository;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskRepository;
 use App\Repository\TaskTagRepository;
@@ -31,7 +30,6 @@ class CreateTimeEntryTool
         private readonly TaskRepository $taskRepository,
         private readonly TaskTagRepository $taskTagRepository,
         private readonly TimeEntryRepository $timeEntryRepository,
-        private readonly ClientTicketRepository $clientTicketRepository,
         private readonly Security $security,
     ) {}
 
@@ -44,7 +42,6 @@ class CreateTimeEntryTool
         ?int $taskId = null,
         ?array $tagIds = null,
         ?string $description = null,
-        ?int $clientTicketId = null,
     ): string {
         if (!$this->security->isGranted('ROLE_USER')) {
             throw new AccessDeniedException('Access denied: ROLE_USER required.');
@@ -90,13 +87,6 @@ class CreateTimeEntryTool
             }
             $entry->setTask($task);
         }
-        if (null !== $clientTicketId) {
-            $clientTicket = $this->clientTicketRepository->find($clientTicketId);
-            if (null === $clientTicket) {
-                throw new InvalidArgumentException(sprintf('ClientTicket with ID %d not found.', $clientTicketId));
-            }
-            $entry->setClientTicket($clientTicket);
-        }
         if (null !== $tagIds) {
             foreach ($tagIds as $tagId) {
                 $tag = $this->taskTagRepository->find($tagId);
diff --git a/src/Mcp/Tool/TimeEntry/ListTimeEntriesTool.php b/src/Mcp/Tool/TimeEntry/ListTimeEntriesTool.php
index a89e8a8..243e8a7 100644
--- a/src/Mcp/Tool/TimeEntry/ListTimeEntriesTool.php
+++ b/src/Mcp/Tool/TimeEntry/ListTimeEntriesTool.php
@@ -23,7 +23,6 @@ class ListTimeEntriesTool
         ?int $userId = null,
         ?int $projectId = null,
         ?int $taskId = null,
-        ?int $clientTicketId = null,
         ?string $startDate = null,
         ?string $endDate = null,
         int $limit = 100,
@@ -39,7 +38,6 @@ class ListTimeEntriesTool
             ->leftJoin('te.project', 'p')->addSelect('p')
             ->leftJoin('te.task', 't')->addSelect('t')
             ->leftJoin('te.tags', 'tg')->addSelect('tg')
-            ->leftJoin('te.clientTicket', 'ct')->addSelect('ct')
             ->orderBy('te.startedAt', 'DESC')
             ->setMaxResults($limit)
         ;
@@ -53,9 +51,6 @@ class ListTimeEntriesTool
         if (null !== $taskId) {
             $qb->andWhere('t.id = :taskId')->setParameter('taskId', $taskId);
         }
-        if (null !== $clientTicketId) {
-            $qb->andWhere('ct.id = :clientTicketId')->setParameter('clientTicketId', $clientTicketId);
-        }
         if (null !== $startDate) {
             $qb->andWhere('te.startedAt >= :startDate')
                 ->setParameter('startDate', new DateTimeImmutable($startDate.' 00:00:00'))
diff --git a/src/Mcp/Tool/TimeEntry/UpdateTimeEntryTool.php b/src/Mcp/Tool/TimeEntry/UpdateTimeEntryTool.php
index ccd3d54..3222f87 100644
--- a/src/Mcp/Tool/TimeEntry/UpdateTimeEntryTool.php
+++ b/src/Mcp/Tool/TimeEntry/UpdateTimeEntryTool.php
@@ -5,7 +5,6 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\TimeEntry;
 
 use App\Mcp\Tool\Serializer;
-use App\Repository\ClientTicketRepository;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskRepository;
 use App\Repository\TaskTagRepository;
@@ -27,7 +26,6 @@ class UpdateTimeEntryTool
         private readonly ProjectRepository $projectRepository,
         private readonly TaskRepository $taskRepository,
         private readonly TaskTagRepository $taskTagRepository,
-        private readonly ClientTicketRepository $clientTicketRepository,
         private readonly EntityManagerInterface $entityManager,
         private readonly Security $security,
     ) {}
@@ -41,7 +39,6 @@ class UpdateTimeEntryTool
         ?int $taskId = null,
         ?array $tagIds = null,
         ?string $description = null,
-        ?int $clientTicketId = null,
     ): string {
         if (!$this->security->isGranted('ROLE_USER')) {
             throw new AccessDeniedException('Access denied: ROLE_USER required.');
@@ -79,13 +76,6 @@ class UpdateTimeEntryTool
             }
             $entry->setTask($task);
         }
-        if (null !== $clientTicketId) {
-            $clientTicket = $this->clientTicketRepository->find($clientTicketId);
-            if (null === $clientTicket) {
-                throw new InvalidArgumentException(sprintf('ClientTicket with ID %d not found.', $clientTicketId));
-            }
-            $entry->setClientTicket($clientTicket);
-        }
         if (null !== $tagIds) {
             foreach ($entry->getTags()->toArray() as $existingTag) {
                 $entry->removeTag($existingTag);
diff --git a/src/Repository/ClientTicketRepository.php b/src/Repository/ClientTicketRepository.php
deleted file mode 100644
index 9ca3726..0000000
--- a/src/Repository/ClientTicketRepository.php
+++ /dev/null
@@ -1,45 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Repository;
-
-use App\Entity\ClientTicket;
-use App\Entity\Project;
-use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
-use Doctrine\Persistence\ManagerRegistry;
-
-/**
- * @extends ServiceEntityRepository<ClientTicket>
- */
-class ClientTicketRepository extends ServiceEntityRepository
-{
-    public function __construct(ManagerRegistry $registry)
-    {
-        parent::__construct($registry, ClientTicket::class);
-    }
-
-    /**
-     * Returns the max ticket number for a project, using an advisory lock
-     * to prevent race conditions when creating tickets concurrently.
-     */
-    public function findMaxNumberByProjectForUpdate(Project $project): int
-    {
-        $conn = $this->getEntityManager()->getConnection();
-
-        // Use PostgreSQL advisory lock instead of FOR UPDATE
-        // because FOR UPDATE is not allowed with aggregate functions in PostgreSQL.
-        // Offset by 1000000 to avoid collision with task locks on the same project ID.
-        $conn->executeStatement(
-            'SELECT pg_advisory_xact_lock(:lockKey)',
-            ['lockKey' => $project->getId() + 1000000],
-        );
-
-        $result = $conn->fetchOne(
-            'SELECT COALESCE(MAX(number), 0) FROM client_ticket WHERE project_id = :project',
-            ['project' => $project->getId()],
-        );
-
-        return (int) $result;
-    }
-}
diff --git a/src/Repository/UserRepository.php b/src/Repository/UserRepository.php
index d0681e1..df31a3f 100644
--- a/src/Repository/UserRepository.php
+++ b/src/Repository/UserRepository.php
@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Repository;
 
 use App\Entity\User;
+use DateTimeInterface;
 use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
 use Doctrine\Persistence\ManagerRegistry;
 
@@ -38,4 +39,24 @@ class UserRepository extends ServiceEntityRepository
             ->getResult()
         ;
     }
+
+    /**
+     * Employees active on the given date (hired on/before it, not yet left).
+     *
+     * @return User[]
+     */
+    public function findActiveEmployees(DateTimeInterface $date): array
+    {
+        $dateStr = $date->format('Y-m-d');
+
+        return $this->createQueryBuilder('u')
+            ->where('u.isEmployee = true')
+            ->andWhere('u.hireDate IS NULL OR u.hireDate <= :date')
+            ->andWhere('u.endDate IS NULL OR u.endDate >= :date')
+            ->setParameter('date', $dateStr)
+            ->orderBy('u.username', 'ASC')
+            ->getQuery()
+            ->getResult()
+        ;
+    }
 }
diff --git a/src/Security/MailAccessChecker.php b/src/Security/MailAccessChecker.php
index aa5073a..85b73f8 100644
--- a/src/Security/MailAccessChecker.php
+++ b/src/Security/MailAccessChecker.php
@@ -18,7 +18,6 @@ final readonly class MailAccessChecker
     /**
      * Verifie que l'utilisateur courant peut acceder aux endpoints mail.
      * Autorise : ROLE_USER, ROLE_ADMIN.
-     * Refuse : ROLE_CLIENT pur (sans ROLE_ADMIN), non authentifie.
      *
      * @throws AccessDeniedException
      */
@@ -30,10 +29,6 @@ final readonly class MailAccessChecker
 
         $roles = $user->getRoles();
 
-        if (in_array('ROLE_CLIENT', $roles, true) && !in_array('ROLE_ADMIN', $roles, true)) {
-            throw new AccessDeniedException('Mail not accessible to clients');
-        }
-
         if (!in_array('ROLE_USER', $roles, true) && !in_array('ROLE_ADMIN', $roles, true)) {
             throw new AccessDeniedException('ROLE_USER required');
         }
diff --git a/src/Service/NotificationService.php b/src/Service/NotificationService.php
deleted file mode 100644
index 20d4639..0000000
--- a/src/Service/NotificationService.php
+++ /dev/null
@@ -1,74 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Service;
-
-use App\Entity\ClientTicket;
-use App\Entity\Notification;
-use App\Repository\UserRepository;
-use DateTimeImmutable;
-use Doctrine\ORM\EntityManagerInterface;
-
-final readonly class NotificationService
-{
-    public function __construct(
-        private EntityManagerInterface $entityManager,
-        private UserRepository $userRepository,
-    ) {}
-
-    /**
-     * Notify all ROLE_ADMIN users that a new ticket was created.
-     */
-    public function createForTicketCreated(ClientTicket $ticket): void
-    {
-        $admins      = $this->userRepository->findByRole('ROLE_ADMIN');
-        $number      = sprintf('CT-%03d', $ticket->getNumber());
-        $projectName = $ticket->getProject()?->getName() ?? '';
-
-        foreach ($admins as $admin) {
-            $notification = new Notification();
-            $notification->setUser($admin);
-            $notification->setType('ticket_created');
-            $notification->setTitle('Nouveau ticket client '.$number);
-            $notification->setMessage($ticket->getTitle().' — '.$projectName);
-            $notification->setRelatedTicket($ticket);
-            $notification->setCreatedAt(new DateTimeImmutable());
-
-            $this->entityManager->persist($notification);
-        }
-
-        $this->entityManager->flush();
-    }
-
-    /**
-     * Notify the ticket submitter that the status has changed.
-     */
-    public function createForStatusChange(ClientTicket $ticket): void
-    {
-        $submittedBy = $ticket->getSubmittedBy();
-
-        if (null === $submittedBy) {
-            return;
-        }
-
-        $number        = sprintf('CT-%03d', $ticket->getNumber());
-        $statusComment = $ticket->getStatusComment();
-        $message       = 'Nouveau statut : '.$ticket->getStatus();
-
-        if (null !== $statusComment && '' !== $statusComment) {
-            $message .= ' — '.$statusComment;
-        }
-
-        $notification = new Notification();
-        $notification->setUser($submittedBy);
-        $notification->setType('ticket_status_changed');
-        $notification->setTitle('Ticket '.$number.' mis à jour');
-        $notification->setMessage($message);
-        $notification->setRelatedTicket($ticket);
-        $notification->setCreatedAt(new DateTimeImmutable());
-
-        $this->entityManager->persist($notification);
-        $this->entityManager->flush();
-    }
-}
diff --git a/src/State/ClientTicketNumberProcessor.php b/src/State/ClientTicketNumberProcessor.php
deleted file mode 100644
index 49bebcc..0000000
--- a/src/State/ClientTicketNumberProcessor.php
+++ /dev/null
@@ -1,70 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\State;
-
-use ApiPlatform\Metadata\Operation;
-use ApiPlatform\State\ProcessorInterface;
-use App\Entity\ClientTicket;
-use App\Entity\User;
-use App\Repository\ClientTicketRepository;
-use App\Service\NotificationService;
-use DateTimeImmutable;
-use Doctrine\ORM\EntityManagerInterface;
-use Symfony\Bundle\SecurityBundle\Security;
-use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
-use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
-
-/**
- * @implements ProcessorInterface<ClientTicket, ClientTicket>
- */
-final readonly class ClientTicketNumberProcessor implements ProcessorInterface
-{
-    public function __construct(
-        private EntityManagerInterface $entityManager,
-        private Security $security,
-        private ClientTicketRepository $clientTicketRepository,
-        private NotificationService $notificationService,
-    ) {}
-
-    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): ClientTicket
-    {
-        assert($data instanceof ClientTicket);
-
-        $user = $this->security->getUser();
-        assert($user instanceof User);
-
-        $project = $data->getProject();
-        if (null === $project) {
-            throw new BadRequestHttpException('Project is required.');
-        }
-
-        // Admins can create tickets on any project; clients only on allowed projects
-        if (!$this->security->isGranted('ROLE_ADMIN')) {
-            if (null === $user->getClient()) {
-                throw new AccessDeniedHttpException('Only client users can create tickets.');
-            }
-
-            if (!$user->getAllowedProjects()->contains($project)) {
-                throw new AccessDeniedHttpException('You do not have access to this project.');
-            }
-        }
-
-        $now = new DateTimeImmutable();
-
-        $maxNumber = $this->clientTicketRepository->findMaxNumberByProjectForUpdate($project);
-        $data->setNumber($maxNumber + 1);
-        $data->setSubmittedBy($user);
-        $data->setStatus('new');
-        $data->setCreatedAt($now);
-        $data->setUpdatedAt($now);
-
-        $this->entityManager->persist($data);
-        $this->entityManager->flush();
-
-        $this->notificationService->createForTicketCreated($data);
-
-        return $data;
-    }
-}
diff --git a/src/State/ClientTicketProvider.php b/src/State/ClientTicketProvider.php
deleted file mode 100644
index 6e2dd23..0000000
--- a/src/State/ClientTicketProvider.php
+++ /dev/null
@@ -1,80 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\State;
-
-use ApiPlatform\Metadata\Operation;
-use ApiPlatform\State\ProviderInterface;
-use App\Entity\ClientTicket;
-use App\Entity\User;
-use Doctrine\ORM\EntityManagerInterface;
-use Symfony\Bundle\SecurityBundle\Security;
-
-/**
- * @implements ProviderInterface<ClientTicket>
- */
-final readonly class ClientTicketProvider implements ProviderInterface
-{
-    public function __construct(
-        private EntityManagerInterface $entityManager,
-        private Security $security,
-    ) {}
-
-    public function provide(Operation $operation, array $uriVariables = [], array $context = []): array|ClientTicket|null
-    {
-        $user = $this->security->getUser();
-        assert($user instanceof User);
-
-        $repo = $this->entityManager->getRepository(ClientTicket::class);
-
-        // Single item
-        if (isset($uriVariables['id'])) {
-            $ticket = $repo->find($uriVariables['id']);
-            if (null === $ticket) {
-                return null;
-            }
-            if (!$this->security->isGranted('ROLE_ADMIN') && $ticket->getSubmittedBy() !== $user) {
-                return null;
-            }
-
-            return $ticket;
-        }
-
-        // Collection with manual filtering
-        $qb = $repo->createQueryBuilder('ct')
-            ->orderBy('ct.createdAt', 'DESC')
-        ;
-
-        // ROLE_CLIENT: only own tickets
-        if (!$this->security->isGranted('ROLE_ADMIN')) {
-            $qb->andWhere('ct.submittedBy = :user')->setParameter('user', $user);
-        }
-
-        // Apply filters from query parameters
-        $filters = $context['filters'] ?? [];
-        if (isset($filters['project'])) {
-            $qb->andWhere('ct.project = :project')
-                ->setParameter('project', self::extractId($filters['project']))
-            ;
-        }
-        if (isset($filters['status'])) {
-            $qb->andWhere('ct.status = :status')->setParameter('status', $filters['status']);
-        }
-        if (isset($filters['submittedBy']) && $this->security->isGranted('ROLE_ADMIN')) {
-            $qb->andWhere('ct.submittedBy = :submittedBy')
-                ->setParameter('submittedBy', self::extractId($filters['submittedBy']))
-            ;
-        }
-
-        return $qb->getQuery()->getResult();
-    }
-
-    /**
-     * Extract an entity ID from a value that may be a numeric ID or an IRI string.
-     */
-    private static function extractId(string $value): int
-    {
-        return is_numeric($value) ? (int) $value : (int) basename($value);
-    }
-}
diff --git a/src/State/ClientTicketStatusProcessor.php b/src/State/ClientTicketStatusProcessor.php
deleted file mode 100644
index 7248cb6..0000000
--- a/src/State/ClientTicketStatusProcessor.php
+++ /dev/null
@@ -1,74 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\State;
-
-use ApiPlatform\Metadata\Operation;
-use ApiPlatform\State\ProcessorInterface;
-use App\Entity\ClientTicket;
-use App\Service\NotificationService;
-use DateTimeImmutable;
-use Doctrine\ORM\EntityManagerInterface;
-use Symfony\Bundle\SecurityBundle\Security;
-use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
-
-/**
- * @implements ProcessorInterface<ClientTicket, ClientTicket>
- */
-final readonly class ClientTicketStatusProcessor implements ProcessorInterface
-{
-    private const FORBIDDEN_TRANSITIONS = [
-        'done'     => ['new'],
-        'rejected' => ['new'],
-    ];
-
-    public function __construct(
-        private EntityManagerInterface $entityManager,
-        private NotificationService $notificationService,
-        private Security $security,
-    ) {}
-
-    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): ClientTicket
-    {
-        assert($data instanceof ClientTicket);
-
-        $originalData = $context['previous_data'] ?? null;
-
-        $statusChanged = false;
-
-        if ($originalData instanceof ClientTicket) {
-            // ROLE_CLIENT: can only edit content fields, not status
-            if (!$this->security->isGranted('ROLE_ADMIN')) {
-                $data->setStatus($originalData->getStatus());
-                $data->setStatusComment($originalData->getStatusComment());
-            }
-
-            $oldStatus = $originalData->getStatus();
-            $newStatus = $data->getStatus();
-
-            if ($oldStatus !== $newStatus) {
-                $statusChanged = true;
-                $forbidden     = self::FORBIDDEN_TRANSITIONS[$oldStatus] ?? [];
-                if (in_array($newStatus, $forbidden, true)) {
-                    throw new BadRequestHttpException(sprintf('Transition from "%s" to "%s" is not allowed.', $oldStatus, $newStatus));
-                }
-
-                if ('rejected' === $newStatus && (null === $data->getStatusComment() || '' === trim($data->getStatusComment()))) {
-                    throw new BadRequestHttpException('A comment is required when rejecting a ticket.');
-                }
-            }
-        }
-
-        $data->setUpdatedAt(new DateTimeImmutable());
-
-        $this->entityManager->persist($data);
-        $this->entityManager->flush();
-
-        if ($statusChanged) {
-            $this->notificationService->createForStatusChange($data);
-        }
-
-        return $data;
-    }
-}
diff --git a/src/State/TaskDocumentProcessor.php b/src/State/TaskDocumentProcessor.php
index 7359fb8..feeb136 100644
--- a/src/State/TaskDocumentProcessor.php
+++ b/src/State/TaskDocumentProcessor.php
@@ -6,14 +6,12 @@ namespace App\State;
 
 use ApiPlatform\Metadata\Operation;
 use ApiPlatform\State\ProcessorInterface;
-use App\Entity\ClientTicket;
 use App\Entity\Task;
 use App\Entity\TaskDocument;
 use DateTimeImmutable;
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\RequestStack;
-use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 use Symfony\Component\Uid\Uuid;
 
@@ -81,39 +79,16 @@ final readonly class TaskDocumentProcessor implements ProcessorInterface
             throw new BadRequestHttpException('File size exceeds 50 MB limit.');
         }
 
-        $taskIri         = $request->request->get('task', '');
-        $clientTicketIri = $request->request->get('clientTicket', '');
+        $taskIri = $request->request->get('task', '');
 
-        if ('' === $taskIri && '' === $clientTicketIri) {
-            throw new BadRequestHttpException('Either task or clientTicket IRI is required.');
+        if ('' === $taskIri) {
+            throw new BadRequestHttpException('A task IRI is required.');
         }
 
-        $task         = null;
-        $clientTicket = null;
+        $task = $this->entityManager->getRepository(Task::class)->find((int) basename($taskIri));
 
-        if ('' !== $taskIri) {
-            // ROLE_CLIENT (without ROLE_ADMIN) cannot upload documents directly to tasks
-            if ($this->security->isGranted('ROLE_CLIENT') && !$this->security->isGranted('ROLE_ADMIN')) {
-                throw new AccessDeniedHttpException('Clients can only upload documents to client tickets.');
-            }
-
-            $task = $this->entityManager->getRepository(Task::class)->find((int) basename($taskIri));
-
-            if (null === $task) {
-                throw new BadRequestHttpException('Task not found.');
-            }
-        }
-
-        if ('' !== $clientTicketIri) {
-            $clientTicket = $this->entityManager->getRepository(ClientTicket::class)->find((int) basename($clientTicketIri));
-
-            if (null === $clientTicket) {
-                throw new BadRequestHttpException('Client ticket not found.');
-            }
-
-            if (!$this->security->isGranted('ROLE_ADMIN') && $clientTicket->getSubmittedBy() !== $this->security->getUser()) {
-                throw new AccessDeniedHttpException('You can only upload documents to your own tickets.');
-            }
+        if (null === $task) {
+            throw new BadRequestHttpException('Task not found.');
         }
 
         // Use server-detected MIME type (finfo), not the client-supplied one
@@ -137,7 +112,6 @@ final readonly class TaskDocumentProcessor implements ProcessorInterface
 
         $document = new TaskDocument();
         $document->setTask($task);
-        $document->setClientTicket($clientTicket);
         $document->setOriginalName($originalName);
         $document->setFileName($fileName);
         $document->setMimeType($mimeType);
diff --git a/src/State/TaskDocumentProvider.php b/src/State/TaskDocumentProvider.php
index 5b24676..f998d17 100644
--- a/src/State/TaskDocumentProvider.php
+++ b/src/State/TaskDocumentProvider.php
@@ -26,24 +26,11 @@ final readonly class TaskDocumentProvider implements ProviderInterface
         $user = $this->security->getUser();
         assert($user instanceof User);
 
-        $repo     = $this->entityManager->getRepository(TaskDocument::class);
-        $isClient = $this->security->isGranted('ROLE_CLIENT') && !$this->security->isGranted('ROLE_ADMIN');
+        $repo = $this->entityManager->getRepository(TaskDocument::class);
 
         // Single item
         if (isset($uriVariables['id'])) {
-            $document = $repo->find($uriVariables['id']);
-            if (null === $document) {
-                return null;
-            }
-
-            if ($isClient) {
-                $ticket = $document->getClientTicket();
-                if (null === $ticket || $ticket->getSubmittedBy() !== $user) {
-                    return null;
-                }
-            }
-
-            return $document;
+            return $repo->find($uriVariables['id']);
         }
 
         // Collection
@@ -51,13 +38,6 @@ final readonly class TaskDocumentProvider implements ProviderInterface
             ->orderBy('d.id', 'DESC')
         ;
 
-        if ($isClient) {
-            $qb->innerJoin('d.clientTicket', 'ct')
-                ->andWhere('ct.submittedBy = :user')
-                ->setParameter('user', $user)
-            ;
-        }
-
         // Apply filters from query parameters
         $filters = $context['filters'] ?? [];
         if (isset($filters['task'])) {
@@ -65,11 +45,6 @@ final readonly class TaskDocumentProvider implements ProviderInterface
                 ->setParameter('task', self::extractId($filters['task']))
             ;
         }
-        if (isset($filters['clientTicket'])) {
-            $qb->andWhere('d.clientTicket = :clientTicket')
-                ->setParameter('clientTicket', self::extractId($filters['clientTicket']))
-            ;
-        }
 
         return $qb->getQuery()->getResult();
     }
diff --git a/tests/Functional/Controller/Mail/MailFoldersControllerTest.php b/tests/Functional/Controller/Mail/MailFoldersControllerTest.php
index 520942c..2266047 100644
--- a/tests/Functional/Controller/Mail/MailFoldersControllerTest.php
+++ b/tests/Functional/Controller/Mail/MailFoldersControllerTest.php
@@ -20,19 +20,6 @@ class MailFoldersControllerTest extends WebTestCase
         self::assertResponseStatusCodeSame(401);
     }
 
-    public function testListFoldersReturns403ForRoleClient(): void
-    {
-        $client    = static::createClient();
-        $container = static::getContainer();
-        $em        = $container->get('doctrine.orm.entity_manager');
-
-        $clientUser = $em->getRepository(User::class)->findOneBy(['username' => 'client-liot']);
-        $client->loginUser($clientUser);
-        $client->request('GET', '/api/mail/folders');
-
-        self::assertResponseStatusCodeSame(403);
-    }
-
     public function testListFoldersReturns200ForRoleUser(): void
     {
         $client    = static::createClient();
diff --git a/tests/Functional/Controller/Mail/MailMessagesControllerTest.php b/tests/Functional/Controller/Mail/MailMessagesControllerTest.php
index f82e4f1..041cc21 100644
--- a/tests/Functional/Controller/Mail/MailMessagesControllerTest.php
+++ b/tests/Functional/Controller/Mail/MailMessagesControllerTest.php
@@ -20,19 +20,6 @@ class MailMessagesControllerTest extends WebTestCase
         self::assertResponseStatusCodeSame(401);
     }
 
-    public function testGetMessageDetailReturns403ForRoleClient(): void
-    {
-        $client    = static::createClient();
-        $container = static::getContainer();
-        $em        = $container->get('doctrine.orm.entity_manager');
-
-        $clientUser = $em->getRepository(User::class)->findOneBy(['username' => 'client-liot']);
-        $client->loginUser($clientUser);
-        $client->request('GET', '/api/mail/messages/999');
-
-        self::assertResponseStatusCodeSame(403);
-    }
-
     public function testGetMessageDetailReturns404WhenMessageNotFound(): void
     {
         $client    = static::createClient();
diff --git a/tests/Functional/Controller/Mail/MailSyncTriggerControllerTest.php b/tests/Functional/Controller/Mail/MailSyncTriggerControllerTest.php
index 54dbbc1..4cdc7cf 100644
--- a/tests/Functional/Controller/Mail/MailSyncTriggerControllerTest.php
+++ b/tests/Functional/Controller/Mail/MailSyncTriggerControllerTest.php
@@ -20,19 +20,6 @@ class MailSyncTriggerControllerTest extends WebTestCase
         self::assertResponseStatusCodeSame(401);
     }
 
-    public function testSyncTriggerReturns403ForRoleClient(): void
-    {
-        $client    = static::createClient();
-        $container = static::getContainer();
-        $em        = $container->get('doctrine.orm.entity_manager');
-
-        $clientUser = $em->getRepository(User::class)->findOneBy(['username' => 'client-liot']);
-        $client->loginUser($clientUser);
-        $client->request('POST', '/api/mail/sync');
-
-        self::assertResponseStatusCodeSame(403);
-    }
-
     public function testSyncTriggerReturns202ForRoleUser(): void
     {
         $client    = static::createClient();
diff --git a/tests/Functional/Controller/Mail/MailTaskIntegrationControllerTest.php b/tests/Functional/Controller/Mail/MailTaskIntegrationControllerTest.php
index e8b7f1c..ba9e55a 100644
--- a/tests/Functional/Controller/Mail/MailTaskIntegrationControllerTest.php
+++ b/tests/Functional/Controller/Mail/MailTaskIntegrationControllerTest.php
@@ -25,19 +25,6 @@ class MailTaskIntegrationControllerTest extends WebTestCase
         self::assertResponseStatusCodeSame(401);
     }
 
-    public function testLinkTaskReturns403ForRoleClient(): void
-    {
-        $client    = static::createClient();
-        $container = static::getContainer();
-        $em        = $container->get('doctrine.orm.entity_manager');
-
-        $clientUser = $em->getRepository(User::class)->findOneBy(['username' => 'client-liot']);
-        $client->loginUser($clientUser);
-        $client->request('POST', '/api/mail/messages/1/link-task', [], [], ['CONTENT_TYPE' => 'application/json'], json_encode(['taskId' => 1]));
-
-        self::assertResponseStatusCodeSame(403);
-    }
-
     public function testUnlinkTaskReturns401WhenNotAuthenticated(): void
     {
         $client = static::createClient();
@@ -54,19 +41,6 @@ class MailTaskIntegrationControllerTest extends WebTestCase
         self::assertResponseStatusCodeSame(401);
     }
 
-    public function testTaskMailsListReturns403ForRoleClient(): void
-    {
-        $client    = static::createClient();
-        $container = static::getContainer();
-        $em        = $container->get('doctrine.orm.entity_manager');
-
-        $clientUser = $em->getRepository(User::class)->findOneBy(['username' => 'client-liot']);
-        $client->loginUser($clientUser);
-        $client->request('GET', '/api/tasks/1/mails');
-
-        self::assertResponseStatusCodeSame(403);
-    }
-
     public function testCreateTaskReturns401WhenNotAuthenticated(): void
     {
         $client = static::createClient();

From 2b148fa65afb7ef0b8cfb1a2e93516081d7bb97d Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Fri, 22 May 2026 14:10:56 +0200
Subject: [PATCH 3/9] feat(absences) : outils MCP CRUD pour les absences
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Expose le module Absences via le serveur MCP et comble les trous CRUD
existants (projets, groupes, métadonnées de tâches, clients, users RH).

Absences (réutilise AbsenceDayCalculator + AbsenceBalanceService pour ne
pas contourner la logique de soldes) :
- list/get/create/review/cancel/delete-absence-request
- list/update-absence-policy, list/update-absence-balance
- create-absence-request prend un userId explicite (agir au nom d'un employé) ;
  review/cancel maintiennent les soldes (pending/taken) cohérents
- AbsenceRequestRepository::findFiltered pour les filtres de liste

Trous CRUD comblés :
- delete-project, delete-group
- CRUD tag, effort, priority
- CRUD status (couplé au workflow, avec category)
- CRUD client, get/update-user (champs RH, sans password ni roles)

Sérialisation centralisée (Serializer::absenceRequest/Policy/Balance/client/userFull).
Instructions MCP (mcp.yaml) mises à jour : statuts par workflow + domaine absences.

