fix: harden sessions and domain validation

tests/JobcardCalculationsTest.php

@@ -13,6 +13,9 @@ if (calculate_duration_hours(null, null, 1.25) !== 1.25) {
 if (calculate_duration_hours('11:30', '09:00') !== null) {
     throw new RuntimeException('Expected invalid reverse time to be rejected');
 }
+if (calculate_duration_hours(null, null, 0.0) !== null) {
+    throw new RuntimeException('Expected zero manual hours to be rejected');
+}
 $sla = calculate_sla_usage(20.0, [2.0, 1.5, 1.0]);
 if ($sla !== ['used' => 4.5, 'remaining' => 15.5, 'percentage' => 22.5, 'status' => 'within_limit']) {
     throw new RuntimeException('Unexpected SLA calculation: ' . json_encode($sla));

tests/JobcardDomainTest.php

@@ -29,5 +29,5 @@ if ($nonNumericEntry['valid'] || !isset($nonNumericEntry['errors']['hours'])) th
 
 $aggregator = new TimeAggregator();
 if ($aggregator->total([['hours' => 2.25], ['hours' => 1.5], ['hours' => -4]]) !== 3.75) throw new RuntimeException('Expected positive time aggregation.');
-if ($aggregator->slaTotal([['hours' => 2, 'counts_toward_sla' => true], ['hours' => 3, 'counts_toward_sla' => false]]) !== 2.0) throw new RuntimeException('Expected SLA-filtered aggregation.');
+if ($aggregator->slaTotal([['hours' => 2, 'counts_toward_sla' => true], ['hours' => 3, 'counts_toward_sla' => false], ['hours' => 1, 'counts_toward_sla' => 1]]) !== 3.0) throw new RuntimeException('Expected SLA-filtered aggregation.');
 printf("Jobcard domain tests: 12 passed\n");

tests/SlaDomainTest.php

@@ -2,9 +2,14 @@
 declare(strict_types=1);
 
 require_once __DIR__ . '/../app/Domain/SLA/SlaThresholdClassifier.php';
+require_once __DIR__ . '/../app/Domain/SLA/SlaCalculator.php';
 
 use App\Domain\SLA\SlaThresholdClassifier;
 
+$negativeRejected = false;
+try { calculate_sla_usage(-1.0, [1.0]); } catch (InvalidArgumentException $exception) { $negativeRejected = true; }
+if (!$negativeRejected) throw new RuntimeException('Negative SLA allocation must be rejected');
+
 $classifier = new SlaThresholdClassifier();
 if ($classifier->classify(7.5, 10.0) !== 'warning') throw new RuntimeException('75% should be warning.');
 if ($classifier->classify(9.0, 10.0) !== 'critical') throw new RuntimeException('90% should be critical.');