feat(test): migration dry-run gate + boot smoke (Slice 1)

Slice 1 of docs/design-paliad-test-strategy-2026-05-19.md — the test
infrastructure that would have caught mig 098 (digit-regex) and mig 099
(missing audit_reason) before the deploy hit prod.

Three new files + one route addition:

- Makefile: `make verify-migrations` (alias `verify-mig`) runs the
  per-migration dry-run + boot smoke against TEST_DATABASE_URL. Fails
  fast with a clear error if TEST_DATABASE_URL is unset so CI can't
  silently pass a missing env var. `make test` and `make test-go`
  cover the rest of the short / full Go suites.

- internal/db/migrate_test.go (TestMigrations_DryRun): walks every
  pending *.up.sql in numeric order, applies each inside its own
  BEGIN..ROLLBACK transaction, fails on the first SQL error with the
  file name + Postgres error. "Pending" = greater than the scratch
  DB's current tracker version, so fresh-DB CI runs verify everything
  while developer scratch DBs only re-verify the new pending migration.
  Always non-destructive — the rollback runs even on success.

- cmd/server/main_smoke_test.go (TestBootSmoke): boots the apply path
  end-to-end, asserts (a) db.ApplyMigrations returns nil, (b) the
  tracker advanced to the highest *.up.sql version on disk with
  dirty=false, (c) GET /healthz on the registered mux returns 200.
  The dry-run catches per-migration syntax errors; this catches the
  apply+bind path the container actually runs.

- internal/handlers/handlers.go: adds a GET /healthz public route — a
  no-auth, no-DB liveness probe. Used by the boot smoke; also safe
  for any future orchestrator or uptime check.

Both live-DB tests gate on TEST_DATABASE_URL and skip cleanly without
it, matching the rest of paliad's live-DB test pattern.

Verification: go build ./... clean, go vet ./... clean,
go test -short ./internal/... ./cmd/... clean (all packages pass,
live-DB tests skip), bun run build clean (2436 i18n keys unchanged).

Per CLAUDE.md inventor → coder gate, NOT self-merged.

Makefile

@@ -0,0 +1,73 @@
+# Paliad — developer entrypoints.
+#
+# Targets here are the gate tier from the test-strategy design
+# (docs/design-paliad-test-strategy-2026-05-19.md). Slice 1 lands:
+#
+#   make verify-migrations   — dry-run every pending migration (BEGIN..ROLLBACK)
+#                              plus the full boot smoke (apply + tracker
+#                              advances + /healthz returns 200).
+#   make verify-mig          — alias for verify-migrations.
+#   make test                — short test pass: go test ./internal/... -short
+#                              plus the cmd/server package. Includes the
+#                              live-DB tests when TEST_DATABASE_URL is set,
+#                              skips them otherwise.
+#   make test-go             — go test ./... -race (full Go suite).
+#
+# Future slices will extend this with:
+#   make test-frontend       — bun test (Slice 3 / Slice 6)
+#   make e2e                 — Playwright golden-path suite (Slice 4)
+#
+# All targets are idempotent. None of them write to the filesystem outside
+# the test runner's working dirs. None of them touch internal/db/migrations/
+# files.
+
+.PHONY: help verify-migrations verify-mig test test-go
+
+help:
+	@echo "Paliad — developer targets"
+	@echo ""
+	@echo "  verify-migrations   Dry-run pending migrations + boot smoke (needs TEST_DATABASE_URL)"
+	@echo "  verify-mig          Alias for verify-migrations"
+	@echo "  test                Short test pass — covers gate tier"
+	@echo "  test-go             Full Go suite with race detector"
+	@echo ""
+	@echo "Set TEST_DATABASE_URL to enable live-DB tests. Example:"
+	@echo "  export TEST_DATABASE_URL=postgres://paliad:...@localhost:11833/paliad_test"
+
+# Gate target — the test that would have caught mig 098 / mig 099 before
+# deploy. Combines:
+#   - TestMigrations_DryRun  (internal/db): per-migration BEGIN..ROLLBACK
+#   - TestBootSmoke          (cmd/server): apply-end-to-end + tracker advances
+#                                          + /healthz 200
+#
+# Requires TEST_DATABASE_URL. Without it, both tests skip and the target
+# is effectively a no-op — guard against that explicitly so CI doesn't
+# silently green a missing env var.
+verify-migrations:
+	@if [ -z "$$TEST_DATABASE_URL" ]; then \
+		echo "ERROR: TEST_DATABASE_URL is not set."; \
+		echo "       The migration gate cannot run without a scratch DB."; \
+		echo "       Set TEST_DATABASE_URL to a Postgres URL the test can"; \
+		echo "       open transactions against, e.g."; \
+		echo "         export TEST_DATABASE_URL=postgres://paliad:PW@localhost:11833/paliad_test"; \
+		exit 2; \
+	fi
+	@echo "==> migration dry-run (per-mig BEGIN..ROLLBACK)"
+	go test -count=1 -run TestMigrations_DryRun ./internal/db/
+	@echo "==> boot smoke (apply + tracker + /healthz)"
+	go test -count=1 -run TestBootSmoke ./cmd/server/
+
+verify-mig: verify-migrations
+
+# Gate-tier test pass. -short skips the slow live-DB tests when the
+# author opts out via `if testing.Short() { t.Skip(...) }`; today most of
+# paliad's live-DB tests gate on TEST_DATABASE_URL instead, so -short is
+# forward-compatible rather than load-bearing.
+test:
+	go test -short ./internal/... ./cmd/...
+
+# Full Go suite with race detection. Slower but catches concurrent-map
+# regressions that -short would skip; intended for the merge-to-main gate
+# (full suite, not per-PR).
+test-go:
+	go test -race ./...

cmd/server/main_smoke_test.go

@@ -0,0 +1,170 @@
+// Boot smoke test — assert paliad reaches a serving state.
+//
+// Three checks against TEST_DATABASE_URL:
+//
+//  1. db.ApplyMigrations does not panic and returns nil.
+//  2. The migration tracker (public.paliad_schema_migrations) advances to
+//     the highest *.up.sql version on disk — no migrations were silently
+//     skipped, no "dirty=true" stragglers left behind.
+//  3. The handler mux (with /healthz mounted) responds 200 to GET /healthz.
+//
+// This is the lightweight cousin of the migration dry-run gate
+// (internal/db/migrate_test.go): the dry-run catches per-migration syntax
+// errors before merge; this smoke confirms the apply+bind path the
+// container actually runs at boot. Together they cover the mig-098 /
+// mig-099 class of crash-loops end-to-end.
+//
+// Skipped without TEST_DATABASE_URL — matches the rest of the live-DB tests.
+//
+// Design: docs/design-paliad-test-strategy-2026-05-19.md §5 Slice 1.
+
+package main
+
+import (
+	"database/sql"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"testing"
+
+	_ "github.com/lib/pq"
+
+	"mgit.msbls.de/m/paliad/internal/auth"
+	"mgit.msbls.de/m/paliad/internal/db"
+	"mgit.msbls.de/m/paliad/internal/handlers"
+)
+
+func TestBootSmoke(t *testing.T) {
+	url := os.Getenv("TEST_DATABASE_URL")
+	if url == "" {
+		t.Skip("TEST_DATABASE_URL not set — skipping boot smoke")
+	}
+
+	// (1) Apply migrations end-to-end. The same code path the prod
+	// container runs at boot before `http.ListenAndServe`. A regression
+	// like mig-098's digit-regex would surface here as a non-nil error.
+	if err := db.ApplyMigrations(url); err != nil {
+		t.Fatalf("db.ApplyMigrations: %v", err)
+	}
+
+	// (2) Assert the tracker advanced to the highest *.up.sql version we
+	// embed. If a migration was silently skipped or the tracker is dirty,
+	// the prod container would crash-loop — this turns that into a test
+	// failure with a precise reason.
+	expected := highestEmbeddedMigrationVersion(t)
+	got, dirty := readTrackerVersion(t, url)
+	if dirty {
+		t.Errorf("tracker reports dirty=true at version %d — investigate before deploying", got)
+	}
+	if got != expected {
+		t.Errorf("tracker at version %d; expected %d (highest *.up.sql on disk). "+
+			"A migration was skipped or applied out of order.",
+			got, expected)
+	}
+
+	// (3) Mount the public handlers (the same Register call main() makes,
+	// minus the DB-backed Services bundle which the /healthz route doesn't
+	// need) and assert /healthz returns 200. This is the bind-and-serve
+	// half of the smoke: catches a regression that would make /healthz
+	// 404 or break the mux registration order.
+	//
+	// We deliberately do not boot the full main() — that would require
+	// SUPABASE_URL, SUPABASE_ANON_KEY, SUPABASE_JWT_SECRET, an open
+	// listening socket and a real auth client. The /healthz handler is
+	// auth-independent by design, and Register registers it on the outer
+	// mux before any DB-backed route, so this minimal setup exercises the
+	// exact code path main() takes.
+	mux := http.NewServeMux()
+	authClient := auth.NewClient("https://test.invalid", "anon-key", []byte("test-secret"))
+	handlers.Register(mux, authClient, "", nil)
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/healthz", nil)
+	mux.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Errorf("GET /healthz: status=%d, body=%q; want 200 OK", rec.Code, rec.Body.String())
+	}
+	if body := strings.TrimSpace(rec.Body.String()); body != "ok" {
+		t.Errorf("GET /healthz: body=%q; want \"ok\"", body)
+	}
+}
+
+// highestEmbeddedMigrationVersion finds max(N) over every NNN_*.up.sql
+// file in internal/db/migrations/ on disk. Used as the expected tracker
+// version after a clean apply. We read from disk (not the embed.FS in
+// the db package — it's unexported) since the test runs from the repo.
+func highestEmbeddedMigrationVersion(t *testing.T) int {
+	t.Helper()
+	root, err := repoRoot()
+	if err != nil {
+		t.Fatalf("locate repo root: %v", err)
+	}
+	dir := filepath.Join(root, "internal", "db", "migrations")
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatalf("read migrations dir %s: %v", dir, err)
+	}
+	var versions []int
+	for _, e := range entries {
+		name := e.Name()
+		if !strings.HasSuffix(name, ".up.sql") {
+			continue
+		}
+		base := strings.TrimSuffix(name, ".up.sql")
+		underscore := strings.IndexByte(base, '_')
+		if underscore <= 0 {
+			continue
+		}
+		v, err := strconv.Atoi(base[:underscore])
+		if err != nil {
+			continue
+		}
+		versions = append(versions, v)
+	}
+	if len(versions) == 0 {
+		t.Fatalf("no *.up.sql files found in %s", dir)
+	}
+	sort.Ints(versions)
+	return versions[len(versions)-1]
+}
+
+// readTrackerVersion fetches the lone row from the tracker. golang-migrate
+// keeps exactly one row; if we ever see zero or more, that's the dirty-state
+// the test is designed to flag.
+func readTrackerVersion(t *testing.T, url string) (version int, dirty bool) {
+	t.Helper()
+	conn, err := sql.Open("postgres", url)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	defer conn.Close()
+	row := conn.QueryRow(`SELECT version, dirty FROM public.paliad_schema_migrations LIMIT 1`)
+	if err := row.Scan(&version, &dirty); err != nil {
+		t.Fatalf("read tracker: %v", err)
+	}
+	return version, dirty
+}
+
+// repoRoot walks upward from the test binary's working directory until it
+// finds a go.mod. `go test` runs in the package dir, so we typically have
+// to climb a couple of levels.
+func repoRoot() (string, error) {
+	dir, err := os.Getwd()
+	if err != nil {
+		return "", err
+	}
+	for {
+		if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {
+			return dir, nil
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			return "", os.ErrNotExist
+		}
+		dir = parent
+	}
+}