Tests : tests/Functional/Mcp/AbsenceRequestLifecycleTest (création / approbation /
annulation admin) vérifient le cycle complet et la cohérence des soldes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 config/packages/mcp.yaml                      |    8 +-
 .../2026-05-22-mcp-absence-crud-tools.md      | 2519 +++++++++++++++++
 ...026-05-22-mcp-absence-crud-tools-design.md |  141 +
 .../Tool/Absence/CancelAbsenceRequestTool.php |   59 +
 .../Tool/Absence/CreateAbsenceRequestTool.php |  104 +
 .../Tool/Absence/DeleteAbsenceRequestTool.php |   41 +
 .../Tool/Absence/GetAbsenceRequestTool.php    |   37 +
 .../Tool/Absence/ListAbsenceBalancesTool.php  |   53 +
 .../Tool/Absence/ListAbsencePoliciesTool.php  |   31 +
 .../Tool/Absence/ListAbsenceRequestsTool.php  |   68 +
 .../Tool/Absence/ReviewAbsenceRequestTool.php |   74 +
 .../Tool/Absence/UpdateAbsenceBalanceTool.php |   55 +
 .../Tool/Absence/UpdateAbsencePolicyTool.php  |   67 +
 src/Mcp/Tool/Project/DeleteProjectTool.php    |   42 +
 src/Mcp/Tool/Reference/CreateClientTool.php   |   47 +
 src/Mcp/Tool/Reference/DeleteClientTool.php   |   42 +
 src/Mcp/Tool/Reference/GetClientTool.php      |   37 +
 src/Mcp/Tool/Reference/GetUserTool.php        |   37 +
 src/Mcp/Tool/Reference/UpdateClientTool.php   |   67 +
 src/Mcp/Tool/Reference/UpdateUserTool.php     |   92 +
 src/Mcp/Tool/Serializer.php                   |  106 +
 src/Mcp/Tool/TaskMeta/CreateEffortTool.php    |   34 +
 src/Mcp/Tool/TaskMeta/CreatePriorityTool.php  |   37 +
 src/Mcp/Tool/TaskMeta/CreateStatusTool.php    |   74 +
 src/Mcp/Tool/TaskMeta/CreateTagTool.php       |   38 +
 src/Mcp/Tool/TaskMeta/DeleteEffortTool.php    |   42 +
 src/Mcp/Tool/TaskMeta/DeleteGroupTool.php     |   42 +
 src/Mcp/Tool/TaskMeta/DeletePriorityTool.php  |   42 +
 src/Mcp/Tool/TaskMeta/DeleteStatusTool.php    |   42 +
 src/Mcp/Tool/TaskMeta/DeleteTagTool.php       |   42 +
 src/Mcp/Tool/TaskMeta/UpdateEffortTool.php    |   41 +
 src/Mcp/Tool/TaskMeta/UpdatePriorityTool.php  |   46 +
 src/Mcp/Tool/TaskMeta/UpdateStatusTool.php    |   74 +
 src/Mcp/Tool/TaskMeta/UpdateTagTool.php       |   47 +
 src/Repository/AbsenceRequestRepository.php   |   32 +
 .../Mcp/AbsenceRequestLifecycleTest.php       |  177 ++
 36 files changed, 4536 insertions(+), 1 deletion(-)
 create mode 100644 docs/superpowers/plans/2026-05-22-mcp-absence-crud-tools.md
 create mode 100644 docs/superpowers/specs/2026-05-22-mcp-absence-crud-tools-design.md
 create mode 100644 src/Mcp/Tool/Absence/CancelAbsenceRequestTool.php
 create mode 100644 src/Mcp/Tool/Absence/CreateAbsenceRequestTool.php
 create mode 100644 src/Mcp/Tool/Absence/DeleteAbsenceRequestTool.php
 create mode 100644 src/Mcp/Tool/Absence/GetAbsenceRequestTool.php
 create mode 100644 src/Mcp/Tool/Absence/ListAbsenceBalancesTool.php
 create mode 100644 src/Mcp/Tool/Absence/ListAbsencePoliciesTool.php
 create mode 100644 src/Mcp/Tool/Absence/ListAbsenceRequestsTool.php
 create mode 100644 src/Mcp/Tool/Absence/ReviewAbsenceRequestTool.php
 create mode 100644 src/Mcp/Tool/Absence/UpdateAbsenceBalanceTool.php
 create mode 100644 src/Mcp/Tool/Absence/UpdateAbsencePolicyTool.php
 create mode 100644 src/Mcp/Tool/Project/DeleteProjectTool.php
 create mode 100644 src/Mcp/Tool/Reference/CreateClientTool.php
 create mode 100644 src/Mcp/Tool/Reference/DeleteClientTool.php
 create mode 100644 src/Mcp/Tool/Reference/GetClientTool.php
 create mode 100644 src/Mcp/Tool/Reference/GetUserTool.php
 create mode 100644 src/Mcp/Tool/Reference/UpdateClientTool.php
 create mode 100644 src/Mcp/Tool/Reference/UpdateUserTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/CreateEffortTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/CreatePriorityTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/CreateStatusTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/CreateTagTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/DeleteEffortTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/DeleteGroupTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/DeletePriorityTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/DeleteStatusTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/DeleteTagTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/UpdateEffortTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/UpdatePriorityTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/UpdateStatusTool.php
 create mode 100644 src/Mcp/Tool/TaskMeta/UpdateTagTool.php
 create mode 100644 tests/Functional/Mcp/AbsenceRequestLifecycleTest.php

