test(attendance): guard component method surfaces

docs/tests/unit/lombok-attendance-boilerplate.md

@@ -6,7 +6,8 @@
 - **Test class/method:**
   `com.lab.labtimesheet.feature.attendance.AttendanceLombokBoilerplateTest#generatedConstructorsPreserveParameterListsAndVisibility`,
   `com.lab.labtimesheet.feature.attendance.AttendanceLombokBoilerplateTest#immutableModelsRemainRecordsWithTheirComponentContracts`,
-  `com.lab.labtimesheet.feature.attendance.AttendanceLombokBoilerplateTest#entitiesExposeOnlyIntentionalPublicAndProtectedDeclaredMethods`
+  `com.lab.labtimesheet.feature.attendance.AttendanceLombokBoilerplateTest#entitiesExposeOnlyIntentionalPublicAndProtectedDeclaredMethods`,
+  `com.lab.labtimesheet.feature.attendance.AttendanceLombokBoilerplateTest#componentsExposeOnlyIntentionalPublicAndProtectedDeclaredMethods`
 - **Implementation commit:** `82ad8202fd31f77db8c3932a902dba07cee70894`
 
 ## Protected behavior
@@ -21,7 +22,8 @@ Reflection inspects compiled `feature.attendance` classes rather than source spe
 parameter order and modifier, every immutable model's record components, and the exact public/protected declared method
 surface of each Attendance entity. The entity surface prevents generated bean getters/setters or entity
 `equals`/`hashCode`/`toString` widening while explicitly retaining `AttendanceRecordEntity#setCheckOutAt` and the
-`LeaveRequestDayId` identity methods.
+`LeaveRequestDayId` identity methods. Exact controller and service surfaces likewise prevent Lombok from exposing
+collaborator getters/setters or generated `equals`/`hashCode`/`toString` methods.
 
 ## Hand-derived expected result
 
@@ -29,7 +31,8 @@ Five injection-only components expose only their package-scoped dependency const
 retain protected no-argument construction alongside their intentional domain constructors, and the stateless domain
 service remains package-scoped. Seven immutable models remain records with the same component order and types. Entity
 method surfaces contain only intentional domain conversion/access/mutation methods; only the composite key owns
-`equals` and `hashCode`, and no Attendance entity declares `toString`.
+`equals` and `hashCode`, and no Attendance entity declares `toString`. Both controllers and all four Attendance
+services expose only their existing route or application/domain operations, never their injected collaborators.
 
 ## RED
 
@@ -66,7 +69,7 @@ export PATH="$JAVA_HOME/bin:$PATH"
 **Observed result**
 
 ```text
-Tests run: 3, Failures: 0, Errors: 0, Skipped: 0
+Tests run: 4, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 Process exited 0.
 ```
@@ -80,7 +83,7 @@ export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
 export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
 ./mvnw -Dtest='*Attendance*Test' test
-Tests run: 38, Failures: 0, Errors: 0, Skipped: 0
+Tests run: 39, Failures: 0, Errors: 0, Skipped: 0
 PostgreSQL 18.4 started and Flyway applied V1 for the persistence and concurrency contexts.
 BUILD SUCCESS
 Process exited 0.
@@ -98,14 +101,6 @@ Additional verification on the same source tree:
 ./mvnw -DskipTests compile
 BUILD SUCCESS
 
-./mvnw -Dtest=AttendanceLombokBoilerplateTest,AttendanceLayerStructureTest,AttendancePolicyTest,AttendanceServiceTest,AttendanceApplicationServiceTest,AttendanceControllerTest test
-Tests run: 27, Failures: 0, Errors: 0, Skipped: 0
-BUILD SUCCESS
-
-./mvnw -Dtest=AttendancePersistenceIntegrationTest,AttendanceConcurrencyIntegrationTest test
-Tests run: 8, Failures: 0, Errors: 0, Skipped: 0
-PostgreSQL 18.4; BUILD SUCCESS
-
 ./mvnw -q -DskipTests compile dependency:build-classpath -Dmdep.outputFile=target/attendance-javadoc-classpath.txt
 javadoc -quiet -Xdoclint:all -d target/attendance-javadocs -classpath "target/classes:$(tr -d '\n' < target/attendance-javadoc-classpath.txt)" -sourcepath src/main/java -subpackages com.lab.labtimesheet.feature.attendance
 Process exited 0. The source frontend reported seven generated-constructor missing-comment warnings because it does not