docs/design-paliad-test-strategy-2026-05-19.md

@@ -0,0 +1,582 @@
+# Design — Paliad Test Strategy (production-grade)
+
+**Author:** mendel (inventor)
+**Date:** 2026-05-19
+**Task:** t-paliad-213
+**Branch:** `mai/mendel/inventor-test-strategy`
+**Status:** DESIGN READY FOR REVIEW. No test files / Make targets / CI configs touched. Awaiting m go/no-go on §5 slice plan + §6 open questions before any coder shift.
+
+---
+
+## 0. TL;DR
+
+Paliad has accidental test discipline today: 59 `_test.go` files / 323 test functions in Go (≈45 % of services tested, ≈12 % of handlers tested) and 4 frontend test files for 90+ client modules (≈4 %). There is no committed end-to-end suite and no CI — every smoke pass is human-driven via the manual reports in `tests/`. The `mig 098` prod crash-loop, the `t-paliad-036` triple-bug after the German→English rename, and a long tail of UX regressions (deadline-done modal, calendar column drift) would all have been caught by a 10-test boot-and-click smoke pass.
+
+This design proposes a six-layer test pyramid with a concrete tool per layer (stdlib `testing` + bun's built-in `bun:test` + `playwright` for E2E — nothing third-party we don't already use). It pins three lessons paliad has paid for in commits:
+
+1. **No mocks at the service↔DB boundary.** Live-DB tests against a per-developer Postgres are the floor; in-memory mocks for `paliad.*` would have hidden every rename-after-DROP-CASCADE bug. Project preference is already in this direction (27/44 service tests are live-DB-gated); we double down rather than reverse.
+2. **Migrations must dry-run before they merge.** Every recent prod-down (mig 098, mig 020-after-rename, mig 099 audit_reason gap) was a migration that compiled, passed `go test ./...` (which skips without `TEST_DATABASE_URL`), and broke on first apply against the real schema. A `make verify-migrations` target that does BEGIN/apply/ROLLBACK in CI fixes the entire failure mode.
+3. **Browser-shaped bugs need a browser.** The fristenrechner cascade, shape-timeline render, calendar grid, inline paliadin widget — these are JS state machines. Bun's stdlib `bun:test` covers the pure parser/codec code; Playwright covers the auth-gated DOM. Don't try to substitute one for the other.
+
+Six slices roll the strategy out as tracer-bullet PRs, each independently shippable. Slice 1 (migration dry-run harness) and Slice 4 (Playwright golden-path smoke) buy the most outage-prevention per LoC; the rest is widening proven patterns.
+
+Six open questions for m at §6. Most surface a coverage-vs-cost trade-off — the picks that need m's call before any code lands are CI infrastructure choice (Q2), per-PR run-time budget (Q1), and live-DB-vs-dockerised Postgres (Q3).
+
+---
+
+## 1. Audit — what exists today
+
+Counts taken on `mai/mendel/inventor-test-strategy` @ HEAD (2026-05-19, 100 migrations applied).
+
+### 1.1 Go test inventory
+
+| Package | Source files | Test files | Test functions | Notes |
+|---|---|---|---|---|
+| `internal/services` | 56 | 44 | ~200 | 26 live-DB-gated (`TEST_DATABASE_URL`), 18 pure-Go. 24 services have **no test file at all** — see §1.4. |
+| `internal/handlers` | 59 | 7 | ~30 | Only auth-domain check, search, audit-parse, approval-error-mapping, redirects, verfahrensablauf-redirect, chart-404 covered. **53 handlers have no test file.** |
+| `internal/auth` | small | 2 | ~10 | Session middleware + require-admin. |
+| `internal/branding` | small | 1 | small | Firm-name override. |
+| `internal/offices` | small | 1 | small | Office enum. |
+| `internal/changelog` | small | 1 | small | Pure parser. |
+| `internal/calc` | small | 1 | small | Fees / fee tables. |
+| `cmd/server` | 1 | 1 | small | `main_paliadin_backend_test.go` covers env-gate selection. |
+| **Total** | **133** | **58** | **323** | |
+
+`go test ./...` runs all 58 files. Without `TEST_DATABASE_URL` set, 27 of them silently skip their live-DB cases — the suite still passes, but coverage of mutation paths drops to near zero.
+
+### 1.2 Frontend test inventory
+
+| Path | Test files | Tested |
+|---|---|---|
+| `frontend/src/client/filter-bar/url-codec.test.ts` | 1 | FilterBar URL codec round-trip. |
+| `frontend/src/client/views/format.test.ts` | 1 | Date/time formatters (regression for t-paliad-153). |
+| `frontend/src/client/views/shape-timeline-chart.test.ts` | 1 | Chart layout pure function. |
+| `frontend/src/client/views/shape-timeline-cv.test.ts` | 1 | Continuous-view shape layout. |
+| **Total** | **4** | Out of ~90 client modules (`frontend/src/client/*.ts`). |
+
+All four use bun's built-in `bun:test` (no extra dep). No DOM/jsdom tests. No Playwright. No `bun test` script in `package.json` (`bun run build` is the only script).
+
+### 1.3 End-to-end / smoke
+
+- `tests/smoke-2026-04-25.md`, `tests/smoke-auth-2026-04-25.md`, `tests/smoke-auth-2026-04-26-cleanup.md` — human-written reports with screenshots committed under `tests/screenshots-*`. No code. No re-runnable script.
+- `mai-tester` skill uses Playwright for ad-hoc runs; nothing committed.
+- No `e2e/`, no `.gitea/workflows/`, no `.github/workflows/`, no `Makefile`.
+
+### 1.4 Critical service paths with no test file
+
+These are `internal/services/*.go` for which no `*_test.go` sibling exists:
+
+| Service | Risk class | Why it matters |
+|---|---|---|
+| `caldav_service.go`, `caldav_client.go`, `caldav_crypto.go`, `caldav_ical.go` | High | Per-user push/pull goroutines + AES-GCM at rest. One pure parser test (`caldav_ical_timeline_test.go`) exists but the service + crypto + WebDAV client are blind. |
+| `agenda_service.go` | High | Dashboard agenda query; reused by `/agenda` page. Exercised transitively by visibility tests but no direct test. |
+| `dashboard_service.go` | High | Traffic-light + summary counts. Same story — transitively covered via visibility, no direct test. |
+| `derivation_service.go` | Medium | Project-tree derivation (the new t-paliad-194-era subtree machinery). |
+| `team_service.go` | Medium | Team membership / inheritance. |
+| `partner_unit_service.go` | Medium | Dezernat replacement (t-paliad-070). |
+| `party_service.go`, `note_service.go`, `link_service.go`, `checklist_instance_service.go` | Medium | All do project-scoped CRUD with the same RLS+audit pattern that `t-paliad-036` proved easy to break. |
+| `appointment_service.go` | High | Hot — every calendar mutation. Exercised through approval tests but has no own test file. |
+| `view_service.go` | Medium | Powers the substrate (`/views/*`). |
+| `paliadin_jwt.go` | Medium | Per-turn JWT mint for the aichat path (`t-paliad-194`). No call sites in tests today. |
+| `markdown.go` | Low | Glossary + checklist content render. |
+
+### 1.5 Handlers with no test file
+
+53 of 59. Notably: **`auth.go` itself** (login / logout / session creation), **`projects.go`** (the most-mutated entity), **`deadlines.go` / `appointments.go`** (writes), **`paliadin.go` / `paliadin_suggest.go`** (m-only routes — never click-tested), **`fristenrechner.go` / `fristenrechner_search.go` / `fristenrechner_event_categories.go`** (the cascade users live in), **`dashboard.go` / `agenda.go`** (landing), **`onboarding.go` / `onboarding_gate.go`** (every new user's first three minutes), **`invite.go`** (rate-limited write path). The currently-tested handlers (search, audit-parse, approval error mapping, etc.) are the cheap pure-Go ones; every handler that touches the DB is untested at handler level.
+
+### 1.6 Live-DB test scaffold — is it sound?
+
+The pattern (read from `internal/services/visibility_test.go`):
+
+```go
+url := os.Getenv("TEST_DATABASE_URL")
+if url == "" { t.Skip("TEST_DATABASE_URL not set — skipping live DB test") }
+if err := db.ApplyMigrations(url); err != nil { t.Fatalf(...) }
+pool, _ := sqlx.Connect("postgres", url)
+defer pool.Close()
+// per-test seed + cleanup via DELETE + defer cleanup()
+```
+
+Verdict: **sound, but has rough edges that need addressing before we widen.**
+
+- ✅ Migrations apply at test startup against the test DB — catches every "you forgot to add a CHECK" / "you reference a column that doesn't exist" before a real-DB-touching test runs.
+- ✅ Per-test cleanup via `DELETE FROM ... WHERE id IN ($1,...)` is explicit and idempotent.
+- ✅ The `paliad.paliad_schema_migrations` tracker collision noted in memory `0b900afa…` is a pre-existing issue, not introduced by this design.
+- ⚠️ Cleanup-via-DELETE is fragile: a test that creates a row referenced by FK from another table needs to remember to clean both. A few existing tests (see `audit_service_test.go`) already chain 5+ DELETEs.
+- ⚠️ Tests can't run in parallel against the same `TEST_DATABASE_URL` because they share schema state. `go test ./...` defaults to `-parallel` per-package; same-package tests with overlapping cleanup IDs can interfere.
+- ⚠️ No CI today actually exercises `TEST_DATABASE_URL` — so every live-DB test is effectively run only on the author's laptop or not at all. Half the value is paid-for but unbilled.
+
+### 1.7 Migration tooling
+
+- `internal/db/migrate.go` embeds `migrations/*.sql` and applies on server boot via `golang-migrate/v4` with the `paliad_schema_migrations` tracker in `public` schema.
+- 100 migrations on disk (`001` → `100`).
+- **No dry-run gate today.** A bad migration breaks `paliad.de` at boot (Dokploy crash-loops the container). Recent prod incidents: mig 098 (submission code rename), mig 099 (with_po flag drop missed audit_reason gap), mig 020 (function rename without body rewrite — see memory `49a05cfa…`).
+- `down.sql` exists for every migration but no test ever exercises it.
+
+### 1.8 CI / deploy loop
+
+- No CI. Push-to-main → Gitea webhook → Dokploy auto-builds the Dockerfile and replaces the container. The Dockerfile runs `bun run build` then `go build`. **Neither `go test` nor `bun test` runs in the build pipeline.**
+- Pre-commit hooks: none in repo. Each worker runs `go build / go vet / go test / bun run build` by convention (see memories — every shipped task report ends with "build hygiene held").
+
+---
+
+## 2. Test pyramid — recommended shape
+
+```
+                           ┌─────────────────┐
+                           │  E2E (Playwright)│  ~10 flows
+                           │  L6              │
+                           └─────────────────┘
+                       ┌─────────────────────────┐
+                       │  Handler integration    │  ~30 routes
+                       │  L5 (httptest + real DB)│
+                       └─────────────────────────┘
+                  ┌──────────────────────────────────┐
+                  │  Service-layer (live DB)         │  ~60 tests
+                  │  L4 (BEGIN/ROLLBACK harness)     │
+                  └──────────────────────────────────┘
+              ┌──────────────────────────────────────────┐
+              │  Frontend DOM / cascade (bun:test+jsdom) │  ~15 modules
+              │  L3                                      │
+              └──────────────────────────────────────────┘
+        ┌──────────────────────────────────────────────────────┐
+        │  Frontend unit (bun:test pure TS)                    │  ~30 modules
+        │  L2                                                   │
+        └──────────────────────────────────────────────────────┘
+   ┌──────────────────────────────────────────────────────────────┐
+   │  Go unit (stdlib testing, table-driven, pure functions)      │  ~150 tests
+   │  L1                                                          │
+   └──────────────────────────────────────────────────────────────┘
+   ┌──────────────────────────────────────────────────────────────┐
+   │  Migration dry-run (make verify-migrations)                  │  100 mig
+   │  L0 — gate on every PR                                       │
+   └──────────────────────────────────────────────────────────────┘
+```
+
+### Layer 0 — Migration dry-run
+
+**What:** Every `*.up.sql` in `internal/db/migrations/` is applied inside a single `BEGIN ... ROLLBACK` transaction against a scratch Postgres, in numeric order. The harness asserts each statement succeeds *and* asserts no statement leaves the schema in a `paliad_schema_migrations.dirty=true` state. A second pass applies all up-migrations end-to-end (no rollback) and then re-applies the latest up-migration to assert idempotency (every paliad migration since `t-paliad-070` has been written to be idempotent — this enforces it).
+
+**Tool:** stdlib `testing` package, no third-party. Pattern: `internal/db/migrate_test.go` with a `TestMigrations_DryRun` driven from `TEST_DATABASE_URL`. A `make verify-migrations` target wraps it.
+
+**Why this layer matters most:** Every recent prod-down was a migration. Catching them on a CI run before merge is the highest-leverage test investment paliad can make. Cost: one ~100-line Go file + one Postgres in CI.
+
+**Coverage target:** 100 % of `*.up.sql` files. Hard gate on PR — no exceptions.
+
+### Layer 1 — Go unit (pure)
+
+**What:** `go test ./...` against pure functions — formatters, parsers, validators, calculators, fee tables, deadline calculators, projection lookahead clamping, codec round-trips. No DB, no HTTP.
+
+**Tool:** stdlib `testing`. Table-driven `cases := []struct{...}{...}` style is already the house pattern (see `auth_test.go` / `projection_anchor_test.go`). **Do not introduce testify or any matcher library** — the current code reads cleanly without one, and 323 existing test functions don't need a rename pass.
+
+**What's already there:** 19 pure-Go test files (calculator, mapping, codec, holiday, fees, etc.). Density is good; targeted infill rather than re-architecture.
+
+**Coverage target:** Every pure function in `internal/services/`, `internal/handlers/`, `internal/calc/`, `internal/changelog/`. Aim for "every branch in a decision table has at least one test row." Don't chase % — chase "the obvious edge that would burn a coworker".