diff --git a/config/packages/mcp.yaml b/config/packages/mcp.yaml
index 50179be..d901762 100644
--- a/config/packages/mcp.yaml
+++ b/config/packages/mcp.yaml
@@ -6,8 +6,14 @@ mcp:
         This server provides access to the Lesstime project management system.
         You can list/create/update/delete projects, tasks, and time entries.
         Tasks belong to projects and have statuses, priorities, efforts, tags, and groups.
-        Statuses, priorities, efforts, and tags are GLOBAL (shared across all projects).
+        Priorities, efforts, and tags are GLOBAL (shared across all projects).
+        Statuses belong to a WORKFLOW (not global) — use list-workflows and list-statuses
+        to see how they group; create-status requires a workflowId and a category.
         Groups are PER-PROJECT (each group belongs to one project).
+        Absences: manage employee leave with absence-request tools (list/get/create/review/
+        cancel/delete), absence-policy tools (list/update) and absence-balance tools
+        (list/update). create-absence-request takes an explicit userId to act on behalf of
+        an employee; review/cancel keep the leave balances consistent (pending/taken).
         Time entries track work duration and can be linked to projects and tasks.
         Use list-statuses, list-priorities, list-efforts, list-tags, list-groups to discover
         available metadata before creating or updating tasks.
diff --git a/docs/superpowers/plans/2026-05-22-mcp-absence-crud-tools.md b/docs/superpowers/plans/2026-05-22-mcp-absence-crud-tools.md
new file mode 100644
index 0000000..534adf9
--- /dev/null
+++ b/docs/superpowers/plans/2026-05-22-mcp-absence-crud-tools.md
@@ -0,0 +1,2519 @@
+# Outils MCP — Module Absences + trous CRUD — Plan d'implémentation
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Exposer le module Absences (requests/policies/balances) et combler les trous CRUD existants (projets, groupes, métadonnées de tâches, clients, users) via de nouveaux outils MCP, sans contourner la logique métier des soldes.
+
+**Architecture:** Chaque outil = une classe avec `#[McpTool]`, auto-découverte par le scan `src/` de `config/packages/mcp.yaml`. Les outils d'absence répliquent l'orchestration des Processors en réutilisant les services `AbsenceDayCalculator` et `AbsenceBalanceService` (et non les Processors, liés à `Security::getUser()`), avec un `userId` explicite pour agir au nom d'un employé. Sérialisation centralisée dans `App\Mcp\Tool\Serializer`.
+
+**Tech Stack:** PHP 8.4, Symfony 8, Doctrine ORM, PHPUnit (`KernelTestCase` + `Security` mocké), serveur MCP `mcp` bundle.
+
+---
+
+## Référence : conventions d'un outil MCP
+
+Tout outil suit ce squelette (vu dans `src/Mcp/Tool/Task/CreateTaskTool.php`) :
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\<SousDossier>;
+
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+// + repos/services/entities
+
+#[McpTool(name: '<nom-kebab>', description: '<description>')]
+class <Nom>Tool
+{
+    public function __construct(/* deps injectées */) {}
+
+    public function __invoke(/* params */): string
+    {
+        if (!$this->security->isGranted('<ROLE>')) {
+            throw new AccessDeniedException('Access denied: <ROLE> required.');
+        }
+        // ... logique
+        return json_encode(/* tableau */);
+    }
+}
+```
+
+Règles : `InvalidArgumentException` (avec `use function sprintf;`) quand un ID est introuvable ; helpers de parsing d'enum (voir Task 4) ; `json_encode` en sortie.
+
+---
+
+## JALON 1 — Module Absences
+
+### Task 1 : Helpers de sérialisation Absences
+
+**Files:**
+- Modify: `src/Mcp/Tool/Serializer.php`
+
+- [ ] **Step 1 : Ajouter les imports d'entités absence**
+
+En tête de `Serializer.php`, ajouter aux `use` existants :
+
+```php
+use App\Entity\AbsenceBalance;
+use App\Entity\AbsencePolicy;
+use App\Entity\AbsenceRequest;
+use App\Entity\Client;
+```
+
+- [ ] **Step 2 : Ajouter les méthodes de sérialisation**
+
+Ajouter ces méthodes statiques dans la classe `Serializer` (avant l'accolade de fin) :
+
+```php
+    /**
+     * @return array<string, mixed>
+     */
+    public static function absenceRequest(AbsenceRequest $r): array
+    {
+        return [
+            'id'                     => $r->getId(),
+            'user'                   => self::user($r->getUser()),
+            'type'                   => $r->getType()?->value,
+            'typeLabel'              => $r->getType()?->label(),
+            'startDate'              => $r->getStartDate()?->format('Y-m-d'),
+            'endDate'                => $r->getEndDate()?->format('Y-m-d'),
+            'startHalfDay'           => $r->getStartHalfDay()?->value,
+            'endHalfDay'             => $r->getEndHalfDay()?->value,
+            'countedDays'            => $r->getCountedDays(),
+            'reason'                 => $r->getReason(),
+            'status'                 => $r->getStatus()->value,
+            'statusLabel'            => $r->getStatus()->label(),
+            'rejectionReason'        => $r->getRejectionReason(),
+            'justificationFileName'  => $r->getJustificationFileName(),
+            'createdAt'              => $r->getCreatedAt()?->format('c'),
+            'reviewedAt'             => $r->getReviewedAt()?->format('c'),
+            'reviewedBy'             => self::user($r->getReviewedBy()),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function absencePolicy(AbsencePolicy $p): array
+    {
+        return [
+            'id'                   => $p->getId(),
+            'type'                 => $p->getType()->value,
+            'typeLabel'            => $p->getType()->label(),
+            'daysPerYear'          => $p->getDaysPerYear(),
+            'daysPerEvent'         => $p->getDaysPerEvent(),
+            'justificationRequired'=> $p->isJustificationRequired(),
+            'noticeDays'           => $p->getNoticeDays(),
+            'countWorkingDaysOnly' => $p->isCountWorkingDaysOnly(),
+            'active'               => $p->isActive(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function absenceBalance(AbsenceBalance $b): array
+    {
+        return [
+            'id'            => $b->getId(),
+            'user'          => self::user($b->getUser()),
+            'type'          => $b->getType()->value,
+            'typeLabel'     => $b->getType()->label(),
+            'period'        => $b->getPeriod(),
+            'acquired'      => $b->getAcquired(),
+            'acquiring'     => $b->getAcquiring(),
+            'taken'         => $b->getTaken(),
+            'pending'       => $b->getPending(),
+            'acquiredTotal' => $b->getAcquiredTotal(),
+            'available'     => $b->getAvailable(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function client(Client $c): array
+    {
+        return [
+            'id'         => $c->getId(),
+            'name'       => $c->getName(),
+            'email'      => $c->getEmail(),
+            'phone'      => $c->getPhone(),
+            'street'     => $c->getStreet(),
+            'city'       => $c->getCity(),
+            'postalCode' => $c->getPostalCode(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function userFull(User $u): array
+    {
+        return [
+            'id'                   => $u->getId(),
+            'username'             => $u->getUsername(),
+            'roles'                => $u->getRoles(),
+            'isEmployee'           => $u->isEmployee(),
+            'hireDate'             => $u->getHireDate()?->format('Y-m-d'),
+            'endDate'              => $u->getEndDate()?->format('Y-m-d'),
+            'contractType'         => $u->getContractType()?->value,
+            'workTimeRatio'        => $u->getWorkTimeRatio(),
+            'annualLeaveDays'      => $u->getAnnualLeaveDays(),
+            'referencePeriodStart' => $u->getReferencePeriodStart(),
+            'initialLeaveBalance'  => $u->getInitialLeaveBalance(),
+            'familySituation'      => $u->getFamilySituation()?->value,
+            'nbChildren'           => $u->getNbChildren(),
+        ];
+    }
+```
+
+- [ ] **Step 3 : Vérifier que PHP ne casse pas (lint)**
+
+Run: `docker exec php-lesstime-fpm php -l src/Mcp/Tool/Serializer.php`
+Expected: `No syntax errors detected`
+
+- [ ] **Step 4 : Commit**
+
+```bash
+git add src/Mcp/Tool/Serializer.php
+git commit -m "feat(mcp) : helpers de sérialisation pour absences/client/user"
+```
+
+---
+
+### Task 2 : Outils de policies — `list-absence-policies`, `update-absence-policy`
+
+**Files:**
+- Create: `src/Mcp/Tool/Absence/ListAbsencePoliciesTool.php`
+- Create: `src/Mcp/Tool/Absence/UpdateAbsencePolicyTool.php`
+
+- [ ] **Step 1 : Créer `ListAbsencePoliciesTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsencePolicyRepository;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+#[McpTool(name: 'list-absence-policies', description: 'List all absence policies (one per absence type) with their rules: days/year, days/event, notice period, working-days mode, active flag.')]
+class ListAbsencePoliciesTool
+{
+    public function __construct(
+        private readonly AbsencePolicyRepository $policyRepository,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $policies = $this->policyRepository->findBy([], ['type' => 'ASC']);
+
+        return json_encode(array_map(Serializer::absencePolicy(...), $policies));
+    }
+}
+```
+
+- [ ] **Step 2 : Créer `UpdateAbsencePolicyTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsencePolicyRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-absence-policy', description: 'Update an absence policy (admin). Only provided fields change.')]
+class UpdateAbsencePolicyTool
+{
+    public function __construct(
+        private readonly AbsencePolicyRepository $policyRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $id,
+        ?float $daysPerYear = null,
+        ?float $daysPerEvent = null,
+        ?bool $justificationRequired = null,
+        ?int $noticeDays = null,
+        ?bool $countWorkingDaysOnly = null,
+        ?bool $active = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $policy = $this->policyRepository->find($id);
+        if (null === $policy) {
+            throw new InvalidArgumentException(sprintf('AbsencePolicy with ID %d not found.', $id));
+        }
+
+        if (null !== $daysPerYear) {
+            $policy->setDaysPerYear($daysPerYear);
+        }
+        if (null !== $daysPerEvent) {
+            $policy->setDaysPerEvent($daysPerEvent);
+        }
+        if (null !== $justificationRequired) {
+            $policy->setJustificationRequired($justificationRequired);
+        }
+        if (null !== $noticeDays) {
+            $policy->setNoticeDays($noticeDays);
+        }
+        if (null !== $countWorkingDaysOnly) {
+            $policy->setCountWorkingDaysOnly($countWorkingDaysOnly);
+        }
+        if (null !== $active) {
+            $policy->setActive($active);
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::absencePolicy($policy));
+    }
+}
+```
+
+- [ ] **Step 3 : Lint**
+
+Run: `docker exec php-lesstime-fpm php -l src/Mcp/Tool/Absence/ListAbsencePoliciesTool.php && docker exec php-lesstime-fpm php -l src/Mcp/Tool/Absence/UpdateAbsencePolicyTool.php`
+Expected: `No syntax errors detected` ×2
+
+- [ ] **Step 4 : Vérifier la découverte MCP**
+
+Run: `docker exec php-lesstime-fpm php bin/console debug:container --tag=mcp.tool 2>/dev/null | grep -i absence || docker exec php-lesstime-fpm php bin/console cache:clear`
+Expected : pas d'erreur de cache (la découverte se fait au runtime ; l'absence d'erreur de compilation suffit ici).
+
+- [ ] **Step 5 : Commit**
+
+```bash
+git add src/Mcp/Tool/Absence/ListAbsencePoliciesTool.php src/Mcp/Tool/Absence/UpdateAbsencePolicyTool.php
+git commit -m "feat(mcp) : outils list/update absence-policy"
+```
+
+---
+
+### Task 3 : Outils de soldes — `list-absence-balances`, `update-absence-balance`
+
+**Files:**
+- Create: `src/Mcp/Tool/Absence/ListAbsenceBalancesTool.php`
+- Create: `src/Mcp/Tool/Absence/UpdateAbsenceBalanceTool.php`
+
+- [ ] **Step 1 : Créer `ListAbsenceBalancesTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Enum\AbsenceType;
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsenceBalanceRepository;
+use App\Repository\UserRepository;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'list-absence-balances', description: 'List leave balances. Optional filters: userId, type (cp, mariage_pacs, conge_parental, deces, maladie), period (e.g. "2025-2026" or "2025").')]
+class ListAbsenceBalancesTool
+{
+    public function __construct(
+        private readonly AbsenceBalanceRepository $balanceRepository,
+        private readonly UserRepository $userRepository,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(?int $userId = null, ?string $type = null, ?string $period = null): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $criteria = [];
+        if (null !== $userId) {
+            $user = $this->userRepository->find($userId);
+            if (null === $user) {
+                throw new InvalidArgumentException(sprintf('User with ID %d not found.', $userId));
+            }
+            $criteria['user'] = $user;
+        }
+        if (null !== $type) {
+            $criteria['type'] = AbsenceType::tryFrom($type)
+                ?? throw new InvalidArgumentException(sprintf('Unknown absence type "%s".', $type));
+        }
+        if (null !== $period) {
+            $criteria['period'] = $period;
+        }
+
+        $balances = $this->balanceRepository->findBy($criteria, ['period' => 'DESC']);
+
+        return json_encode(array_map(Serializer::absenceBalance(...), $balances));
+    }
+}
+```
+
+- [ ] **Step 2 : Créer `UpdateAbsenceBalanceTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsenceBalanceRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-absence-balance', description: 'Manually adjust a leave balance (admin regularisation). Only provided buckets change: acquired (N-1), acquiring (N), taken.')]
+class UpdateAbsenceBalanceTool
+{
+    public function __construct(
+        private readonly AbsenceBalanceRepository $balanceRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $id,
+        ?float $acquired = null,
+        ?float $acquiring = null,
+        ?float $taken = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $balance = $this->balanceRepository->find($id);
+        if (null === $balance) {
+            throw new InvalidArgumentException(sprintf('AbsenceBalance with ID %d not found.', $id));
+        }
+
+        if (null !== $acquired) {
+            $balance->setAcquired($acquired);
+        }
+        if (null !== $acquiring) {
+            $balance->setAcquiring($acquiring);
+        }
+        if (null !== $taken) {
+            $balance->setTaken($taken);
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::absenceBalance($balance));
+    }
+}
+```
+
+- [ ] **Step 3 : Lint**
+
+Run: `docker exec php-lesstime-fpm php -l src/Mcp/Tool/Absence/ListAbsenceBalancesTool.php && docker exec php-lesstime-fpm php -l src/Mcp/Tool/Absence/UpdateAbsenceBalanceTool.php`
+Expected: `No syntax errors detected` ×2
+
+- [ ] **Step 4 : Commit**
+
+```bash
+git add src/Mcp/Tool/Absence/ListAbsenceBalancesTool.php src/Mcp/Tool/Absence/UpdateAbsenceBalanceTool.php
+git commit -m "feat(mcp) : outils list/update absence-balance"
+```
+
+---
+
+### Task 4 : Outils de lecture des demandes — repo filtré + `list/get-absence-request`
+
+**Files:**
+- Modify: `src/Repository/AbsenceRequestRepository.php`
+- Create: `src/Mcp/Tool/Absence/ListAbsenceRequestsTool.php`
+- Create: `src/Mcp/Tool/Absence/GetAbsenceRequestTool.php`
+
+- [ ] **Step 1 : Ajouter une méthode de filtrage au repo**
+
+Dans `AbsenceRequestRepository`, ajouter les imports si absents (`use App\Enum\AbsenceType;` déjà présent ? sinon ajouter) et la méthode :
+
+```php
+    /**
+     * @return AbsenceRequest[]
+     */
+    public function findFiltered(
+        ?User $user = null,
+        ?AbsenceStatus $status = null,
+        ?\App\Enum\AbsenceType $type = null,
+        ?DateTimeInterface $from = null,
+        ?DateTimeInterface $to = null,
+    ): array {
+        $qb = $this->createQueryBuilder('a')->orderBy('a.startDate', 'DESC');
+
+        if (null !== $user) {
+            $qb->andWhere('a.user = :user')->setParameter('user', $user);
+        }
+        if (null !== $status) {
+            $qb->andWhere('a.status = :status')->setParameter('status', $status);
+        }
+        if (null !== $type) {
+            $qb->andWhere('a.type = :type')->setParameter('type', $type);
+        }
+        if (null !== $from) {
+            $qb->andWhere('a.endDate >= :from')->setParameter('from', $from->format('Y-m-d'));
+        }
+        if (null !== $to) {
+            $qb->andWhere('a.startDate <= :to')->setParameter('to', $to->format('Y-m-d'));
+        }
+
+        return $qb->getQuery()->getResult();
+    }
+```
+
+> Note : `AbsenceStatus` est déjà importé dans ce repo. Ajouter `use App\Enum\AbsenceType;` en tête s'il n'y est pas (sinon le FQCN inline ci-dessus suffit, mais préférer l'import et remplacer `\App\Enum\AbsenceType` par `AbsenceType`).
+
+- [ ] **Step 2 : Créer `ListAbsenceRequestsTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Enum\AbsenceStatus;
+use App\Enum\AbsenceType;
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsenceRequestRepository;
+use App\Repository\UserRepository;
+use DateTimeImmutable;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'list-absence-requests', description: 'List absence requests. Optional filters: userId, status (pending, approved, rejected, cancelled), type (cp, mariage_pacs, conge_parental, deces, maladie), from/to (YYYY-MM-DD, overlap window). Without userId returns all employees.')]
+class ListAbsenceRequestsTool
+{
+    public function __construct(
+        private readonly AbsenceRequestRepository $requestRepository,
+        private readonly UserRepository $userRepository,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        ?int $userId = null,
+        ?string $status = null,
+        ?string $type = null,
+        ?string $from = null,
+        ?string $to = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $user = null;
+        if (null !== $userId) {
+            $user = $this->userRepository->find($userId)
+                ?? throw new InvalidArgumentException(sprintf('User with ID %d not found.', $userId));
+        }
+
+        $statusEnum = null;
+        if (null !== $status) {
+            $statusEnum = AbsenceStatus::tryFrom($status)
+                ?? throw new InvalidArgumentException(sprintf('Unknown status "%s".', $status));
+        }
+
+        $typeEnum = null;
+        if (null !== $type) {
+            $typeEnum = AbsenceType::tryFrom($type)
+                ?? throw new InvalidArgumentException(sprintf('Unknown absence type "%s".', $type));
+        }
+
+        $requests = $this->requestRepository->findFiltered(
+            $user,
+            $statusEnum,
+            $typeEnum,
+            null !== $from ? new DateTimeImmutable($from) : null,
+            null !== $to ? new DateTimeImmutable($to) : null,
+        );
+
+        return json_encode(array_map(Serializer::absenceRequest(...), $requests));
+    }
+}
+```
+
+- [ ] **Step 3 : Créer `GetAbsenceRequestTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsenceRequestRepository;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'get-absence-request', description: 'Get a single absence request by ID.')]
+class GetAbsenceRequestTool
+{
+    public function __construct(
+        private readonly AbsenceRequestRepository $requestRepository,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $request = $this->requestRepository->find($id);
+        if (null === $request) {
+            throw new InvalidArgumentException(sprintf('AbsenceRequest with ID %d not found.', $id));
+        }
+
+        return json_encode(Serializer::absenceRequest($request));
+    }
+}
+```
+
+- [ ] **Step 4 : Lint les 3 fichiers**
+
+Run: `for f in src/Repository/AbsenceRequestRepository.php src/Mcp/Tool/Absence/ListAbsenceRequestsTool.php src/Mcp/Tool/Absence/GetAbsenceRequestTool.php; do docker exec php-lesstime-fpm php -l $f; done`
+Expected: `No syntax errors detected` ×3
+
+- [ ] **Step 5 : Commit**
+
+```bash
+git add src/Repository/AbsenceRequestRepository.php src/Mcp/Tool/Absence/ListAbsenceRequestsTool.php src/Mcp/Tool/Absence/GetAbsenceRequestTool.php
+git commit -m "feat(mcp) : outils list/get absence-request + repo findFiltered"
+```
+
+---
+
+### Task 5 : `create-absence-request` (réplique `AbsenceRequestProcessor`)
+
+**Files:**
+- Create: `src/Mcp/Tool/Absence/CreateAbsenceRequestTool.php`
+- Create: `tests/Functional/Mcp/AbsenceRequestLifecycleTest.php`
+
+- [ ] **Step 1 : Écrire le test du cycle de vie (échoue d'abord) — création**
+
+Ce test crée son propre employé et sa policy (auto-suffisant), puis vérifie la création + la réservation de solde. Il sera complété aux Tasks 6 et 7.
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Functional\Mcp;
+
+use App\Entity\AbsencePolicy;
+use App\Entity\User;
+use App\Enum\AbsenceType;
+use App\Mcp\Tool\Absence\CreateAbsenceRequestTool;
+use App\Repository\AbsenceBalanceRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
+use Symfony\Bundle\SecurityBundle\Security;
+
+/**
+ * @internal
+ */
+class AbsenceRequestLifecycleTest extends KernelTestCase
+{
+    private EntityManagerInterface $em;
+    private User $employee;
+    private User $admin;
+
+    protected function setUp(): void
+    {
+        self::bootKernel();
+        $this->em = self::getContainer()->get(EntityManagerInterface::class);
+
+        // Employé dédié au test.
+        $this->employee = new User();
+        $this->employee->setUsername('mcp-test-employee-'.uniqid());
+        $this->employee->setPassword('x');
+        $this->employee->setRoles(['ROLE_USER']);
+        $this->employee->setIsEmployee(true);
+        $this->employee->setReferencePeriodStart('06-01');
+        $this->em->persist($this->employee);
+
+        $this->admin = new User();
+        $this->admin->setUsername('mcp-test-admin-'.uniqid());
+        $this->admin->setPassword('x');
+        $this->admin->setRoles(['ROLE_ADMIN']);
+        $this->em->persist($this->admin);
+
+        // Policy CP active (créée si absente — findOneByType peut déjà exister via fixtures).
+        $policy = $this->em->getRepository(AbsencePolicy::class)->findOneBy(['type' => AbsenceType::PaidLeave]);
+        if (null === $policy) {
+            $policy = new AbsencePolicy();
+            $policy->setType(AbsenceType::PaidLeave);
+            $policy->setCountWorkingDaysOnly(true);
+            $policy->setActive(true);
+            $this->em->persist($policy);
+        } else {
+            $policy->setActive(true);
+        }
+
+        $this->em->flush();
+    }
+
+    private function securityFor(User $user): Security
+    {
+        $security = $this->createMock(Security::class);
+        $security->method('isGranted')->willReturn(true);
+        $security->method('getUser')->willReturn($user);
+
+        return $security;
+    }
+
+    private function createTool(User $actor): CreateAbsenceRequestTool
+    {
+        $c = self::getContainer();
+
+        return new CreateAbsenceRequestTool(
+            $c->get(EntityManagerInterface::class),
+            $c->get(\App\Repository\UserRepository::class),
+            $c->get(\App\Repository\AbsencePolicyRepository::class),
+            $c->get(\App\Repository\AbsenceRequestRepository::class),
+            $c->get(\App\Service\AbsenceDayCalculator::class),
+            $c->get(\App\Service\AbsenceBalanceService::class),
+            $this->securityFor($actor),
+        );
+    }
+
+    public function testCreateReservesPendingDays(): void
+    {
+        $tool = $this->createTool($this->admin);
+
+        // Lundi 2026-06-01 → vendredi 2026-06-05 = 5 jours ouvrés.
+        $json = ($tool)(
+            $this->employee->getId(),
+            'cp',
+            '2026-06-01',
+            '2026-06-05',
+        );
+        $data = json_decode($json, true);
+
+        self::assertSame('pending', $data['status']);
+        self::assertSame(5.0, $data['countedDays']);
+        self::assertSame($this->employee->getId(), $data['user']['id']);
+
+        $balance = self::getContainer()->get(AbsenceBalanceRepository::class)
+            ->findOneForPeriod($this->employee, AbsenceType::PaidLeave, '2026-2027');
+        self::assertNotNull($balance);
+        self::assertSame(5.0, $balance->getPending());
+    }
+}
+```
+
+> Période attendue : `referencePeriodStart = '06-01'`, date `2026-06-01` ≥ `06-01` ⇒ période `2026-2027` (cf. `AbsenceBalanceService::periodFor`).
+
+- [ ] **Step 2 : Lancer le test — il échoue (classe outil absente)**
+
+Run: `docker exec php-lesstime-fpm php bin/phpunit tests/Functional/Mcp/AbsenceRequestLifecycleTest.php`
+Expected: FAIL — `Class "App\Mcp\Tool\Absence\CreateAbsenceRequestTool" not found`.
+
+- [ ] **Step 3 : Créer `CreateAbsenceRequestTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Entity\AbsenceRequest;
+use App\Enum\AbsenceStatus;
+use App\Enum\AbsenceType;
+use App\Enum\HalfDay;
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsencePolicyRepository;
+use App\Repository\AbsenceRequestRepository;
+use App\Repository\UserRepository;
+use App\Service\AbsenceBalanceService;
+use App\Service\AbsenceDayCalculator;
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'create-absence-request', description: 'Create an absence request on behalf of an employee (userId). Validates active policy + no overlap, computes deducted working days, sets status=pending and reserves the days in the pending balance. type: cp|mariage_pacs|conge_parental|deces|maladie. Dates YYYY-MM-DD. halfDay (matin|apres_midi) on a boundary subtracts 0.5.')]
+class CreateAbsenceRequestTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly UserRepository $userRepository,
+        private readonly AbsencePolicyRepository $policyRepository,
+        private readonly AbsenceRequestRepository $requestRepository,
+        private readonly AbsenceDayCalculator $calculator,
+        private readonly AbsenceBalanceService $balanceService,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $userId,
+        string $type,
+        string $startDate,
+        string $endDate,
+        ?string $startHalfDay = null,
+        ?string $endHalfDay = null,
+        ?string $reason = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $user = $this->userRepository->find($userId)
+            ?? throw new InvalidArgumentException(sprintf('User with ID %d not found.', $userId));
+
+        $typeEnum = AbsenceType::tryFrom($type)
+            ?? throw new InvalidArgumentException(sprintf('Unknown absence type "%s".', $type));
+
+        $start = new DateTimeImmutable($startDate);
+        $end   = new DateTimeImmutable($endDate);
+        if ($end < $start) {
+            throw new InvalidArgumentException('End date must be on or after start date.');
+        }
+
+        $startHd = null !== $startHalfDay
+            ? (HalfDay::tryFrom($startHalfDay) ?? throw new InvalidArgumentException(sprintf('Unknown half day "%s".', $startHalfDay)))
+            : null;
+        $endHd = null !== $endHalfDay
+            ? (HalfDay::tryFrom($endHalfDay) ?? throw new InvalidArgumentException(sprintf('Unknown half day "%s".', $endHalfDay)))
+            : null;
+
+        $policy = $this->policyRepository->findOneByType($typeEnum);
+        if (null === $policy || !$policy->isActive()) {
+            throw new InvalidArgumentException('This absence type is not available.');
+        }
+
+        if ($this->requestRepository->hasOverlap($user, $start, $end)) {
+            throw new InvalidArgumentException('This request overlaps an existing absence.');
+        }
+
+        $countedDays = $this->calculator->countWorkingDays($start, $end, $startHd, $endHd, $policy->isCountWorkingDaysOnly());
+        if ($countedDays <= 0.0) {
+            throw new InvalidArgumentException('The selected range contains no working day.');
+        }
+
+        $request = new AbsenceRequest();
+        $request->setUser($user);
+        $request->setType($typeEnum);
+        $request->setStartDate($start);
+        $request->setEndDate($end);
+        $request->setStartHalfDay($startHd);
+        $request->setEndHalfDay($endHd);
+        $request->setReason($reason);
+        $request->setCountedDays($countedDays);
+        $request->setStatus(AbsenceStatus::Pending);
+        $request->setRejectionReason(null);
+        $request->setCreatedAt(new DateTimeImmutable());
+
+        $this->entityManager->persist($request);
+        $this->balanceService->reservePending($request);
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::absenceRequest($request));
+    }
+}
+```
+
+- [ ] **Step 4 : Relancer le test — il passe**
+
+Run: `docker exec php-lesstime-fpm php bin/phpunit tests/Functional/Mcp/AbsenceRequestLifecycleTest.php`
+Expected: PASS (1 test).
+
+- [ ] **Step 5 : Commit**
+
+```bash
+git add src/Mcp/Tool/Absence/CreateAbsenceRequestTool.php tests/Functional/Mcp/AbsenceRequestLifecycleTest.php
+git commit -m "feat(mcp) : outil create-absence-request + test cycle de vie"
+```
+
+---
+
+### Task 6 : `review-absence-request` (réplique `AbsenceReviewProcessor`)
+
+**Files:**
+- Create: `src/Mcp/Tool/Absence/ReviewAbsenceRequestTool.php`
+- Modify: `tests/Functional/Mcp/AbsenceRequestLifecycleTest.php`
+
+- [ ] **Step 1 : Ajouter le test d'approbation (échoue d'abord)**
+
+Ajouter dans `AbsenceRequestLifecycleTest` une fabrique d'outil review + un test :
+
+```php
+    private function reviewTool(User $actor): \App\Mcp\Tool\Absence\ReviewAbsenceRequestTool
+    {
+        $c = self::getContainer();
+
+        return new \App\Mcp\Tool\Absence\ReviewAbsenceRequestTool(
+            $c->get(EntityManagerInterface::class),
+            $c->get(\App\Repository\AbsenceRequestRepository::class),
+            $c->get(\App\Service\AbsenceBalanceService::class),
+            $this->securityFor($actor),
+        );
+    }
+
+    public function testApproveMovesPendingToTaken(): void
+    {
+        $created = json_decode(
+            ($this->createTool($this->admin))($this->employee->getId(), 'cp', '2026-06-01', '2026-06-05'),
+            true,
+        );
+
+        $json = ($this->reviewTool($this->admin))($created['id'], 'approve');
+        $data = json_decode($json, true);
+
+        self::assertSame('approved', $data['status']);
+        self::assertSame($this->admin->getId(), $data['reviewedBy']['id']);
+
+        $balance = self::getContainer()->get(AbsenceBalanceRepository::class)
+            ->findOneForPeriod($this->employee, AbsenceType::PaidLeave, '2026-2027');
+        self::assertSame(0.0, $balance->getPending());
+        self::assertSame(5.0, $balance->getTaken());
+    }
+```
+
+- [ ] **Step 2 : Lancer — échoue (classe absente)**
+
+Run: `docker exec php-lesstime-fpm php bin/phpunit tests/Functional/Mcp/AbsenceRequestLifecycleTest.php --filter testApprove`
+Expected: FAIL — `ReviewAbsenceRequestTool` not found.
+
+- [ ] **Step 3 : Créer `ReviewAbsenceRequestTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Entity\User;
+use App\Enum\AbsenceStatus;
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsenceRequestRepository;
+use App\Service\AbsenceBalanceService;
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'review-absence-request', description: 'Approve or reject a PENDING absence request (admin). decision = "approve" or "reject"; rejectionReason is required when rejecting. Approving moves the days from pending to taken; rejecting releases the reserved days.')]
+class ReviewAbsenceRequestTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly AbsenceRequestRepository $requestRepository,
+        private readonly AbsenceBalanceService $balanceService,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id, string $decision, ?string $rejectionReason = null): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        if (!in_array($decision, ['approve', 'reject'], true)) {
+            throw new InvalidArgumentException('decision must be "approve" or "reject".');
+        }
+
+        $request = $this->requestRepository->find($id);
+        if (null === $request) {
+            throw new InvalidArgumentException(sprintf('AbsenceRequest with ID %d not found.', $id));
+        }
+
+        if (AbsenceStatus::Pending !== $request->getStatus()) {
+            throw new InvalidArgumentException('Only a pending request can be reviewed.');
+        }
+
+        $admin = $this->security->getUser();
+        \assert($admin instanceof User);
+
+        if ('approve' === $decision) {
+            $request->setStatus(AbsenceStatus::Approved);
+            $request->setRejectionReason(null);
+            $this->balanceService->applyApproval($request);
+        } else {
+            if (null === $rejectionReason || '' === trim($rejectionReason)) {
+                throw new InvalidArgumentException('A reason is required when rejecting a request.');
+            }
+            $request->setStatus(AbsenceStatus::Rejected);
+            $request->setRejectionReason($rejectionReason);
+            $this->balanceService->release($request, false);
+        }
+
+        $request->setReviewedAt(new DateTimeImmutable());
+        $request->setReviewedBy($admin);
+
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::absenceRequest($request));
+    }
+}
+```
+
+- [ ] **Step 4 : Relancer — passe**
+
+Run: `docker exec php-lesstime-fpm php bin/phpunit tests/Functional/Mcp/AbsenceRequestLifecycleTest.php`
+Expected: PASS (2 tests).
+
+- [ ] **Step 5 : Commit**
+
+```bash
+git add src/Mcp/Tool/Absence/ReviewAbsenceRequestTool.php tests/Functional/Mcp/AbsenceRequestLifecycleTest.php
+git commit -m "feat(mcp) : outil review-absence-request (approve/reject)"
+```
+
+---
+
+### Task 7 : `cancel-absence-request` + `delete-absence-request`
+
+**Files:**
+- Create: `src/Mcp/Tool/Absence/CancelAbsenceRequestTool.php`
+- Create: `src/Mcp/Tool/Absence/DeleteAbsenceRequestTool.php`
+- Modify: `tests/Functional/Mcp/AbsenceRequestLifecycleTest.php`
+
+- [ ] **Step 1 : Ajouter le test d'annulation d'une demande approuvée (admin) — échoue d'abord**
+
+```php
+    private function cancelTool(User $actor): \App\Mcp\Tool\Absence\CancelAbsenceRequestTool
+    {
+        $c = self::getContainer();
+
+        return new \App\Mcp\Tool\Absence\CancelAbsenceRequestTool(
+            $c->get(EntityManagerInterface::class),
+            $c->get(\App\Repository\AbsenceRequestRepository::class),
+            $c->get(\App\Service\AbsenceBalanceService::class),
+            $this->securityFor($actor),
+        );
+    }
+
+    public function testAdminCancelApprovedReleasesTaken(): void
+    {
+        $created = json_decode(
+            ($this->createTool($this->admin))($this->employee->getId(), 'cp', '2026-06-01', '2026-06-05'),
+            true,
+        );
+        ($this->reviewTool($this->admin))($created['id'], 'approve');
+
+        $data = json_decode(($this->cancelTool($this->admin))($created['id']), true);
+        self::assertSame('cancelled', $data['status']);
+
+        $balance = self::getContainer()->get(AbsenceBalanceRepository::class)
+            ->findOneForPeriod($this->employee, AbsenceType::PaidLeave, '2026-2027');
+        self::assertSame(0.0, $balance->getTaken());
+        self::assertSame(0.0, $balance->getPending());
+    }
+```
+
+- [ ] **Step 2 : Lancer — échoue (classe absente)**
+
+Run: `docker exec php-lesstime-fpm php bin/phpunit tests/Functional/Mcp/AbsenceRequestLifecycleTest.php --filter testAdminCancel`
+Expected: FAIL — `CancelAbsenceRequestTool` not found.
+
+- [ ] **Step 3 : Créer `CancelAbsenceRequestTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Enum\AbsenceStatus;
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsenceRequestRepository;
+use App\Service\AbsenceBalanceService;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'cancel-absence-request', description: 'Cancel an absence request. A PENDING request releases its reserved days; an APPROVED request can only be cancelled by an admin and credits the taken days back. Already cancelled/rejected requests cannot be cancelled.')]
+class CancelAbsenceRequestTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly AbsenceRequestRepository $requestRepository,
+        private readonly AbsenceBalanceService $balanceService,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $request = $this->requestRepository->find($id);
+        if (null === $request) {
+            throw new InvalidArgumentException(sprintf('AbsenceRequest with ID %d not found.', $id));
+        }
+
+        $isAdmin = $this->security->isGranted('ROLE_ADMIN');
+        $status  = $request->getStatus();
+
+        if (AbsenceStatus::Pending === $status) {
+            $this->balanceService->release($request, false);
+        } elseif (AbsenceStatus::Approved === $status) {
+            if (!$isAdmin) {
+                throw new AccessDeniedException('Only an admin can cancel an approved request.');
+            }
+            $this->balanceService->release($request, true);
+        } else {
+            throw new InvalidArgumentException('This request can no longer be cancelled.');
+        }
+
+        $request->setStatus(AbsenceStatus::Cancelled);
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::absenceRequest($request));
+    }
+}
+```
+
+> Note : en MCP, l'acteur est le propriétaire du token (souvent admin), donc on ne réplique pas le contrôle « only your own request » du Processor (pas de notion d'employé courant ici). L'annulation d'une PENDING par token non-admin reste autorisée, ce qui est cohérent avec un usage d'administration.
+
+- [ ] **Step 4 : Créer `DeleteAbsenceRequestTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Repository\AbsenceRequestRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-absence-request', description: 'Permanently delete an absence request (admin). Does not adjust balances — use cancel-absence-request first if the days must be credited back.')]
+class DeleteAbsenceRequestTool
+{
+    public function __construct(
+        private readonly AbsenceRequestRepository $requestRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $request = $this->requestRepository->find($id);
+        if (null === $request) {
+            throw new InvalidArgumentException(sprintf('AbsenceRequest with ID %d not found.', $id));
+        }
+
+        $this->entityManager->remove($request);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('AbsenceRequest %d deleted.', $id)]);
+    }
+}
+```
+
+- [ ] **Step 5 : Lancer toute la suite — passe**
+
+Run: `docker exec php-lesstime-fpm php bin/phpunit tests/Functional/Mcp/AbsenceRequestLifecycleTest.php`
+Expected: PASS (3 tests).
+
+- [ ] **Step 6 : Commit**
+
+```bash
+git add src/Mcp/Tool/Absence/CancelAbsenceRequestTool.php src/Mcp/Tool/Absence/DeleteAbsenceRequestTool.php tests/Functional/Mcp/AbsenceRequestLifecycleTest.php
+git commit -m "feat(mcp) : outils cancel/delete absence-request"
+```
+
+---
+
+## JALON 2 — Trous CRUD : projets, groupes, métadonnées de tâches
+
+### Task 8 : `delete-project` + `delete-group`
+
+**Files:**
+- Create: `src/Mcp/Tool/Project/DeleteProjectTool.php`
+- Create: `src/Mcp/Tool/TaskMeta/DeleteGroupTool.php`
+
+- [ ] **Step 1 : Créer `DeleteProjectTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Project;
+
+use App\Repository\ProjectRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-project', description: 'Permanently delete a project and all its tasks (admin). Irreversible.')]
+class DeleteProjectTool
+{
+    public function __construct(
+        private readonly ProjectRepository $projectRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $project = $this->projectRepository->find($id);
+        if (null === $project) {
+            throw new InvalidArgumentException(sprintf('Project with ID %d not found.', $id));
+        }
+
+        $name = $project->getName();
+        $this->entityManager->remove($project);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Project "%s" deleted.', $name)]);
+    }
+}
+```
+
+- [ ] **Step 2 : Créer `DeleteGroupTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskGroupRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-group', description: 'Delete a task group. Tasks in the group are not deleted; they become ungrouped.')]
+class DeleteGroupTool
+{
+    public function __construct(
+        private readonly TaskGroupRepository $taskGroupRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $group = $this->taskGroupRepository->find($id);
+        if (null === $group) {
+            throw new InvalidArgumentException(sprintf('TaskGroup with ID %d not found.', $id));
+        }
+
+        $title = $group->getTitle();
+        $this->entityManager->remove($group);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Group "%s" deleted.', $title)]);
+    }
+}
+```
+
+> ⚠️ Vérifier le comportement de suppression de groupe : si la relation `Task.group` n'a pas `onDelete: SET NULL`, Doctrine lèvera une contrainte FK. Étape de vérification ci-dessous.
+
+- [ ] **Step 3 : Vérifier la contrainte FK sur Task.group**
+
+Run: `grep -nA3 "private.*TaskGroup .group\|class.*group" src/Entity/Task.php | grep -i "joincolumn\|ondelete"`
+Si aucune règle `onDelete: 'SET NULL'` n'apparaît et que la colonne est nullable, le `remove` peut échouer tant que des tâches référencent le groupe. Dans ce cas, dans `DeleteGroupTool::__invoke`, avant `remove`, dissocier les tâches :
+
+```php
+        foreach ($group->getTasks() as $task) {
+            $task->setGroup(null);
+        }
+```
+
+(N'ajouter ce bloc que si `Task` expose `getTasks()` côté groupe — sinon ignorer car la BDD gère déjà `SET NULL`.)
+
+- [ ] **Step 4 : Lint**
+
+Run: `docker exec php-lesstime-fpm php -l src/Mcp/Tool/Project/DeleteProjectTool.php && docker exec php-lesstime-fpm php -l src/Mcp/Tool/TaskMeta/DeleteGroupTool.php`
+Expected: `No syntax errors detected` ×2
+
+- [ ] **Step 5 : Commit**
+
+```bash
+git add src/Mcp/Tool/Project/DeleteProjectTool.php src/Mcp/Tool/TaskMeta/DeleteGroupTool.php
+git commit -m "feat(mcp) : outils delete-project et delete-group"
+```
+
+---
+
+### Task 9 : CRUD `tag` — `create-tag`, `update-tag`, `delete-tag`
+
+**Files:**
+- Create: `src/Mcp/Tool/TaskMeta/CreateTagTool.php`
+- Create: `src/Mcp/Tool/TaskMeta/UpdateTagTool.php`
+- Create: `src/Mcp/Tool/TaskMeta/DeleteTagTool.php`
+
+Helper de sortie : réutiliser `Serializer::tagsWithColor` n'accepte qu'une Collection ; pour un tag unique, renvoyer un tableau inline `['id' => ..., 'label' => ..., 'color' => ...]`.
+
+- [ ] **Step 1 : Créer `CreateTagTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Entity\TaskTag;
+use Doctrine\ORM\EntityManagerInterface;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+#[McpTool(name: 'create-tag', description: 'Create a global task tag. Tags are shared across all projects.')]
+class CreateTagTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(string $label, ?string $color = null): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $tag = new TaskTag();
+        $tag->setLabel($label);
+        if (null !== $color) {
+            $tag->setColor($color);
+        }
+
+        $this->entityManager->persist($tag);
+        $this->entityManager->flush();
+
+        return json_encode(['id' => $tag->getId(), 'label' => $tag->getLabel(), 'color' => $tag->getColor()]);
+    }
+}
+```
+
+- [ ] **Step 2 : Créer `UpdateTagTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskTagRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-tag', description: 'Update a task tag. Only provided fields change.')]
+class UpdateTagTool
+{
+    public function __construct(
+        private readonly TaskTagRepository $tagRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id, ?string $label = null, ?string $color = null): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $tag = $this->tagRepository->find($id);
+        if (null === $tag) {
+            throw new InvalidArgumentException(sprintf('TaskTag with ID %d not found.', $id));
+        }
+
+        if (null !== $label) {
+            $tag->setLabel($label);
+        }
+        if (null !== $color) {
+            $tag->setColor($color);
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode(['id' => $tag->getId(), 'label' => $tag->getLabel(), 'color' => $tag->getColor()]);
+    }
+}
+```
+
+- [ ] **Step 3 : Créer `DeleteTagTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskTagRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-tag', description: 'Delete a global task tag. It is removed from all tasks that use it.')]
+class DeleteTagTool
+{
+    public function __construct(
+        private readonly TaskTagRepository $tagRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $tag = $this->tagRepository->find($id);
+        if (null === $tag) {
+            throw new InvalidArgumentException(sprintf('TaskTag with ID %d not found.', $id));
+        }
+
+        $label = $tag->getLabel();
+        $this->entityManager->remove($tag);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Tag "%s" deleted.', $label)]);
+    }
+}
+```
+
+- [ ] **Step 4 : Lint les 3 fichiers**
+
+Run: `for f in Create Update Delete; do docker exec php-lesstime-fpm php -l src/Mcp/Tool/TaskMeta/${f}TagTool.php; done`
+Expected: `No syntax errors detected` ×3
+
+- [ ] **Step 5 : Commit**
+
+```bash
+git add src/Mcp/Tool/TaskMeta/CreateTagTool.php src/Mcp/Tool/TaskMeta/UpdateTagTool.php src/Mcp/Tool/TaskMeta/DeleteTagTool.php
+git commit -m "feat(mcp) : CRUD tag"
+```
+
+---
+
+### Task 10 : CRUD `effort` — `create-effort`, `update-effort`, `delete-effort`
+
+`TaskEffort` n'a qu'un champ `label` (length 50), pas de couleur.
+
+**Files:**
+- Create: `src/Mcp/Tool/TaskMeta/CreateEffortTool.php`
+- Create: `src/Mcp/Tool/TaskMeta/UpdateEffortTool.php`
+- Create: `src/Mcp/Tool/TaskMeta/DeleteEffortTool.php`
+
+- [ ] **Step 1 : Créer `CreateEffortTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Entity\TaskEffort;
+use Doctrine\ORM\EntityManagerInterface;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+#[McpTool(name: 'create-effort', description: 'Create a global task effort level (label only).')]
+class CreateEffortTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(string $label): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $effort = new TaskEffort();
+        $effort->setLabel($label);
+        $this->entityManager->persist($effort);
+        $this->entityManager->flush();
+
+        return json_encode(['id' => $effort->getId(), 'label' => $effort->getLabel()]);
+    }
+}
+```
+
+- [ ] **Step 2 : Créer `UpdateEffortTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskEffortRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-effort', description: 'Rename a task effort level.')]
+class UpdateEffortTool
+{
+    public function __construct(
+        private readonly TaskEffortRepository $effortRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id, string $label): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $effort = $this->effortRepository->find($id);
+        if (null === $effort) {
+            throw new InvalidArgumentException(sprintf('TaskEffort with ID %d not found.', $id));
+        }
+
+        $effort->setLabel($label);
+        $this->entityManager->flush();
+
+        return json_encode(['id' => $effort->getId(), 'label' => $effort->getLabel()]);
+    }
+}
+```
+
+- [ ] **Step 3 : Créer `DeleteEffortTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskEffortRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-effort', description: 'Delete a task effort level.')]
+class DeleteEffortTool
+{
+    public function __construct(
+        private readonly TaskEffortRepository $effortRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $effort = $this->effortRepository->find($id);
+        if (null === $effort) {
+            throw new InvalidArgumentException(sprintf('TaskEffort with ID %d not found.', $id));
+        }
+
+        $label = $effort->getLabel();
+        $this->entityManager->remove($effort);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Effort "%s" deleted.', $label)]);
+    }
+}
+```
+
+- [ ] **Step 4 : Lint**
+
+Run: `for f in Create Update Delete; do docker exec php-lesstime-fpm php -l src/Mcp/Tool/TaskMeta/${f}EffortTool.php; done`
+Expected: `No syntax errors detected` ×3
+
+- [ ] **Step 5 : Commit**
+
+```bash
+git add src/Mcp/Tool/TaskMeta/CreateEffortTool.php src/Mcp/Tool/TaskMeta/UpdateEffortTool.php src/Mcp/Tool/TaskMeta/DeleteEffortTool.php
+git commit -m "feat(mcp) : CRUD effort"
+```
+
+---
+
+### Task 11 : CRUD `priority` — `create-priority`, `update-priority`, `delete-priority`
+
+`TaskPriority` a `label` + `color`. Mêmes formes que les tags.
+
+**Files:**
+- Create: `src/Mcp/Tool/TaskMeta/CreatePriorityTool.php`
+- Create: `src/Mcp/Tool/TaskMeta/UpdatePriorityTool.php`
+- Create: `src/Mcp/Tool/TaskMeta/DeletePriorityTool.php`
+
+- [ ] **Step 1 : Créer `CreatePriorityTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Entity\TaskPriority;
+use Doctrine\ORM\EntityManagerInterface;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+#[McpTool(name: 'create-priority', description: 'Create a global task priority (label + color).')]
+class CreatePriorityTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(string $label, ?string $color = null): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $priority = new TaskPriority();
+        $priority->setLabel($label);
+        if (null !== $color) {
+            $priority->setColor($color);
+        }
+        $this->entityManager->persist($priority);
+        $this->entityManager->flush();
+
+        return json_encode(['id' => $priority->getId(), 'label' => $priority->getLabel(), 'color' => $priority->getColor()]);
+    }
+}
+```
+
+- [ ] **Step 2 : Créer `UpdatePriorityTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskPriorityRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-priority', description: 'Update a task priority. Only provided fields change.')]
+class UpdatePriorityTool
+{
+    public function __construct(
+        private readonly TaskPriorityRepository $priorityRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id, ?string $label = null, ?string $color = null): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $priority = $this->priorityRepository->find($id);
+        if (null === $priority) {
+            throw new InvalidArgumentException(sprintf('TaskPriority with ID %d not found.', $id));
+        }
+
+        if (null !== $label) {
+            $priority->setLabel($label);
+        }
+        if (null !== $color) {
+            $priority->setColor($color);
+        }
+        $this->entityManager->flush();
+
+        return json_encode(['id' => $priority->getId(), 'label' => $priority->getLabel(), 'color' => $priority->getColor()]);
+    }
+}
+```
+
+- [ ] **Step 3 : Créer `DeletePriorityTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskPriorityRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-priority', description: 'Delete a task priority.')]
+class DeletePriorityTool
+{
+    public function __construct(
+        private readonly TaskPriorityRepository $priorityRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $priority = $this->priorityRepository->find($id);
+        if (null === $priority) {
+            throw new InvalidArgumentException(sprintf('TaskPriority with ID %d not found.', $id));
+        }
+
+        $label = $priority->getLabel();
+        $this->entityManager->remove($priority);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Priority "%s" deleted.', $label)]);
+    }
+}
+```
+
+- [ ] **Step 4 : Lint**
+
+Run: `for f in Create Update Delete; do docker exec php-lesstime-fpm php -l src/Mcp/Tool/TaskMeta/${f}PriorityTool.php; done`
+Expected: `No syntax errors detected` ×3
+
+- [ ] **Step 5 : Commit**
+
+```bash
+git add src/Mcp/Tool/TaskMeta/CreatePriorityTool.php src/Mcp/Tool/TaskMeta/UpdatePriorityTool.php src/Mcp/Tool/TaskMeta/DeletePriorityTool.php
+git commit -m "feat(mcp) : CRUD priority"
+```
+
+---
+
+### Task 12 : CRUD `status` (couplé au workflow)
+
+`TaskStatus` appartient à un `Workflow` (`workflow` non nullable) et porte une `category` (`StatusCategory`: todo|in_progress|blocked|review|done), `label`, `color` (défaut `#222783`), `position`, `isFinal`.
+
+**Files:**
+- Create: `src/Mcp/Tool/TaskMeta/CreateStatusTool.php`
+- Create: `src/Mcp/Tool/TaskMeta/UpdateStatusTool.php`
+- Create: `src/Mcp/Tool/TaskMeta/DeleteStatusTool.php`
+
+- [ ] **Step 1 : Créer `CreateStatusTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Entity\TaskStatus;
+use App\Enum\StatusCategory;
+use App\Repository\WorkflowRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'create-status', description: 'Create a task status inside a workflow (admin). Statuses are NOT global: each belongs to a workflow (use list-workflows for IDs). category = todo|in_progress|blocked|review|done.')]
+class CreateStatusTool
+{
+    public function __construct(
+        private readonly WorkflowRepository $workflowRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $workflowId,
+        string $label,
+        string $category,
+        ?string $color = null,
+        ?int $position = null,
+        ?bool $isFinal = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $workflow = $this->workflowRepository->find($workflowId);
+        if (null === $workflow) {
+            throw new InvalidArgumentException(sprintf('Workflow with ID %d not found.', $workflowId));
+        }
+
