Fix invalid vaccination dates in already vaccinated flow

The "record as already vaccinated" flow from a child programme page creates a
session-less `DraftVaccinationRecord`. In that path, draft date validation was not
being enforced consistently, so invalid vaccination dates could reach the
check-and-confirm step and then fail later when `VaccinationRecord` validation
ran on save.

Update `DraftVaccinationRecord` so `performed_at_date` range validation runs during
draft updates for session-less manual-report flows as well as session-backed
flows.

Jira-Issue: MAV-7121

Author: jhenderson

app/models/draft_vaccination_record.rb

@@ -92,7 +92,6 @@ def wizard_steps
 
   on_wizard_step :date_and_time, exact: true do
     validates :performed_at_date, presence: true
-    validate :performed_at_date_within_range
   end
 
   on_wizard_step :outcome, exact: true do
@@ -188,6 +187,8 @@ def wizard_steps
     validates :source, inclusion: { in: VaccinationRecord.sources.keys }
   end
 
+  validate :performed_at_date_within_range, on: :update
+
   def created_at = Time.current
 
   def administered?
@@ -478,7 +479,7 @@ def reset_unused_attributes
     end
   end
 
-  def academic_year = session&.academic_year
+  def academic_year = session&.academic_year || AcademicYear.pending
 
   def batch
     return nil if batch_id.nil?
@@ -498,7 +499,7 @@ def latest_possible_date
   end
 
   def performed_at_date_within_range
-    return if performed_at_date.nil? || session.nil?
+    return if performed_at_date.nil?
 
     if performed_at_date < earliest_possible_date
       errors.add(

spec/features/record_already_vaccinated_flu_spec.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+describe "Record already vaccinated" do
+  around { |example| travel_to(Date.new(2026, 5, 1)) { example.run } }
+
+  scenario "Flu rejects a future date" do
+    given_i_am_signed_in
+
+    when_i_go_to_a_patient
+    and_i_click_on_the_programme
+    then_i_see_the_patient_page
+
+    when_i_click_record_already_vaccinated
+    and_i_choose_a_future_date
+    then_i_see_an_error_for_the_future_date
+  end
+
+  def given_i_am_signed_in
+    programmes = [Programme.flu]
+
+    team = create(:team, :with_one_nurse, programmes:)
+    school = create(:gias_school, :primary, team:, programmes:)
+
+    @patient = create(:patient, :consent_no_response, school:, programmes:)
+
+    sign_in team.users.first
+  end
+
+  def when_i_go_to_a_patient
+    visit patient_path(@patient)
+  end
+
+  def and_i_click_on_the_programme
+    within(".app-secondary-navigation") { click_on "Flu" }
+  end
+
+  def then_i_see_the_patient_page
+    expect(page).to have_content(@patient.full_name)
+  end
+
+  def when_i_click_record_already_vaccinated
+    click_on "Record as already vaccinated"
+  end
+
+  def and_i_choose_a_future_date
+    fill_in "Day", with: "2"
+    fill_in "Month", with: "5"
+    fill_in "Year", with: "2026"
+    click_on "Continue"
+  end
+
+  def then_i_see_an_error_for_the_future_date
+    expect(page).to have_content(
+      "The vaccination cannot take place after 1 May 2026"
+    )
+    expect(page).not_to have_content("Check and confirm")
+  end
+end

spec/models/draft_vaccination_record_spec.rb

@@ -72,6 +72,33 @@
       end
     end
 
+    context "when recording recording already vaccinated" do
+      context "when performed_at is in the future on the date step" do
+        let(:attributes) do
+          valid_administered_attributes.merge(
+            patient_id: patient.id,
+            performed_at: 1.day.from_now,
+            programme_type: programme.type,
+            session_id: nil,
+            source: "manual_report"
+          )
+        end
+
+        around { |example| freeze_time { example.run } }
+
+        before { draft_vaccination_record.wizard_step = :date_and_time }
+
+        it "has an error" do
+          expect(draft_vaccination_record.save(context: :update)).to be(false)
+          expect(
+            draft_vaccination_record.errors[:performed_at_date]
+          ).to include(
+            "The vaccination cannot take place after #{Date.current.to_fs(:long)}"
+          )
+        end
+      end
+    end
+
     context "when the programme is flu" do
       let(:attributes) do
         valid_administered_attributes.merge(