"""Leaver Blocked hard-gate + dashboard + dual-sign override.

The ``employment_status='left'`` invariant ("no row points at the
leaver") is the platform's hardest guarantee. This domain enforces it
at FOUR independent layers:

  1. ``LeaverBlockGuard`` — the public service every code path calls
     to flip a person to 'left'. Performs the blocker check + writes
     the audit row + raises ``LeaverBlockedError`` on rejection.

  2. SQLAlchemy ``before_flush`` event listener — registered at module
     import via ``register_listener``. Catches direct ORM mutations
     that bypassed the guard (e.g. ``person.employment_status = 'left'``)
     and treats them the same way: query blockers, audit, reject.

  3. ``IdentityPerson._validate_employment_status`` — model-level
     ``@validates`` ensuring the value is in the allowed set. Cheap
     defence-in-depth that catches typos at assignment time.

  4. ``DualSignOverrideService`` — escape hatch for genuine business
     emergencies: IT admin + a second signer (typically the person's
     department director) can co-sign an override that explicitly
     waives specific blocker IDs. The waiver itself is recorded
     forever in ``leaver_dual_sign_overrides``.

The dashboard (``LeaverBlockedDashboardService``) reads
OffboardingProcess + WorkflowRun + the latest leaver_block_audit rows
to power ``/admin/offboarding``.

The escalation tick (``LeaverEscalationService.run_tick`` extended
in this PR) walks first_blocked_at and advances sla_breach_level
through warn/urgent/breach.
"""
from app.domains.leaver_blocked.guard import (
    LEAVER_VIA_ADMIN_API,
    LEAVER_VIA_CLI,
    LEAVER_VIA_DUAL_SIGN_OVERRIDE,
    LEAVER_VIA_HRIS_SYNC,
    LEAVER_VIA_PROCESS_ADVANCE,
    LeaverBlockGuard,
    LeaverBlockResult,
)
from app.domains.leaver_blocked.models import (
    DUAL_SIGN_APPROVED,
    DUAL_SIGN_CANCELLED,
    DUAL_SIGN_EXECUTED,
    DUAL_SIGN_EXPIRED,
    DUAL_SIGN_PENDING_SECONDARY,
    DUAL_SIGN_REJECTED,
    LeaverBlockAudit,
    LeaverDualSignOverride,
)

__all__ = [
    "LeaverBlockGuard",
    "LeaverBlockResult",
    "LeaverBlockAudit",
    "LeaverDualSignOverride",
    "LEAVER_VIA_ADMIN_API",
    "LEAVER_VIA_HRIS_SYNC",
    "LEAVER_VIA_PROCESS_ADVANCE",
    "LEAVER_VIA_DUAL_SIGN_OVERRIDE",
    "LEAVER_VIA_CLI",
    "DUAL_SIGN_PENDING_SECONDARY",
    "DUAL_SIGN_APPROVED",
    "DUAL_SIGN_REJECTED",
    "DUAL_SIGN_EXECUTED",
    "DUAL_SIGN_CANCELLED",
    "DUAL_SIGN_EXPIRED",
]