+        $categoryEnum = StatusCategory::tryFrom($category)
+            ?? throw new InvalidArgumentException(sprintf('Unknown status category "%s".', $category));
+
+        $status = new TaskStatus();
+        $status->setWorkflow($workflow);
+        $status->setLabel($label);
+        $status->setCategory($categoryEnum);
+        if (null !== $color) {
+            $status->setColor($color);
+        }
+        if (null !== $position) {
+            $status->setPosition($position);
+        }
+        if (null !== $isFinal) {
+            $status->setIsFinal($isFinal);
+        }
+
+        $this->entityManager->persist($status);
+        $this->entityManager->flush();
+
+        return json_encode([
+            'id'         => $status->getId(),
+            'label'      => $status->getLabel(),
+            'color'      => $status->getColor(),
+            'position'   => $status->getPosition(),
+            'isFinal'    => $status->getIsFinal(),
+            'category'   => $status->getCategory()->value,
+            'workflowId' => $workflow->getId(),
+        ]);
+    }
+}
+```
+
+> Vérifier les noms exacts des setters de `TaskStatus` (`setCategory`, `setIsFinal`, `setPosition`, `setColor`, `setWorkflow`) avec : `grep -nE "public function set" src/Entity/TaskStatus.php`. Ajuster si l'un diffère.
+
+- [ ] **Step 2 : Créer `UpdateStatusTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Enum\StatusCategory;
+use App\Repository\TaskStatusRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-status', description: 'Update a task status (admin). Only provided fields change. category = todo|in_progress|blocked|review|done.')]
+class UpdateStatusTool
+{
+    public function __construct(
+        private readonly TaskStatusRepository $statusRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $id,
+        ?string $label = null,
+        ?string $category = null,
+        ?string $color = null,
+        ?int $position = null,
+        ?bool $isFinal = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $status = $this->statusRepository->find($id);
+        if (null === $status) {
+            throw new InvalidArgumentException(sprintf('TaskStatus with ID %d not found.', $id));
+        }
+
+        if (null !== $label) {
+            $status->setLabel($label);
+        }
+        if (null !== $category) {
+            $status->setCategory(
+                StatusCategory::tryFrom($category)
+                    ?? throw new InvalidArgumentException(sprintf('Unknown status category "%s".', $category)),
+            );
+        }
+        if (null !== $color) {
+            $status->setColor($color);
+        }
+        if (null !== $position) {
+            $status->setPosition($position);
+        }
+        if (null !== $isFinal) {
+            $status->setIsFinal($isFinal);
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode([
+            'id'         => $status->getId(),
+            'label'      => $status->getLabel(),
+            'color'      => $status->getColor(),
+            'position'   => $status->getPosition(),
+            'isFinal'    => $status->getIsFinal(),
+            'category'   => $status->getCategory()->value,
+            'workflowId' => $status->getWorkflow()?->getId(),
+        ]);
+    }
+}
+```
+
+- [ ] **Step 3 : Créer `DeleteStatusTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskStatusRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-status', description: 'Delete a task status from its workflow (admin). Fails at the database level if tasks still use it.')]
+class DeleteStatusTool
+{
+    public function __construct(
+        private readonly TaskStatusRepository $statusRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $status = $this->statusRepository->find($id);
+        if (null === $status) {
+            throw new InvalidArgumentException(sprintf('TaskStatus with ID %d not found.', $id));
+        }
+
+        $label = $status->getLabel();
+        $this->entityManager->remove($status);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Status "%s" deleted.', $label)]);
+    }
+}
+```
+
+- [ ] **Step 4 : Lint**
+
+Run: `for f in Create Update Delete; do docker exec php-lesstime-fpm php -l src/Mcp/Tool/TaskMeta/${f}StatusTool.php; done`
+Expected: `No syntax errors detected` ×3
+
+- [ ] **Step 5 : Commit**
+
+```bash
+git add src/Mcp/Tool/TaskMeta/CreateStatusTool.php src/Mcp/Tool/TaskMeta/UpdateStatusTool.php src/Mcp/Tool/TaskMeta/DeleteStatusTool.php
+git commit -m "feat(mcp) : CRUD status (couplé workflow)"
+```
+
+---
+
+## JALON 3 — Clients, users, documentation
+
+### Task 13 : CRUD `client` — `get/create/update/delete-client`
+
+**Files:**
+- Create: `src/Mcp/Tool/Reference/GetClientTool.php`
+- Create: `src/Mcp/Tool/Reference/CreateClientTool.php`
+- Create: `src/Mcp/Tool/Reference/UpdateClientTool.php`
+- Create: `src/Mcp/Tool/Reference/DeleteClientTool.php`
+
+- [ ] **Step 1 : Créer `GetClientTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Reference;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\ClientRepository;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'get-client', description: 'Get a client by ID with full contact details.')]
+class GetClientTool
+{
+    public function __construct(
+        private readonly ClientRepository $clientRepository,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $client = $this->clientRepository->find($id);
+        if (null === $client) {
+            throw new InvalidArgumentException(sprintf('Client with ID %d not found.', $id));
+        }
+
+        return json_encode(Serializer::client($client));
+    }
+}
+```
+
+- [ ] **Step 2 : Créer `CreateClientTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Reference;
+
+use App\Entity\Client;
+use App\Mcp\Tool\Serializer;
+use Doctrine\ORM\EntityManagerInterface;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+#[McpTool(name: 'create-client', description: 'Create a client (admin). Only name is required.')]
+class CreateClientTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        string $name,
+        ?string $email = null,
+        ?string $phone = null,
+        ?string $street = null,
+        ?string $city = null,
+        ?string $postalCode = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $client = new Client();
+        $client->setName($name);
+        $client->setEmail($email);
+        $client->setPhone($phone);
+        $client->setStreet($street);
+        $client->setCity($city);
+        $client->setPostalCode($postalCode);
+
+        $this->entityManager->persist($client);
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::client($client));
+    }
+}
+```
+
+- [ ] **Step 3 : Créer `UpdateClientTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Reference;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\ClientRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-client', description: 'Update a client (admin). Only provided fields change.')]
+class UpdateClientTool
+{
+    public function __construct(
+        private readonly ClientRepository $clientRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $id,
+        ?string $name = null,
+        ?string $email = null,
+        ?string $phone = null,
+        ?string $street = null,
+        ?string $city = null,
+        ?string $postalCode = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $client = $this->clientRepository->find($id);
+        if (null === $client) {
+            throw new InvalidArgumentException(sprintf('Client with ID %d not found.', $id));
+        }
+
+        if (null !== $name) {
+            $client->setName($name);
+        }
+        if (null !== $email) {
+            $client->setEmail($email);
+        }
+        if (null !== $phone) {
+            $client->setPhone($phone);
+        }
+        if (null !== $street) {
+            $client->setStreet($street);
+        }
+        if (null !== $city) {
+            $client->setCity($city);
+        }
+        if (null !== $postalCode) {
+            $client->setPostalCode($postalCode);
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::client($client));
+    }
+}
+```
+
+- [ ] **Step 4 : Créer `DeleteClientTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Reference;
+
+use App\Repository\ClientRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-client', description: 'Delete a client (admin). Fails if the client still has projects attached.')]
+class DeleteClientTool
+{
+    public function __construct(
+        private readonly ClientRepository $clientRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $client = $this->clientRepository->find($id);
+        if (null === $client) {
+            throw new InvalidArgumentException(sprintf('Client with ID %d not found.', $id));
+        }
+
+        $name = $client->getName();
+        $this->entityManager->remove($client);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Client "%s" deleted.', $name)]);
+    }
+}
+```
+
+- [ ] **Step 5 : Lint**
+
+Run: `for f in Get Create Update Delete; do docker exec php-lesstime-fpm php -l src/Mcp/Tool/Reference/${f}ClientTool.php; done`
+Expected: `No syntax errors detected` ×4
+
+- [ ] **Step 6 : Commit**
+
+```bash
+git add src/Mcp/Tool/Reference/GetClientTool.php src/Mcp/Tool/Reference/CreateClientTool.php src/Mcp/Tool/Reference/UpdateClientTool.php src/Mcp/Tool/Reference/DeleteClientTool.php
+git commit -m "feat(mcp) : CRUD client"
+```
+
+---
+
+### Task 14 : `get-user` + `update-user` (champs RH/profil)
+
+Pas de création ni de gestion mot de passe/rôles (décision utilisateur).
+
+**Files:**
+- Create: `src/Mcp/Tool/Reference/GetUserTool.php`
+- Create: `src/Mcp/Tool/Reference/UpdateUserTool.php`
+
+- [ ] **Step 1 : Créer `GetUserTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Reference;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\UserRepository;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'get-user', description: 'Get a user by ID with full HR profile (employee flag, hire/end date, contract, work-time ratio, leave entitlement, reference period, family situation).')]
+class GetUserTool
+{
+    public function __construct(
+        private readonly UserRepository $userRepository,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $user = $this->userRepository->find($id);
+        if (null === $user) {
+            throw new InvalidArgumentException(sprintf('User with ID %d not found.', $id));
+        }
+
+        return json_encode(Serializer::userFull($user));
+    }
+}
+```
+
+- [ ] **Step 2 : Créer `UpdateUserTool`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Reference;
+
+use App\Enum\ContractType;
+use App\Enum\FamilySituation;
+use App\Mcp\Tool\Serializer;
+use App\Repository\UserRepository;
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-user', description: 'Update a user HR/profile fields (admin). Does NOT change password or roles. contractType = CDI|CDD|STAGE|ALTERNANCE|AUTRE. familySituation = CELIBATAIRE|MARIE|PACSE|DIVORCE|VEUF. hireDate/endDate as YYYY-MM-DD. referencePeriodStart as MM-DD (e.g. 06-01).')]
+class UpdateUserTool
+{
+    public function __construct(
+        private readonly UserRepository $userRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $id,
+        ?bool $isEmployee = null,
+        ?string $hireDate = null,
+        ?string $endDate = null,
+        ?string $contractType = null,
+        ?float $workTimeRatio = null,
+        ?float $annualLeaveDays = null,
+        ?string $referencePeriodStart = null,
+        ?float $initialLeaveBalance = null,
+        ?string $familySituation = null,
+        ?int $nbChildren = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $user = $this->userRepository->find($id);
+        if (null === $user) {
+            throw new InvalidArgumentException(sprintf('User with ID %d not found.', $id));
+        }
+
+        if (null !== $isEmployee) {
+            $user->setIsEmployee($isEmployee);
+        }
+        if (null !== $hireDate) {
+            $user->setHireDate(new DateTimeImmutable($hireDate));
+        }
+        if (null !== $endDate) {
+            $user->setEndDate(new DateTimeImmutable($endDate));
+        }
+        if (null !== $contractType) {
+            $user->setContractType(
+                ContractType::tryFrom($contractType)
+                    ?? throw new InvalidArgumentException(sprintf('Unknown contract type "%s".', $contractType)),
+            );
+        }
+        if (null !== $workTimeRatio) {
+            $user->setWorkTimeRatio($workTimeRatio);
+        }
+        if (null !== $annualLeaveDays) {
+            $user->setAnnualLeaveDays($annualLeaveDays);
+        }
+        if (null !== $referencePeriodStart) {
+            $user->setReferencePeriodStart($referencePeriodStart);
+        }
+        if (null !== $initialLeaveBalance) {
+            $user->setInitialLeaveBalance($initialLeaveBalance);
+        }
+        if (null !== $familySituation) {
+            $user->setFamilySituation(
+                FamilySituation::tryFrom($familySituation)
+                    ?? throw new InvalidArgumentException(sprintf('Unknown family situation "%s".', $familySituation)),
+            );
+        }
+        if (null !== $nbChildren) {
+            $user->setNbChildren($nbChildren);
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::userFull($user));
+    }
+}
+```
+
+- [ ] **Step 3 : Lint**
+
+Run: `docker exec php-lesstime-fpm php -l src/Mcp/Tool/Reference/GetUserTool.php && docker exec php-lesstime-fpm php -l src/Mcp/Tool/Reference/UpdateUserTool.php`
+Expected: `No syntax errors detected` ×2
+
+- [ ] **Step 4 : Commit**
+
+```bash
+git add src/Mcp/Tool/Reference/GetUserTool.php src/Mcp/Tool/Reference/UpdateUserTool.php
+git commit -m "feat(mcp) : get-user et update-user (champs RH)"
+```
+
+---
+
+### Task 15 : Mettre à jour les instructions MCP
+
+**Files:**
+- Modify: `config/packages/mcp.yaml`
+
+- [ ] **Step 1 : Corriger/enrichir le bloc `instructions`**
+
+Remplacer la ligne fausse sur les statuts globaux et ajouter le domaine Absences. Dans `config/packages/mcp.yaml`, remplacer :
+
+```
+    Statuses, priorities, efforts, and tags are GLOBAL (shared across all projects).
+    Groups are PER-PROJECT (each group belongs to one project).
+```
+
+par :
+
+```
+    Priorities, efforts, and tags are GLOBAL (shared across all projects).
+    Statuses belong to a WORKFLOW (not global) — use list-workflows and list-statuses
+    to see how they group; create-status requires a workflowId and a category.
+    Groups are PER-PROJECT (each group belongs to one project).
+    Absences: manage employee leave with absence-request tools (list/get/create/review/
+    cancel/delete), absence-policy tools (list/update) and absence-balance tools
+    (list/update). create-absence-request takes an explicit userId to act on behalf of
+    an employee; review/cancel keep the leave balances consistent (pending/taken).
+```
+
+- [ ] **Step 2 : Vérifier le YAML + cache**
+
+Run: `docker exec php-lesstime-fpm php bin/console lint:yaml config/packages/mcp.yaml && docker exec php-lesstime-fpm php bin/console cache:clear`
+Expected: `All 1 YAML files contain valid syntax.` puis cache vidé sans erreur.
+
+- [ ] **Step 3 : Commit**
+
+```bash
+git add config/packages/mcp.yaml
+git commit -m "docs(mcp) : maj instructions (statuts par workflow + domaine absences)"
+```
+
+---
+
+## Vérification finale (après tous les jalons)
+
+- [ ] **Suite de tests complète**
+
+Run: `make test`
+Expected: tous les tests passent, dont `tests/Functional/Mcp/AbsenceRequestLifecycleTest.php` (3 tests).
+
+- [ ] **Code style PHP**
+
+Run: `make php-cs-fixer-allow-risky`
+Expected: fichiers reformatés conformes ; relancer `make test` si des fichiers changent.
+
+- [ ] **Découverte MCP en conditions réelles (STDIO)**
+
+Run: `docker exec -i php-lesstime-fpm php bin/console mcp:server <<< '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'`
+Expected : la réponse JSON liste les nouveaux outils (`create-absence-request`, `review-absence-request`, `delete-project`, `create-status`, `update-user`, etc.).
+
+> ⚠️ Rappel (mémoire projet) : le serveur MCP configuré côté client interroge la **PROD**. Ces outils ne piloteront le module Absences en prod qu'une fois la branche `feat/absence-management` déployée. En local, tester via la commande STDIO ci-dessus contre la base de dev.
+
+---
+
+## Couverture du spec (auto-revue)
+
+| Exigence du spec | Task |
+|---|---|
+| Serializer absences/client/user | 1 |
+| list/update absence-policy | 2 |
+| list/update absence-balance | 3 |
+| list/get absence-request | 4 |
+| create-absence-request (logique métier) | 5 |
+| review-absence-request | 6 |
+| cancel + delete absence-request | 7 |
+| delete-project, delete-group | 8 |
+| CRUD tag | 9 |
+| CRUD effort | 10 |
+| CRUD priority | 11 |
+| CRUD status (workflow + category) | 12 |
+| CRUD client | 13 |
+| get/update user (RH, sans password/roles) | 14 |
+| maj instructions mcp.yaml | 15 |
+
+Hors périmètre confirmé : create-user, password/roles, upload justificatif, mail/bookstack/gitea/zimbra/notifications.
diff --git a/docs/superpowers/specs/2026-05-22-mcp-absence-crud-tools-design.md b/docs/superpowers/specs/2026-05-22-mcp-absence-crud-tools-design.md
new file mode 100644
index 0000000..e3ee771
--- /dev/null
+++ b/docs/superpowers/specs/2026-05-22-mcp-absence-crud-tools-design.md
@@ -0,0 +1,141 @@
+# Spec — Extension des outils MCP : module Absences + trous CRUD
+
+Date : 2026-05-22
+Branche : `feat/absence-management`
+
+## Contexte & objectif
+
+Le serveur MCP Lesstime (`src/Mcp/Tool/`) expose aujourd'hui les projets, tâches,
+métadonnées de tâches, time tracking et workflows. Le nouveau **module Absences**
+(`AbsenceRequest`, `AbsencePolicy`, `AbsenceBalance`) n'est pas exposé, et plusieurs
+entités existantes n'ont qu'une couverture partielle (souvent `list` sans
+create/update/delete).
+
+Objectif : permettre de piloter l'app via MCP (assistant) sur ces domaines, en
+respectant strictement la logique métier déjà en place.
+
+## Conventions reprises de l'existant
+
+- Une classe par outil, attribut `#[McpTool(name, description)]` sur la **classe**.
+- Discovery automatique : `config/packages/mcp.yaml` scanne `src/` (exclut `DataFixtures`).
+  Aucune config à ajouter — créer la classe suffit.
+- Constructeur : injection de repos/services + `Security`.
+- `__invoke(...)` : check de rôle en première ligne (`AccessDeniedException` sinon),
+  validation des IDs (`InvalidArgumentException` si introuvable), retour `json_encode(...)`.
+- Sérialisation centralisée dans `App\Mcp\Tool\Serializer`.
+- Rôle : `ROLE_USER` pour la lecture/écriture courante ; `ROLE_ADMIN` pour les
+  opérations sensibles (déjà le cas pour `list-clients`/`list-users`, et pour les
+  opérations admin du module absences).
+
+## Décision clé — réutilisation de la logique métier (pas les Processors)
+
+Les Processors API Platform (`AbsenceRequestProcessor`, `AbsenceReviewProcessor`,
+`AbsenceCancelProcessor`) sont liés à `Security::getUser()` (l'utilisateur courant)
+et à l'`Operation` HTTP. En MCP, l'utilisateur courant est le **propriétaire du
+token** (admin), or on veut pouvoir agir **au nom d'un employé**.
+
+→ Les outils MCP **n'appellent pas les Processors** ; ils répliquent leur
+orchestration en réutilisant les **services partagés** qui portent la vraie règle
+métier :
+
+- `AbsenceDayCalculator::countWorkingDays(...)` — calcul des jours décomptés.
+- `AbsenceBalanceService` — `reservePending`, `applyApproval`, `release`, `periodFor`.
+- `AbsencePolicyRepository::findOneByType(...)` — politique active du type.
+- `AbsenceRequestRepository::hasOverlap(...)` — règle anti-chevauchement.
+
+`create-absence-request` prend un `userId` explicite (l'employé cible) ;
+`review`/`cancel` posent `reviewedBy` = utilisateur du token MCP.
+
+Ainsi soldes (`pending`/`taken`/`acquired`) et statuts restent cohérents avec ce
+que produit l'UI.
+
+## Inventaire des outils
+
+### Module Absences — `src/Mcp/Tool/Absence/` (10 outils)
+
+| Outil | Rôle | Paramètres | Logique |
+|---|---|---|---|
+| `list-absence-requests` | USER | `userId?`, `status?`, `type?`, `from?`, `to?` | Filtre ; sans `userId` renvoie tout (token admin). |
+| `get-absence-request` | USER | `id` | — |
+| `create-absence-request` | USER | `userId`, `type`, `startDate`, `endDate`, `startHalfDay?`, `endHalfDay?`, `reason?` | Vérifie policy active + overlap, calcule `countedDays`, refuse si ≤ 0, statut `Pending`, `reservePending`. |
+| `review-absence-request` | ADMIN | `id`, `decision` (`approve`\|`reject`), `rejectionReason?` | Seulement si `Pending`. Approve → `applyApproval` ; reject → `rejectionReason` requis + `release(false)`. Pose `reviewedAt`/`reviewedBy`. |
+| `cancel-absence-request` | USER | `id` | `Pending` → `release(false)` ; `Approved` → ADMIN requis + `release(true)` ; sinon conflit. Statut `Cancelled`. |
+| `delete-absence-request` | ADMIN | `id` | Suppression définitive. |
+| `list-absence-policies` | USER | — | Toutes les policies (ordre `type`). |
+| `update-absence-policy` | ADMIN | `id`, `daysPerYear?`, `daysPerEvent?`, `justificationRequired?`, `noticeDays?`, `countWorkingDaysOnly?`, `active?` | Seuls les champs fournis changent. |
+| `list-absence-balances` | USER | `userId?`, `type?`, `period?` | Soldes filtrés. |
+| `update-absence-balance` | ADMIN | `id`, `acquired?`, `acquiring?`, `taken?` | Ajustement manuel (régularisation). |
+
+`type` et `status` acceptés en valeur d'enum string (ex. `cp`, `maladie`,
+`pending`) ; erreur de validation explicite si invalide. `startDate`/`endDate`
+au format `YYYY-MM-DD`.
+
+### Trous CRUD sur l'existant
+
+**Projets / groupes**
+- `delete-project` (ADMIN) — `id`.
+- `delete-group` (USER) — `id`.
+
+**Métadonnées de tâches** — `src/Mcp/Tool/TaskMeta/`
+- `create-tag` / `update-tag` / `delete-tag` (USER) — `label`, `color?`.
+- `create-effort` / `update-effort` / `delete-effort` (USER) — `label` (+ ordre éventuel).
+- `create-priority` / `update-priority` / `delete-priority` (USER) — `label`, `color?`.
+- `create-status` / `update-status` / `delete-status` (ADMIN) — **`workflowId` requis**
+  + `category` (`todo`|`in_progress`|`blocked`|`review`|`done`), `label`, `color?`,
+  `position?`, `isFinal?`. (Les statuts ne sont PAS globaux : ils appartiennent à un workflow.)
+
+**Clients** — `src/Mcp/Tool/Reference/` (ADMIN, aligné sur `list-clients`)
+- `get-client` — `id`.
+- `create-client` — `name` (+ `email?`, `phone?`, `street?`, `city?`, `postalCode?`).
+- `update-client` — `id` + champs optionnels.
+- `delete-client` — `id`.
+
+**Utilisateurs** — `src/Mcp/Tool/Reference/` (ADMIN)
+- `get-user` — `id` (profil complet RH).
+- `update-user` — `id` + champs RH/profil : `isEmployee?`, `hireDate?`, `endDate?`,
+  `contractType?`, `workTimeRatio?`, `annualLeaveDays?`, `referencePeriodStart?`,
+  `initialLeaveBalance?`, `familySituation?`, `nbChildren?`.
+  **Hors périmètre (décision utilisateur) : pas de `create-user`, pas de modification
+  de `password` ni `roles` via MCP.**
+
+## Sérialisation — ajouts à `Serializer.php`
+
+- `absenceRequest(AbsenceRequest)` : id, user{id,username}, type{value,label},
+  startDate, endDate, startHalfDay, endHalfDay, countedDays, reason, status{value,label},
+  rejectionReason, createdAt, reviewedAt, reviewedBy, justificationFileName.
+- `absencePolicy(AbsencePolicy)` : id, type{value,label}, daysPerYear, daysPerEvent,
+  justificationRequired, noticeDays, countWorkingDaysOnly, active.
+- `absenceBalance(AbsenceBalance)` : id, user, type{value,label}, period, acquired,
+  acquiring, taken, pending, acquiredTotal, available.
+- `client(Client)` : id, name, email, phone, street, city, postalCode.
+- `userFull(User)` : id, username, roles, isEmployee, hireDate, endDate, contractType,
+  workTimeRatio, annualLeaveDays, referencePeriodStart, initialLeaveBalance,
+  familySituation, nbChildren.
+
+## Mise à jour de la doc MCP
+
+`config/packages/mcp.yaml` — bloc `instructions` :
+- corriger la mention « statuses … are GLOBAL » (faux : par workflow) ;
+- ajouter une phrase sur le domaine Absences (requests/policies/balances, lifecycle
+  approve/reject/cancel, `userId` pour agir au nom d'un employé).
+
+## Découpage du plan d'implémentation (jalons)
+
+1. **Absences** : Serializer + 10 outils + tests de cohérence des soldes.
+2. **Métadonnées tâches** : delete-project/group, CRUD tag/effort/priority/status.
+3. **Clients & users** : CRUD clients, get/update user + maj `mcp.yaml`.
+
+Chaque jalon est livrable et testable indépendamment.
+
+## Tests
+
+Tests fonctionnels MCP (si une infra de test MCP existe) ou tests unitaires sur la
+réplication de la logique de solde : créer → review(approve) → cancel et vérifier
+`pending`/`taken` à chaque étape ; vérifier le refus sur chevauchement et sur
+plage sans jour ouvré.
+
+## Hors périmètre
+
+- Mail, BookStack, Gitea, Zimbra, Notifications, TaskDocument (non demandés).
+- Création d'utilisateurs et gestion mot de passe/rôles via MCP.
+- Upload de justificatif d'absence via MCP.
diff --git a/src/Mcp/Tool/Absence/CancelAbsenceRequestTool.php b/src/Mcp/Tool/Absence/CancelAbsenceRequestTool.php
new file mode 100644
index 0000000..d946bae
--- /dev/null
+++ b/src/Mcp/Tool/Absence/CancelAbsenceRequestTool.php
@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Enum\AbsenceStatus;
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsenceRequestRepository;
+use App\Service\AbsenceBalanceService;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'cancel-absence-request', description: 'Cancel an absence request. A PENDING request releases its reserved days; an APPROVED request can only be cancelled by an admin and credits the taken days back. Already cancelled/rejected requests cannot be cancelled.')]
+class CancelAbsenceRequestTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly AbsenceRequestRepository $requestRepository,
+        private readonly AbsenceBalanceService $balanceService,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $request = $this->requestRepository->find($id);
+        if (null === $request) {
+            throw new InvalidArgumentException(sprintf('AbsenceRequest with ID %d not found.', $id));
+        }
+
+        $isAdmin = $this->security->isGranted('ROLE_ADMIN');
+        $status  = $request->getStatus();
+
+        if (AbsenceStatus::Pending === $status) {
+            $this->balanceService->release($request, false);
+        } elseif (AbsenceStatus::Approved === $status) {
+            if (!$isAdmin) {
+                throw new AccessDeniedException('Only an admin can cancel an approved request.');
+            }
+            $this->balanceService->release($request, true);
+        } else {
+            throw new InvalidArgumentException('This request can no longer be cancelled.');
+        }
+
+        $request->setStatus(AbsenceStatus::Cancelled);
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::absenceRequest($request));
+    }
+}
diff --git a/src/Mcp/Tool/Absence/CreateAbsenceRequestTool.php b/src/Mcp/Tool/Absence/CreateAbsenceRequestTool.php
new file mode 100644
index 0000000..80d6658
--- /dev/null
+++ b/src/Mcp/Tool/Absence/CreateAbsenceRequestTool.php
@@ -0,0 +1,104 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Entity\AbsenceRequest;
+use App\Enum\AbsenceStatus;
+use App\Enum\AbsenceType;
+use App\Enum\HalfDay;
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsencePolicyRepository;
+use App\Repository\AbsenceRequestRepository;
+use App\Repository\UserRepository;
+use App\Service\AbsenceBalanceService;
+use App\Service\AbsenceDayCalculator;
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'create-absence-request', description: 'Create an absence request on behalf of an employee (userId). Validates active policy + no overlap, computes deducted working days, sets status=pending and reserves the days in the pending balance. type: cp|mariage_pacs|conge_parental|deces|maladie. Dates YYYY-MM-DD. halfDay (matin|apres_midi) on a boundary subtracts 0.5.')]
+class CreateAbsenceRequestTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly UserRepository $userRepository,
+        private readonly AbsencePolicyRepository $policyRepository,
+        private readonly AbsenceRequestRepository $requestRepository,
+        private readonly AbsenceDayCalculator $calculator,
+        private readonly AbsenceBalanceService $balanceService,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $userId,
+        string $type,
+        string $startDate,
+        string $endDate,
+        ?string $startHalfDay = null,
+        ?string $endHalfDay = null,
+        ?string $reason = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $user = $this->userRepository->find($userId)
+            ?? throw new InvalidArgumentException(sprintf('User with ID %d not found.', $userId));
+
+        $typeEnum = AbsenceType::tryFrom($type)
+            ?? throw new InvalidArgumentException(sprintf('Unknown absence type "%s".', $type));
+
+        $start = new DateTimeImmutable($startDate);
+        $end   = new DateTimeImmutable($endDate);
+        if ($end < $start) {
+            throw new InvalidArgumentException('End date must be on or after start date.');
+        }
+
+        $startHd = null !== $startHalfDay
+            ? (HalfDay::tryFrom($startHalfDay) ?? throw new InvalidArgumentException(sprintf('Unknown half day "%s".', $startHalfDay)))
+            : null;
+        $endHd = null !== $endHalfDay
+            ? (HalfDay::tryFrom($endHalfDay) ?? throw new InvalidArgumentException(sprintf('Unknown half day "%s".', $endHalfDay)))
+            : null;
+
+        $policy = $this->policyRepository->findOneByType($typeEnum);
+        if (null === $policy || !$policy->isActive()) {
+            throw new InvalidArgumentException('This absence type is not available.');
+        }
+
+        if ($this->requestRepository->hasOverlap($user, $start, $end)) {
+            throw new InvalidArgumentException('This request overlaps an existing absence.');
+        }
+
+        $countedDays = $this->calculator->countWorkingDays($start, $end, $startHd, $endHd, $policy->isCountWorkingDaysOnly());
+        if ($countedDays <= 0.0) {
+            throw new InvalidArgumentException('The selected range contains no working day.');
+        }
+
+        $request = new AbsenceRequest();
+        $request->setUser($user);
+        $request->setType($typeEnum);
+        $request->setStartDate($start);
+        $request->setEndDate($end);
+        $request->setStartHalfDay($startHd);
+        $request->setEndHalfDay($endHd);
+        $request->setReason($reason);
+        $request->setCountedDays($countedDays);
+        $request->setStatus(AbsenceStatus::Pending);
+        $request->setRejectionReason(null);
+        $request->setCreatedAt(new DateTimeImmutable());
+
+        $this->entityManager->persist($request);
+        $this->balanceService->reservePending($request);
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::absenceRequest($request));
+    }
+}
diff --git a/src/Mcp/Tool/Absence/DeleteAbsenceRequestTool.php b/src/Mcp/Tool/Absence/DeleteAbsenceRequestTool.php
new file mode 100644
index 0000000..2048ba3
--- /dev/null
+++ b/src/Mcp/Tool/Absence/DeleteAbsenceRequestTool.php
@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Repository\AbsenceRequestRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-absence-request', description: 'Permanently delete an absence request (admin). Does not adjust balances — use cancel-absence-request first if the days must be credited back.')]
+class DeleteAbsenceRequestTool
+{
+    public function __construct(
+        private readonly AbsenceRequestRepository $requestRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $request = $this->requestRepository->find($id);
+        if (null === $request) {
+            throw new InvalidArgumentException(sprintf('AbsenceRequest with ID %d not found.', $id));
+        }
+
+        $this->entityManager->remove($request);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('AbsenceRequest %d deleted.', $id)]);
+    }
+}
diff --git a/src/Mcp/Tool/Absence/GetAbsenceRequestTool.php b/src/Mcp/Tool/Absence/GetAbsenceRequestTool.php
new file mode 100644
index 0000000..eb0d2aa
--- /dev/null
+++ b/src/Mcp/Tool/Absence/GetAbsenceRequestTool.php
@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsenceRequestRepository;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'get-absence-request', description: 'Get a single absence request by ID.')]
+class GetAbsenceRequestTool
+{
+    public function __construct(
+        private readonly AbsenceRequestRepository $requestRepository,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $request = $this->requestRepository->find($id);
+        if (null === $request) {
+            throw new InvalidArgumentException(sprintf('AbsenceRequest with ID %d not found.', $id));
+        }
+
+        return json_encode(Serializer::absenceRequest($request));
+    }
+}
diff --git a/src/Mcp/Tool/Absence/ListAbsenceBalancesTool.php b/src/Mcp/Tool/Absence/ListAbsenceBalancesTool.php
new file mode 100644
index 0000000..f0baf6a
--- /dev/null
+++ b/src/Mcp/Tool/Absence/ListAbsenceBalancesTool.php
@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Enum\AbsenceType;
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsenceBalanceRepository;
+use App\Repository\UserRepository;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'list-absence-balances', description: 'List leave balances. Optional filters: userId, type (cp, mariage_pacs, conge_parental, deces, maladie), period (e.g. "2025-2026" or "2025").')]
+class ListAbsenceBalancesTool
+{
+    public function __construct(
+        private readonly AbsenceBalanceRepository $balanceRepository,
+        private readonly UserRepository $userRepository,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(?int $userId = null, ?string $type = null, ?string $period = null): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $criteria = [];
+        if (null !== $userId) {
+            $user = $this->userRepository->find($userId);
+            if (null === $user) {
+                throw new InvalidArgumentException(sprintf('User with ID %d not found.', $userId));
+            }
+            $criteria['user'] = $user;
+        }
+        if (null !== $type) {
+            $criteria['type'] = AbsenceType::tryFrom($type)
+                ?? throw new InvalidArgumentException(sprintf('Unknown absence type "%s".', $type));
+        }
+        if (null !== $period) {
+            $criteria['period'] = $period;
+        }
+
+        $balances = $this->balanceRepository->findBy($criteria, ['period' => 'DESC']);
+
+        return json_encode(array_map(Serializer::absenceBalance(...), $balances));
+    }
+}
diff --git a/src/Mcp/Tool/Absence/ListAbsencePoliciesTool.php b/src/Mcp/Tool/Absence/ListAbsencePoliciesTool.php
new file mode 100644
index 0000000..491aed0
--- /dev/null
+++ b/src/Mcp/Tool/Absence/ListAbsencePoliciesTool.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsencePolicyRepository;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+#[McpTool(name: 'list-absence-policies', description: 'List all absence policies (one per absence type) with their rules: days/year, days/event, notice period, working-days mode, active flag.')]
+class ListAbsencePoliciesTool
+{
+    public function __construct(
+        private readonly AbsencePolicyRepository $policyRepository,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $policies = $this->policyRepository->findBy([], ['type' => 'ASC']);
+
+        return json_encode(array_map(Serializer::absencePolicy(...), $policies));
+    }
+}
diff --git a/src/Mcp/Tool/Absence/ListAbsenceRequestsTool.php b/src/Mcp/Tool/Absence/ListAbsenceRequestsTool.php
new file mode 100644
index 0000000..485f730
--- /dev/null
+++ b/src/Mcp/Tool/Absence/ListAbsenceRequestsTool.php
@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Enum\AbsenceStatus;
+use App\Enum\AbsenceType;
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsenceRequestRepository;
+use App\Repository\UserRepository;
+use DateTimeImmutable;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'list-absence-requests', description: 'List absence requests. Optional filters: userId, status (pending, approved, rejected, cancelled), type (cp, mariage_pacs, conge_parental, deces, maladie), from/to (YYYY-MM-DD, overlap window). Without userId returns all employees.')]
+class ListAbsenceRequestsTool
+{
+    public function __construct(
+        private readonly AbsenceRequestRepository $requestRepository,
+        private readonly UserRepository $userRepository,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        ?int $userId = null,
+        ?string $status = null,
+        ?string $type = null,
+        ?string $from = null,
+        ?string $to = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $user = null;
+        if (null !== $userId) {
+            $user = $this->userRepository->find($userId)
+                ?? throw new InvalidArgumentException(sprintf('User with ID %d not found.', $userId));
+        }
+
+        $statusEnum = null;
+        if (null !== $status) {
+            $statusEnum = AbsenceStatus::tryFrom($status)
+                ?? throw new InvalidArgumentException(sprintf('Unknown status "%s".', $status));
+        }
+
+        $typeEnum = null;
+        if (null !== $type) {
+            $typeEnum = AbsenceType::tryFrom($type)
+                ?? throw new InvalidArgumentException(sprintf('Unknown absence type "%s".', $type));
+        }
+
+        $requests = $this->requestRepository->findFiltered(
+            $user,
+            $statusEnum,
+            $typeEnum,
+            null !== $from ? new DateTimeImmutable($from) : null,
+            null !== $to ? new DateTimeImmutable($to) : null,
+        );
+
+        return json_encode(array_map(Serializer::absenceRequest(...), $requests));
+    }
+}
diff --git a/src/Mcp/Tool/Absence/ReviewAbsenceRequestTool.php b/src/Mcp/Tool/Absence/ReviewAbsenceRequestTool.php
new file mode 100644
index 0000000..3391781
--- /dev/null
+++ b/src/Mcp/Tool/Absence/ReviewAbsenceRequestTool.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Entity\User;
+use App\Enum\AbsenceStatus;
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsenceRequestRepository;
+use App\Service\AbsenceBalanceService;
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function assert;
+use function sprintf;
+
+#[McpTool(name: 'review-absence-request', description: 'Approve or reject a PENDING absence request (admin). decision = "approve" or "reject"; rejectionReason is required when rejecting. Approving moves the days from pending to taken; rejecting releases the reserved days.')]
+class ReviewAbsenceRequestTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly AbsenceRequestRepository $requestRepository,
+        private readonly AbsenceBalanceService $balanceService,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id, string $decision, ?string $rejectionReason = null): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        if (!in_array($decision, ['approve', 'reject'], true)) {
+            throw new InvalidArgumentException('decision must be "approve" or "reject".');
+        }
+
+        $request = $this->requestRepository->find($id);
+        if (null === $request) {
+            throw new InvalidArgumentException(sprintf('AbsenceRequest with ID %d not found.', $id));
+        }
+
+        if (AbsenceStatus::Pending !== $request->getStatus()) {
+            throw new InvalidArgumentException('Only a pending request can be reviewed.');
+        }
+
+        $admin = $this->security->getUser();
+        assert($admin instanceof User);
+
+        if ('approve' === $decision) {
+            $request->setStatus(AbsenceStatus::Approved);
+            $request->setRejectionReason(null);
+            $this->balanceService->applyApproval($request);
+        } else {
+            if (null === $rejectionReason || '' === trim($rejectionReason)) {
+                throw new InvalidArgumentException('A reason is required when rejecting a request.');
+            }
+            $request->setStatus(AbsenceStatus::Rejected);
+            $request->setRejectionReason($rejectionReason);
+            $this->balanceService->release($request, false);
+        }
+
+        $request->setReviewedAt(new DateTimeImmutable());
+        $request->setReviewedBy($admin);
+
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::absenceRequest($request));
+    }
+}
diff --git a/src/Mcp/Tool/Absence/UpdateAbsenceBalanceTool.php b/src/Mcp/Tool/Absence/UpdateAbsenceBalanceTool.php
new file mode 100644
index 0000000..069d764
--- /dev/null
+++ b/src/Mcp/Tool/Absence/UpdateAbsenceBalanceTool.php
@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsenceBalanceRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-absence-balance', description: 'Manually adjust a leave balance (admin regularisation). Only provided buckets change: acquired (N-1), acquiring (N), taken.')]
+class UpdateAbsenceBalanceTool
+{
+    public function __construct(
+        private readonly AbsenceBalanceRepository $balanceRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $id,
+        ?float $acquired = null,
+        ?float $acquiring = null,
+        ?float $taken = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $balance = $this->balanceRepository->find($id);
+        if (null === $balance) {
+            throw new InvalidArgumentException(sprintf('AbsenceBalance with ID %d not found.', $id));
+        }
+
+        if (null !== $acquired) {
+            $balance->setAcquired($acquired);
+        }
+        if (null !== $acquiring) {
+            $balance->setAcquiring($acquiring);
+        }
+        if (null !== $taken) {
+            $balance->setTaken($taken);
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::absenceBalance($balance));
+    }
+}
diff --git a/src/Mcp/Tool/Absence/UpdateAbsencePolicyTool.php b/src/Mcp/Tool/Absence/UpdateAbsencePolicyTool.php
new file mode 100644
index 0000000..7ff6274
--- /dev/null
+++ b/src/Mcp/Tool/Absence/UpdateAbsencePolicyTool.php
@@ -0,0 +1,67 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Absence;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\AbsencePolicyRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-absence-policy', description: 'Update an absence policy (admin). Only provided fields change.')]
+class UpdateAbsencePolicyTool
+{
+    public function __construct(
+        private readonly AbsencePolicyRepository $policyRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $id,
+        ?float $daysPerYear = null,
+        ?float $daysPerEvent = null,
+        ?bool $justificationRequired = null,
+        ?int $noticeDays = null,
+        ?bool $countWorkingDaysOnly = null,
+        ?bool $active = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $policy = $this->policyRepository->find($id);
+        if (null === $policy) {
+            throw new InvalidArgumentException(sprintf('AbsencePolicy with ID %d not found.', $id));
+        }
+
+        if (null !== $daysPerYear) {
+            $policy->setDaysPerYear($daysPerYear);
+        }
+        if (null !== $daysPerEvent) {
+            $policy->setDaysPerEvent($daysPerEvent);
+        }
+        if (null !== $justificationRequired) {
+            $policy->setJustificationRequired($justificationRequired);
+        }
+        if (null !== $noticeDays) {
+            $policy->setNoticeDays($noticeDays);
+        }
+        if (null !== $countWorkingDaysOnly) {
+            $policy->setCountWorkingDaysOnly($countWorkingDaysOnly);
+        }
+        if (null !== $active) {
+            $policy->setActive($active);
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::absencePolicy($policy));
+    }
+}
diff --git a/src/Mcp/Tool/Project/DeleteProjectTool.php b/src/Mcp/Tool/Project/DeleteProjectTool.php
new file mode 100644
index 0000000..ed0f488
--- /dev/null
+++ b/src/Mcp/Tool/Project/DeleteProjectTool.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Project;
+
+use App\Repository\ProjectRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-project', description: 'Permanently delete a project and all its tasks (admin). Irreversible.')]
+class DeleteProjectTool
+{
+    public function __construct(
+        private readonly ProjectRepository $projectRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $project = $this->projectRepository->find($id);
+        if (null === $project) {
+            throw new InvalidArgumentException(sprintf('Project with ID %d not found.', $id));
+        }
+
+        $name = $project->getName();
+        $this->entityManager->remove($project);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Project "%s" deleted.', $name)]);
+    }
+}
diff --git a/src/Mcp/Tool/Reference/CreateClientTool.php b/src/Mcp/Tool/Reference/CreateClientTool.php
new file mode 100644
index 0000000..3218610
--- /dev/null
+++ b/src/Mcp/Tool/Reference/CreateClientTool.php
@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Reference;
+
+use App\Entity\Client;
+use App\Mcp\Tool\Serializer;
+use Doctrine\ORM\EntityManagerInterface;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+#[McpTool(name: 'create-client', description: 'Create a client (admin). Only name is required.')]
+class CreateClientTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        string $name,
+        ?string $email = null,
+        ?string $phone = null,
+        ?string $street = null,
+        ?string $city = null,
+        ?string $postalCode = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $client = new Client();
+        $client->setName($name);
+        $client->setEmail($email);
+        $client->setPhone($phone);
+        $client->setStreet($street);
+        $client->setCity($city);
+        $client->setPostalCode($postalCode);
+
+        $this->entityManager->persist($client);
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::client($client));
+    }
+}
diff --git a/src/Mcp/Tool/Reference/DeleteClientTool.php b/src/Mcp/Tool/Reference/DeleteClientTool.php
new file mode 100644
index 0000000..b3af640
--- /dev/null
+++ b/src/Mcp/Tool/Reference/DeleteClientTool.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Reference;
+
+use App\Repository\ClientRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-client', description: 'Delete a client (admin). Fails if the client still has projects attached.')]
+class DeleteClientTool
+{
+    public function __construct(
+        private readonly ClientRepository $clientRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $client = $this->clientRepository->find($id);
+        if (null === $client) {
+            throw new InvalidArgumentException(sprintf('Client with ID %d not found.', $id));
+        }
+
+        $name = $client->getName();
+        $this->entityManager->remove($client);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Client "%s" deleted.', $name)]);
+    }
+}
diff --git a/src/Mcp/Tool/Reference/GetClientTool.php b/src/Mcp/Tool/Reference/GetClientTool.php
new file mode 100644
index 0000000..163070f
--- /dev/null
+++ b/src/Mcp/Tool/Reference/GetClientTool.php
@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Reference;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\ClientRepository;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'get-client', description: 'Get a client by ID with full contact details.')]
+class GetClientTool
+{
+    public function __construct(
+        private readonly ClientRepository $clientRepository,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $client = $this->clientRepository->find($id);
+        if (null === $client) {
+            throw new InvalidArgumentException(sprintf('Client with ID %d not found.', $id));
+        }
+
+        return json_encode(Serializer::client($client));
+    }
+}
diff --git a/src/Mcp/Tool/Reference/GetUserTool.php b/src/Mcp/Tool/Reference/GetUserTool.php
new file mode 100644
index 0000000..4ef1791
--- /dev/null
+++ b/src/Mcp/Tool/Reference/GetUserTool.php
@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Reference;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\UserRepository;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'get-user', description: 'Get a user by ID with full HR profile (employee flag, hire/end date, contract, work-time ratio, leave entitlement, reference period, family situation).')]
+class GetUserTool
+{
+    public function __construct(
+        private readonly UserRepository $userRepository,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $user = $this->userRepository->find($id);
+        if (null === $user) {
+            throw new InvalidArgumentException(sprintf('User with ID %d not found.', $id));
+        }
+
+        return json_encode(Serializer::userFull($user));
+    }
+}
diff --git a/src/Mcp/Tool/Reference/UpdateClientTool.php b/src/Mcp/Tool/Reference/UpdateClientTool.php
new file mode 100644
index 0000000..fc03cb8
--- /dev/null
+++ b/src/Mcp/Tool/Reference/UpdateClientTool.php
@@ -0,0 +1,67 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Reference;
+
+use App\Mcp\Tool\Serializer;
+use App\Repository\ClientRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-client', description: 'Update a client (admin). Only provided fields change.')]
+class UpdateClientTool
+{
+    public function __construct(
+        private readonly ClientRepository $clientRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $id,
+        ?string $name = null,
+        ?string $email = null,
+        ?string $phone = null,
+        ?string $street = null,
+        ?string $city = null,
+        ?string $postalCode = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $client = $this->clientRepository->find($id);
+        if (null === $client) {
+            throw new InvalidArgumentException(sprintf('Client with ID %d not found.', $id));
+        }
+
+        if (null !== $name) {
+            $client->setName($name);
+        }
+        if (null !== $email) {
+            $client->setEmail($email);
+        }
+        if (null !== $phone) {
+            $client->setPhone($phone);
+        }
+        if (null !== $street) {
+            $client->setStreet($street);
+        }
+        if (null !== $city) {
+            $client->setCity($city);
+        }
+        if (null !== $postalCode) {
+            $client->setPostalCode($postalCode);
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::client($client));
+    }
+}
diff --git a/src/Mcp/Tool/Reference/UpdateUserTool.php b/src/Mcp/Tool/Reference/UpdateUserTool.php
new file mode 100644
index 0000000..8158f23
--- /dev/null
+++ b/src/Mcp/Tool/Reference/UpdateUserTool.php
@@ -0,0 +1,92 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\Reference;
+
+use App\Enum\ContractType;
+use App\Enum\FamilySituation;
+use App\Mcp\Tool\Serializer;
+use App\Repository\UserRepository;
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-user', description: 'Update a user HR/profile fields (admin). Does NOT change password or roles. contractType = CDI|CDD|STAGE|ALTERNANCE|AUTRE. familySituation = CELIBATAIRE|MARIE|PACSE|DIVORCE|VEUF. hireDate/endDate as YYYY-MM-DD. referencePeriodStart as MM-DD (e.g. 06-01).')]
+class UpdateUserTool
+{
+    public function __construct(
+        private readonly UserRepository $userRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $id,
+        ?bool $isEmployee = null,
+        ?string $hireDate = null,
+        ?string $endDate = null,
+        ?string $contractType = null,
+        ?float $workTimeRatio = null,
+        ?float $annualLeaveDays = null,
+        ?string $referencePeriodStart = null,
+        ?float $initialLeaveBalance = null,
+        ?string $familySituation = null,
+        ?int $nbChildren = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $user = $this->userRepository->find($id);
+        if (null === $user) {
+            throw new InvalidArgumentException(sprintf('User with ID %d not found.', $id));
+        }
+
+        if (null !== $isEmployee) {
+            $user->setIsEmployee($isEmployee);
+        }
+        if (null !== $hireDate) {
+            $user->setHireDate(new DateTimeImmutable($hireDate));
+        }
+        if (null !== $endDate) {
+            $user->setEndDate(new DateTimeImmutable($endDate));
+        }
+        if (null !== $contractType) {
+            $user->setContractType(
+                ContractType::tryFrom($contractType)
+                    ?? throw new InvalidArgumentException(sprintf('Unknown contract type "%s".', $contractType)),
+            );
+        }
+        if (null !== $workTimeRatio) {
+            $user->setWorkTimeRatio($workTimeRatio);
+        }
+        if (null !== $annualLeaveDays) {
+            $user->setAnnualLeaveDays($annualLeaveDays);
+        }
+        if (null !== $referencePeriodStart) {
+            $user->setReferencePeriodStart($referencePeriodStart);
+        }
+        if (null !== $initialLeaveBalance) {
+            $user->setInitialLeaveBalance($initialLeaveBalance);
+        }
+        if (null !== $familySituation) {
+            $user->setFamilySituation(
+                FamilySituation::tryFrom($familySituation)
+                    ?? throw new InvalidArgumentException(sprintf('Unknown family situation "%s".', $familySituation)),
+            );
+        }
+        if (null !== $nbChildren) {
+            $user->setNbChildren($nbChildren);
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode(Serializer::userFull($user));
+    }
+}
diff --git a/src/Mcp/Tool/Serializer.php b/src/Mcp/Tool/Serializer.php
index c45d8fd..7f97043 100644
--- a/src/Mcp/Tool/Serializer.php
+++ b/src/Mcp/Tool/Serializer.php
@@ -4,6 +4,10 @@ declare(strict_types=1);
 