+
+### Layer 2 — Frontend unit (pure)
+
+**What:** `bun test` against pure TS modules — URL codecs (`filter-bar/url-codec`), formatters, parsers, i18n key correctness (every `data-i18n` attribute used in TSX has a key in `i18n.ts`), view-spec parsers, projection-row mapping helpers.
+
+**Tool:** `bun:test` (built into bun, no install). Already in use in 4 files — extend the same pattern. Add `bun test` to `package.json` `scripts`.
+
+**What to add:**
+- i18n key audit (every `t("foo.bar")` and `data-i18n="foo.bar"` resolves in both `de` and `en`).
+- `filter-bar/` types + render helpers (paliad has shipped 4 FilterBar slices; coverage is one codec test).
+- `paliadin-context.ts` route table + entity extraction (the `[ctx …]` envelope is a stable contract paliadin's SKILL.md depends on; any drift here is a silent failure).
+- `paliadin-starters.ts` registry — every route maps to ≥1 starter; every starter is bilingual.
+- View-spec parsers in `views/`.
+
+**Coverage target:** Every pure TS module in `frontend/src/client/`. Pages (TSX renderers) are E2E concern, not unit concern.
+
+### Layer 3 — Frontend DOM (cascade / jsdom)
+
+**What:** `bun test` with jsdom global, exercising the interactive cascade modules — the fristenrechner cascade builder, the shape-timeline render, the FilterBar UI (chips, panels), the calendar grid, the inline Paliadin widget message stream, the inbox-row click handler, the dashboard activity item navigation.
+
+These modules contain enough state that pure-function tests miss real bugs (e.g. the t-paliad-098 `.entity-table` row-cursor lie was a CSS+DOM bug; t-paliad-099's modal close was a DOM-event bug; t-paliad-103's `::before` overlay click-swallow was a DOM bug).
+
+**Tool:** bun + `happy-dom` is the lighter choice; if it can't handle event ordering, fall back to `jsdom`. Both are ESM-clean and bun-friendly. **Pick one and stick with it — running both means twice the dependency surface.** Default pick: `happy-dom` (smaller, paliad doesn't need legacy IE semantics).
+
+**Pattern:** import the cascade module, build a minimal DOM (`document.body.innerHTML = …`), dispatch synthetic events, assert resulting state. Reuses the production renderers — no test-only fakes.
+
+**Coverage target:** ~15 modules. Specifically:
+- `client/filter-bar/index.ts` chip render + active-state.
+- `client/fristenrechner.ts` cascade — most complex JS in the codebase; depend chains light up every UPC bug we know.
+- `client/shape-timeline.ts` lane mode + track mode (envelope wire shape brittle to refactor).
+- `client/projects-detail.ts` row click + Verlauf render.
+- `client/paliadin-widget.ts` + `paliadin-context.ts` interaction.
+- `client/inbox.ts` row-action click routing.
+- `client/dashboard.ts` activity-item nav.
+- `client/deadlines-calendar.ts` / `appointments-calendar.ts` column layout (the calendar-column-drift bug class).
+
+Not unit tests; not E2E. They are the missing middle.
+
+### Layer 4 — Service-layer (live DB)
+
+**What:** Go service methods against a real Postgres, using the existing `TEST_DATABASE_URL` pattern. Two improvements:
+
+1. **Replace per-test DELETE cleanup with a per-test transaction harness** — open a transaction, run the test inside it, ROLLBACK. Faster, isolating, no cleanup forgotten. Already viable because the service layer accepts `*sqlx.DB`-or-tx-shaped interfaces in many places; needs a small `internal/services/internal/testdb` package that exposes `WithTx(t *testing.T, fn func(*sqlx.Tx))`. Migration is mechanical, can happen alongside infill.
+
+   *Caveat:* some service methods open their own transactions internally (`approval_service.submit` is one). Those keep DELETE cleanup; the tx harness is a default, not a mandate.
+
+2. **Make `TEST_DATABASE_URL` mandatory in CI.** Today these tests are skipped on every machine that doesn't `export TEST_DATABASE_URL=…` — i.e. they don't run on autoatic pipelines because there's no pipeline. Once CI exists (§3.5), it becomes a required env var.
+
+**Tool:** stdlib `testing` + `sqlx` (already in `go.mod`). **No mocks at the service↔DB boundary.** This is m's hardest line — see global CLAUDE.md memory pattern and `t-paliad-036` (the bug that masked two other bugs would have been caught instantly by a real-DB test).
+
+**Where to invest first:** Approval (already heavy), Projection (already heavy), Fristenrechner (already heavy), DeadlineService Create/Update/Complete/Delete with `pending_request_id` interplay, AppointmentService same, ProjectService visibility predicate, CalDAV push (the four CalDAV `*.go` files have zero direct test).
+
+**Coverage target:** Every service method that mutates the DB has at least one happy-path live-DB test. RLS predicate (`visibilityPredicatePositional`) has one test per role (global_admin, member, non-member).
+
+### Layer 5 — Handler integration (httptest + real DB)
+
+**What:** Spin a real `services.DBService`, mount the protected mux, drive `httptest.NewRequest` + `ServeHTTP` against it. Auth via a fake session cookie produced by a `testauth.Login(t, userID)` helper that mints the same Supabase JWT shape `auth.UserIDFromContext` expects.
+
+**Why:** The 53 untested handlers are where the request shape ↔ service interaction lives. Examples that would have caught real bugs:
+- `t-paliad-036`'s "`/projects/{id}` 404 while `/api/projects/{id}` 200" mismatch — a 5-line handler test would have failed before the migration ran.
+- mig 020's three-stacked bug — a handler test that POSTs a deadline and asserts a 200 + read-back row would have failed at submit-time, not boot-time.
+- The audit-log query timezone bug — handler test asserts the JSON contains the expected `event_date`.
+
+**Tool:** stdlib `net/http/httptest`. **No new framework.** Pattern: handler tests live next to the handler file (`internal/handlers/deadlines_test.go` next to `deadlines.go`).
+
+**Coverage target:** Every handler that gates a state-changing route — `POST/PATCH/DELETE` flavour. Plus `GET` handlers that compose a non-trivial query (dashboard, agenda, search, audit-log).
+
+### Layer 6 — End-to-end (Playwright)
+
+**What:** A small Playwright suite (~10 flows) committed at `e2e/` with a `bun run e2e` entry. Targets a local `./paliad` against a scratch Postgres (the same `TEST_DATABASE_URL`). Each test logs in, drives the UI through one user journey, asserts visible state.
+
+**Why ~10 not 100:** Per-PR budget caps at ~2 min total (§6 Q1). Playwright tests are the most expensive minute-per-confidence in this stack; they pay for themselves on the *golden path* and nothing else. The deep-coverage layer is L5; E2E is *"is the app still alive end to end?"*.
+
+**Tool:** `playwright` (npm; bun installs cleanly). No third-party test runner — Playwright ships its own. Tests live in `e2e/*.spec.ts`. **Not bun:test.** Playwright's runner is purpose-built for browser-driving and integrates with their tracing — don't fight it.
+
+**Cap:** 10 flows. If a new test wants in, an existing one must drop out (or we have a real reason to widen). This is the cheapest discipline available: it forces the suite to remain a smoke pass, not a regression-test dumping ground.
+
+**Coverage target:** See §4.
+
+---
+
+## 3. Tooling — concrete picks per layer
+
+| Layer | Tool | Already in deps? | Install? |
+|---|---|---|---|
+| L0 — migration dry-run | stdlib `testing` + `migrate/v4` | yes | no |
+| L1 — Go unit | stdlib `testing` | yes | no |
+| L2 — Frontend unit | `bun:test` | yes (built into bun) | no |
+| L3 — Frontend DOM | `bun:test` + `happy-dom` | bun yes, happy-dom **new** | `bun add -d happy-dom` (one dep, ~200 KB) |
+| L4 — Service live-DB | stdlib + sqlx | yes | no |
+| L5 — Handler integration | stdlib `net/http/httptest` + sqlx | yes | no |
+| L6 — E2E | `@playwright/test` | **new** | `bun add -d @playwright/test` + `npx playwright install chromium` |
+
+Net new deps: **2** (happy-dom + playwright). Both are mainstream, both have small surface area, both align with bun's ecosystem.
+
+Explicit rejects:
+- ❌ **testify** — current tests read cleanly with stdlib; adding it forces a rename pass nobody wants.
+- ❌ **vitest** — bun's built-in test runner is faster and the tests are already in `bun:test` shape.
+- ❌ **dockertest / testcontainers-go** — m's preference is real-DB tests against the existing Postgres; spinning ephemeral Docker Postgres per package run adds latency and surface area for marginal isolation gain. See Q3.
+- ❌ **sqlmock / gomock for DB** — banned by §0 lesson 1.
+- ❌ **cypress** — Playwright is the better tool today, and the team's existing skill (`/mai-tester`) already uses it.
+
+### 3.1 Per-PR run-time budget
+
+Target (subject to m's call in Q1): **≤ 90 s for the gating tier (L0+L1+L2+L4 subset+L5 happy-path)**, ≤ 4 min for the full suite (add L3+L4 full+L6). The gating tier blocks merge; the full suite blocks deploy.
+
+Indicative times (estimated, validate when slice 1 lands):
+
+| Tier | Layers | Est. time | Blocks |
+|---|---|---|---|
+| **Gate (every PR)** | L0 + L1 + L2 + L5 happy-path + L4 critical | 60–90 s | merge |
+| **Full (every merge to main)** | + L4 full + L3 + L6 | 3–4 min | deploy |
+
+### 3.2 CI — proposal, not commitment
+
+paliad has no CI today. Two routes:
+
+- **Gitea Actions** (m's stack already runs `mgit.msbls.de`). Self-hosted; same auth model as the rest of mAi. Adds a `.gitea/workflows/test.yml`. Postgres comes from a service container.
+- **Stay click-deploy.** No CI. Workers run tests locally; Dokploy auto-deploys on green-main convention.
+
+Recommendation: **Gitea Actions for the gate tier only** (L0 + L1 + L2), driven by a single short workflow. The L3-L6 expansion can be a follow-up once the gate tier proves stable. Deferred to Q2 for m's call.
+
+### 3.3 Test DB — live YouPC vs ephemeral
+
+The `paliad` schema lives on the shared YouPC Postgres (port 11833). Three options:
+
+| Option | Pros | Cons |
+|---|---|---|
+| **Per-developer separate DB on YouPC** (`TEST_DATABASE_URL` per laptop) | Closest to prod; existing pattern. | Cleanup discipline matters; cross-developer contention possible. |
+| **Ephemeral docker postgres per CI run** | Full isolation; parallel-safe; reset for free. | New infra; ~5 s container startup per CI invocation. |
+| **Dedicated test DB on a paliad-only Postgres** | Isolated; cheap. | New infra to maintain. |
+
+Recommendation: **option 1 for developers (no-op change), option 2 for CI** (Gitea Actions postgres service container). Deferred to Q3 for m's call.
+
+### 3.4 Coverage targets
+
+Don't gate on percentage. Gate on critical-path coverage (§4). Add `go test -coverprofile=` output to CI for visibility, not as a merge gate. Coverage % gating produces tests-for-tests'-sake; we want the tests that catch the bugs we've shipped.
+
+---
+
+## 4. Critical journeys — what MUST be covered
+
+These are the golden-path flows. Anything not on this list is L1-L5 territory, not L6. The list is intentionally short; if it grows beyond 10, we are doing E2E wrong.
+
+| # | Flow | Why it's critical | Layer mix |
+|---|---|---|---|
+| 1 | **Login → dashboard renders → traffic-light counts match** | Every user does this every day; broken auth = paliad is offline. | L6 (Playwright) + L5 handler (auth.go) |
+| 2 | **Create project (Client → Litigation → Patent → Case)** | Hierarchy with team inheritance — the data model's spine. | L6 + L5 + L4 (project_service) |
+| 3 | **Submit deadline → routes to /inbox → approver approves → state flips** | The 4-eye flow (t-paliad-138). Most-mutated paliad surface. | L6 + L5 (deadlines, approvals) + L4 (approval_service) |
+| 4 | **Fristenrechner: pick proceeding → cascade fires → result shows** | The platform's flagship interactive tool. JS cascade. | L6 + L3 (fristenrechner cascade) + L4 (fristenrechner) |
+| 5 | **SmartTimeline: anchor a projected row → predecessor-missing-error handled** | Recent Slice-2 work (t-paliad-173 / #31). High-touch surface. | L6 + L3 (shape-timeline) + L4 (projection_service) |
+| 6 | **CalDAV sync: PUT a Termin → external client sees it, edits there → pull reconciles** | Owned-event semantics + foreign-UID skip rule from Phase F. Untested today. | L4 (caldav_service push/pull) — gated on Q3 (live YouPC vs ephemeral) |
+| 7 | **Paliadin chat: anon visit hits 404; m's session opens widget; turn renders** | Owner-gated `/paliadin` is the only m-only surface. Quiet failures here are silent. | L6 (smoke) + L5 (paliadin_suggest) + L4 (paliadin / aichat_paliadin) |
+| 8 | **/admin/rules: filter → edit one rule → lifecycle transition → audit log row** | Rules drive the cascade; bad edits break every user's fristenrechner. | L6 + L5 (admin_rules) + L4 (rule_editor_service) |
+| 9 | **Onboarding: new user with allowed email → onboarding form → first project membership** | The new-user funnel; gateOnboarded middleware traps. | L6 + L5 (onboarding, invite) |
+| 10 | **Migration boot smoke: spin paliad against an empty DB → server binds 8080** | Catches every mig-N crash-loop. | L0 (migration dry-run) + L4 boot-smoke variant |
+
+Picks 1, 3, 4 and 10 are the highest-value-per-cost — they cover the routes most regressions land on (auth, mutation, cascade, boot).
+
+---
+
+## 5. Slice plan — tracer-bullet roll-out
+
+Each slice is a shippable PR with a concrete deliverable, in order of expected outage-prevention payoff. Sized for a single coder shift unless flagged. No slice depends on a later one being merged. Hour estimates intentionally omitted (per global CLAUDE.md).
+
+### Slice 1 — Migration dry-run harness + boot smoke (highest leverage)
+
+**Branch:** `mai/<coder>/test-strategy-slice-1-migrations`
+
+**Deliverable:**
+- `internal/db/migrate_test.go` — `TestMigrations_DryRun` (per-mig BEGIN/ROLLBACK), `TestMigrations_EndToEnd` (full apply, then re-apply latest to assert idempotency), `TestMigrations_Down` (apply N→0).
