Root cause: Accident.employee_name contains submitter EMAIL addresses
(e.g. info@scmedical.hk), not the injured staff name. UNION of all three
sources polluted the attendance staff dropdown with emails.
Fix:
- Removed Accident from /api/employees/list UNION (source=all now means
attendance + leave only)
- Added EMAIL_RE filter to skip any name containing @ (defensive)
- Updated docstring + response includes excluded field explaining why
Verified: 12 clean staff names returned (down from 16 with 4 emails mixed in)
IT Dog
c0076a125c