 namespace App\Mcp\Tool;
 
+use App\Entity\AbsenceBalance;
+use App\Entity\AbsencePolicy;
+use App\Entity\AbsenceRequest;
+use App\Entity\Client;
 use App\Entity\Project;
 use App\Entity\Task;
 use App\Entity\TaskDocument;
@@ -287,4 +291,106 @@ final class Serializer
             'uploadedBy'   => self::user($doc->getUploadedBy()),
         ])->toArray();
     }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function absenceRequest(AbsenceRequest $r): array
+    {
+        return [
+            'id'                    => $r->getId(),
+            'user'                  => self::user($r->getUser()),
+            'type'                  => $r->getType()?->value,
+            'typeLabel'             => $r->getType()?->label(),
+            'startDate'             => $r->getStartDate()?->format('Y-m-d'),
+            'endDate'               => $r->getEndDate()?->format('Y-m-d'),
+            'startHalfDay'          => $r->getStartHalfDay()?->value,
+            'endHalfDay'            => $r->getEndHalfDay()?->value,
+            'countedDays'           => $r->getCountedDays(),
+            'reason'                => $r->getReason(),
+            'status'                => $r->getStatus()->value,
+            'statusLabel'           => $r->getStatus()->label(),
+            'rejectionReason'       => $r->getRejectionReason(),
+            'justificationFileName' => $r->getJustificationFileName(),
+            'createdAt'             => $r->getCreatedAt()?->format('c'),
+            'reviewedAt'            => $r->getReviewedAt()?->format('c'),
+            'reviewedBy'            => self::user($r->getReviewedBy()),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function absencePolicy(AbsencePolicy $p): array
+    {
+        return [
+            'id'                    => $p->getId(),
+            'type'                  => $p->getType()->value,
+            'typeLabel'             => $p->getType()->label(),
+            'daysPerYear'           => $p->getDaysPerYear(),
+            'daysPerEvent'          => $p->getDaysPerEvent(),
+            'justificationRequired' => $p->isJustificationRequired(),
+            'noticeDays'            => $p->getNoticeDays(),
+            'countWorkingDaysOnly'  => $p->isCountWorkingDaysOnly(),
+            'active'                => $p->isActive(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function absenceBalance(AbsenceBalance $b): array
+    {
+        return [
+            'id'            => $b->getId(),
+            'user'          => self::user($b->getUser()),
+            'type'          => $b->getType()->value,
+            'typeLabel'     => $b->getType()->label(),
+            'period'        => $b->getPeriod(),
+            'acquired'      => $b->getAcquired(),
+            'acquiring'     => $b->getAcquiring(),
+            'taken'         => $b->getTaken(),
+            'pending'       => $b->getPending(),
+            'acquiredTotal' => $b->getAcquiredTotal(),
+            'available'     => $b->getAvailable(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function client(Client $c): array
+    {
+        return [
+            'id'         => $c->getId(),
+            'name'       => $c->getName(),
+            'email'      => $c->getEmail(),
+            'phone'      => $c->getPhone(),
+            'street'     => $c->getStreet(),
+            'city'       => $c->getCity(),
+            'postalCode' => $c->getPostalCode(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function userFull(User $u): array
+    {
+        return [
+            'id'                   => $u->getId(),
+            'username'             => $u->getUsername(),
+            'roles'                => $u->getRoles(),
+            'isEmployee'           => $u->getIsEmployee(),
+            'hireDate'             => $u->getHireDate()?->format('Y-m-d'),
+            'endDate'              => $u->getEndDate()?->format('Y-m-d'),
+            'contractType'         => $u->getContractType()?->value,
+            'workTimeRatio'        => $u->getWorkTimeRatio(),
+            'annualLeaveDays'      => $u->getAnnualLeaveDays(),
+            'referencePeriodStart' => $u->getReferencePeriodStart(),
+            'initialLeaveBalance'  => $u->getInitialLeaveBalance(),
+            'familySituation'      => $u->getFamilySituation()?->value,
+            'nbChildren'           => $u->getNbChildren(),
+        ];
+    }
 }
diff --git a/src/Mcp/Tool/TaskMeta/CreateEffortTool.php b/src/Mcp/Tool/TaskMeta/CreateEffortTool.php
new file mode 100644
index 0000000..5c2fb95
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/CreateEffortTool.php
@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Entity\TaskEffort;
+use Doctrine\ORM\EntityManagerInterface;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+#[McpTool(name: 'create-effort', description: 'Create a global task effort level (label only).')]
+class CreateEffortTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(string $label): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $effort = new TaskEffort();
+        $effort->setLabel($label);
+        $this->entityManager->persist($effort);
+        $this->entityManager->flush();
+
+        return json_encode(['id' => $effort->getId(), 'label' => $effort->getLabel()]);
+    }
+}
diff --git a/src/Mcp/Tool/TaskMeta/CreatePriorityTool.php b/src/Mcp/Tool/TaskMeta/CreatePriorityTool.php
new file mode 100644
index 0000000..9e324f9
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/CreatePriorityTool.php
@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Entity\TaskPriority;
+use Doctrine\ORM\EntityManagerInterface;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+#[McpTool(name: 'create-priority', description: 'Create a global task priority (label + color).')]
+class CreatePriorityTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(string $label, ?string $color = null): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $priority = new TaskPriority();
+        $priority->setLabel($label);
+        if (null !== $color) {
+            $priority->setColor($color);
+        }
+        $this->entityManager->persist($priority);
+        $this->entityManager->flush();
+
+        return json_encode(['id' => $priority->getId(), 'label' => $priority->getLabel(), 'color' => $priority->getColor()]);
+    }
+}
diff --git a/src/Mcp/Tool/TaskMeta/CreateStatusTool.php b/src/Mcp/Tool/TaskMeta/CreateStatusTool.php
new file mode 100644
index 0000000..ae978f3
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/CreateStatusTool.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Entity\TaskStatus;
+use App\Enum\StatusCategory;
+use App\Repository\WorkflowRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'create-status', description: 'Create a task status inside a workflow (admin). Statuses are NOT global: each belongs to a workflow (use list-workflows for IDs). category = todo|in_progress|blocked|review|done.')]
+class CreateStatusTool
+{
+    public function __construct(
+        private readonly WorkflowRepository $workflowRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $workflowId,
+        string $label,
+        string $category,
+        ?string $color = null,
+        ?int $position = null,
+        ?bool $isFinal = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $workflow = $this->workflowRepository->find($workflowId);
+        if (null === $workflow) {
+            throw new InvalidArgumentException(sprintf('Workflow with ID %d not found.', $workflowId));
+        }
+
+        $categoryEnum = StatusCategory::tryFrom($category)
+            ?? throw new InvalidArgumentException(sprintf('Unknown status category "%s".', $category));
+
+        $status = new TaskStatus();
+        $status->setWorkflow($workflow);
+        $status->setLabel($label);
+        $status->setCategory($categoryEnum);
+        if (null !== $color) {
+            $status->setColor($color);
+        }
+        if (null !== $position) {
+            $status->setPosition($position);
+        }
+        if (null !== $isFinal) {
+            $status->setIsFinal($isFinal);
+        }
+
+        $this->entityManager->persist($status);
+        $this->entityManager->flush();
+
+        return json_encode([
+            'id'         => $status->getId(),
+            'label'      => $status->getLabel(),
+            'color'      => $status->getColor(),
+            'position'   => $status->getPosition(),
+            'isFinal'    => $status->getIsFinal(),
+            'category'   => $status->getCategory()->value,
+            'workflowId' => $workflow->getId(),
+        ]);
+    }
+}
diff --git a/src/Mcp/Tool/TaskMeta/CreateTagTool.php b/src/Mcp/Tool/TaskMeta/CreateTagTool.php
new file mode 100644
index 0000000..867ea25
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/CreateTagTool.php
@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Entity\TaskTag;
+use Doctrine\ORM\EntityManagerInterface;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+#[McpTool(name: 'create-tag', description: 'Create a global task tag. Tags are shared across all projects.')]
+class CreateTagTool
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(string $label, ?string $color = null): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $tag = new TaskTag();
+        $tag->setLabel($label);
+        if (null !== $color) {
+            $tag->setColor($color);
+        }
+
+        $this->entityManager->persist($tag);
+        $this->entityManager->flush();
+
+        return json_encode(['id' => $tag->getId(), 'label' => $tag->getLabel(), 'color' => $tag->getColor()]);
+    }
+}
diff --git a/src/Mcp/Tool/TaskMeta/DeleteEffortTool.php b/src/Mcp/Tool/TaskMeta/DeleteEffortTool.php
new file mode 100644
index 0000000..92dc8e1
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/DeleteEffortTool.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskEffortRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-effort', description: 'Delete a task effort level.')]
+class DeleteEffortTool
+{
+    public function __construct(
+        private readonly TaskEffortRepository $effortRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $effort = $this->effortRepository->find($id);
+        if (null === $effort) {
+            throw new InvalidArgumentException(sprintf('TaskEffort with ID %d not found.', $id));
+        }
+
+        $label = $effort->getLabel();
+        $this->entityManager->remove($effort);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Effort "%s" deleted.', $label)]);
+    }
+}
diff --git a/src/Mcp/Tool/TaskMeta/DeleteGroupTool.php b/src/Mcp/Tool/TaskMeta/DeleteGroupTool.php
new file mode 100644
index 0000000..ae65342
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/DeleteGroupTool.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskGroupRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-group', description: 'Delete a task group. Tasks in the group are not deleted; they become ungrouped.')]
+class DeleteGroupTool
+{
+    public function __construct(
+        private readonly TaskGroupRepository $taskGroupRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $group = $this->taskGroupRepository->find($id);
+        if (null === $group) {
+            throw new InvalidArgumentException(sprintf('TaskGroup with ID %d not found.', $id));
+        }
+
+        $title = $group->getTitle();
+        $this->entityManager->remove($group);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Group "%s" deleted.', $title)]);
+    }
+}
diff --git a/src/Mcp/Tool/TaskMeta/DeletePriorityTool.php b/src/Mcp/Tool/TaskMeta/DeletePriorityTool.php
new file mode 100644
index 0000000..4c9b25a
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/DeletePriorityTool.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskPriorityRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-priority', description: 'Delete a task priority.')]
+class DeletePriorityTool
+{
+    public function __construct(
+        private readonly TaskPriorityRepository $priorityRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $priority = $this->priorityRepository->find($id);
+        if (null === $priority) {
+            throw new InvalidArgumentException(sprintf('TaskPriority with ID %d not found.', $id));
+        }
+
+        $label = $priority->getLabel();
+        $this->entityManager->remove($priority);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Priority "%s" deleted.', $label)]);
+    }
+}
diff --git a/src/Mcp/Tool/TaskMeta/DeleteStatusTool.php b/src/Mcp/Tool/TaskMeta/DeleteStatusTool.php
new file mode 100644
index 0000000..d5aab15
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/DeleteStatusTool.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskStatusRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-status', description: 'Delete a task status from its workflow (admin). Fails at the database level if tasks still use it.')]
+class DeleteStatusTool
+{
+    public function __construct(
+        private readonly TaskStatusRepository $statusRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $status = $this->statusRepository->find($id);
+        if (null === $status) {
+            throw new InvalidArgumentException(sprintf('TaskStatus with ID %d not found.', $id));
+        }
+
+        $label = $status->getLabel();
+        $this->entityManager->remove($status);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Status "%s" deleted.', $label)]);
+    }
+}
diff --git a/src/Mcp/Tool/TaskMeta/DeleteTagTool.php b/src/Mcp/Tool/TaskMeta/DeleteTagTool.php
new file mode 100644
index 0000000..78e2660
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/DeleteTagTool.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskTagRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'delete-tag', description: 'Delete a global task tag. It is removed from all tasks that use it.')]
+class DeleteTagTool
+{
+    public function __construct(
+        private readonly TaskTagRepository $tagRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $tag = $this->tagRepository->find($id);
+        if (null === $tag) {
+            throw new InvalidArgumentException(sprintf('TaskTag with ID %d not found.', $id));
+        }
+
+        $label = $tag->getLabel();
+        $this->entityManager->remove($tag);
+        $this->entityManager->flush();
+
+        return json_encode(['success' => true, 'message' => sprintf('Tag "%s" deleted.', $label)]);
+    }
+}
diff --git a/src/Mcp/Tool/TaskMeta/UpdateEffortTool.php b/src/Mcp/Tool/TaskMeta/UpdateEffortTool.php
new file mode 100644
index 0000000..b317d6c
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/UpdateEffortTool.php
@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskEffortRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-effort', description: 'Rename a task effort level.')]
+class UpdateEffortTool
+{
+    public function __construct(
+        private readonly TaskEffortRepository $effortRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id, string $label): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $effort = $this->effortRepository->find($id);
+        if (null === $effort) {
+            throw new InvalidArgumentException(sprintf('TaskEffort with ID %d not found.', $id));
+        }
+
+        $effort->setLabel($label);
+        $this->entityManager->flush();
+
+        return json_encode(['id' => $effort->getId(), 'label' => $effort->getLabel()]);
+    }
+}
diff --git a/src/Mcp/Tool/TaskMeta/UpdatePriorityTool.php b/src/Mcp/Tool/TaskMeta/UpdatePriorityTool.php
new file mode 100644
index 0000000..992feff
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/UpdatePriorityTool.php
@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskPriorityRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-priority', description: 'Update a task priority. Only provided fields change.')]
+class UpdatePriorityTool
+{
+    public function __construct(
+        private readonly TaskPriorityRepository $priorityRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id, ?string $label = null, ?string $color = null): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $priority = $this->priorityRepository->find($id);
+        if (null === $priority) {
+            throw new InvalidArgumentException(sprintf('TaskPriority with ID %d not found.', $id));
+        }
+
+        if (null !== $label) {
+            $priority->setLabel($label);
+        }
+        if (null !== $color) {
+            $priority->setColor($color);
+        }
+        $this->entityManager->flush();
+
+        return json_encode(['id' => $priority->getId(), 'label' => $priority->getLabel(), 'color' => $priority->getColor()]);
+    }
+}
diff --git a/src/Mcp/Tool/TaskMeta/UpdateStatusTool.php b/src/Mcp/Tool/TaskMeta/UpdateStatusTool.php
new file mode 100644
index 0000000..09e12cb
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/UpdateStatusTool.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Enum\StatusCategory;
+use App\Repository\TaskStatusRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-status', description: 'Update a task status (admin). Only provided fields change. category = todo|in_progress|blocked|review|done.')]
+class UpdateStatusTool
+{
+    public function __construct(
+        private readonly TaskStatusRepository $statusRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(
+        int $id,
+        ?string $label = null,
+        ?string $category = null,
+        ?string $color = null,
+        ?int $position = null,
+        ?bool $isFinal = null,
+    ): string {
+        if (!$this->security->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
+        }
+
+        $status = $this->statusRepository->find($id);
+        if (null === $status) {
+            throw new InvalidArgumentException(sprintf('TaskStatus with ID %d not found.', $id));
+        }
+
+        if (null !== $label) {
+            $status->setLabel($label);
+        }
+        if (null !== $category) {
+            $status->setCategory(
+                StatusCategory::tryFrom($category)
+                    ?? throw new InvalidArgumentException(sprintf('Unknown status category "%s".', $category)),
+            );
+        }
+        if (null !== $color) {
+            $status->setColor($color);
+        }
+        if (null !== $position) {
+            $status->setPosition($position);
+        }
+        if (null !== $isFinal) {
+            $status->setIsFinal($isFinal);
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode([
+            'id'         => $status->getId(),
+            'label'      => $status->getLabel(),
+            'color'      => $status->getColor(),
+            'position'   => $status->getPosition(),
+            'isFinal'    => $status->getIsFinal(),
+            'category'   => $status->getCategory()->value,
+            'workflowId' => $status->getWorkflow()?->getId(),
+        ]);
+    }
+}
diff --git a/src/Mcp/Tool/TaskMeta/UpdateTagTool.php b/src/Mcp/Tool/TaskMeta/UpdateTagTool.php
new file mode 100644
index 0000000..60cff41
--- /dev/null
+++ b/src/Mcp/Tool/TaskMeta/UpdateTagTool.php
@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool\TaskMeta;
+
+use App\Repository\TaskTagRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
+use Mcp\Capability\Attribute\McpTool;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+use function sprintf;
+
+#[McpTool(name: 'update-tag', description: 'Update a task tag. Only provided fields change.')]
+class UpdateTagTool
+{
+    public function __construct(
+        private readonly TaskTagRepository $tagRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
+    ) {}
+
+    public function __invoke(int $id, ?string $label = null, ?string $color = null): string
+    {
+        if (!$this->security->isGranted('ROLE_USER')) {
+            throw new AccessDeniedException('Access denied: ROLE_USER required.');
+        }
+
+        $tag = $this->tagRepository->find($id);
+        if (null === $tag) {
+            throw new InvalidArgumentException(sprintf('TaskTag with ID %d not found.', $id));
+        }
+
+        if (null !== $label) {
+            $tag->setLabel($label);
+        }
+        if (null !== $color) {
+            $tag->setColor($color);
+        }
+
+        $this->entityManager->flush();
+
+        return json_encode(['id' => $tag->getId(), 'label' => $tag->getLabel(), 'color' => $tag->getColor()]);
+    }
+}
diff --git a/src/Repository/AbsenceRequestRepository.php b/src/Repository/AbsenceRequestRepository.php
index 620755b..ffd8d3f 100644
--- a/src/Repository/AbsenceRequestRepository.php
+++ b/src/Repository/AbsenceRequestRepository.php
@@ -7,6 +7,7 @@ namespace App\Repository;
 use App\Entity\AbsenceRequest;
 use App\Entity\User;
 use App\Enum\AbsenceStatus;
+use App\Enum\AbsenceType;
 use DateTimeInterface;
 use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
 use Doctrine\Persistence\ManagerRegistry;
@@ -71,4 +72,35 @@ class AbsenceRequestRepository extends ServiceEntityRepository
             ->getResult()
         ;
     }
+
+    /**
+     * @return AbsenceRequest[]
+     */
+    public function findFiltered(
+        ?User $user = null,
+        ?AbsenceStatus $status = null,
+        ?AbsenceType $type = null,
+        ?DateTimeInterface $from = null,
+        ?DateTimeInterface $to = null,
+    ): array {
+        $qb = $this->createQueryBuilder('a')->orderBy('a.startDate', 'DESC');
+
+        if (null !== $user) {
+            $qb->andWhere('a.user = :user')->setParameter('user', $user);
+        }
+        if (null !== $status) {
+            $qb->andWhere('a.status = :status')->setParameter('status', $status);
+        }
+        if (null !== $type) {
+            $qb->andWhere('a.type = :type')->setParameter('type', $type);
+        }
+        if (null !== $from) {
+            $qb->andWhere('a.endDate >= :from')->setParameter('from', $from->format('Y-m-d'));
+        }
+        if (null !== $to) {
+            $qb->andWhere('a.startDate <= :to')->setParameter('to', $to->format('Y-m-d'));
+        }
+
+        return $qb->getQuery()->getResult();
+    }
 }
diff --git a/tests/Functional/Mcp/AbsenceRequestLifecycleTest.php b/tests/Functional/Mcp/AbsenceRequestLifecycleTest.php
new file mode 100644
index 0000000..2f4335a
--- /dev/null
+++ b/tests/Functional/Mcp/AbsenceRequestLifecycleTest.php
@@ -0,0 +1,177 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Functional\Mcp;
+
+use App\Entity\AbsencePolicy;
+use App\Entity\User;
+use App\Enum\AbsenceType;
+use App\Mcp\Tool\Absence\CancelAbsenceRequestTool;
+use App\Mcp\Tool\Absence\CreateAbsenceRequestTool;
+use App\Mcp\Tool\Absence\ReviewAbsenceRequestTool;
+use App\Repository\AbsenceBalanceRepository;
+use App\Repository\AbsencePolicyRepository;
+use App\Repository\AbsenceRequestRepository;
+use App\Repository\UserRepository;
+use App\Service\AbsenceBalanceService;
+use App\Service\AbsenceDayCalculator;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
+use Symfony\Bundle\SecurityBundle\Security;
+
+/**
+ * @internal
+ */
+class AbsenceRequestLifecycleTest extends KernelTestCase
+{
+    private EntityManagerInterface $em;
+    private User $employee;
+    private User $admin;
+
+    protected function setUp(): void
+    {
+        self::bootKernel();
+        $this->em = self::getContainer()->get(EntityManagerInterface::class);
+
+        // Employé dédié au test.
+        $this->employee = new User();
+        $this->employee->setUsername('mcp-test-employee-'.uniqid());
+        $this->employee->setPassword('x');
+        $this->employee->setRoles(['ROLE_USER']);
+        $this->employee->setIsEmployee(true);
+        $this->employee->setReferencePeriodStart('06-01');
+        $this->em->persist($this->employee);
+
+        $this->admin = new User();
+        $this->admin->setUsername('mcp-test-admin-'.uniqid());
+        $this->admin->setPassword('x');
+        $this->admin->setRoles(['ROLE_ADMIN']);
+        $this->em->persist($this->admin);
+
+        // Policy CP active (créée si absente — findOneByType peut déjà exister via fixtures).
+        $policy = $this->em->getRepository(AbsencePolicy::class)->findOneBy(['type' => AbsenceType::PaidLeave]);
+        if (null === $policy) {
+            $policy = new AbsencePolicy();
+            $policy->setType(AbsenceType::PaidLeave);
+            $policy->setCountWorkingDaysOnly(true);
+            $policy->setActive(true);
+            $this->em->persist($policy);
+        } else {
+            $policy->setActive(true);
+        }
+
+        $this->em->flush();
+    }
+
+    public function testCreateReservesPendingDays(): void
+    {
+        $tool = $this->createTool($this->admin);
+
+        // Lundi 2026-06-01 → vendredi 2026-06-05 = 5 jours ouvrés.
+        $json = ($tool)(
+            $this->employee->getId(),
+            'cp',
+            '2026-06-01',
+            '2026-06-05',
+        );
+        $data = json_decode($json, true);
+
+        self::assertSame('pending', $data['status']);
+        // JSON ne préserve pas le type float pour un entier (5.0 -> 5) : on compare la valeur.
+        self::assertSame(5.0, (float) $data['countedDays']);
+        self::assertSame($this->employee->getId(), $data['user']['id']);
+
+        $balance = self::getContainer()->get(AbsenceBalanceRepository::class)
+            ->findOneForPeriod($this->employee, AbsenceType::PaidLeave, '2026-2027')
+        ;
+        self::assertNotNull($balance);
+        self::assertSame(5.0, $balance->getPending());
+    }
+
+    public function testApproveMovesPendingToTaken(): void
+    {
+        $created = json_decode(
+            ($this->createTool($this->admin))($this->employee->getId(), 'cp', '2026-06-01', '2026-06-05'),
+            true,
+        );
+
+        $json = ($this->reviewTool($this->admin))($created['id'], 'approve');
+        $data = json_decode($json, true);
+
+        self::assertSame('approved', $data['status']);
+        self::assertSame($this->admin->getId(), $data['reviewedBy']['id']);
+
+        $balance = self::getContainer()->get(AbsenceBalanceRepository::class)
+            ->findOneForPeriod($this->employee, AbsenceType::PaidLeave, '2026-2027')
+        ;
+        self::assertSame(0.0, $balance->getPending());
+        self::assertSame(5.0, $balance->getTaken());
+    }
+
+    public function testAdminCancelApprovedReleasesTaken(): void
+    {
+        $created = json_decode(
+            ($this->createTool($this->admin))($this->employee->getId(), 'cp', '2026-06-01', '2026-06-05'),
+            true,
+        );
+        ($this->reviewTool($this->admin))($created['id'], 'approve');
+
+        $data = json_decode(($this->cancelTool($this->admin))($created['id']), true);
+        self::assertSame('cancelled', $data['status']);
+
+        $balance = self::getContainer()->get(AbsenceBalanceRepository::class)
+            ->findOneForPeriod($this->employee, AbsenceType::PaidLeave, '2026-2027')
+        ;
+        self::assertSame(0.0, $balance->getTaken());
+        self::assertSame(0.0, $balance->getPending());
+    }
+
+    private function securityFor(User $user): Security
+    {
+        $security = $this->createMock(Security::class);
+        $security->method('isGranted')->willReturn(true);
+        $security->method('getUser')->willReturn($user);
+
+        return $security;
+    }
+
+    private function createTool(User $actor): CreateAbsenceRequestTool
+    {
+        $c = self::getContainer();
+
+        return new CreateAbsenceRequestTool(
+            $c->get(EntityManagerInterface::class),
+            $c->get(UserRepository::class),
+            $c->get(AbsencePolicyRepository::class),
+            $c->get(AbsenceRequestRepository::class),
+            $c->get(AbsenceDayCalculator::class),
+            $c->get(AbsenceBalanceService::class),
+            $this->securityFor($actor),
+        );
+    }
+
+    private function reviewTool(User $actor): ReviewAbsenceRequestTool
+    {
+        $c = self::getContainer();
+
+        return new ReviewAbsenceRequestTool(
+            $c->get(EntityManagerInterface::class),
+            $c->get(AbsenceRequestRepository::class),
+            $c->get(AbsenceBalanceService::class),
+            $this->securityFor($actor),
+        );
+    }
+
+    private function cancelTool(User $actor): CancelAbsenceRequestTool
+    {
+        $c = self::getContainer();
+
+        return new CancelAbsenceRequestTool(
+            $c->get(EntityManagerInterface::class),
+            $c->get(AbsenceRequestRepository::class),
+            $c->get(AbsenceBalanceService::class),
+            $this->securityFor($actor),
+        );
+    }
+}