+- `Makefile` with `make verify-migrations` (the gate target), `make test` (run everything), `make test-go`, `make test-frontend`.
+- `cmd/server/main_paliadin_backend_test.go` already exists; extend with a `TestMain_BindsHTTPAfterMigrate` that boots the full server against `TEST_DATABASE_URL`, asserts `:8080` is listening, then shuts down. Catches the mig-098-class crash-loop in a single test.
+- README section: how to set `TEST_DATABASE_URL` locally.
+
+**Catches:** Every mig-98-class crash-loop; every drop-cascade-with-stale-policy-name regression (t-paliad-036).
+
+### Slice 2 — Service-layer infill: critical mutators
+
+**Branch:** `mai/<coder>/test-strategy-slice-2-services`
+
+**Deliverable:**
+- Test files for the three highest-impact untested services:
+  - `internal/services/agenda_service_test.go` (live-DB, dashboard agenda query)
+  - `internal/services/dashboard_service_test.go` (traffic-light counts)
+  - `internal/services/team_service_test.go` (membership + inheritance — RLS-load-bearing)
+- Tighten existing `approval_service_test.go` + `deadline_service_test.go` coverage of the create/update/complete/delete × pending-request matrix where there are demonstrable gaps.
+- Add `internal/services/internal/testdb/withtx.go` — the per-test tx harness (optional adoption; existing tests stay).
+
+**Catches:** RLS regressions, approval interplay regressions, dashboard count drift after schema renames.
+
+### Slice 3 — Frontend bun:test setup + L2 infill
+
+**Branch:** `mai/<coder>/test-strategy-slice-3-frontend-unit`
+
+**Deliverable:**
+- `frontend/package.json` `scripts.test = "bun test"`.
+- New tests under `frontend/src/client/`:
+  - `paliadin-context.test.ts` (route table, entity extraction, selection truncation).
+  - `paliadin-starters.test.ts` (every route ≥1 starter, every starter bilingual).
+  - `filter-bar/index.test.ts` (chip render + active state — pure DOM-less helpers).
+  - i18n key audit: `frontend/scripts/i18n-audit.test.ts` parses every `data-i18n="…"` from `dist/` HTML and every `t("…")` call from `src/`, asserts both `de` and `en` resolve. Runs as part of `bun test`.
+- `make test-frontend` wires `cd frontend && bun test`.
+
+**Catches:** i18n drift (untranslated key shipped to user), context-envelope contract drift (paliadin SKILL.md depends on it), starter-registry regressions.
+
+### Slice 4 — Playwright golden-path smoke
+
+**Branch:** `mai/<coder>/test-strategy-slice-4-e2e`
+
+**Deliverable:**
+- `e2e/` directory at repo root.
+- `playwright.config.ts` pointing at `http://localhost:8080` (paliad started by the test, not assumed).
+- Five Playwright `*.spec.ts` files covering critical journeys 1, 3, 4, 7, 9 from §4.
+- `make e2e` target that:
+  1. starts paliad against `TEST_DATABASE_URL`,
+  2. waits for `:8080` to be live,
+  3. runs `npx playwright test`,
+  4. tears the server down.
+- `bun add -d @playwright/test` + `npx playwright install chromium`.
+
+**Catches:** Auth regressions, deadline-mutation regressions, fristenrechner cascade regressions, owner-gated /paliadin leaks, onboarding-gate misbehaviour.
+
+### Slice 5 — Handler integration tests for the 5 most-touched routes
+
+**Branch:** `mai/<coder>/test-strategy-slice-5-handlers`
+
+**Deliverable:**
+- `internal/handlers/auth_test.go` extended with `TestLogin_HappyPath` + `TestLogout_ClearsCookie` (real DB).
+- `internal/handlers/projects_test.go` — `TestProjectsCreate` (POST 200, row inserted, audit emitted), `TestProjectsGetByID_RespectsVisibility` (404 for non-member).
+- `internal/handlers/deadlines_test.go` — `TestDeadlinesCreate_TriggersApproval` (verifies pending pill).
+- `internal/handlers/appointments_test.go` — same shape.
+- `internal/handlers/paliadin_test.go` — `TestPaliadinPage_404ForNonOwner`, `TestPaliadinPage_200ForOwner`.
+- Shared `internal/handlers/testauth/testauth.go` — mints a session cookie for `userID` so handler tests don't reinvent auth seeding.
+
+**Catches:** Handler ↔ service wiring drift, visibility-predicate handler-side bugs (t-paliad-036 bug 2 was exactly this), owner-gate bypass.
+
+### Slice 6 — Frontend L3 (DOM) cascade tests
+
+**Branch:** `mai/<coder>/test-strategy-slice-6-frontend-dom`
+
+**Deliverable:**
+- `bun add -d happy-dom`.
+- DOM-driven tests for the three most-touched cascades:
+  - `client/fristenrechner.test.ts` (cascade activate → row appears → date-set fires fetch).
+  - `client/shape-timeline.test.ts` (lane render, track render, projected-row click).
+  - `client/filter-bar/index.test.ts` (chip click toggles state, URL params update).
+
+**Catches:** The whole class of "the function exists and is unit-tested but the cascade in the browser doesn't fire it" bugs. This is the layer that catches t-paliad-098 / 099 / 102 / 103.
+
+### Slice 7 — CI wiring (deferred — Q2 dependent)
+
+**Branch:** `mai/<coder>/test-strategy-slice-7-ci` (gated on m's Q2 pick)
+
+**Deliverable:**
+- `.gitea/workflows/test.yml` (or stay click-deploy if m picks that).
+- Gate tier runs on every PR; full suite runs on merge to main.
+- Postgres service container provides `TEST_DATABASE_URL`.
+- Slack/Gotify ping on red main.
+
+**Catches:** Drift between "tests pass on my laptop" and prod reality.
+
+### Slice 8 — Coverage reporting + dashboard (lowest priority)
+
+**Branch:** `mai/<coder>/test-strategy-slice-8-coverage`
+
+**Deliverable:**
+- `go test -coverprofile=` aggregated into a single `coverage.html`.
+- Bun's coverage output similarly.
+- A `docs/coverage.md` index updated by CI.
+- **Not a merge gate.** Visibility only.
+
+**Catches:** Slow drift; nice-to-have once the floor is in.
+
+### Slice order rationale
+
+1, 4, 5 are the highest outage-prevention per LoC: migration dry-run kills crash-loops, E2E kills regressions, handler tests kill wiring drift. 2, 3, 6 widen the floor; 7-8 are infrastructure.
+
+---
+
+## 6. Open questions for m
+
+These need m's call before any coder shift starts (or before specific slices start, where noted).
+
+### Q1 — Per-PR test-run budget
+
+How long is acceptable to wait on the gate tier before merge?
+
+- 30 s — only L0 + L1 (no L2+ on the gate).
+- **60–90 s (recommended)** — L0 + L1 + L2 + L5 happy-path + L4 critical.
+- 2 min — add L3 + L4 full.
+- 4+ min — add L6 (E2E on gate).
+
+The pick determines whether E2E gates merge or only deploy.
+
+### Q2 — CI infrastructure
+
+- **Gitea Actions** (self-hosted, gate tier only, recommended) — minimal new infra; aligns with m's existing stack.
+- **Stay click-deploy** — workers run tests locally; merge discipline enforced by convention. Today's reality; we keep it.
+- **Both:** start with click-deploy, add Gitea Actions in Slice 7 once gate tier proves stable.
+
+### Q3 — Live-DB vs ephemeral docker Postgres for tests
+
+- **Per-developer YouPC DB (current pattern)** — closest to prod; existing tests work unchanged.
+- **Ephemeral docker postgres in CI, YouPC for devs (recommended hybrid)** — keeps local-dev simple, gives CI deterministic isolation.
+- **YouPC everywhere** — simplest, but parallel CI runs would contend.
+
+### Q4 — Coverage targets — % or critical-path?
+
+- **Critical-path only (recommended)** — §4's 10 flows + every state-mutating service method has a test. No % gate.
+- **% gate** — set a floor (e.g. 60 % lines, 50 % branches) and refuse merges below it.
+- **Both** — critical-path is mandatory, % is informational.
+
+m's prior preference (memory pattern: "tests that catch real bugs > coverage theatre") points at critical-path-only. Confirming.
+
+### Q5 — Which slices land before paliad is "production-grade"?
+
+paliad is already live at `paliad.de` and being used by HLC colleagues. "Production-grade" here means "next time someone ships, we don't go down."
+
+Picks:
+- **Slices 1 + 4 + 5 are the production-grade floor (recommended).** Migration dry-run + golden-path E2E + handler integration tests cover the failure modes that hit prod since the rebrand.
+- Add Slice 2 + 3 + 6 as widening passes, on their own cadence.
+- Slice 7-8 are nice-to-haves.
+
+Confirming the floor pick — and whether m wants all three to land before any new feature work, or whether they roll out alongside.
+
+### Q6 — Who owns each slice?
+
+Recommendation: rotate coder slots so the same person isn't on every slice. Suggested assignment (head can override):
+
+| Slice | Profile fit |
+|---|---|
+| 1 — migrations | Backend-heavy coder (knuth, gauss, cronus). |
+| 2 — service infill | Backend-heavy coder; whoever owns approval/projection. |
+| 3 — frontend unit | Frontend-heavy coder. |
+| 4 — Playwright E2E | Cross-stack coder; ideally one familiar with `/mai-tester`. |
+| 5 — handler integration | Backend coder. |
+| 6 — frontend DOM | Frontend coder (same person as 3 makes sense). |
+
+Inventor does **not** decide assignments; head + m do.
+
+---
+
+## 7. Out of scope (explicit)
+
+- **No rewrite of any existing test.** The 323 existing test functions stay. New tests use the new patterns; old tests are migrated only when their files are touched for unrelated reasons.
+- **No third-party framework where stdlib + bun:test suffice** (testify, vitest, etc. — see §3).
+- **No mocks at the service↔DB boundary.** This is the lock-in. Mocks lie; the live-DB tests we already have are paliad's most useful safety net.
+- **No new feature work in this strategy.** The doc proposes infra; feature scope is unchanged.
+- **No retirement of the `tests/smoke-*.md` human-written reports.** Those are great for one-shot regression hunts; they coexist with the automated suite.
+
+---
+
+## 8. Implementation notes for the eventual coder
+
+(For whichever coder picks up a slice. Not exhaustive.)
+
+- **Test-name collisions in Go's flat package namespace bite when a service grows N implementations.** Memory note from `t-paliad-194` already records this. Prefix tests with the service name (e.g. `TestAichatPaliadin_RunTurn_…` not `TestRunTurn_…`).
+- **`httptest.NewRequest` does not URL-encode** — use `url.QueryEscape` for any `?q=…` argument. Memory note from `t-paliad-026`.
+- **sqlx v1.4.0 `Named` parser strips one colon from `::uuid[]`** — known pitfall, repro lives at `internal/services/project_service.go`. Use `CAST(... AS uuid[])` in new query strings.
+- **Live-DB cleanup must DELETE FKs first.** Order matters (auth.users last). Look at `audit_service_test.go` for the chain pattern.
+- **`paliad.paliad_schema_migrations` tracker collision** is documented but unresolved. Slice 1 should add a `make reset-test-db` target that drops both `public.paliad_schema_migrations` *and* `paliad.paliad_schema_migrations` to keep developers unblocked.
+- **`bun:test` matchers are Jest-compatible** — `expect().toEqual()`, `expect().toHaveBeenCalled()`, etc. No deps needed.
+- **happy-dom does not implement** every DOM method (notably some `<dialog>` semantics). If a cascade test fails on something missing, jsdom is the escape hatch.
+
+---
+
+## 9. Decision summary — pick list for m
+
+| # | Question | Inventor recommends |
+|---|---|---|
+| Q1 | Per-PR budget | 60–90 s gate, 3–4 min full |
+| Q2 | CI infra | Gitea Actions, gate tier only |
+| Q3 | Test DB | YouPC for devs, ephemeral docker for CI |
+| Q4 | Coverage target | Critical-path only, no % gate |
+| Q5 | Production-grade floor | Slices 1 + 4 + 5 before new feature work |
+| Q6 | Slice ownership | Rotate per profile; head decides |
+
+If m's calls match inventor's, the implementer's brief writes itself: Slice 1 first, then 4 + 5 in parallel, then 2/3/6 as widening passes.
+
+---
+
+**Status:** DESIGN READY FOR REVIEW. Awaiting m go/no-go on §5 slice plan + §6 open questions before any coder shift starts.
+
+---
+
+## 10. m's decisions (2026-05-19, locked)
+
+Walked through §6 with m via the AskUserQuestion interview (per head's 2026-05-19 workflow rule: inventor questions are resolved before parking, not after). Six picks locked, all matching inventor's recommendation.
+
+| # | Question | m's answer | Effect on plan |
+|---|---|---|---|
+| Q1 | Per-PR test-run budget | **Inventor's call** (m deferred). Pick: **60–90 s gate, 3–4 min full.** | Gate tier = L0 + L1 + L2 + L5 happy-path + L4 critical. L6 E2E gates deploy, not merge. |
+| Q2 | CI infrastructure | **Gitea Actions, gate tier only.** | Slice 7 adds `.gitea/workflows/test.yml` running the gate tier; full suite stays on merge-to-main. |
+| Q3 | Test DB topology | **YouPC for devs + ephemeral docker for CI.** | Local dev unchanged. Slice 7 wires Postgres service container in Gitea Actions. |
+| Q4 | Coverage target | **Critical-path only, no % gate.** | §4's 10 flows + every state-mutating service method gets a test. Coverage % output is informational in Slice 8, never a merge gate. |
+| Q5 | Production-grade floor | **Slices 1 + 4 + 5 before new feature work.** | These three land before any new paliad feature gets a coder shift. Slices 2, 3, 6 widen the floor on their own cadence. Slices 7-8 are nice-to-haves. |
+| Q6 | Slice ownership | **Head decides + rotate per profile.** | Backend slices (1, 2, 5) → backend-heavy coder. Frontend slices (3, 6) → frontend-heavy coder. E2E (4) → cross-stack. Head picks at dispatch time. |
+
+**Implementer brief (post-m-decisions):**
+
+1. **Slice 1 starts first** — migration dry-run harness + `make verify-migrations` + boot-smoke variant of `cmd/server/main_paliadin_backend_test.go`. Backend-heavy coder.
+2. **Slice 4 + Slice 5 in parallel** once Slice 1 is merged — Playwright golden-path (cross-stack coder, 5 specs) and handler integration (backend coder, auth/projects/deadlines/appointments/paliadin).
+3. Slice 7 (Gitea Actions wiring) follows once Slice 1 gate tier is proven locally.
+4. Slices 2, 3, 6 enter rotation alongside feature work — not blocking.
+5. Slice 8 (coverage reporting) lowest priority.
+
+**Status:** DESIGN APPROVED — awaiting head's dispatch of Slice 1 coder shift.