From 11fdf8d1bf5dd392299eb9f95affb4c320abfe93 Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Fri, 22 May 2026 14:28:48 +0200
Subject: [PATCH 4/9] =?UTF-8?q?fix(absences)=20:=20durcissement=20RGPD=20d?=
 =?UTF-8?q?es=20donn=C3=A9es=20RH=20des=20utilisateurs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Suite à la revue de conformité du module absences.

Fuite corrigée : GET /api/users et /api/users/{id} n'avaient aucun contrôle
d'accès alors que le groupe user:list exposait les données RH/familiales
(date d'embauche, contrat, soldes de CP, rôles…). Tout utilisateur authentifié
pouvait donc lire ces informations sur tous ses collègues.
- chaque champ RH (isEmployee, hireDate, endDate, contractType, workTimeRatio,
  annualLeaveDays, referencePeriodStart, initialLeaveBalance) ainsi que roles
  est désormais exposé via #[ApiProperty(security: "is_granted('ROLE_ADMIN') or
  object == user")] : visible uniquement par un admin ou par l'utilisateur
  lui-même. id et username restent publics (sélecteurs d'assigné, avatars).

Minimisation : suppression de familySituation et nbChildren, collectés et
exposés (form RH, API, outil MCP) mais utilisés par aucun calcul.
- entité User + enum FamilySituation + migration de drop des colonnes
- Serializer MCP, update-user (MCP), EmployeeDrawer, DTO, fixtures, i18n

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../components/absence/EmployeeDrawer.vue     | 28 +-----------
 frontend/i18n/locales/fr.json                 | 11 +----
 frontend/services/dto/user-data.ts            |  5 ---
 migrations/Version20260522140000.php          | 33 ++++++++++++++
 src/DataFixtures/AppFixtures.php              |  6 ---
 src/Entity/User.php                           | 45 +++++--------------
 src/Enum/FamilySituation.php                  | 25 -----------
 src/Mcp/Tool/Reference/UpdateUserTool.php     | 14 +-----
 src/Mcp/Tool/Serializer.php                   |  2 -
 9 files changed, 47 insertions(+), 122 deletions(-)
 create mode 100644 migrations/Version20260522140000.php
 delete mode 100644 src/Enum/FamilySituation.php

diff --git a/frontend/components/absence/EmployeeDrawer.vue b/frontend/components/absence/EmployeeDrawer.vue
index ae1029e..3684da5 100644
--- a/frontend/components/absence/EmployeeDrawer.vue
+++ b/frontend/components/absence/EmployeeDrawer.vue
@@ -24,13 +24,6 @@
                 empty-option-label="—"
                 group-class="w-full"
             />
-            <MalioSelect
-                v-model="form.familySituation"
-                :label="$t('absences.admin.employees.fields.familySituation')"
-                :options="familyOptions"
-                empty-option-label="—"
-                group-class="w-full"
-            />
             <MalioInputText
                 v-model="form.workTimeRatio"
                 :label="$t('absences.admin.employees.fields.workTimeRatio')"
@@ -51,11 +44,6 @@
                 :label="$t('absences.admin.employees.fields.initialLeaveBalance')"
                 input-class="w-full"
             />
-            <MalioInputText
-                v-model="form.nbChildren"
-                :label="$t('absences.admin.employees.fields.nbChildren')"
-                input-class="w-full"
-            />
 
             <div class="col-span-full mt-2 flex justify-end">
                 <MalioButton
@@ -70,7 +58,7 @@
 </template>
 
 <script setup lang="ts">
-import type { ContractType, FamilySituation, UserData } from '~/services/dto/user-data'
+import type { ContractType, UserData } from '~/services/dto/user-data'
 import { useUserService } from '~/services/users'
 
 const props = defineProps<{
@@ -101,24 +89,14 @@ const contractOptions = [
     { label: t('absences.admin.employees.contract.autre'), value: 'AUTRE' },
 ]
 
-const familyOptions = [
-    { label: t('absences.admin.employees.family.celibataire'), value: 'CELIBATAIRE' },
-    { label: t('absences.admin.employees.family.marie'), value: 'MARIE' },
-    { label: t('absences.admin.employees.family.pacse'), value: 'PACSE' },
-    { label: t('absences.admin.employees.family.divorce'), value: 'DIVORCE' },
-    { label: t('absences.admin.employees.family.veuf'), value: 'VEUF' },
-]
-
 const form = reactive({
     hireDate: null as string | null,
     endDate: null as string | null,
     contractType: null as ContractType | null,
-    familySituation: null as FamilySituation | null,
     workTimeRatio: '1.0',
     annualLeaveDays: '25',
     referencePeriodStart: '06-01',
     initialLeaveBalance: '0',
-    nbChildren: '0',
 })
 
 function hydrate(u: UserData | null) {
@@ -126,12 +104,10 @@ function hydrate(u: UserData | null) {
     form.hireDate = u.hireDate ? u.hireDate.slice(0, 10) : null
     form.endDate = u.endDate ? u.endDate.slice(0, 10) : null
     form.contractType = u.contractType ?? null
-    form.familySituation = u.familySituation ?? null
     form.workTimeRatio = String(u.workTimeRatio ?? 1)
     form.annualLeaveDays = String(u.annualLeaveDays ?? 25)
     form.referencePeriodStart = u.referencePeriodStart ?? '06-01'
     form.initialLeaveBalance = String(u.initialLeaveBalance ?? 0)
-    form.nbChildren = String(u.nbChildren ?? 0)
 }
 
 watch(() => props.modelValue, (isOpen) => {
@@ -147,12 +123,10 @@ async function save() {
             hireDate: form.hireDate || null,
             endDate: form.endDate || null,
             contractType: form.contractType,
-            familySituation: form.familySituation,
             workTimeRatio: Number(form.workTimeRatio) || 1,
             annualLeaveDays: Number(form.annualLeaveDays) || 0,
             referencePeriodStart: form.referencePeriodStart || '06-01',
             initialLeaveBalance: Number(form.initialLeaveBalance) || 0,
-            nbChildren: Number(form.nbChildren) || 0,
         })
         emit('saved')
         open.value = false
diff --git a/frontend/i18n/locales/fr.json b/frontend/i18n/locales/fr.json
index 1f27edc..bcef698 100644
--- a/frontend/i18n/locales/fr.json
+++ b/frontend/i18n/locales/fr.json
@@ -703,12 +703,10 @@
                     "hireDate": "Date d'embauche",
                     "endDate": "Date de sortie",
                     "contractType": "Type de contrat",
-                    "familySituation": "Situation familiale",
                     "workTimeRatio": "Temps de travail (ex : 1.0)",
                     "annualLeaveDays": "CP annuels (jours)",
                     "referencePeriodStart": "Début période réf. (MM-DD)",
-                    "initialLeaveBalance": "Solde CP initial",
-                    "nbChildren": "Nombre d'enfants"
+                    "initialLeaveBalance": "Solde CP initial"
                 },
                 "contract": {
                     "cdi": "CDI",
@@ -716,13 +714,6 @@
                     "stage": "Stage",
                     "alternance": "Alternance",
                     "autre": "Autre"
-                },
-                "family": {
-                    "celibataire": "Célibataire",
-                    "marie": "Marié(e)",
-                    "pacse": "Pacsé(e)",
-                    "divorce": "Divorcé(e)",
-                    "veuf": "Veuf(ve)"
                 }
             }
         },
diff --git a/frontend/services/dto/user-data.ts b/frontend/services/dto/user-data.ts
index 43265b5..84e4608 100644
--- a/frontend/services/dto/user-data.ts
+++ b/frontend/services/dto/user-data.ts
@@ -1,5 +1,4 @@
 export type ContractType = 'CDI' | 'CDD' | 'STAGE' | 'ALTERNANCE' | 'AUTRE'
-export type FamilySituation = 'CELIBATAIRE' | 'MARIE' | 'PACSE' | 'DIVORCE' | 'VEUF'
 
 export type UserData = {
     id: number
@@ -17,8 +16,6 @@ export type UserData = {
     annualLeaveDays?: number
     referencePeriodStart?: string
     initialLeaveBalance?: number
-    familySituation?: FamilySituation | null
-    nbChildren?: number
 }
 
 export type UserWrite = {
@@ -34,6 +31,4 @@ export type UserWrite = {
     annualLeaveDays?: number
     referencePeriodStart?: string
     initialLeaveBalance?: number
-    familySituation?: FamilySituation | null
-    nbChildren?: number
 }
diff --git a/migrations/Version20260522140000.php b/migrations/Version20260522140000.php
new file mode 100644
index 0000000..1e06881
--- /dev/null
+++ b/migrations/Version20260522140000.php
@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * RGPD / minimisation : suppression des colonnes user.family_situation et
+ * user.nb_children. Ces données (situation familiale, nombre d'enfants)
+ * étaient collectées et exposées mais n'étaient utilisées par aucun calcul.
+ */
+final class Version20260522140000 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Drop unused HR fields user.family_situation and user.nb_children (data minimisation)';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE "user" DROP COLUMN IF EXISTS family_situation');
+        $this->addSql('ALTER TABLE "user" DROP COLUMN IF EXISTS nb_children');
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE "user" ADD family_situation VARCHAR(16) DEFAULT NULL');
+        $this->addSql('ALTER TABLE "user" ADD nb_children INT NOT NULL DEFAULT 0');
+    }
+}
diff --git a/src/DataFixtures/AppFixtures.php b/src/DataFixtures/AppFixtures.php
index c17c489..a6ef14f 100644
--- a/src/DataFixtures/AppFixtures.php
+++ b/src/DataFixtures/AppFixtures.php
@@ -24,7 +24,6 @@ use App\Entity\ZimbraConfiguration;
 use App\Enum\AbsenceStatus;
 use App\Enum\AbsenceType;
 use App\Enum\ContractType;
-use App\Enum\FamilySituation;
 use App\Enum\RecurrenceType;
 use App\Enum\StatusCategory;
 use DateTimeImmutable;
@@ -670,20 +669,15 @@ class AppFixtures extends Fixture
         $admin->setIsEmployee(true);
         $admin->setHireDate(new DateTimeImmutable('2020-01-15'));
         $admin->setContractType(ContractType::Cdi);
-        $admin->setFamilySituation(FamilySituation::Married);
-        $admin->setNbChildren(2);
 
         $userAlice->setIsEmployee(true);
         $userAlice->setHireDate(new DateTimeImmutable('2022-09-01'));
         $userAlice->setContractType(ContractType::Cdi);
-        $userAlice->setFamilySituation(FamilySituation::Single);
 
         $userBob->setIsEmployee(true);
         $userBob->setHireDate(new DateTimeImmutable('2023-03-10'));
         $userBob->setContractType(ContractType::Cdd);
         $userBob->setWorkTimeRatio(0.8);
-        $userBob->setFamilySituation(FamilySituation::Pacsed);
-        $userBob->setNbChildren(1);
 
         // Paid-leave balances for the current reference period (June 1st → May 31st)
         $cpPeriod    = '2025-2026';
diff --git a/src/Entity/User.php b/src/Entity/User.php
index 80f4504..22b8a8d 100644
--- a/src/Entity/User.php
+++ b/src/Entity/User.php
@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Entity;
 
+use ApiPlatform\Metadata\ApiProperty;
 use ApiPlatform\Metadata\ApiResource;
 use ApiPlatform\Metadata\Delete;
 use ApiPlatform\Metadata\Get;
@@ -11,7 +12,6 @@ use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
 use ApiPlatform\Metadata\Post;
 use App\Enum\ContractType;
-use App\Enum\FamilySituation;
 use App\Repository\UserRepository;
 use App\State\MeProvider;
 use App\State\UserPasswordHasherProcessor;
@@ -57,6 +57,7 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
 
     /** @var list<string> */
     #[ORM\Column]
+    #[ApiProperty(security: "is_granted('ROLE_ADMIN') or object == user")]
     #[Groups(['me:read', 'user:list', 'user:write'])]
     private array $roles = [];
 
@@ -76,54 +77,54 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
     #[ORM\Column(length: 255, nullable: true)]
     private ?string $avatarFileName = null;
 
-    // --- HR / absence management fields ---
+    // --- HR / absence management fields (readable only by an admin or the user themselves) ---
 
     /** Whether this user is an employee subject to absence management. */
     #[ORM\Column]
+    #[ApiProperty(security: "is_granted('ROLE_ADMIN') or object == user")]
     #[Groups(['me:read', 'user:list', 'user:write'])]
     private bool $isEmployee = false;
 
     /** Hiring date — start of paid-leave acquisition. */
     #[ORM\Column(type: Types::DATE_IMMUTABLE, nullable: true)]
+    #[ApiProperty(security: "is_granted('ROLE_ADMIN') or object == user")]
     #[Groups(['me:read', 'user:list', 'user:write'])]
     private ?DateTimeImmutable $hireDate = null;
 
     #[ORM\Column(type: Types::DATE_IMMUTABLE, nullable: true)]
+    #[ApiProperty(security: "is_granted('ROLE_ADMIN') or object == user")]
     #[Groups(['me:read', 'user:list', 'user:write'])]
     private ?DateTimeImmutable $endDate = null;
 
     #[ORM\Column(type: Types::STRING, length: 16, nullable: true, enumType: ContractType::class)]
+    #[ApiProperty(security: "is_granted('ROLE_ADMIN') or object == user")]
     #[Groups(['me:read', 'user:list', 'user:write'])]
     private ?ContractType $contractType = null;
 
     /** Work-time ratio: 1.0 = full time, 0.8 = 4 days out of 5. */
     #[ORM\Column(type: Types::FLOAT)]
+    #[ApiProperty(security: "is_granted('ROLE_ADMIN') or object == user")]
     #[Groups(['me:read', 'user:list', 'user:write'])]
     private float $workTimeRatio = 1.0;
 
     /** Yearly paid-leave entitlement in worked days (default 25 = jours ouvrés). */
     #[ORM\Column(type: Types::FLOAT)]
+    #[ApiProperty(security: "is_granted('ROLE_ADMIN') or object == user")]
     #[Groups(['me:read', 'user:list', 'user:write'])]
     private float $annualLeaveDays = 25.0;
 
     /** Reference period start as MM-DD (default 06-01, 1st of June). */
     #[ORM\Column(length: 5)]
+    #[ApiProperty(security: "is_granted('ROLE_ADMIN') or object == user")]
     #[Groups(['me:read', 'user:list', 'user:write'])]
     private string $referencePeriodStart = '06-01';
 
     /** Paid-leave already acquired when the module is rolled out. */
     #[ORM\Column(type: Types::FLOAT)]
+    #[ApiProperty(security: "is_granted('ROLE_ADMIN') or object == user")]
     #[Groups(['me:read', 'user:list', 'user:write'])]
     private float $initialLeaveBalance = 0.0;
 
-    #[ORM\Column(type: Types::STRING, length: 16, nullable: true, enumType: FamilySituation::class)]
-    #[Groups(['me:read', 'user:list', 'user:write'])]
-    private ?FamilySituation $familySituation = null;
-
-    #[ORM\Column]
-    #[Groups(['me:read', 'user:list', 'user:write'])]
-    private int $nbChildren = 0;
-
     public function __construct()
     {
         $this->createdAt = new DateTimeImmutable();
@@ -338,28 +339,4 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
 
         return $this;
     }
-
-    public function getFamilySituation(): ?FamilySituation
-    {
-        return $this->familySituation;
-    }
-
-    public function setFamilySituation(?FamilySituation $familySituation): static
-    {
-        $this->familySituation = $familySituation;
-
-        return $this;
-    }
-
-    public function getNbChildren(): int
-    {
-        return $this->nbChildren;
-    }
-
-    public function setNbChildren(int $nbChildren): static
-    {
-        $this->nbChildren = $nbChildren;
-
-        return $this;
-    }
 }
diff --git a/src/Enum/FamilySituation.php b/src/Enum/FamilySituation.php
deleted file mode 100644
index 938498b..0000000
--- a/src/Enum/FamilySituation.php
+++ /dev/null
@@ -1,25 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Enum;
-
-enum FamilySituation: string
-{
-    case Single   = 'CELIBATAIRE';
-    case Married  = 'MARIE';
-    case Pacsed   = 'PACSE';
-    case Divorced = 'DIVORCE';
-    case Widowed  = 'VEUF';
-
-    public function label(): string
-    {
-        return match ($this) {
-            self::Single   => 'Célibataire',
-            self::Married  => 'Marié(e)',
-            self::Pacsed   => 'Pacsé(e)',
-            self::Divorced => 'Divorcé(e)',
-            self::Widowed  => 'Veuf(ve)',
-        };
-    }
-}
diff --git a/src/Mcp/Tool/Reference/UpdateUserTool.php b/src/Mcp/Tool/Reference/UpdateUserTool.php
index 8158f23..c7a3d94 100644
--- a/src/Mcp/Tool/Reference/UpdateUserTool.php
+++ b/src/Mcp/Tool/Reference/UpdateUserTool.php
@@ -5,7 +5,6 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\Reference;
 
 use App\Enum\ContractType;
-use App\Enum\FamilySituation;
 use App\Mcp\Tool\Serializer;
 use App\Repository\UserRepository;
 use DateTimeImmutable;
@@ -17,7 +16,7 @@ use Symfony\Component\Security\Core\Exception\AccessDeniedException;
 
 use function sprintf;
 
-#[McpTool(name: 'update-user', description: 'Update a user HR/profile fields (admin). Does NOT change password or roles. contractType = CDI|CDD|STAGE|ALTERNANCE|AUTRE. familySituation = CELIBATAIRE|MARIE|PACSE|DIVORCE|VEUF. hireDate/endDate as YYYY-MM-DD. referencePeriodStart as MM-DD (e.g. 06-01).')]
+#[McpTool(name: 'update-user', description: 'Update a user HR/profile fields (admin). Does NOT change password or roles. contractType = CDI|CDD|STAGE|ALTERNANCE|AUTRE. hireDate/endDate as YYYY-MM-DD. referencePeriodStart as MM-DD (e.g. 06-01).')]
 class UpdateUserTool
 {
     public function __construct(
@@ -36,8 +35,6 @@ class UpdateUserTool
         ?float $annualLeaveDays = null,
         ?string $referencePeriodStart = null,
         ?float $initialLeaveBalance = null,
-        ?string $familySituation = null,
-        ?int $nbChildren = null,
     ): string {
         if (!$this->security->isGranted('ROLE_ADMIN')) {
             throw new AccessDeniedException('Access denied: ROLE_ADMIN required.');
@@ -75,15 +72,6 @@ class UpdateUserTool
         if (null !== $initialLeaveBalance) {
             $user->setInitialLeaveBalance($initialLeaveBalance);
         }
-        if (null !== $familySituation) {
-            $user->setFamilySituation(
-                FamilySituation::tryFrom($familySituation)
-                    ?? throw new InvalidArgumentException(sprintf('Unknown family situation "%s".', $familySituation)),
-            );
-        }
-        if (null !== $nbChildren) {
-            $user->setNbChildren($nbChildren);
-        }
 
         $this->entityManager->flush();
 
diff --git a/src/Mcp/Tool/Serializer.php b/src/Mcp/Tool/Serializer.php
index 7f97043..51a47f0 100644
--- a/src/Mcp/Tool/Serializer.php
+++ b/src/Mcp/Tool/Serializer.php
@@ -389,8 +389,6 @@ final class Serializer
             'annualLeaveDays'      => $u->getAnnualLeaveDays(),
             'referencePeriodStart' => $u->getReferencePeriodStart(),
             'initialLeaveBalance'  => $u->getInitialLeaveBalance(),
-            'familySituation'      => $u->getFamilySituation()?->value,
-            'nbChildren'           => $u->getNbChildren(),
         ];
     }
 }

From 4858f73d0709b28f2dbe9e4457b204d2c10ec798 Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Fri, 22 May 2026 14:29:01 +0200
Subject: [PATCH 5/9] =?UTF-8?q?docs(absences)=20:=20aide=20/help=20du=20mo?=
 =?UTF-8?q?dule=20+=20revue=20de=20conformit=C3=A9=20l=C3=A9gale?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- frontend/content/help/06-absences.md : nouveau chapitre d'aide « Absences »
  (poser une demande, lecture des soldes, mode de décompte des CP, ajout d'un
  salarié — nouveau ou déjà présent via le solde initial). Enregistré dans help.vue.
- revue de conformité (Syntec/RGPD) du module absences : rapport d'audit avec
  constats légaux et RGPD + recommandations.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 ...6-05-22-absence-legal-compliance-review.md | 115 ++++++++++++++++++
 frontend/content/help/06-absences.md          |  72 +++++++++++
 frontend/pages/help.vue                       |   1 +
 3 files changed, 188 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-05-22-absence-legal-compliance-review.md
 create mode 100644 frontend/content/help/06-absences.md

diff --git a/docs/superpowers/specs/2026-05-22-absence-legal-compliance-review.md b/docs/superpowers/specs/2026-05-22-absence-legal-compliance-review.md
new file mode 100644
index 0000000..52db33f
--- /dev/null
+++ b/docs/superpowers/specs/2026-05-22-absence-legal-compliance-review.md
@@ -0,0 +1,115 @@
+# Audit de conformité légale & RGPD — Module « Gestion des absences » (Lesstime)
+
+> **Date** : 2026-05-22
+> **Périmètre** : code backend (`src/Enum`, `src/Entity`, `src/Service`, `src/State`, `src/Command`, `src/Controller/Absence`), fixtures, migrations et front (`frontend/components/absence`, `frontend/pages/absences.vue`, `team-absences.vue`).
+> **Nature** : audit documentaire. **Aucune modification de code** n'a été réalisée.
+> **Avertissement** : ce document est une analyse technique de conformité, pas un avis juridique formel. Faire valider par un conseil RH/juridique avant mise en production paie.
+
+---
+
+## 1. Convention collective applicable
+
+### Constat
+Le code (`AbsencePolicy` par défaut, fixtures `AppFixtures.php`) part d'hypothèses « Syntec » sans le formaliser : 25 jours **ouvrés** de CP, période de référence **1er juin → 31 mai** (`referencePeriodStart = '06-01'`), décompte en jours ouvrés par défaut (`countWorkingDaysOnly = true`).
+
+### Convention probable
+Pour une société d'édition de logiciels / services informatiques (« bureau informatique »), c'est très majoritairement la **Convention collective nationale Syntec — IDCC 1486** (« Bureaux d'études techniques, cabinets d'ingénieurs-conseils et sociétés de conseils ») qui s'applique. C'est cohérent avec les valeurs codées (25 jours ouvrés, décompte en jours ouvrés).
+
+### ⚠️ Ambiguïté à lever
+La convention applicable **ne se déduit pas de l'activité seule** : elle dépend du **code APE/NAF** de l'entreprise et de l'activité principale réelle. Une SSII/éditeur peut relever de Syntec, mais certaines structures relèvent d'autres CCN. **À confirmer** sur le bulletin de paie ou auprès de l'expert-comptable. Le module **code en dur** des hypothèses Syntec mais ne stocke nulle part la CCN de référence : à documenter.
+
+### Sources
+- Code du travail / congés payés : https://www.service-public.gouv.fr/particuliers/vosdroits/F2258
+- Syntec — congés payés (25 jours ouvrés, ancienneté) : https://www.legisocial.fr/conventions-collectives-nationales/1486-syntec-bureaux-etudes-techniques-cabinets-ingenieurs-conseils-societes/conges-payes-indemnites-conges-sans-solde.html
+- Syntec — congés événements familiaux (Code du travail numérique) : https://code.travail.gouv.fr/contribution/1486-les-conges-pour-evenements-familiaux
+- Texte de base Syntec (Légifrance) : https://www.legifrance.gouv.fr/conv_coll/id/KALIARTI000044253087/?idConteneur=KALICONT000005635173
+
+---
+
+## 2. Conformité par type d'absence
+
+Valeurs implémentées : voir `AppFixtures.php` (lignes 648-667) et `User::$annualLeaveDays = 25.0`.
+
+| Type | Minimum légal / Syntec | Implémenté | Verdict |
+|------|------------------------|------------|---------|
+| **Congés payés (CP)** | Légal : 2,5 j ouvrables/mois = 30 j ouvrables/an (5 sem.). Syntec : 25 j ouvrés/an = équivalent 30 j ouvrables. Période réf. 01/06→31/05. | `daysPerYear = 25`, décompte jours ouvrés, période `06-01`, acquisition 1/12 par mois (`AccrueLeaveCommand`). | ✅ **Conforme** sur le principe. ⚠️ Réserves : (a) pas de **règle d'arrondi** légal à l'entier supérieur (art. L3141-7) ; (b) pas de **congés d'ancienneté Syntec** (1 j à 5 ans, 2 j à 10 ans, 3 j à 15 ans, 4 j à 20 ans) ; (c) acquisition figée à `annualLeaveDays/12` sans assimilation des périodes d'arrêt maladie (voir §3). |
+| **Mariage / PACS** | Légal : **4 jours minimum** (L3142-4). Syntec : 4 jours ouvrés. | `daysPerEvent = 4`, justificatif requis. | ✅ **Conforme**. |
+| **Décès proche** | Légal : **enfant = 5 j min** (et jusqu'à 7 j + congé deuil 8 j si enfant <25 ans) ; conjoint/partenaire = 3 j ; père/mère/beau-parent/frère/sœur = 3 j (L3142-4). Syntec : barème ≥ légal, dont **jusqu'à ~22 j** pour décès enfant <25 ans. | **Un seul** `Bereavement` à `daysPerEvent = 3`, sans distinction du lien de parenté. | ❌ **Non conforme**. Un forfait unique de 3 j est **inférieur au minimum légal** pour le décès d'un enfant (5 j) et ignore le congé de deuil (8 j) et le barème Syntec. Dérive : sous-attribution de droits. |
+| **Naissance** | Légal : **3 jours min** (en sus du congé paternité). | **Type absent** de l'enum `AbsenceType`. | ❌ **Manquant**. La naissance n'est pas gérée ; aucun congé naissance ni paternité. |
+| **Congé parental d'éducation** | Cadre L1225-47 s. : suspension du contrat, durée 1 an renouvelable 2×, jusqu'aux 3 ans de l'enfant, **non rémunéré**, ancienneté 1 an. | `ParentalLeave` : `daysPerYear`/`daysPerEvent` null, `decrementsBalance() = true` (décrémente un solde). | ⚠️ **Modélisation incorrecte**. Le congé parental est une **suspension longue** (mois/années), pas un décompte sur solde annuel. Le traiter comme une absence qui « décrémente un solde » (vide ici, donc 0) n'a pas de sens métier. À modéliser comme suspension, sans solde. |
+| **Arrêt maladie** | Indemnisé par la Sécu ; **ne se déduit jamais des CP**. Depuis loi 2024-364 du 22/04/2024 : acquiert **2 j ouvrables/mois** de CP (maladie non pro). | `SickLeave` : `decrementsBalance() = false` → ne touche aucun solde. | ✅ **Conforme** sur le non-décompte. ⚠️ **Manque** : l'acquisition de CP pendant l'arrêt (2 j/mois) n'est pas implémentée — `AccrueLeaveCommand` crédite `annualLeaveDays/12` quel que soit le statut, sans tenir compte des arrêts. Impact paie potentiel. |
+
+### Décompte des jours (`AbsenceDayCalculator`)
+- ✅ Dimanche jamais compté ; samedi compté seulement en « jours ouvrables » ; jours fériés exclus ; demi-journées aux bornes à -0,5. Logique **correcte**.
+- ✅ `PublicHolidayProvider` : 11 jours fériés métropole + Pâques/Ascension/Pentecôte via Computus. Correct **hors Alsace-Moselle** (Vendredi saint + 26/12 non gérés — documenté comme hors périmètre, à signaler si salariés concernés).
+- ⚠️ La **demi-journée à -0,5** est appliquée sans vérifier que la borne tombe sur un jour décompté : si `startHalfDay` est posé alors que le jour de début est un week-end/férié (non compté), on retire quand même 0,5, ce qui peut **sous-décompter**. Cas limite à border côté validation.
+
+---
+
+## 3. Constats RGPD / dérive
+
+### 🔴 BLOQUANT — Fuite des données RH/familiales à tous les utilisateurs authentifiés
+**Fichiers** : `src/Entity/User.php` (lignes 32-37, groupes `user:list`), `config/packages/security.yaml` (ligne 69).
+
+Les opérations API `GET /api/users` (collection) et `GET /api/users/{id}` n'ont **aucun attribut `security`** : seule la règle globale `^/api → IS_AUTHENTICATED_FULLY` s'applique. **N'importe quel salarié** (`ROLE_USER`) peut donc lister tous ses collègues et lire le groupe `user:list`, qui expose : `familySituation`, `nbChildren`, `hireDate`, `endDate`, `contractType`, `workTimeRatio`, `annualLeaveDays`, `initialLeaveBalance` et **`roles`**.
+
+C'est une violation directe des principes RGPD de **minimisation** et de **limitation d'accès** (référentiel CNIL RH) : la situation familiale et le nombre d'enfants d'un collègue n'ont aucune raison d'être accessibles à un pair. Gravité maximale (donnée personnelle sensible au sens RH diffusée largement).
+
+### 🟠 MOYEN — Collecte de `familySituation` / `nbChildren` non justifiée (non-minimisation)
+**Fichiers** : `User.php` (119-125), `EmployeeDrawer.vue`, `Serializer.php` (MCP, 392-393).
+
+Recherche d'usage exhaustive : ces deux champs sont **stockés, saisis dans le formulaire RH et exposés (API + MCP), mais ne sont utilisés dans AUCUN calcul** d'absence (ni `AbsenceDayCalculator`, ni `AbsenceBalanceService`, ni `AccrueLeaveCommand`, ni les policies). Or :
+- Le module gère le décès via un forfait unique sans lien de parenté → `familySituation`/`nbChildren` ne servent pas au congé décès.
+- La naissance et le congé parental ne sont pas calculés à partir de `nbChildren`.
+
+Conséquence : **collecte sans finalité opérationnelle** = violation du principe de minimisation (art. 5.1.c RGPD). Soit ces champs servent réellement un calcul légal (alors les implémenter et le documenter dans le registre des traitements), soit ils doivent être **supprimés**. En l'état c'est une **dérive de collecte**. De plus la situation familiale peut révéler indirectement l'orientation/la vie privée → prudence renforcée.
+
+### 🟠 MOYEN — Exposition de données RH via le MCP
+**Fichier** : `src/Mcp/Tool/Serializer.php` (392-393). Le serializer MCP renvoie `familySituation` et `nbChildren`. Le serveur MCP HTTP **pointe sur la PROD** (cf. mémoire projet). Toute intégration MCP (assistant IA, scripts) peut donc aspirer ces données familiales. À restreindre / retirer du payload MCP.
+
+### 🟡 MINEUR — Justificatif et motif : données potentiellement sensibles
+**Fichiers** : `AbsenceRequest::$reason`, `justificationFileName`, `AbsenceJustification*Controller`.
+- Le **contrôle d'accès au justificatif est correct** (propriétaire ou admin uniquement, `AbsenceJustificationDownloadController` lignes 38-40). ✅
+- Mais un justificatif d'**arrêt maladie** peut contenir des **données de santé**. Le champ `reason` (texte libre) peut aussi en contenir. Recommandations CNIL : ne stocker que le **volet administratif**, durée de conservation limitée, accès tracé. Aucune **politique de rétention/purge** n'est implémentée (fichiers et demandes conservés indéfiniment).
+
+### 🟡 MINEUR — Approbation sans contrôle de solde
+**Fichier** : `AbsenceReviewProcessor.php`. L'approbation déplace les jours de `pending` vers `taken` **sans vérifier** que le solde disponible est suffisant — un solde peut devenir négatif. Pas un problème RGPD mais une **dérive de calcul** (congés non acquis posables sans alerte). À noter : `getAvailable()` autorise volontairement de poser les CP « en cours d'acquisition » (N), ce qui est un **choix d'entreprise admis** mais à confirmer (certaines entreprises n'autorisent que le N-1).
+
+### ✅ Points conformes
+- Accès aux `AbsenceRequest` / `AbsenceBalance` : les providers (`AbsenceRequestProvider`, `AbsenceBalanceProvider`) **filtrent bien** par propriétaire pour un non-admin (un salarié ne voit que ses propres demandes/soldes). Le filtre `user` n'est appliqué que si `ROLE_ADMIN`. ✅
+- Approbation/rejet/suppression réservés à `ROLE_ADMIN`. ✅
+- Upload justificatif limité au propriétaire/admin, MIME validé côté serveur, taille plafonnée 10 Mo. ✅
+
+---
+
+## 4. Recommandations actionnables
+
+### Priorité 1 — Bloquant (à corriger avant prod)
+1. **Restreindre `GET /api/users` et `GET /api/users/{id}`** : ajouter `security: "is_granted('ROLE_ADMIN')"` sur ces opérations, OU créer un groupe de sérialisation « annuaire » minimal (id, username, avatar) pour les non-admins et réserver `user:list` (champs RH) à l'admin via un contexte conditionné par le rôle. Retirer impérativement `familySituation`, `nbChildren`, `hireDate`, `endDate`, `contractType`, `annualLeaveDays`, `initialLeaveBalance`, `roles` de toute vue accessible à `ROLE_USER`.
+
+### Priorité 2 — Moyen
+2. **Trancher sur `familySituation` / `nbChildren`** : soit les supprimer (recommandé tant qu'aucun calcul ne les utilise), soit les rattacher à une finalité réelle (barème décès/naissance) et les inscrire au registre des traitements. Les retirer du payload MCP (`Serializer.php`).
+3. **Refondre le congé décès** : remplacer le forfait unique 3 j par un barème par lien de parenté conforme au minimum légal (enfant ≥ 5 j + deuil 8 j ; conjoint/parent/fratrie 3 j) et au barème Syntec applicable.
+4. **Ajouter le congé naissance** (3 j min) et, le cas échéant, le congé paternité.
+5. **Remodéliser le congé parental** comme suspension de contrat (sans décompte de solde annuel).
+
+### Priorité 3 — Mineur / robustesse
+6. **Acquisition CP pendant arrêt maladie** : aligner `AccrueLeaveCommand` sur la loi 2024-364 (2 j ouvrables/mois pour maladie non pro, plafond annuel).
+7. **Congés d'ancienneté Syntec** : implémenter le barème (1/2/3/4 j à 5/10/15/20 ans) et l'arrondi légal à l'entier supérieur.
+8. **Politique de rétention** : définir une durée de conservation des `AbsenceRequest`, `reason` et justificatifs (santé), avec purge automatique ; tracer les accès aux justificatifs.
+9. **Contrôle de solde à l'approbation** + garde-fou demi-journée sur jour non décompté dans `AbsenceDayCalculator`.
+10. **Documenter la CCN de référence** dans la config (ne pas la coder en dur implicitement) et confirmer Syntec via le code APE de l'entreprise.
+
+---
+
+## Sources (règles légales citées)
+- Congés payés (2,5 j/mois, 30 j, période 01/06→31/05) : https://www.service-public.gouv.fr/particuliers/vosdroits/F2258
+- Jours ouvrés vs ouvrables : https://www.juritravail.com/Actualite/decompte-du-nombre-de-jours-de-conges-payes-les-jours-ouvrables-et-les-jours-ouvres-comment-faire/Id/2161
+- Syntec — CP & ancienneté : https://www.legisocial.fr/conventions-collectives-nationales/1486-syntec-bureaux-etudes-techniques-cabinets-ingenieurs-conseils-societes/conges-payes-indemnites-conges-sans-solde.html
+- Syntec — événements familiaux : https://code.travail.gouv.fr/contribution/1486-les-conges-pour-evenements-familiaux
+- Code du travail — congés événements familiaux (L3142-1 s.) : https://www.legifrance.gouv.fr/codes/section_lc/LEGITEXT000006072050/LEGISCTA000006195795/
+- Congé de deuil / décès enfant : https://travail-emploi.gouv.fr/les-conges-pour-evenements-familiaux-et-le-conge-de-deuil
+- Congé parental d'éducation (L1225-47 s.) : https://www.legifrance.gouv.fr/codes/id/LEGISCTA000006195596/
+- CP pendant arrêt maladie (loi 2024-364) : https://code.travail.gouv.fr/information/acquisition-de-conges-payes-pendant-un-arret-maladie-les-nouvelles-regles
+- CNIL — données de santé / employeur : https://www.cnil.fr/fr/cnil-direct/question/donnees-sur-la-sante-un-employeur-peut-il-les-connaitre
+- CNIL — référentiel gestion RH (minimisation) : https://www.cnil.fr/sites/default/files/atoms/files/referentiel_grh_novembre_2019_0.pdf
diff --git a/frontend/content/help/06-absences.md b/frontend/content/help/06-absences.md
new file mode 100644
index 0000000..0c748ab
--- /dev/null
+++ b/frontend/content/help/06-absences.md
@@ -0,0 +1,72 @@
+# Absences
+
+Le module **Absences** gère les congés des salariés : demande, validation, et suivi des soldes de congés payés (CP) et des congés pour événements (mariage/PACS, décès, congé parental, maladie).
+
+Il y a deux espaces :
+
+- **Mes absences** (`/absences`) — accessible à tout salarié : poser une demande et consulter ses soldes.
+- **Absences équipe** (`/team-absences`) — réservé aux **administrateurs** : valider les demandes, voir le calendrier d'équipe, ajuster les soldes et gérer la fiche RH des salariés.
+
+> 🛡️ La gestion des salariés (onglet *Employés*) et la validation des demandes sont aujourd'hui réservées au rôle **ROLE_ADMIN**.
+
+## Poser une demande (tout salarié)
+
+Depuis **Mes absences** → bouton *Nouvelle demande* :
+
+1. **Type** : Congés payés, Mariage/PACS, Congé parental, Décès, ou Maladie.
+2. **Dates** : début et fin. Une **demi-journée** (matin / après-midi) peut être posée sur le premier ou le dernier jour (décompte −0,5).
+3. **Motif** (optionnel) et **justificatif** (selon le type).
+
+La demande passe au statut **En attente**. Les jours sont immédiatement **réservés** dans le solde « en attente » pour éviter de poser deux fois les mêmes congés. Un administrateur valide ou refuse ensuite la demande.
+
+## Lire ses soldes
+
+Chaque solde de CP se lit sur une **période de référence** (par défaut **1er juin → 31 mai**) et se décompose en :
+
+| Bucket | Signification |
+|---|---|
+| **Acquis (N-1)** | Jours déjà acquis sur la période précédente, **disponibles** maintenant |
+| **En cours d'acquisition (N)** | Jours qui s'accumulent ce mois-ci, disponibles à la prochaine période |
+| **En attente** | Jours réservés par des demandes non encore validées |
+| **Pris** | Jours de demandes validées |
+
+Le **disponible** = acquis + acquis-en-cours − en attente − pris.
+
+## Comment les congés payés sont comptés
+
+L'acquisition est **mensuelle**, créditée par une tâche planifiée (commande `app:accrue-leave`, lancée par un cron en début de mois) :
+
+```
+acquisition mensuelle = (jours de CP annuels ÷ 12) × quotité de travail
+```
+
+Pour un temps plein à **25 jours/an**, cela fait **≈ 2,08 jour/mois** crédités dans « en cours d'acquisition (N) ». À chaque changement de période de référence, le « en cours (N) » bascule automatiquement en « acquis (N-1) ».
+
+Le décompte d'une absence ne compte que les **jours ouvrés** (lundi→vendredi) ; les week-ends sont ignorés. Les arrêts **maladie** ne sont pas déduits du solde de CP.
+
+## Ajouter un salarié
+
+> Aujourd'hui réalisé par un **administrateur** depuis **Absences équipe → onglet *Employés* → *Ajouter / Modifier***.
+
+Cocher *Employé* sur la fiche d'un utilisateur l'intègre à la gestion des absences. La fiche RH demande :
+
+| Champ | Rôle | Valeur typique |
+|---|---|---|
+| **Date d'embauche** | Début du contrat | date réelle |
+| **Type de contrat** | CDI, CDD, Stage, Alternance, Autre | — |
+| **Quotité de travail** | Temps plein = `1.0`, mi-temps = `0.5` | `1.0` |
+| **CP annuels** | Jours de CP acquis par an | `25` |
+| **Début de période de référence** | Format `MM-JJ` | `06-01` |
+| **Solde initial de CP** | Jours déjà acquis et disponibles à l'activation | voir ci-dessous |
+
+### Nouveau salarié qui arrive
+
+Renseigner date d'embauche, contrat, quotité, `25` CP annuels et `06-01` de période. Laisser le **solde initial à `0`** : le salarié commence à acquérir ses CP au prochain passage mensuel.
+
+### Salarié déjà présent avant l'activation du module
+
+C'est le **solde initial de CP** qui sert à reprendre l'existant. Y saisir le **nombre de jours de CP déjà acquis et disponibles** par le salarié au moment où on active le module.
+
+Au premier calcul mensuel, cette valeur amorce le bucket **« acquis (N-1) »** (donc immédiatement disponible), puis l'acquisition normale (~2,08 j/mois) reprend par-dessus. Les salariés déjà présents sont ainsi « comptés » sans repartir de zéro — il suffit de connaître leur solde de départ (depuis l'ancien suivi : tableur, fiches de paie, etc.).
+
+> 💡 En cas d'erreur de reprise, un administrateur peut **ajuster un solde** à la main depuis l'onglet *Soldes* (régularisation).
diff --git a/frontend/pages/help.vue b/frontend/pages/help.vue
index bd00046..5b4da7a 100644
--- a/frontend/pages/help.vue
+++ b/frontend/pages/help.vue
@@ -20,6 +20,7 @@ const META: Record<string, { title: string, icon: string, accent: string, roles:
     '03-my-tasks':           { title: 'Mes tâches',           icon: 'mdi:checkbox-marked-circle-outline', accent: 'from-sky-500 to-cyan-500',        roles: ['admin', 'user'] },
     '04-time-tracking':      { title: 'Time tracking',        icon: 'mdi:timer-outline',                   accent: 'from-emerald-500 to-teal-500',    roles: ['admin', 'user'] },
     '05-tasks-detail':       { title: 'Tâches en détail',     icon: 'mdi:file-document-edit-outline',      accent: 'from-violet-500 to-purple-600',  roles: ['admin', 'user'] },
+    '06-absences':           { title: 'Absences',             icon: 'mdi:calendar-account-outline',        accent: 'from-lime-500 to-green-600',     roles: ['admin', 'user'] },
     '07-admin':              { title: 'Administration',       icon: 'mdi:shield-crown-outline',            accent: 'from-rose-500 to-pink-600',      roles: ['admin'] },
     '08-integrations':       { title: 'Intégrations',         icon: 'mdi:puzzle-outline',                  accent: 'from-blue-500 to-indigo-500',    roles: ['admin', 'user'] },
     '09-mcp-api':            { title: 'Token MCP & API',      icon: 'mdi:robot-outline',                   accent: 'from-slate-700 to-slate-900',    roles: ['admin', 'user'] },

From e9aaccc62c6eb3966d0c231131c9160b6c975b2d Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Fri, 22 May 2026 15:20:20 +0200
Subject: [PATCH 6/9] =?UTF-8?q?docs(absences)=20:=20spec=20de=20mise=20en?=
 =?UTF-8?q?=20conformit=C3=A9=20l=C3=A9gale=20(p=C3=A9rim=C3=A8tre=201-6)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Design des corrections légales retenues (modèle événements familiaux sans
solde, décès=motif obligatoire, ajout naissance, parental=suspension,
garde-fou demi-journée, CCN documentée). Points lourds (ancienneté, CP
pendant maladie, rétention) explicitement reportés en backlog.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 ...2-absence-legal-compliance-fixes-design.md | 88 +++++++++++++++++++
 1 file changed, 88 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-05-22-absence-legal-compliance-fixes-design.md

diff --git a/docs/superpowers/specs/2026-05-22-absence-legal-compliance-fixes-design.md b/docs/superpowers/specs/2026-05-22-absence-legal-compliance-fixes-design.md
new file mode 100644
index 0000000..7f0ff3c
--- /dev/null
+++ b/docs/superpowers/specs/2026-05-22-absence-legal-compliance-fixes-design.md
@@ -0,0 +1,88 @@
+# Mise en conformité légale du module Absences — Design
+
+> **Date** : 2026-05-22
+> **Branche** : `feat/absence-management`
+> **Origine** : audit `2026-05-22-absence-legal-compliance-review.md`. Ce design ne traite QUE les corrections retenues (périmètre arrêté avec l'utilisateur). Les points « lourds » sont explicitement reportés.
+
+## Objectif
+
+Corriger les non-conformités légales **structurantes mais à faible risque** du module Absences, sans multiplier les types/paramètres (préférence utilisateur : gérer le détail via le motif plutôt que par des paramètres structurés).
+
+## Décisions cadrées
+
+- **Décès** : un seul type, le lien de parenté est saisi dans le **motif** (rendu obligatoire) ; pas d'éclatement par lien.
+- **Points lourds reportés en backlog** (NON traités ici) : congés d'ancienneté Syntec + arrondi légal, acquisition de CP pendant arrêt maladie (loi 2024-364), politique de rétention/purge des justificatifs.
+
+## Périmètre (6 corrections)
+
+### 1. Les événements familiaux ne décrémentent plus de solde
+**Problème** : `AbsenceType::decrementsBalance()` renvoie `true` pour tout sauf la maladie. Mariage/PACS, décès et congé parental décrémentent donc un « solde » par (type, année) qui n'a **aucune acquisition** (artefact sémantique). Légalement, ces congés sont des **droits par événement**, non déduits d'un solde annuel.
+
+**Solution** : `decrementsBalance()` ne renvoie `true` que pour `PaidLeave` (CP).
+```php
+return self::PaidLeave === $this;
+```
+Conséquence : pour tous les autres types, `AbsenceBalanceService::reservePending/applyApproval/release` deviennent des no-op (déjà gardés par `shouldTrack()`/`decrementsBalance()`). Les demandes restent enregistrées, validées et décomptées (`countedDays`), mais ne touchent aucun `AbsenceBalance`.
+
+**Impact données** : les fixtures ne doivent plus semer de `AbsenceBalance` pour des types ≠ CP (à vérifier dans `AppFixtures`). Aucune migration (pas de changement de schéma).
+
+### 2. Décès — motif obligatoire, plus de forfait trompeur
+**Problème** : forfait unique `daysPerEvent = 3` < minimum légal (enfant 5 j + deuil 8 j ; conjoint/parent/fratrie 3 j).
+
+**Solution** :
+- Policy décès : `daysPerEvent = null` (« selon lien de parenté », pas de forfait codé en dur faux).
+- **Motif obligatoire** pour le type décès, contrôlé à la création dans **les deux** chemins : `AbsenceRequestProcessor` (REST) et `CreateAbsenceRequestTool` (MCP). Erreur explicite si `reason` vide.
+- Les minimums légaux sont rappelés dans l'aide `/help` (06-absences) ; l'admin accorde le nombre de jours correct en validant les dates.
+
+### 3. Ajout du congé naissance
+**Problème** : type absent.
+
+**Solution** : nouveau cas `AbsenceType::Birth = 'naissance'`.
+- `label()` = « Naissance ».
+- `decrementsBalance()` = `false` (couvert par le point 1).
+- Policy par défaut (fixtures) : `daysPerEvent = 3`, `justificationRequired = true`, `countWorkingDaysOnly = true`, `active = true`.
+- Frontend : ajouter « naissance » à la liste des types proposés (form Nouvelle demande) + libellés i18n + couleur de badge dans `useAbsenceHelpers`.
+
+### 4. Congé parental = suspension
+**Problème** : modélisé comme décompte de solde.
+
+**Solution** : couvert par le point 1 (`decrementsBalance()` false). Le congé parental reste enregistré comme **absence longue justifiée**, sans impact solde. `daysPerYear`/`daysPerEvent` restent `null`. Justificatif requis (policy inchangée si déjà à true).
+
+### 5. Garde-fou demi-journée
+**Problème** : `AbsenceDayCalculator::countWorkingDays` retire `-0,5` pour `startHalfDay`/`endHalfDay` **sans vérifier** que le jour-borne est réellement décompté (week-end/férié). Sous-décompte possible.
+
+**Solution** : n'appliquer la déduction de demi-journée que si le jour-borne (début pour `startHalfDay`, fin pour `endHalfDay`) est un jour effectivement compté. Couvert par un **test unitaire** dédié dans `AbsenceDayCalculatorTest` (TDD : test rouge d'abord).
+
+### 6. Documenter la convention collective
+**Problème** : hypothèses Syntec codées en dur, CCN nulle part formalisée.
+
+**Solution** : paramètre de config `app.absence.convention` (valeur `"Syntec (IDCC 1486)"`), affiché :
+- en sous-titre de l'onglet admin « Absences » (`AdminAbsencePolicyTab`) ;
+- dans l'aide `/help` (06-absences).
+Aucune logique conditionnée à cette valeur (purement documentaire/affichage).
+
+## Hors périmètre (backlog, documenté dans le rapport d'audit)
+
+- Congés d'ancienneté Syntec (1/2/3/4 j à 5/10/15/20 ans) + arrondi légal à l'entier supérieur.
+- Acquisition de CP pendant arrêt maladie (loi 2024-364, 2 j ouvrables/mois plafonnés).
+- Politique de rétention/purge des justificatifs (données de santé) et des demandes.
+- Contrôle de solde négatif à l'approbation (comportement « poser le N en cours » volontairement conservé).
+- Alsace-Moselle (jours fériés spécifiques).
+
+## Tests & validation
+
+- **TDD** : test rouge → vert pour le garde-fou demi-journée (point 5) dans `tests/Unit/Service/AbsenceDayCalculatorTest.php`.
+- Test du motif décès obligatoire (création MCP) dans le cycle de vie existant ou un test ciblé.
+- `make test` au vert (49 + nouveaux), `lint:container` OK, `doctrine:schema:validate` OK (aucune migration), `php-cs-fixer` propre.
+- Build Nuxt OK (changements front : type naissance + i18n + libellés CCN).
+- Vérif fonctionnelle : créer une demande décès sans motif → refus ; avec motif → OK et **aucun** `AbsenceBalance` créé pour le décès.
+
+## Composants touchés
+
+- `src/Enum/AbsenceType.php` (decrementsBalance, cas Birth, label).
+- `src/State/AbsenceRequestProcessor.php` + `src/Mcp/Tool/Absence/CreateAbsenceRequestTool.php` (motif décès obligatoire).
+- `src/Service/AbsenceDayCalculator.php` (garde-fou demi-journée).
+- `src/DataFixtures/AppFixtures.php` (policy naissance, décès daysPerEvent=null, plus de balance non-CP).
+- `config/services.yaml` (param convention) + `AdminAbsencePolicyTab.vue` + `06-absences.md` (affichage CCN).
+- `frontend/composables/useAbsenceHelpers.ts` + `frontend/components/absence/AbsenceRequestDrawer.vue` + `i18n/locales/fr.json` (type naissance).
+- Tests : `AbsenceDayCalculatorTest`, `AbsenceRequestLifecycleTest`.

From f9773b3a5e2296bec0445dc8ab777daf892c5950 Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Fri, 22 May 2026 16:00:28 +0200
Subject: [PATCH 7/9] =?UTF-8?q?feat(absences)=20:=20mise=20en=20conformit?=
 =?UTF-8?q?=C3=A9=20l=C3=A9gale=20(=C3=A9v=C3=A9nements=20familiaux,=20dem?=
 =?UTF-8?q?i-journ=C3=A9e,=20CCN)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Périmètre 1-6 du design 2026-05-22-absence-legal-compliance-fixes (points
lourds — ancienneté, CP pendant maladie, rétention — reportés en backlog).

- Événements familiaux sans solde : AbsenceType::decrementsBalance() ne vaut
  true que pour les CP. Mariage/PACS, naissance, décès = droits par événement ;
  congé parental = suspension ; maladie = Sécu. Plus de solde fantôme.
- Décès : daysPerEvent = null (selon lien de parenté) + motif obligatoire à la
  création (REST + MCP), les minimums légaux étant rappelés dans l'aide.
- Ajout du congé naissance (type, policy 3 j, justificatif, libellés/couleur front).
- Garde-fou demi-journée : -0,5 appliqué uniquement si le jour-borne est
  réellement décompté (corrige un sous-décompte week-end/férié) — TDD.
- CCN documentée : paramètre app.absence.convention = "Syntec (IDCC 1486)",
  rappelée en sous-titre admin et dans l'aide /help.

Tests : AbsenceDayCalculatorTest (garde-fou demi-journée), AbsenceRequestLifecycle
(motif décès obligatoire + aucun solde touché). make test 52/52, build Nuxt OK.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 config/services.yaml                          |  3 ++
 frontend/composables/useAbsenceHelpers.ts     |  1 +
 frontend/content/help/06-absences.md          | 14 ++++---
 frontend/i18n/locales/fr.json                 |  3 +-
 frontend/services/dto/absence.ts              |  2 +-
 src/DataFixtures/AppFixtures.php              |  7 +++-
 src/Enum/AbsenceType.php                      | 10 ++++-
 .../Tool/Absence/CreateAbsenceRequestTool.php |  6 +++
 src/Service/AbsenceDayCalculator.php          | 35 +++++++++++-------
 src/State/AbsenceRequestProcessor.php         |  7 ++++
 .../Mcp/AbsenceRequestLifecycleTest.php       | 37 +++++++++++++++++++
 .../Unit/Service/AbsenceDayCalculatorTest.php | 23 ++++++++++++
 12 files changed, 123 insertions(+), 25 deletions(-)

diff --git a/config/services.yaml b/config/services.yaml
index 1708a92..b0f5649 100644
--- a/config/services.yaml
+++ b/config/services.yaml
@@ -10,6 +10,9 @@ parameters:
     task_document_upload_dir: '%kernel.project_dir%/var/uploads/documents'
     avatar_upload_dir: '%kernel.project_dir%/var/uploads/avatars'
     absence_justification_upload_dir: '%kernel.project_dir%/var/uploads/justificatifs'
+    # Reference collective agreement for the absence module's legal defaults.
+    # To confirm against the company's APE/NAF code (a CCN is not derived from activity alone).
+    app.absence.convention: 'Syntec (IDCC 1486)'
 
 imports:
     - { resource: version.yaml }
diff --git a/frontend/composables/useAbsenceHelpers.ts b/frontend/composables/useAbsenceHelpers.ts
index c8bc305..d4dadb7 100644
--- a/frontend/composables/useAbsenceHelpers.ts
+++ b/frontend/composables/useAbsenceHelpers.ts
@@ -20,6 +20,7 @@ const STATUS_ICONS: Record<AbsenceStatus, string> = {
 const TYPE_COLORS: Record<AbsenceType, string> = {
     cp: '#4A90D9',
     mariage_pacs: '#E91E63',
+    naissance: '#26A69A',
     conge_parental: '#9C27B0',
     deces: '#607D8B',
     maladie: '#C62828',
diff --git a/frontend/content/help/06-absences.md b/frontend/content/help/06-absences.md
index 0c748ab..e517eb1 100644
--- a/frontend/content/help/06-absences.md
+++ b/frontend/content/help/06-absences.md
@@ -1,6 +1,8 @@
 # Absences
 
-Le module **Absences** gère les congés des salariés : demande, validation, et suivi des soldes de congés payés (CP) et des congés pour événements (mariage/PACS, décès, congé parental, maladie).
+Le module **Absences** gère les congés des salariés : demande, validation, et suivi du **solde de congés payés (CP)**. Les congés pour événements familiaux (mariage/PACS, naissance, décès) sont des **droits par événement** : ils sont enregistrés et validés mais **ne se déduisent pas d'un solde**. Le congé parental et l'arrêt maladie sont des suspensions, sans impact sur les soldes.
+
+> Convention de référence pour les valeurs par défaut : **Syntec (IDCC 1486)** — à confirmer selon le code APE de l'entreprise (une CCN ne se déduit pas de la seule activité).
 