docs/t-paliad-207-followup-scope.md

@@ -1,52 +0,0 @@
-# t-paliad-207 follow-up scope — close-out assessment
-
-**Author:** fermi (inventor)
-**Date:** 2026-05-20
-**Verdict:** **(A) DONE** — interactive session scope is shipped; remaining tail is filed-or-fileable as discrete issues, not a fresh fermi slice.
-
----
-
-## 0. What shipped under t-paliad-207
-
-Six substantive deliveries on `mai/fermi/interactive-session`, all merged to main as of 2026-05-20 morning:
-
-1. **Verfahrensablauf + Fristenrechner polish** — jurisdiction prefix on the picked proceeding, trigger-event label derived from the root rule, flag rows lifted to `/tools/verfahrensablauf`, rule references rendered as `youpc.org/laws#…` links via new `BuildLegalSourceURL`, `Vorab-Einrede → Einspruch` rename (DE i18n).
-2. **DE proceeding picker — sub-group headers** (`Verletzungsverfahren` / `Nichtigkeitsverfahren`) + parallel labels (`LG (1. Instanz)` / `OLG (Berufung)` / …).
-3. **mig 099** — drop the `with_po` flag from the two RoP 19 rules (Einspruch is always-available, not flag-gated).
-4. **mig 100** — `upc.inf.cfi.ccr` visible rule (`Nichtigkeitswiderklage`) so the CCR filing event surfaces when `with_ccr` is set; later corrected to `priority='optional'` via mig 101.
-5. **mig 101** — strip rule-cite brackets from the two Einspruch names + flip the CCR priority `informational → optional`.
-6. **mig 102** — track-aware sequence reshuffle on `upc.inf.cfi` so at any tied date the order is infringement (Replik) → revocation (Erwiderung Nichtigkeitswiderklage) → amendment.
-7. **Notes toggle** — `Hinweise anzeigen` checkbox in the view-toggle bar; compact ⓘ hover hint when off (default), inline `timeline-notes` block when on. `localStorage` shared across both tool pages.
-
-Filed two follow-up issues during the session:
-
-- **m/paliad#39** — link DE + EPA + EU rule references to `youpc.org/laws` (depends on youpc.org ingesting the corpus).
-- **m/paliad#41** — DE proceedings as one combined timeline per type (LG→OLG→BGH, BPatG→BGH) — corpus + spawn + de-duplication + multi-instance UI.
-
-## 1. Why (A) DONE
-
-Every concrete thing m surfaced in the session was addressed and merged. The two larger unaddressed asks — combined-timeline behaviour for DE proceedings, and DE/EPA rule-link coverage — are already captured in #39 and #41 with concrete scope notes. Neither belongs as a fermi "next slice" because:
-
-- **#41** is a corpus + UI design pass of its own (3 new spawn rules, de-duplication of the existing `de.inf.lg.berufung ↔ de.inf.olg.berufung` pair, multi-court picker shape, instance markers in the timeline body). That's its own design ticket, not a fermi follow-up.
-- **#39** is primarily a youpc.org-side ingest task; the paliad-side change is a 5-line `switch` extension once youpc serves the URLs. Wait for the dependency, then small.
-
-Everything else I surfaced in the read-only audit is either pre-existing (not introduced by this session) or speculative (no user complaint behind it).
-
-## 2. Optional tail — would file as discrete issues, not a fermi slice
-
-Surfacing these for completeness; none are blocking, and most would be small enough to either roll into the existing tickets or land as one-off polish:
-
-| # | Candidate | Size | Already covered? |
-|---|---|---|---|
-| 1 | **`legal_source` backfill on 47 unsourced active rules** — query: 4 of `upc.inf.cfi`, 4 of `upc.pi.cfi` (100% gap), 6 of `upc.rev.cfi`, others. Pre-condition for #39's links to bite. | Medium — corpus research per rule | Partially: huygens did the broader citation backfill in t-paliad-208 / mig 097. This is the remaining tail. |
-| 2 | **`upc.pi.cfi` corpus completeness audit** — all 4 of its rules lack `legal_source`; likely also missing the analogous track-of-decision spawn rules to `upc.apl.merits`. | Small audit, medium fix | No — would be a fresh task. |
-| 3 | **Touch-device fallback for the ⓘ hover hint** — `title=` attribute degrades poorly on phones (no hover, no tap-to-show). Either a click-to-popover variant, or accept the gap. | Tiny | No, but no user complaint yet. |
-| 4 | **R.46 mutatis-mutandis distinction in `upc.rev.cfi.prelim` description** — when mig 101 stripped the `(R. 19 i.V.m. R. 46)` cite, the legal nuance dropped from the user-visible name. Could be surfaced in the description text where it doesn't crowd the timeline cell. | Tiny (one row update) | No. |
-| 5 | **Save-modal warning on SoD + CCR double-check** — with mig 100's new `upc.inf.cfi.ccr` rule, a user can save both `sod` and `ccr` from the same modal and get two `paliad.deadlines` rows on the same date. Today's pre-uncheck behaviour for optional priority mitigates accidental double-write but doesn't surface the duplication actively. | Small | No. |
-| 6 | **Deferred slices from earlier design docs that touch this surface**: t-paliad-179 Slice 2-4 (variant chips, lane view, side-by-side compare on `/tools/verfahrensablauf`); t-paliad-169 "+ Eintrag" CTA on the SmartTimeline (project-bound) path. | Each a separate slice. | Yes — parked from their original tasks; would be revisited when m prioritises. |
-
-None of these warrant a "next fermi slice" right now. They're polish + corpus tail, and best handled as individual issues that m can pick from.
-
-## 3. Recommendation
-
-Close t-paliad-207. Fire fermi. The remaining tail (items 1–6 above) is appropriate as a small "polish backlog" m can dip into when relevant, but not a coherent unit of work that needs a parked inventor.

frontend/public/patentstyle/version.json

@@ -0,0 +1,5 @@
+{
+  "version": "v0.260518",
+  "dotm_url": "https://paliad.msbls.de/patentstyle/HL-Patents-Style.dotm",
+  "sha256": "5CEA98A29D2FD6D9970B9A2499054DF52685A1116459E07F9290B0D0ADD521F4"
+}

frontend/src/client/events.ts

@@ -126,11 +126,12 @@ const STATUS_OPTIONS_DEADLINE: StatusOption[] = [
 ];
 
 const STATUS_OPTIONS_APPOINTMENT: StatusOption[] = [
-  { value: "all", key: "events.filter.status.all" },
+  { value: "upcoming", key: "events.filter.status.upcoming" },
   { value: "today", key: "deadlines.filter.today" },
   { value: "this_week", key: "deadlines.filter.thisweek" },
   { value: "next_week", key: "deadlines.filter.nextweek" },
   { value: "later", key: "deadlines.filter.later" },
+  { value: "all", key: "events.filter.status.all" },
 ];
 
 function statusOptionsFor(type: EventTypeChoice): StatusOption[] {
@@ -139,7 +140,7 @@ function statusOptionsFor(type: EventTypeChoice): StatusOption[] {
 }
 
 function defaultStatusFor(type: EventTypeChoice): string {
-  return type === "appointment" ? "all" : "pending";
+  return type === "appointment" ? "upcoming" : "pending";
 }
 
 let currentType: EventTypeChoice = "deadline";

frontend/src/client/fristenrechner.ts

@@ -57,19 +57,6 @@ type ProcedureView = "timeline" | "columns";
 // HLC team than the single vertical line.
 let procedureView: ProcedureView = "columns";
 
-// Notes toggle — off by default; per-rule notes render as a compact
-// ⓘ hover icon. Flipped on, they expand under each card. Choice is
-// localStorage-persisted (paliad.fristen.notes-show key shared with
-// /tools/verfahrensablauf so the preference carries across both).
-const NOTES_PREF_KEY = "paliad.fristen.notes-show";
-function readNotesPref(): boolean {
-  try { return localStorage.getItem(NOTES_PREF_KEY) === "1"; } catch { return false; }
-}
-function writeNotesPref(on: boolean): void {
-  try { localStorage.setItem(NOTES_PREF_KEY, on ? "1" : "0"); } catch { /* no-op */ }
-}
-let showNotes = readNotesPref();
-
 onLangChange(() => {
   if (lastResponse) renderProcedureResults(lastResponse);
   // Update trigger event name if a proceeding is selected
@@ -404,8 +391,8 @@ function renderProcedureResults(data: DeadlineResponse) {
   </div>`;
 
   const bodyHtml = procedureView === "columns"
-    ? renderColumnsBody(data, { editable: true, showNotes })
-    : renderTimelineBody(data, { showParty: true, editable: true, showNotes });
+    ? renderColumnsBody(data, { editable: true })
+    : renderTimelineBody(data, { showParty: true, editable: true });
 
   container.innerHTML = headerHtml + bodyHtml;
   printBtn.style.display = "block";
@@ -674,18 +661,6 @@ document.addEventListener("DOMContentLoaded", () => {
   const saveBtn = document.getElementById("fristen-save-cta");
   if (saveBtn) saveBtn.addEventListener("click", openSaveModal);
 