 Il y a deux espaces :
 
@@ -13,11 +15,13 @@ Il y a deux espaces :
 
 Depuis **Mes absences** → bouton *Nouvelle demande* :
 
-1. **Type** : Congés payés, Mariage/PACS, Congé parental, Décès, ou Maladie.
-2. **Dates** : début et fin. Une **demi-journée** (matin / après-midi) peut être posée sur le premier ou le dernier jour (décompte −0,5).
-3. **Motif** (optionnel) et **justificatif** (selon le type).
+1. **Type** : Congés payés, Mariage/PACS, Naissance, Congé parental, Décès, ou Maladie.
+2. **Dates** : début et fin. Une **demi-journée** (matin / après-midi) peut être posée sur le premier ou le dernier jour (décompte −0,5, uniquement si ce jour-borne est un jour décompté).
+3. **Motif** et **justificatif** (selon le type). Le **motif est obligatoire pour le décès** : il sert à préciser le lien de parenté, qui détermine le nombre de jours légal.
 
-La demande passe au statut **En attente**. Les jours sont immédiatement **réservés** dans le solde « en attente » pour éviter de poser deux fois les mêmes congés. Un administrateur valide ou refuse ensuite la demande.
+La demande passe au statut **En attente**, puis un administrateur la valide ou la refuse. Pour les CP uniquement, les jours sont immédiatement **réservés** dans le solde « en attente » pour éviter de poser deux fois les mêmes congés.
+
+> **Congés pour événements familiaux — minimums légaux (rappel).** Mariage/PACS : 4 jours. Naissance : 3 jours (hors congé paternité). Décès : selon le lien — **enfant : au moins 5 jours + 8 jours de congé de deuil**, conjoint/partenaire/parent/frère/sœur : 3 jours. L'administrateur accorde le nombre de jours légal en validant les dates. La convention Syntec peut prévoir des durées supérieures.
 
 ## Lire ses soldes
 
diff --git a/frontend/i18n/locales/fr.json b/frontend/i18n/locales/fr.json
index bcef698..4391b3f 100644
--- a/frontend/i18n/locales/fr.json
+++ b/frontend/i18n/locales/fr.json
@@ -577,6 +577,7 @@
         "types": {
             "cp": "Congés payés",
             "mariage_pacs": "Mariage / PACS",
+            "naissance": "Naissance",
             "conge_parental": "Congé parental",
             "deces": "Décès proche",
             "maladie": "Arrêt maladie"
@@ -719,7 +720,7 @@
         },
         "policies": {
             "title": "Politiques d'absence",
-            "subtitle": "Réglez les défauts par type d'absence (convention collective).",
+            "subtitle": "Réglez les défauts par type d'absence — convention de référence : Syntec (IDCC 1486), à confirmer selon le code APE.",
             "type": "Type",
             "daysPerYear": "Jours / an",
             "daysPerEvent": "Jours / événement",
diff --git a/frontend/services/dto/absence.ts b/frontend/services/dto/absence.ts
index fb1a2cb..d32a1ad 100644
--- a/frontend/services/dto/absence.ts
+++ b/frontend/services/dto/absence.ts
@@ -1,4 +1,4 @@
-export type AbsenceType = 'cp' | 'mariage_pacs' | 'conge_parental' | 'deces' | 'maladie'
+export type AbsenceType = 'cp' | 'mariage_pacs' | 'naissance' | 'conge_parental' | 'deces' | 'maladie'
 export type AbsenceStatus = 'pending' | 'approved' | 'rejected' | 'cancelled'
 export type HalfDay = 'matin' | 'apres_midi'
 
diff --git a/src/DataFixtures/AppFixtures.php b/src/DataFixtures/AppFixtures.php
index a6ef14f..c7ebabf 100644
--- a/src/DataFixtures/AppFixtures.php
+++ b/src/DataFixtures/AppFixtures.php
@@ -643,13 +643,16 @@ class AppFixtures extends Fixture
         // Absence management — policies, employees, balances, requests
         // =============================================
 
-        // Default policies for the 5 absence types (legal defaults, editable by admin)
+        // Default policies for the absence types (legal defaults, editable by admin)
         $policyData = [
             // [type, daysPerYear, daysPerEvent, justifRequired, noticeDays, workingDaysOnly]
             [AbsenceType::PaidLeave, 25.0, null, false, 30, true],
             [AbsenceType::MarriagePacs, null, 4.0, true, 0, true],
+            [AbsenceType::Birth, null, 3.0, true, 0, true],
+            // Bereavement: no fixed entitlement — depends on the relationship to
+            // the deceased (legal minimums recalled in the help), reason required.
+            [AbsenceType::Bereavement, null, null, true, 0, true],
             [AbsenceType::ParentalLeave, null, null, true, 30, true],
-            [AbsenceType::Bereavement, null, 3.0, true, 0, true],
             [AbsenceType::SickLeave, null, null, true, 0, true],
         ];
 
diff --git a/src/Enum/AbsenceType.php b/src/Enum/AbsenceType.php
index c868e32..0406dcb 100644
--- a/src/Enum/AbsenceType.php
+++ b/src/Enum/AbsenceType.php
@@ -8,6 +8,7 @@ enum AbsenceType: string
 {
     case PaidLeave     = 'cp';
     case MarriagePacs  = 'mariage_pacs';
+    case Birth         = 'naissance';
     case ParentalLeave = 'conge_parental';
     case Bereavement   = 'deces';
     case SickLeave     = 'maladie';
@@ -17,6 +18,7 @@ enum AbsenceType: string
         return match ($this) {
             self::PaidLeave     => 'Congés payés',
             self::MarriagePacs  => 'Mariage / PACS',
+            self::Birth         => 'Naissance',
             self::ParentalLeave => 'Congé parental',
             self::Bereavement   => 'Décès proche',
             self::SickLeave     => 'Arrêt maladie',
@@ -25,10 +27,14 @@ enum AbsenceType: string
 
     /**
      * Whether taking this absence decrements a balance.
-     * Sick leave is managed by social security and has no balance.
+     *
+     * Only paid leave (CP) draws down an acquired balance. Family-event leaves
+     * (marriage/PACS, birth, bereavement) are per-event entitlements, parental
+     * leave is a contract suspension, and sick leave is handled by social
+     * security — none of them decrement a balance.
      */
     public function decrementsBalance(): bool
     {
-        return self::SickLeave !== $this;
+        return self::PaidLeave === $this;
     }
 }
diff --git a/src/Mcp/Tool/Absence/CreateAbsenceRequestTool.php b/src/Mcp/Tool/Absence/CreateAbsenceRequestTool.php
index 80d6658..8a7af97 100644
--- a/src/Mcp/Tool/Absence/CreateAbsenceRequestTool.php
+++ b/src/Mcp/Tool/Absence/CreateAbsenceRequestTool.php
@@ -73,6 +73,12 @@ class CreateAbsenceRequestTool
             throw new InvalidArgumentException('This absence type is not available.');
         }
 
+        // Bereavement has no fixed entitlement: the relationship to the deceased
+        // drives the legal number of days, so the reason is mandatory.
+        if (AbsenceType::Bereavement === $typeEnum && '' === trim((string) $reason)) {
+            throw new InvalidArgumentException('A reason (relationship to the deceased) is required for bereavement leave.');
+        }
+
         if ($this->requestRepository->hasOverlap($user, $start, $end)) {
             throw new InvalidArgumentException('This request overlaps an existing absence.');
         }
diff --git a/src/Service/AbsenceDayCalculator.php b/src/Service/AbsenceDayCalculator.php
index fd8ed5a..2a4d667 100644
--- a/src/Service/AbsenceDayCalculator.php
+++ b/src/Service/AbsenceDayCalculator.php
@@ -42,32 +42,39 @@ final readonly class AbsenceDayCalculator
         $period = new DatePeriod($start, new DateInterval('P1D'), $end->modify('+1 day'));
 
         foreach ($period as $day) {
-            $weekday = (int) $day->format('N'); // 1 (Mon) .. 7 (Sun)
-
-            if (7 === $weekday) {
-                continue; // Sunday: never counted
+            if ($this->isCountedDay($day, $workingDaysOnly)) {
+                ++$days;
             }
-            if (6 === $weekday && $workingDaysOnly) {
-                continue; // Saturday: only counted for "jours ouvrables"
-            }
-            if ($this->holidayProvider->isHoliday($day)) {
-                continue;
-            }
-
-            ++$days;
         }
 
         if ($days <= 0.0) {
             return 0.0;
         }
 
-        if (null !== $startHalfDay) {
+        // A half-day only subtracts 0.5 when its boundary day is actually
+        // counted (otherwise a half-day posted on a weekend/holiday would
+        // wrongly under-count the absence).
+        if (null !== $startHalfDay && $this->isCountedDay($start, $workingDaysOnly)) {
             $days -= 0.5;
         }
-        if (null !== $endHalfDay) {
+        if (null !== $endHalfDay && $this->isCountedDay($end, $workingDaysOnly)) {
             $days -= 0.5;
         }
 
         return max(0.0, $days);
     }
+
+    private function isCountedDay(DateTimeImmutable $day, bool $workingDaysOnly): bool
+    {
+        $weekday = (int) $day->format('N'); // 1 (Mon) .. 7 (Sun)
+
+        if (7 === $weekday) {
+            return false; // Sunday: never counted
+        }
+        if (6 === $weekday && $workingDaysOnly) {
+            return false; // Saturday: only counted for "jours ouvrables"
+        }
+
+        return !$this->holidayProvider->isHoliday($day);
+    }
 }
diff --git a/src/State/AbsenceRequestProcessor.php b/src/State/AbsenceRequestProcessor.php
index 4322195..e65ec99 100644
--- a/src/State/AbsenceRequestProcessor.php
+++ b/src/State/AbsenceRequestProcessor.php
@@ -9,6 +9,7 @@ use ApiPlatform\State\ProcessorInterface;
 use App\Entity\AbsenceRequest;
 use App\Entity\User;
 use App\Enum\AbsenceStatus;
+use App\Enum\AbsenceType;
 use App\Repository\AbsencePolicyRepository;
 use App\Repository\AbsenceRequestRepository;
 use App\Service\AbsenceBalanceService;
@@ -60,6 +61,12 @@ final readonly class AbsenceRequestProcessor implements ProcessorInterface
             throw new UnprocessableEntityHttpException('This absence type is not available.');
         }
 
+        // Bereavement has no fixed entitlement: the relationship to the deceased
+        // drives the legal number of days, so the reason is mandatory.
+        if (AbsenceType::Bereavement === $type && '' === trim((string) $data->getReason())) {
+            throw new UnprocessableEntityHttpException('A reason (relationship to the deceased) is required for bereavement leave.');
+        }
+
         if ($this->requestRepository->hasOverlap($user, $startDate, $endDate)) {
             throw new ConflictHttpException('This request overlaps an existing absence.');
         }
diff --git a/tests/Functional/Mcp/AbsenceRequestLifecycleTest.php b/tests/Functional/Mcp/AbsenceRequestLifecycleTest.php
index 2f4335a..a2b37f5 100644
--- a/tests/Functional/Mcp/AbsenceRequestLifecycleTest.php
+++ b/tests/Functional/Mcp/AbsenceRequestLifecycleTest.php
@@ -17,6 +17,7 @@ use App\Repository\UserRepository;
 use App\Service\AbsenceBalanceService;
 use App\Service\AbsenceDayCalculator;
 use Doctrine\ORM\EntityManagerInterface;
+use InvalidArgumentException;
 use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
 use Symfony\Bundle\SecurityBundle\Security;
 
@@ -127,6 +128,42 @@ class AbsenceRequestLifecycleTest extends KernelTestCase
         self::assertSame(0.0, $balance->getPending());
     }
 
+    public function testBereavementRequiresReasonAndDoesNotTouchBalance(): void
+    {
+        // Ensure an active bereavement policy exists (no fixed entitlement).
+        $policy = $this->em->getRepository(AbsencePolicy::class)->findOneBy(['type' => AbsenceType::Bereavement]);
+        if (null === $policy) {
+            $policy = new AbsencePolicy();
+            $policy->setType(AbsenceType::Bereavement);
+            $policy->setCountWorkingDaysOnly(true);
+            $this->em->persist($policy);
+        }
+        $policy->setActive(true);
+        $this->em->flush();
+
+        $tool = $this->createTool($this->admin);
+
+        // Without a reason → rejected.
+        try {
+            ($tool)($this->employee->getId(), 'deces', '2026-06-10', '2026-06-12');
+            self::fail('Expected an exception for bereavement without a reason.');
+        } catch (InvalidArgumentException $e) {
+            self::assertStringContainsString('reason', $e->getMessage());
+        }
+
+        // With a reason → accepted, and no balance row is created (per-event right).
+        $data = json_decode(
+            ($tool)($this->employee->getId(), 'deces', '2026-06-10', '2026-06-12', null, null, 'Décès grand-parent'),
+            true,
+        );
+        self::assertSame('pending', $data['status']);
+
+        $balance = self::getContainer()->get(AbsenceBalanceRepository::class)
+            ->findOneForPeriod($this->employee, AbsenceType::Bereavement, '2026')
+        ;
+        self::assertNull($balance, 'Bereavement must not create or touch any balance.');
+    }
+
     private function securityFor(User $user): Security
     {
         $security = $this->createMock(Security::class);
diff --git a/tests/Unit/Service/AbsenceDayCalculatorTest.php b/tests/Unit/Service/AbsenceDayCalculatorTest.php
index 591763e..0eecdcd 100644
--- a/tests/Unit/Service/AbsenceDayCalculatorTest.php
+++ b/tests/Unit/Service/AbsenceDayCalculatorTest.php
@@ -77,6 +77,29 @@ class AbsenceDayCalculatorTest extends TestCase
         ));
     }
 
+    public function testHalfDayOnNonCountedStartIsIgnored(): void
+    {
+        // Sat 2026-06-06 → Mon 2026-06-08, jours ouvrés : Sat & Sun skipped, Mon = 1.
+        // startHalfDay sits on Saturday (not counted) => must NOT subtract 0.5.
+        self::assertSame(1.0, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-06'),
+            new DateTimeImmutable('2026-06-08'),
+            HalfDay::Afternoon,
+        ));
+    }
+
+    public function testHalfDayOnNonCountedEndIsIgnored(): void
+    {
+        // Fri 2026-06-05 → Sun 2026-06-07, jours ouvrés : Fri = 1, weekend skipped.
+        // endHalfDay sits on Sunday (not counted) => must NOT subtract 0.5.
+        self::assertSame(1.0, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-05'),
+            new DateTimeImmutable('2026-06-07'),
+            null,
+            HalfDay::Morning,
+        ));
+    }
+
     public function testWorkingDaysVsOpenDays(): void
     {
         // Fri 2026-06-05 to Mon 2026-06-08, "ouvrables" includes Saturday

From 65df36dd1ac3c24749d7b0d0d30d2a31403983fc Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Fri, 22 May 2026 16:48:49 +0200
Subject: [PATCH 8/9] =?UTF-8?q?fix(absences)=20:=20garde-fou=20solde=20n?=
 =?UTF-8?q?=C3=A9gatif=20=C3=A0=20l'approbation=20+=20coh=C3=A9rence=20fix?=
 =?UTF-8?q?ture?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- AbsenceBalanceService::availableForRequest() : jours disponibles (acquis N-1
  + en cours N − pris) pour la période de la demande, null si type non suivi.
- Blocage de l'approbation si countedDays > disponible, dans les deux chemins
  (REST AbsenceReviewProcessor + MCP ReviewAbsenceRequestTool), comme le motif
  décès. Les CP en cours d'acquisition restent posables, mais pas au-delà du
  droit total (plus de solde négatif silencieux à l'approbation).
- Fixture : demande pending CP d'alice replacée dans sa période de référence
  2025-2026 (26→29/05/2026, 4 j ouvrés) et solde pending aligné (5 → 4) ;
  plus de "en attente" orphelin non lié à une demande.
- Test fonctionnel testApproveBeyondAvailableBalanceIsBlocked + employé de test
  doté d'un droit pour que les approbations existantes passent le garde-fou.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/DataFixtures/AppFixtures.php              | 12 ++++--
 .../Tool/Absence/ReviewAbsenceRequestTool.php | 10 +++++
 src/Service/AbsenceBalanceService.php         | 23 ++++++++++++
 src/State/AbsenceReviewProcessor.php          | 11 ++++++
 .../Mcp/AbsenceRequestLifecycleTest.php       | 37 +++++++++++++++++++
 5 files changed, 89 insertions(+), 4 deletions(-)

diff --git a/src/DataFixtures/AppFixtures.php b/src/DataFixtures/AppFixtures.php
index c7ebabf..ef9f2cb 100644
--- a/src/DataFixtures/AppFixtures.php
+++ b/src/DataFixtures/AppFixtures.php
@@ -686,8 +686,9 @@ class AppFixtures extends Fixture
         $cpPeriod    = '2025-2026';
         $balanceData = [
             // [user, acquired (N-1), acquiring (N, en cours), taken, pending]
+            // Alice's `pending` matches her pending CP request below (same 2025-2026 period).
             [$admin, 10.0, 22.5, 5.0, 0.0],
-            [$userAlice, 8.0, 18.0, 2.0, 5.0],
+            [$userAlice, 8.0, 18.0, 2.0, 4.0],
             [$userBob, 0.0, 14.0, 0.0, 0.0],
         ];
 
@@ -717,12 +718,15 @@ class AppFixtures extends Fixture
         $approvedCp->setReviewedBy($admin);
         $manager->persist($approvedCp);
 
+        // Pending CP within Alice's current reference period (2025-2026), so the
+        // reserved days line up with her balance's `pending` bucket above.
+        // Tue 26 → Fri 29 May 2026 = 4 working days (Pentecost Mon 25/05 excluded).
         $pendingCp = new AbsenceRequest();
         $pendingCp->setUser($userAlice);
         $pendingCp->setType(AbsenceType::PaidLeave);
-        $pendingCp->setStartDate(new DateTimeImmutable('2026-06-15'));
-        $pendingCp->setEndDate(new DateTimeImmutable('2026-06-19'));
-        $pendingCp->setCountedDays(5.0);
+        $pendingCp->setStartDate(new DateTimeImmutable('2026-05-26'));
+        $pendingCp->setEndDate(new DateTimeImmutable('2026-05-29'));
+        $pendingCp->setCountedDays(4.0);
         $pendingCp->setStatus(AbsenceStatus::Pending);
         $pendingCp->setCreatedAt(new DateTimeImmutable('-2 days'));
         $manager->persist($pendingCp);
diff --git a/src/Mcp/Tool/Absence/ReviewAbsenceRequestTool.php b/src/Mcp/Tool/Absence/ReviewAbsenceRequestTool.php
index 3391781..1556d8a 100644
--- a/src/Mcp/Tool/Absence/ReviewAbsenceRequestTool.php
+++ b/src/Mcp/Tool/Absence/ReviewAbsenceRequestTool.php
@@ -52,6 +52,16 @@ class ReviewAbsenceRequestTool
         assert($admin instanceof User);
 
         if ('approve' === $decision) {
+            // Never let an approval push the balance below zero (CP only).
+            $available = $this->balanceService->availableForRequest($request);
+            if (null !== $available && $request->getCountedDays() > $available + 1e-9) {
+                throw new InvalidArgumentException(sprintf(
+                    'Approving this request would put the balance below zero: %g day(s) requested but only %g available.',
+                    $request->getCountedDays(),
+                    $available,
+                ));
+            }
+
             $request->setStatus(AbsenceStatus::Approved);
             $request->setRejectionReason(null);
             $this->balanceService->applyApproval($request);
diff --git a/src/Service/AbsenceBalanceService.php b/src/Service/AbsenceBalanceService.php
index 399cb64..471bd11 100644
--- a/src/Service/AbsenceBalanceService.php
+++ b/src/Service/AbsenceBalanceService.php
@@ -70,6 +70,29 @@ final readonly class AbsenceBalanceService
         $balance->setPending($balance->getPending() + $request->getCountedDays());
     }
 
+    /**
+     * Days still available to take in the request's balance period
+     * (acquired N-1 + acquiring N − already taken), or null when the type is
+     * not balance-tracked (per-event leaves such as bereavement or marriage).
+     *
+     * Days currently reserved in PENDING are intentionally not subtracted: the
+     * request being reviewed already sits in that pending bucket, and approval
+     * only moves it to TAKEN.
+     */
+    public function availableForRequest(AbsenceRequest $request): ?float
+    {
+        if (!$this->shouldTrack($request)) {
+            return null;
+        }
+
+        /** @var User $user */
+        $user    = $request->getUser();
+        $period  = $this->periodFor($user, $request->getType(), $request->getStartDate());
+        $balance = $this->balanceRepository->findOneForPeriod($user, $request->getType(), $period);
+
+        return $balance?->getAvailable() ?? 0.0;
+    }
+
     /** Move reserved days from PENDING to TAKEN on approval. */
     public function applyApproval(AbsenceRequest $request): void
     {
diff --git a/src/State/AbsenceReviewProcessor.php b/src/State/AbsenceReviewProcessor.php
index 9e8a881..0eecb1e 100644
--- a/src/State/AbsenceReviewProcessor.php
+++ b/src/State/AbsenceReviewProcessor.php
@@ -58,6 +58,17 @@ final readonly class AbsenceReviewProcessor implements ProcessorInterface
         assert($admin instanceof User);
 
         if ($isApprove) {
+            // Never let an approval push the balance below zero (CP only): the
+            // days being accrued (N) are posable, but not beyond the entitlement.
+            $available = $this->balanceService->availableForRequest($data);
+            if (null !== $available && $data->getCountedDays() > $available + 1e-9) {
+                throw new UnprocessableEntityHttpException(sprintf(
+                    'Approving this request would put the balance below zero: %g day(s) requested but only %g available.',
+                    $data->getCountedDays(),
+                    $available,
+                ));
+            }
+
             $data->setStatus(AbsenceStatus::Approved);
             $data->setRejectionReason(null);
             $this->balanceService->applyApproval($data);
diff --git a/tests/Functional/Mcp/AbsenceRequestLifecycleTest.php b/tests/Functional/Mcp/AbsenceRequestLifecycleTest.php
index a2b37f5..55fa495 100644
--- a/tests/Functional/Mcp/AbsenceRequestLifecycleTest.php
+++ b/tests/Functional/Mcp/AbsenceRequestLifecycleTest.php
@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Tests\Functional\Mcp;
 
+use App\Entity\AbsenceBalance;
 use App\Entity\AbsencePolicy;
 use App\Entity\User;
 use App\Enum\AbsenceType;
@@ -62,6 +63,15 @@ class AbsenceRequestLifecycleTest extends KernelTestCase
             $policy->setActive(true);
         }
 
+        // Entitlement so CP requests can be approved without breaching the
+        // no-negative-balance guard (period of the June 2026 test requests).
+        $balance = new AbsenceBalance();
+        $balance->setUser($this->employee);
+        $balance->setType(AbsenceType::PaidLeave);
+        $balance->setPeriod('2026-2027');
+        $balance->setAcquired(25.0);
+        $this->em->persist($balance);
+
         $this->em->flush();
     }
 
@@ -110,6 +120,33 @@ class AbsenceRequestLifecycleTest extends KernelTestCase
         self::assertSame(5.0, $balance->getTaken());
     }
 
+    public function testApproveBeyondAvailableBalanceIsBlocked(): void
+    {
+        $created = json_decode(
+            ($this->createTool($this->admin))($this->employee->getId(), 'cp', '2026-06-01', '2026-06-05'),
+            true,
+        );
+
+        // Shrink the entitlement below the 5 requested days.
+        $balance = self::getContainer()->get(AbsenceBalanceRepository::class)
+            ->findOneForPeriod($this->employee, AbsenceType::PaidLeave, '2026-2027')
+        ;
+        $balance->setAcquired(2.0);
+        $balance->setAcquiring(0.0);
+        $this->em->flush();
+
+        try {
+            ($this->reviewTool($this->admin))($created['id'], 'approve');
+            self::fail('Expected approval to be blocked when it would breach the balance.');
+        } catch (InvalidArgumentException $e) {
+            self::assertStringContainsString('below zero', $e->getMessage());
+        }
+
+        // Approval bailed out before mutating: nothing moved to taken, days stay reserved.
+        self::assertSame(0.0, $balance->getTaken());
+        self::assertSame(5.0, $balance->getPending());
+    }
+
     public function testAdminCancelApprovedReleasesTaken(): void
     {
         $created = json_decode(

From 45e86543a1465ffd12f5587e3fe62272fe0a88d9 Mon Sep 17 00:00:00 2001
From: Matthieu <mtholot19@gmail.com>
Date: Tue, 26 May 2026 10:05:42 +0200
Subject: [PATCH 9/9] =?UTF-8?q?fix(absences)=20:=20demi-journ=C3=A9e=20mon?=
 =?UTF-8?q?o-jour=20d=C3=A9compt=C3=A9e=200,5=20(et=20non=200)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sur une demande d'un seul jour, le formulaire recopie la demi-journée de
début sur la fin (même date), si bien que les deux bornes portaient une
demi-journée et 0,5 était soustrait deux fois (1 - 0,5 - 0,5 = 0).

Quand start et end tombent le même jour, les deux bornes se confondent :
on ne soustrait désormais 0,5 qu'une seule fois. Comparaison par
getTimestamp() pour rester compatible strict_comparison (=== sur deux
DateTimeImmutable distincts teste l'identité d'instance, pas la valeur).

Couverture complétée : mono-jour plein, week-end, férié, inversion de
dates, demi-journée de fin seule, demi sur samedi en mode ouvrables.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/Service/AbsenceDayCalculator.php          | 18 +++--
 .../Unit/Service/AbsenceDayCalculatorTest.php | 76 +++++++++++++++++++
 2 files changed, 89 insertions(+), 5 deletions(-)

diff --git a/src/Service/AbsenceDayCalculator.php b/src/Service/AbsenceDayCalculator.php
index 2a4d667..d30a598 100644
--- a/src/Service/AbsenceDayCalculator.php
+++ b/src/Service/AbsenceDayCalculator.php
@@ -54,11 +54,19 @@ final readonly class AbsenceDayCalculator
         // A half-day only subtracts 0.5 when its boundary day is actually
         // counted (otherwise a half-day posted on a weekend/holiday would
         // wrongly under-count the absence).
-        if (null !== $startHalfDay && $this->isCountedDay($start, $workingDaysOnly)) {
-            $days -= 0.5;
-        }
-        if (null !== $endHalfDay && $this->isCountedDay($end, $workingDaysOnly)) {
-            $days -= 0.5;
+        if ($start->getTimestamp() === $end->getTimestamp()) {
+            // Single-day request: both boundaries collapse onto the same day,
+            // so a half-day must subtract 0.5 once, never twice.
+            if ((null !== $startHalfDay || null !== $endHalfDay) && $this->isCountedDay($start, $workingDaysOnly)) {
+                $days -= 0.5;
+            }
+        } else {
+            if (null !== $startHalfDay && $this->isCountedDay($start, $workingDaysOnly)) {
+                $days -= 0.5;
+            }
+            if (null !== $endHalfDay && $this->isCountedDay($end, $workingDaysOnly)) {
+                $days -= 0.5;
+            }
         }
 
         return max(0.0, $days);
diff --git a/tests/Unit/Service/AbsenceDayCalculatorTest.php b/tests/Unit/Service/AbsenceDayCalculatorTest.php
index 0eecdcd..33b96a3 100644
--- a/tests/Unit/Service/AbsenceDayCalculatorTest.php
+++ b/tests/Unit/Service/AbsenceDayCalculatorTest.php
@@ -68,6 +68,15 @@ class AbsenceDayCalculatorTest extends TestCase
         ));
     }
 
+    public function testSingleFullDayCountsOne(): void
+    {
+        // Most common request: a single full working day = 1.0 (no half-day).
+        self::assertSame(1.0, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-01'),
+            new DateTimeImmutable('2026-06-01'),
+        ));
+    }
+
     public function testSingleHalfDay(): void
     {
         self::assertSame(0.5, $this->calculator->countWorkingDays(
@@ -77,6 +86,73 @@ class AbsenceDayCalculatorTest extends TestCase
         ));
     }
 
+    public function testHalfDayEndOnlySubtractsHalf(): void
+    {
+        // Mirror of testHalfDayStartSubtractsHalf: end half-day only, on a
+        // counted multi-day range => 5 - 0.5 = 4.5.
+        self::assertSame(4.5, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-01'),
+            new DateTimeImmutable('2026-06-05'),
+            null,
+            HalfDay::Morning,
+        ));
+    }
+
+    public function testEndBeforeStartCountsZero(): void
+    {
+        // Inverted range guard (end < start) => 0, never negative.
+        self::assertSame(0.0, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-05'),
+            new DateTimeImmutable('2026-06-01'),
+        ));
+    }
+
+    public function testSingleDayOnWeekendCountsZero(): void
+    {
+        // Saturday, jours ouvrés: not counted, even with a half-day => 0.
+        self::assertSame(0.0, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-06'),
+            new DateTimeImmutable('2026-06-06'),
+            HalfDay::Morning,
+            HalfDay::Morning,
+        ));
+    }
+
+    public function testSingleDayOnHolidayCountsZero(): void
+    {
+        // Fri 2026-05-08 (Victoire 1945): public holiday => 0.
+        self::assertSame(0.0, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-05-08'),
+            new DateTimeImmutable('2026-05-08'),
+        ));
+    }
+
+    public function testHalfDayOnSaturdayCountedInOpenDays(): void
+    {
+        // Fri + Sat in "ouvrables" mode = 2; the end half-day sits on Saturday,
+        // which IS counted here => 2 - 0.5 = 1.5.
+        self::assertSame(1.5, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-05'),
+            new DateTimeImmutable('2026-06-06'),
+            null,
+            HalfDay::Morning,
+            false,
+        ));
+    }
+
+    public function testSingleDayWithBothHalfDaysIsStillHalf(): void
+    {
+        // Real-world single-day request: the form mirrors the start half-day
+        // onto the end (same day), so both boundaries carry a half-day. It must
+        // still count as 0.5, not 0 (the two boundaries collapse onto one day).
+        self::assertSame(0.5, $this->calculator->countWorkingDays(
+            new DateTimeImmutable('2026-06-01'),
+            new DateTimeImmutable('2026-06-01'),
+            HalfDay::Morning,
+            HalfDay::Morning,
+        ));
+    }
+
     public function testHalfDayOnNonCountedStartIsIgnored(): void
     {
         // Sat 2026-06-06 → Mon 2026-06-08, jours ouvrés : Sat & Sun skipped, Mon = 1.