-  // Notes toggle — restores last preference on load + re-renders when
-  // the user flips it. Lives in the same toggle bar as the view picker.
-  const notesShowCb = document.getElementById("fristen-notes-show") as HTMLInputElement | null;
-  if (notesShowCb) {
-    notesShowCb.checked = showNotes;
-    notesShowCb.addEventListener("change", () => {
-      showNotes = notesShowCb.checked;
-      writeNotesPref(showNotes);
-      if (lastResponse) renderProcedureResults(lastResponse);
-    });
-  }
-
   // View toggle (timeline vs. columns layout) for procedure mode.
   initViewToggle();
 

frontend/src/client/i18n.ts

@@ -300,7 +300,6 @@ const translations: Record<Lang, Record<string, string>> = {
     "deadlines.view.label": "Ansicht:",
     "deadlines.view.timeline": "Zeitstrahl",
     "deadlines.view.columns": "Spalten",
-    "deadlines.notes.show": "Hinweise anzeigen",
     "deadlines.col.proactive": "Proaktiv",
     "deadlines.col.court": "Gericht",
     "deadlines.col.reactive": "Reaktiv",
@@ -1606,7 +1605,8 @@ const translations: Record<Lang, Record<string, string>> = {
     "events.toggle.deadline": "Fristen",
     "events.toggle.appointment": "Termine",
     "events.toggle.all": "Beides",
-    "events.filter.status.all": "Alle",
+    "events.filter.status.all": "Alle (auch vergangene)",
+    "events.filter.status.upcoming": "Ab heute",
     "events.summary.later": "Sp\u00e4ter",
     "events.col.date": "Datum",
     "events.col.location": "Ort",
@@ -2888,7 +2888,6 @@ const translations: Record<Lang, Record<string, string>> = {
     "deadlines.view.label": "View:",
     "deadlines.view.timeline": "Timeline",
     "deadlines.view.columns": "Columns",
-    "deadlines.notes.show": "Show details",
     "deadlines.col.proactive": "Proactive",
     "deadlines.col.court": "Court",
     "deadlines.col.reactive": "Reactive",
@@ -4178,7 +4177,8 @@ const translations: Record<Lang, Record<string, string>> = {
     "events.toggle.deadline": "Deadlines",
     "events.toggle.appointment": "Appointments",
     "events.toggle.all": "Both",
-    "events.filter.status.all": "All",
+    "events.filter.status.all": "All (incl. past)",
+    "events.filter.status.upcoming": "From today",
     "events.summary.later": "Later",
     "events.col.date": "Date",
     "events.col.location": "Location",

frontend/src/client/verfahrensablauf.ts

@@ -25,19 +25,6 @@ let lastResponse: DeadlineResponse | null = null;
 type ProcedureView = "timeline" | "columns";
 let procedureView: ProcedureView = "columns";
 
-// Notes toggle — when off (default), per-rule descriptive notes render
-// as a compact ⓘ icon next to the meta line (hover for full text). When
-// on, the full notes block expands under each card. Choice persists in
-// localStorage so a reload or recalc keeps the user's preference.
-const NOTES_PREF_KEY = "paliad.fristen.notes-show";
-function readNotesPref(): boolean {
-  try { return localStorage.getItem(NOTES_PREF_KEY) === "1"; } catch { return false; }
-}
-function writeNotesPref(on: boolean): void {
-  try { localStorage.setItem(NOTES_PREF_KEY, on ? "1" : "0"); } catch { /* no-op */ }
-}
-let showNotes = readNotesPref();
-
 // Jurisdiction display prefix for the proceeding-summary chip + the
 // trigger-event placeholder. Same forum slugs the .proceeding-group
 // `data-forum` attribute carries in verfahrensablauf.tsx /
@@ -180,8 +167,8 @@ function renderResults(data: DeadlineResponse) {
   </div>`;
 
   const bodyHtml = procedureView === "columns"
-    ? renderColumnsBody(data, { showNotes })
-    : renderTimelineBody(data, { showParty: true, showNotes });
+    ? renderColumnsBody(data)
+    : renderTimelineBody(data);
 
   container.innerHTML = headerHtml + bodyHtml;
   if (printBtn) printBtn.style.display = "block";
@@ -312,18 +299,6 @@ document.addEventListener("DOMContentLoaded", () => {
 
   document.getElementById("fristen-print-btn")?.addEventListener("click", () => window.print());
 
-  // Notes toggle — restores last preference on load + re-renders when
-  // the user flips it. Lives in the same toggle bar as the view picker.
-  const notesShowCb = document.getElementById("fristen-notes-show") as HTMLInputElement | null;
-  if (notesShowCb) {
-    notesShowCb.checked = showNotes;
-    notesShowCb.addEventListener("change", () => {
-      showNotes = notesShowCb.checked;
-      writeNotesPref(showNotes);
-      if (lastResponse) renderResults(lastResponse);
-    });
-  }
-
   initViewToggle();
 
   onLangChange(() => {

frontend/src/client/views/verfahrensablauf-core.ts

@@ -219,13 +219,6 @@ export interface CardOpts {
   // verfahrensablauf abstract-browse surface keeps editable=false because
   // there's no anchor-override state on that page in Slice 1.
   editable?: boolean;
-  // showNotes controls how the per-rule descriptive notes render:
-  //   true  → expanded `<div class="timeline-notes">…</div>` below the card
-  //   false → compact ⓘ icon next to the meta line, full text on hover
-  //           (browser-native `title` attribute) and screen-reader-readable
-  // Page shells expose a toggle ("Hinweise anzeigen") that flips this and
-  // re-renders. Default false — notes are noisy on long timelines.
-  showNotes?: boolean;
 }
 
 export function deadlineCardHtml(dl: CalculatedDeadline, opts: CardOpts): string {
@@ -271,19 +264,14 @@ export function deadlineCardHtml(dl: CalculatedDeadline, opts: CardOpts): string
   }
 
   const noteText = getLang() === "en" ? (dl.notesEN || dl.notes) : dl.notes;
-  const showNotes = opts.showNotes === true;
-  const notesBlock = noteText && showNotes
+  const notes = noteText
     ? `<div class="timeline-notes">${noteText}</div>`
     : "";
-  const noteHint = noteText && !showNotes
-    ? `<span class="timeline-note-hint" tabindex="0" role="note" aria-label="${escAttr(noteText)}" title="${escAttr(noteText)}">ⓘ</span>`
-    : "";
 
-  const meta = (opts.showParty || ruleRef || noteHint)
+  const meta = (opts.showParty || ruleRef)
     ? `<div class="timeline-meta">
         ${opts.showParty ? partyBadge(dl.party) : ""}
         ${ruleRef}
-        ${noteHint}
       </div>`
     : "";
 
@@ -296,7 +284,7 @@ export function deadlineCardHtml(dl: CalculatedDeadline, opts: CardOpts): string
     </div>
     ${meta}
     ${adjustedNote}
-    ${notesBlock}`;
+    ${notes}`;
 }
 
 export function renderTimelineBody(data: DeadlineResponse, opts: CardOpts = { showParty: true }): string {
@@ -370,7 +358,7 @@ export function renderColumnsBody(data: DeadlineResponse, opts: Omit<CardOpts, "
   unscheduledKeys.sort();
   const keys = [...datedKeys, ...unscheduledKeys];
 
-  const cardOpts: CardOpts = { showParty: false, editable: opts.editable, showNotes: opts.showNotes };
+  const cardOpts: CardOpts = { showParty: false, editable: opts.editable };
 
   const renderCell = (items: CalculatedDeadline[]): string => {
     if (items.length === 0) {

frontend/src/fristenrechner.tsx

@@ -546,10 +546,6 @@ export function renderFristenrechner(): string {
                       <input type="radio" name="fristen-view" value="timeline" />
                       <span data-i18n="deadlines.view.timeline">Zeitstrahl</span>
                     </label>
-                    <label className="fristen-notes-option">
-                      <input type="checkbox" id="fristen-notes-show" />
-                      <span data-i18n="deadlines.notes.show">Hinweise anzeigen</span>
-                    </label>
                   </div>
 
                   <div id="timeline-container">

frontend/src/i18n-keys.ts

@@ -1069,7 +1069,6 @@ export type I18nKey =
   | "deadlines.neu.submit"
   | "deadlines.neu.subtitle"
   | "deadlines.neu.title"
-  | "deadlines.notes.show"
   | "deadlines.optional.badge"
   | "deadlines.party.both"
   | "deadlines.party.both.label"
@@ -1377,6 +1376,7 @@ export type I18nKey =
   | "events.empty.hint"
   | "events.empty.title"
   | "events.filter.status.all"
+  | "events.filter.status.upcoming"
   | "events.row.type.appointment"
   | "events.row.type.deadline"
   | "events.summary.later"

frontend/src/index.tsx

@@ -9,7 +9,6 @@ const ICON_FILE = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" st
 const ICON_FOLDER = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"/></svg>';
 const ICON_CALC = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><rect x="4" y="2" width="16" height="20" rx="2"/><line x1="8" y1="6" x2="16" y2="6"/><line x1="8" y1="14" x2="8" y2="14.01"/><line x1="12" y1="14" x2="12" y2="14.01"/><line x1="16" y1="14" x2="16" y2="14.01"/><line x1="8" y1="18" x2="16" y2="18"/></svg>';
 const ICON_CLOCK = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polyline points="12 6 12 12 16 14"/></svg>';
-const ICON_DOWNLOAD = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>';
 const ICON_GLOSSAR = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M4 19.5A2.5 2.5 0 0 1 6.5 17H20"/><path d="M6.5 2H20v20H6.5A2.5 2.5 0 0 1 4 19.5v-15A2.5 2.5 0 0 1 6.5 2z"/></svg>';
 const ICON_TABLE = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="18" height="18" rx="2"/><line x1="3" y1="9" x2="21" y2="9"/><line x1="3" y1="15" x2="21" y2="15"/><line x1="9" y1="3" x2="9" y2="21"/></svg>';
 const ICON_CHECK = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M9 11l3 3L22 4"/><path d="M21 12v7a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h11"/></svg>';
@@ -108,19 +107,6 @@ export function renderIndex(): string {
             </div>
           </section>
 
-          <section className="sections">
-            <div className="container">
-              <h3 className="section-heading" data-i18n="index.downloads">Downloads</h3>
-              <div className="grid grid-2">
-                <a href="/files/hl-patents-style.dotm" className="card card-link">
-                  <div className="card-icon" dangerouslySetInnerHTML={{ __html: ICON_DOWNLOAD }} />
-                  <h2 data-i18n="index.style.title">{`${FIRM} Patents Style`}</h2>
-                  <p data-i18n="index.style.desc">{`Word-Vorlage im ${FIRM} Patents Style. Formatierung, Schriftarten und Makros für standardisierte Schriftsätze.`}</p>
-                </a>
-              </div>
-            </div>
-          </section>
-
           <section className="offices">
             <div className="container">
               <h3 data-i18n="index.offices">Standorte</h3>

frontend/src/styles/global.css

@@ -3441,49 +3441,6 @@ input[type="range"]::-moz-range-thumb {
     cursor: pointer;
 }
 
-/* Notes toggle — checkbox affordance in the view-toggle bar that flips
-   per-card descriptive notes between compact (ⓘ tooltip icon) and
-   expanded (timeline-notes block). Sits with a leading separator so it
-   reads as a distinct control from the radio view picker. */
-.fristen-notes-option {
-    display: inline-flex;
-    align-items: center;
-    gap: 0.35rem;
-    cursor: pointer;
-    color: var(--color-text);
-    margin-left: auto;
-    padding-left: 0.75rem;
-    border-left: 1px solid var(--color-border);
-}
-
-.fristen-notes-option input[type=checkbox] {
-    margin: 0;
-    cursor: pointer;
-}
-
-/* Compact note hint — sits in the timeline-meta line when the notes
-   toggle is off. Native browser tooltip via title= attribute carries
-   the full text on hover; tabindex=0 + aria-label make it
-   keyboard / screen-reader accessible. */
-.timeline-note-hint {
-    display: inline-flex;
-    align-items: center;
-    justify-content: center;
-    min-width: 1.1rem;
-    height: 1.1rem;
-    border-radius: 50%;
-    font-size: 0.85rem;
-    color: var(--color-text-muted);
-    cursor: help;
-    user-select: none;
-}
-
-.timeline-note-hint:hover,
-.timeline-note-hint:focus-visible {
-    color: var(--color-text);
-    outline: none;
-}
-
 /* Fristenrechner — three-column lane view (Proactive | Court | Reactive).
    Each lane is independently date-ordered; party=both rows render below
    as full-width spans because they apply to all sides. */

frontend/src/verfahrensablauf.tsx

@@ -225,10 +225,6 @@ export function renderVerfahrensablauf(): string {
                       <input type="radio" name="fristen-view" value="timeline" />
                       <span data-i18n="deadlines.view.timeline">Zeitstrahl</span>
                     </label>
-                    <label className="fristen-notes-option">
-                      <input type="checkbox" id="fristen-notes-show" />
-                      <span data-i18n="deadlines.notes.show">Hinweise anzeigen</span>
-                    </label>
                   </div>
 
                   <div id="timeline-container">

internal/db/migrate_test.go

@@ -0,0 +1,198 @@
+// Package db tests — migration dry-run gate.
+//
+// This is the test that catches mig-N crash-loops before they reach prod.
+// The convention since t-paliad-098/099 is that paliad migrations land in
+// numeric order on a single trunk; the next deploy runs whichever ones are
+// pending against the live `public.paliad_schema_migrations` tracker. A
+// migration that compiles cleanly but fails on apply (typo, missing column,
+// wrong CHECK shape) crashes the Dokploy container loop before paliad.de
+// finishes binding :8080, and the only way to learn about it today is to
+// watch the deploy log.
+//
+// TestMigrations_DryRun closes that gap: for every *.up.sql in this
+// directory whose version is greater than the scratch DB's current tracker
+// version, it opens a transaction, runs the SQL, and ROLLBACKs. Any error
+// fails the test with the file name + Postgres error. Always non-destructive
+// — the ROLLBACK runs even on success, so the scratch DB stays at its
+// starting version.
+//
+// Requires TEST_DATABASE_URL (same pattern as the rest of the live-DB
+// tests). Skipped without it.
+//
+// Design: docs/design-paliad-test-strategy-2026-05-19.md §5 Slice 1.
+
+package db
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"os"
+	"sort"
+	"strconv"
+	"strings"
+	"testing"
+
+	_ "github.com/lib/pq"
+)
+
+// migration is one *.up.sql file from the embedded migrations FS.
+type migration struct {
+	version  int
+	name     string
+	filename string
+}
+
+// TestMigrations_DryRun walks every pending *.up.sql in numeric order,
+// applies each inside its own BEGIN/ROLLBACK against the scratch DB, and
+// fails the test on the first SQL error. Reports per-file as a sub-test so
+// `go test -v` shows which migration failed.
+//
+// What "pending" means: greater than the scratch DB's current tracker
+// version (or 0 if the tracker doesn't exist yet). In CI against a fresh
+// scratch DB, every migration is pending and gets verified. On a developer
+// laptop whose scratch DB is already at HEAD, no migrations are pending and
+// the test logs the start version and passes — the protection only kicks in
+// the moment a new *.up.sql lands in the tree before the developer runs
+// `db.ApplyMigrations` against the same scratch DB.
+func TestMigrations_DryRun(t *testing.T) {
+	url := os.Getenv("TEST_DATABASE_URL")
+	if url == "" {
+		t.Skip("TEST_DATABASE_URL not set — skipping migration dry-run")
+	}
+
+	conn, err := sql.Open("postgres", url)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	defer conn.Close()
+	if err := conn.Ping(); err != nil {
+		t.Fatalf("ping: %v", err)
+	}
+
+	// The paliad schema must exist before migration 001 runs against it,
+	// mirroring the bootstrap step in ApplyMigrations. Without this, a
+	// fresh scratch DB would fail migration 001's CREATE TABLE paliad.*
+	// statements inside the BEGIN/ROLLBACK probe with "schema paliad does
+	// not exist" — a false negative that distracts from real errors.
+	if _, err := conn.Exec(`CREATE SCHEMA IF NOT EXISTS paliad`); err != nil {
+		t.Fatalf("ensure paliad schema: %v", err)
+	}
+
+	startVersion, dirty, err := currentTrackerVersion(conn)
+	if err != nil {
+		t.Fatalf("read tracker: %v", err)
+	}
+	if dirty {
+		t.Fatalf("tracker is dirty at version %d — fix that first (DROP the tracker row "+
+			"or restore from backup); the dry-run cannot trust a dirty starting state",
+			startVersion)
+	}
+	t.Logf("scratch DB tracker at version %d; walking pending migrations from %d upward",
+		startVersion, startVersion+1)
+
+	migs, err := loadPendingMigrations(startVersion)
+	if err != nil {
+		t.Fatalf("load migrations: %v", err)
+	}
+	if len(migs) == 0 {
+		t.Logf("no pending migrations — scratch DB is at HEAD (%d)", startVersion)
+		return
+	}
+
+	for _, m := range migs {
+		t.Run(fmt.Sprintf("%03d_%s", m.version, m.name), func(t *testing.T) {
+			body, err := migrationFS.ReadFile("migrations/" + m.filename)
+			if err != nil {
+				t.Fatalf("read %s: %v", m.filename, err)
+			}
+			tx, err := conn.Begin()
+			if err != nil {
+				t.Fatalf("begin: %v", err)
+			}
+			// Always rollback; the dry-run must not leave the scratch DB
+			// at a different version than where it started. Rollback is
+			// safe to call even after a failed Exec — Postgres aborts the
+			// transaction internally on the first error.
+			defer func() { _ = tx.Rollback() }()
+
+			if _, err := tx.Exec(string(body)); err != nil {
+				t.Fatalf("migration %s failed dry-run: %v", m.filename, err)
+			}
+		})
+	}
+}
+
+// currentTrackerVersion reads the latest version + dirty flag from the
+// `public.paliad_schema_migrations` tracker. Returns (0, false, nil) when the
+// tracker doesn't exist yet — that's the "fresh scratch DB" path.
+//
+// We don't use golang-migrate's API to read this because golang-migrate's
+// driver locks the tracker row on read; a test runner that calls this while
+// the developer has paliad running locally would race. A plain SELECT is
+// race-safe and matches what `psql` would show.
+func currentTrackerVersion(conn *sql.DB) (version int, dirty bool, err error) {
+	const q = `SELECT version, dirty FROM public.paliad_schema_migrations LIMIT 1`
+	row := conn.QueryRow(q)
+	if scanErr := row.Scan(&version, &dirty); scanErr != nil {
+		// Missing table → fresh DB → start at 0. lib/pq surfaces this
+		// as `pq.Error.Code = "42P01"` (undefined_table); the simpler
+		// sql.ErrNoRows fires if the table exists but is empty (also
+		// fresh-DB-shaped).
+		if errors.Is(scanErr, sql.ErrNoRows) {
+			return 0, false, nil
+		}
+		if strings.Contains(scanErr.Error(), "does not exist") {
+			return 0, false, nil
+		}
+		return 0, false, scanErr
+	}
+	return version, dirty, nil
+}
+
+// loadPendingMigrations returns every *.up.sql in the embedded FS whose
+// version is greater than startVersion, sorted by version ascending. A
+// filename like "098_submission_codes_prefix_and_rename.up.sql" yields
+// version=98, name="submission_codes_prefix_and_rename".
+func loadPendingMigrations(startVersion int) ([]migration, error) {
+	entries, err := migrationFS.ReadDir("migrations")
+	if err != nil {
+		return nil, fmt.Errorf("read migrations dir: %w", err)
+	}
+	var out []migration
+	for _, e := range entries {
+		name := e.Name()
+		if !strings.HasSuffix(name, ".up.sql") {
+			continue
+		}
+		v, n, ok := parseMigrationName(name)
+		if !ok {
+			return nil, fmt.Errorf("unparseable migration filename: %s "+
+				"(expected NNN_description.up.sql)", name)
+		}
+		if v <= startVersion {
+			continue
+		}
+		out = append(out, migration{version: v, name: n, filename: name})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].version < out[j].version })
+	return out, nil
+}
+
+// parseMigrationName splits "NNN_description.up.sql" into (NNN, description).
+// Returns ok=false on any deviation from that shape.
+func parseMigrationName(filename string) (version int, name string, ok bool) {
+	base := strings.TrimSuffix(filename, ".up.sql")
+	if base == filename { // suffix wasn't present
+		return 0, "", false
+	}
+	underscore := strings.IndexByte(base, '_')
+	if underscore <= 0 {
+		return 0, "", false
+	}
+	v, err := strconv.Atoi(base[:underscore])
+	if err != nil {
+		return 0, "", false
+	}
+	return v, base[underscore+1:], true
+}

internal/db/migrations/101_einspruch_name_and_ccr_priority.down.sql

@@ -1,52 +0,0 @@
--- Revert mig 101 — restore the bracket-bearing Einspruch names and
--- flip the CCR priority back to 'informational'.
-
-SELECT set_config(
-    'paliad.audit_reason',
-    'mig 101 down: restore "Einspruch (R. 19 VerfO)" and "Einspruch (R. 19 i.V.m. R. 46 VerfO)" names + flip upc.inf.cfi.ccr priority back to informational',
-    true);
-
-UPDATE paliad.deadline_rules dr
-   SET name_en = 'Preliminary Objection (RoP 19 in conjunction with RoP 46)'
-  FROM paliad.proceeding_types pt
- WHERE dr.proceeding_type_id = pt.id
-   AND pt.code = 'upc.rev.cfi'
-   AND dr.submission_code = 'upc.rev.cfi.prelim'
-   AND dr.lifecycle_state = 'published'
-   AND dr.name_en = 'Preliminary Objection';
-
-UPDATE paliad.deadline_rules dr
-   SET name = 'Einspruch (R. 19 i.V.m. R. 46 VerfO)'
-  FROM paliad.proceeding_types pt
- WHERE dr.proceeding_type_id = pt.id
-   AND pt.code = 'upc.rev.cfi'
-   AND dr.submission_code = 'upc.rev.cfi.prelim'
-   AND dr.lifecycle_state = 'published'
-   AND dr.name = 'Einspruch';
-
-UPDATE paliad.deadline_rules dr
-   SET name_en = 'Preliminary Objection (RoP 19)'
-  FROM paliad.proceeding_types pt
- WHERE dr.proceeding_type_id = pt.id
-   AND pt.code = 'upc.inf.cfi'
-   AND dr.submission_code = 'upc.inf.cfi.prelim'
-   AND dr.lifecycle_state = 'published'
-   AND dr.name_en = 'Preliminary Objection';
-
-UPDATE paliad.deadline_rules dr
-   SET name = 'Einspruch (R. 19 VerfO)'
-  FROM paliad.proceeding_types pt
- WHERE dr.proceeding_type_id = pt.id
-   AND pt.code = 'upc.inf.cfi'
-   AND dr.submission_code = 'upc.inf.cfi.prelim'
-   AND dr.lifecycle_state = 'published'
-   AND dr.name = 'Einspruch';
-
-UPDATE paliad.deadline_rules dr
-   SET priority = 'informational'
-  FROM paliad.proceeding_types pt
- WHERE dr.proceeding_type_id = pt.id
-   AND pt.code = 'upc.inf.cfi'
-   AND dr.submission_code = 'upc.inf.cfi.ccr'
-   AND dr.lifecycle_state = 'published'
-   AND dr.priority = 'optional';

internal/db/migrations/101_einspruch_name_and_ccr_priority.up.sql

@@ -1,89 +0,0 @@
--- t-paliad-207 (m's interactive session) — two label/priority polish
--- fixes on upc.inf.cfi / upc.rev.cfi:
---
--- 1. **CCR priority informational → optional.** m's correction
---    2026-05-18 18:01: the Nichtigkeitswiderklage is a substantive
---    defensive choice the defendant makes — not just an informational
---    notice. priority='optional' renders it as an unchecked save row
---    the user can opt into. The fermi amend (commit e8d658a) flipping
---    this didn't land in main — paliadin's merge of mig 100 (commit
---    c10f8cf, merge 4ddcd28) picked up the pre-amend 'informational'
---    version. This is the recovery.
---
--- 2. **Strip rule citation from Einspruch names.** m's correction
---    2026-05-18 18:08: every other rule name in the corpus carries
---    the act-name without a parenthetical rule cite (Klageerwiderung,
---    Antrag auf Patentänderung, Replik, etc.). The Einspruch rule
---    names are the outliers:
---      upc.inf.cfi.prelim  "Einspruch (R. 19 VerfO)"            → "Einspruch"
---      upc.rev.cfi.prelim  "Einspruch (R. 19 i.V.m. R. 46 VerfO)" → "Einspruch"
---    and EN equivalents:
---      "Preliminary Objection (RoP 19)" → "Preliminary Objection"
---      "Preliminary Objection (RoP 19 in conjunction with RoP 46)"
---                                      → "Preliminary Objection"
---    The legal_source / rule_code columns already carry the citation
---    and render in the deadline card's meta line, so the name stays
---    clean. The R.46-i.V.m. distinction is preserved in the legal
---    source field (RoP.019.1 for both — m may want to further
---    differentiate; flagged in description text instead).
---
--- audit_reason set_config required at the top — the deadline_rules
--- audit trigger raises EXCEPTION 'audit reason required' on any
--- mutation without it (cf. mig 099 hotfix history).
---
--- Idempotency:
---   * Priority UPDATE guarded on the current 'informational' value.
---   * Name UPDATEs guarded on the current parenthetical-bearing names.
-
-SELECT set_config(
-    'paliad.audit_reason',
-    'mig 101: flip upc.inf.cfi.ccr priority informational→optional + strip rule-cite brackets from R.19 Einspruch names on both upc.inf.cfi.prelim and upc.rev.cfi.prelim (m''s corrections 2026-05-18, t-paliad-207 interactive session)',
-    true);
-
--- 1) Flip CCR priority
-UPDATE paliad.deadline_rules dr
-   SET priority = 'optional'
-  FROM paliad.proceeding_types pt
- WHERE dr.proceeding_type_id = pt.id
-   AND pt.code = 'upc.inf.cfi'
-   AND dr.submission_code = 'upc.inf.cfi.ccr'
-   AND dr.lifecycle_state = 'published'
-   AND dr.priority = 'informational';
-
--- 2a) Strip "(R. 19 VerfO)" from upc.inf.cfi.prelim DE/EN names
-UPDATE paliad.deadline_rules dr
-   SET name = 'Einspruch'
-  FROM paliad.proceeding_types pt
- WHERE dr.proceeding_type_id = pt.id
-   AND pt.code = 'upc.inf.cfi'
-   AND dr.submission_code = 'upc.inf.cfi.prelim'
-   AND dr.lifecycle_state = 'published'
-   AND dr.name = 'Einspruch (R. 19 VerfO)';
-
-UPDATE paliad.deadline_rules dr
-   SET name_en = 'Preliminary Objection'
-  FROM paliad.proceeding_types pt
- WHERE dr.proceeding_type_id = pt.id
-   AND pt.code = 'upc.inf.cfi'
-   AND dr.submission_code = 'upc.inf.cfi.prelim'
-   AND dr.lifecycle_state = 'published'
-   AND dr.name_en = 'Preliminary Objection (RoP 19)';
-
--- 2b) Strip "(R. 19 i.V.m. R. 46 VerfO)" from upc.rev.cfi.prelim DE/EN names
-UPDATE paliad.deadline_rules dr
-   SET name = 'Einspruch'
-  FROM paliad.proceeding_types pt
- WHERE dr.proceeding_type_id = pt.id
-   AND pt.code = 'upc.rev.cfi'
-   AND dr.submission_code = 'upc.rev.cfi.prelim'
-   AND dr.lifecycle_state = 'published'
-   AND dr.name = 'Einspruch (R. 19 i.V.m. R. 46 VerfO)';
-
-UPDATE paliad.deadline_rules dr
-   SET name_en = 'Preliminary Objection'
-  FROM paliad.proceeding_types pt
- WHERE dr.proceeding_type_id = pt.id
-   AND pt.code = 'upc.rev.cfi'
-   AND dr.submission_code = 'upc.rev.cfi.prelim'
-   AND dr.lifecycle_state = 'published'
-   AND dr.name_en = 'Preliminary Objection (RoP 19 in conjunction with RoP 46)';

internal/db/migrations/102_upc_inf_track_aware_sequence.down.sql

@@ -1,31 +0,0 @@
--- Revert mig 102 — restore the pre-mig-102 sequence_order values
--- (post-mig-100 state). Same two-phase swap pattern.
-
-SELECT set_config(
-    'paliad.audit_reason',
-    'mig 102 down: restore pre-track-aware sequence_order on upc.inf.cfi rules',
-    true);
-
--- Phase 1: park
-UPDATE paliad.deadline_rules SET sequence_order = 1011 WHERE submission_code = 'upc.inf.cfi.ccr'              AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 20;
-UPDATE paliad.deadline_rules SET sequence_order = 1012 WHERE submission_code = 'upc.inf.cfi.def_to_ccr'       AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 22;
-UPDATE paliad.deadline_rules SET sequence_order = 1013 WHERE submission_code = 'upc.inf.cfi.app_to_amend'     AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 30;
-UPDATE paliad.deadline_rules SET sequence_order = 1020 WHERE submission_code = 'upc.inf.cfi.reply'            AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 12;
-UPDATE paliad.deadline_rules SET sequence_order = 1021 WHERE submission_code = 'upc.inf.cfi.def_to_amend'     AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 32;
-UPDATE paliad.deadline_rules SET sequence_order = 1022 WHERE submission_code = 'upc.inf.cfi.reply_def_ccr'    AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 24;
-UPDATE paliad.deadline_rules SET sequence_order = 1030 WHERE submission_code = 'upc.inf.cfi.rejoin'           AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 14;
-UPDATE paliad.deadline_rules SET sequence_order = 1031 WHERE submission_code = 'upc.inf.cfi.reply_def_amd'    AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 34;
-UPDATE paliad.deadline_rules SET sequence_order = 1032 WHERE submission_code = 'upc.inf.cfi.rejoin_reply_ccr' AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 26;
-UPDATE paliad.deadline_rules SET sequence_order = 1033 WHERE submission_code = 'upc.inf.cfi.rejoin_amd'       AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 36;
-
--- Phase 2: assign originals
-UPDATE paliad.deadline_rules SET sequence_order = 11 WHERE submission_code = 'upc.inf.cfi.ccr'              AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 1011;
-UPDATE paliad.deadline_rules SET sequence_order = 12 WHERE submission_code = 'upc.inf.cfi.def_to_ccr'       AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 1012;
-UPDATE paliad.deadline_rules SET sequence_order = 13 WHERE submission_code = 'upc.inf.cfi.app_to_amend'     AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 1013;
-UPDATE paliad.deadline_rules SET sequence_order = 20 WHERE submission_code = 'upc.inf.cfi.reply'            AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 1020;
-UPDATE paliad.deadline_rules SET sequence_order = 21 WHERE submission_code = 'upc.inf.cfi.def_to_amend'     AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 1021;
-UPDATE paliad.deadline_rules SET sequence_order = 22 WHERE submission_code = 'upc.inf.cfi.reply_def_ccr'    AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 1022;
-UPDATE paliad.deadline_rules SET sequence_order = 30 WHERE submission_code = 'upc.inf.cfi.rejoin'           AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 1030;
-UPDATE paliad.deadline_rules SET sequence_order = 31 WHERE submission_code = 'upc.inf.cfi.reply_def_amd'    AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 1031;
-UPDATE paliad.deadline_rules SET sequence_order = 32 WHERE submission_code = 'upc.inf.cfi.rejoin_reply_ccr' AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 1032;
-UPDATE paliad.deadline_rules SET sequence_order = 33 WHERE submission_code = 'upc.inf.cfi.rejoin_amd'       AND proceeding_type_id = 8 AND lifecycle_state = 'published' AND sequence_order = 1033;

internal/db/migrations/102_upc_inf_track_aware_sequence.up.sql

@@ -1,211 +0,0 @@
--- t-paliad-207 — re-sequence upc.inf.cfi rules so within any tied-date
--- group the infringement-track responses sit ABOVE the revocation-
--- track responses ABOVE the amendment-track responses. m's ask
--- 2026-05-18 18:08: "the infringement parts (like Replik) should show
--- above the part for the revocation (Erwiderung Nichtigkeitswider-
--- klage)".
---
--- Three tracks coexist on upc.inf.cfi once the with_ccr / with_amend
--- flags are set. They share calendar dates because R.29 / R.30 / R.32
--- all key off the SoD or its descendants. The current sequence_orders
--- (post-mig 100) interleave them; the user sees Erwiderung-zur-CCR
--- before Replik even though Replik is the infringement-side response
--- to the same triggering event.
---
--- New sequence_order assignment (preserves the soc=0, prelim=5,
--- sod=10, ccr=11 anchors at the head; phase markers interim/oral/
--- decision/cost_app/appeal_spawn keep their existing 40/50/60/70/80
--- slots at the tail):
---
---   Old → New   submission_code             track         date
---   ---   ---   ---------------             -----         ----
---     0     0   upc.inf.cfi.soc             —             D+0
---     5     5   upc.inf.cfi.prelim          —             D+1mo
---    10    10   upc.inf.cfi.sod             infringement  D+3mo
---    11    20   upc.inf.cfi.ccr             revocation    D+3mo
---    20    12   upc.inf.cfi.reply           infringement  D+5mo  ← MOVED UP
---    12    22   upc.inf.cfi.def_to_ccr      revocation    D+5mo
---    13    30   upc.inf.cfi.app_to_amend    amendment     D+5mo
---    30    14   upc.inf.cfi.rejoin          infringement  D+6mo  ← MOVED UP
---    22    24   upc.inf.cfi.reply_def_ccr   revocation    D+7mo
---    21    32   upc.inf.cfi.def_to_amend    amendment     D+7mo
---    32    26   upc.inf.cfi.rejoin_reply_ccr revocation    D+8mo
---    31    34   upc.inf.cfi.reply_def_amd   amendment     D+8mo
---    33    36   upc.inf.cfi.rejoin_amd      amendment     D+9mo
---    40    40   upc.inf.cfi.interim         phase         later
---    50    50   upc.inf.cfi.oral            phase         later
---    60    60   upc.inf.cfi.decision        phase         later
---    70    70   upc.inf.cfi.cost_app        phase         later
---    80    80   upc.inf.cfi.appeal_spawn    phase         later
---
--- Order within each tied-date group after the reshuffle:
---   D+3mo: sod(10), ccr(20)                                — SoD then its CCR
---   D+5mo: reply(12), def_to_ccr(22), app_to_amend(30)    — inf → rev → amd
---   D+7mo: reply_def_ccr(24), def_to_amend(32)            — rev → amd
---   D+8mo: rejoin_reply_ccr(26), reply_def_amd(34)        — rev → amd
---
--- (no infringement-track rule at +7mo or +8mo so revocation leads
--- those dates; rejoin sits alone at +6mo so it has no peers to order
--- against.)
---
--- audit_reason set_config required at the top — the deadline_rules
--- audit trigger raises EXCEPTION 'audit reason required' on any
--- mutation without it (cf. mig 099 hotfix history).
---
--- Idempotency: every UPDATE is guarded by both the submission_code
--- AND the SOURCE sequence_order, so re-apply is a no-op once the new
--- numbers are in place.
-
-SELECT set_config(
-    'paliad.audit_reason',
-    'mig 102: re-sequence upc.inf.cfi rules track-aware (infringement → revocation → amendment within tied-date groups; m''s 2026-05-18 ask, t-paliad-207 interactive session)',
-    true);
-
--- Two-phase swap to avoid sequence collisions during the UPDATE
--- (otherwise two rules can briefly share a sequence_order if Postgres
--- evaluates them in parallel). Phase 1: move every reshuffled rule to
--- a high temporary number (1000+). Phase 2: assign final numbers.
-
--- ─── Phase 1: park reshuffled rules at 1000+ ────────────────────────
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 1011
- WHERE submission_code = 'upc.inf.cfi.ccr'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 11;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 1012
- WHERE submission_code = 'upc.inf.cfi.def_to_ccr'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 12;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 1013
- WHERE submission_code = 'upc.inf.cfi.app_to_amend'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 13;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 1020
- WHERE submission_code = 'upc.inf.cfi.reply'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 20;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 1021
- WHERE submission_code = 'upc.inf.cfi.def_to_amend'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 21;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 1022
- WHERE submission_code = 'upc.inf.cfi.reply_def_ccr'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 22;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 1030
- WHERE submission_code = 'upc.inf.cfi.rejoin'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 30;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 1031
- WHERE submission_code = 'upc.inf.cfi.reply_def_amd'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 31;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 1032
- WHERE submission_code = 'upc.inf.cfi.rejoin_reply_ccr'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 32;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 1033
- WHERE submission_code = 'upc.inf.cfi.rejoin_amd'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 33;
-
--- ─── Phase 2: assign final track-aware numbers ──────────────────────
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 12
- WHERE submission_code = 'upc.inf.cfi.reply'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 1020;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 14
- WHERE submission_code = 'upc.inf.cfi.rejoin'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 1030;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 20
- WHERE submission_code = 'upc.inf.cfi.ccr'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 1011;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 22
- WHERE submission_code = 'upc.inf.cfi.def_to_ccr'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 1012;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 24
- WHERE submission_code = 'upc.inf.cfi.reply_def_ccr'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 1022;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 26
- WHERE submission_code = 'upc.inf.cfi.rejoin_reply_ccr'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 1032;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 30
- WHERE submission_code = 'upc.inf.cfi.app_to_amend'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 1013;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 32
- WHERE submission_code = 'upc.inf.cfi.def_to_amend'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 1021;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 34
- WHERE submission_code = 'upc.inf.cfi.reply_def_amd'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 1031;
-
-UPDATE paliad.deadline_rules
-   SET sequence_order = 36
- WHERE submission_code = 'upc.inf.cfi.rejoin_amd'
-   AND proceeding_type_id = 8
-   AND lifecycle_state = 'published'
-   AND sequence_order = 1033;

internal/handlers/handlers.go

@@ -128,6 +128,17 @@ func Register(mux *http.ServeMux, client *auth.Client, giteaAPIToken string, svc
 		}
 	}
 
+	// Liveness probe. Public, no auth, no DB touch — just confirms the
+	// process bound the listener and the goroutine is alive. Used by the
+	// boot-smoke test (cmd/server/main_smoke_test.go) to assert the server
+	// reaches a serving state after migrations apply; also safe for any
+	// future container orchestrator or uptime check.
+	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		_, _ = w.Write([]byte("ok\n"))
+	})
+
 	// API endpoints (JSON, public)
 	mux.HandleFunc("POST /api/login", handleAPILogin)
 	mux.HandleFunc("POST /api/register", handleAPIRegister)
@@ -159,6 +170,13 @@ func Register(mux *http.ServeMux, client *auth.Client, giteaAPIToken string, svc
 	mux.Handle("GET /icons/", noCacheAssets(http.StripPrefix("/icons/", http.FileServer(http.Dir("dist/icons")))))
 	mux.HandleFunc("GET /sw.js", servePWAServiceWorker)
 
+	// HL Patents Style auto-update endpoint. version.json is the manifest
+	// the installed Word client polls; HL-Patents-Style.dotm is fetched on
+	// version mismatch. Source files live in frontend/public/patentstyle/
+	// (copied into dist/ at build time). noCacheAssets ensures the manifest
+	// is never stale after a release.
+	mux.Handle("GET /patentstyle/", noCacheAssets(http.StripPrefix("/patentstyle/", http.FileServer(http.Dir("dist/patentstyle")))))
+
 	// Protected routes
 	protected := http.NewServeMux()
 	protected.HandleFunc("GET /tools/kostenrechner", handleKostenrechnerPage)