feat(verfahrensablauf): URL state hybrid — filter chips in URL, scenario in localStorage (t-paliad-308, m/paliad#137)

Splits /tools/verfahrensablauf persisted state into two namespaces:

URL params (timeline kind — paste-able, shareable, refresh-resistant):
  proceeding, side, target, trigger_date

localStorage `paliad.verfahrensablauf.scenario.*` (per-user tweaks
that should never leak into a shared link):
  event_choices, court_id, ccr, inf_amend, rev_amend, rev_cci,
  show_hidden

Hydration order: URL wins. localStorage fills the rest. A shared link
reproduces the timeline kind but each user sees their own scenario
state.

Added trigger_date and proceeding to URL (previously DOM-only — a
refresh lost the date and the proceeding tile). Moved event_choices
and show_hidden from URL to localStorage (verbose, per-user). Added
court_id + flag persistence to localStorage (previously DOM-only).

New pure module `views/verfahrensablauf-state.ts` owns the URL +
localStorage contract: URL parsers + encoder (`applyFiltersToSearch`),
scenario read/write helpers, and a `hydrate()` orchestrator that
documents the URL→localStorage order. 31 unit tests pin the contract,
including the "shared link doesn't leak scenario state" invariant.

Anti-patterns explicitly avoided:
- No ?appellant= resurrection (#132 removed it; engine reads from
  the single side picker for role-swap proceedings).
- trigger_date in URL not localStorage (a shared link must reproduce
  the same dated timeline).
- URL→localStorage hydration order is contract; localStorage never
  overrides an explicit URL value.

Project-driven side-fill chip (?project=<id>) still overrides as
before — parseSideFromSearch is called before the project's our_side
is applied so an explicit ?side= still wins.

Build clean: `bun run build`, `bun test` (240 pass / 594 expect calls),
`go test ./...`, `go vet ./...`.

frontend/src/client/verfahrensablauf.ts

@@ -12,7 +12,6 @@ import { initI18n, t, tDyn, getLang, onLangChange } from "./i18n";
 import { initSidebar } from "./sidebar";
 import {
   type DeadlineResponse,
-  type Side,
   calculateDeadlines,
   escHtml,
   formatDate,
@@ -24,10 +23,27 @@ import {
 import {
   attachEventCardChoices,
   reseedChips,
-  currentChoices,
   type EventChoice,
-  type ChoiceKind,
 } from "./views/event-card-choices";
+import {
+  APPEAL_TARGETS,
+  SCENARIO_KEYS,
+  type AppealTarget,
+  type Side,
+  type StorageLike,
+  applyFiltersToSearch,
+  makeMemoryStorage,
+  parseAppealTargetFromSearch,
+  parseProceedingFromSearch,
+  parseSideFromSearch,
+  parseTriggerDateFromSearch,
+  readBoolFlag,
+  readCourtId,
+  readEventChoices,
+  writeBoolFlag,
+  writeCourtId,
+  writeEventChoices,
+} from "./views/verfahrensablauf-state";
 
 let selectedType = "";
 let lastResponse: DeadlineResponse | null = null;
@@ -119,21 +135,13 @@ const ROLE_LABELS: Record<string, RoleLabels> = {
 // Proceedings that surface the appeal-target chip group. Currently
 // only the unified upc.apl proceeding; future variants (e.g. de.apl)
 // can opt in by adding the code here.
+//
+// APPEAL_TARGETS itself lives in ./views/verfahrensablauf-state so the
+// pure URL parser and this page share the same canonical list.
 const APPEAL_TARGET_PROCEEDINGS = new Set([
   "upc.apl.unified",
 ]);
 
-// Five canonical appeal-target slugs (lp.AppealTargets — keep ordered
-// in sync with pkg/litigationplanner/types.go AppealTargets).
-const APPEAL_TARGETS = [
-  "endentscheidung",
-  "kostenentscheidung",
-  "anordnung",
-  "schadensbemessung",
-  "bucheinsicht",
-] as const;
-type AppealTarget = (typeof APPEAL_TARGETS)[number] | "";
-
 function hasAppealTarget(proceedingType: string): boolean {
   return APPEAL_TARGET_PROCEEDINGS.has(proceedingType);
 }
@@ -142,16 +150,35 @@ function hasAppellantAxis(proceedingType: string): boolean {
   return APPELLANT_AXIS_PROCEEDINGS.has(proceedingType);
 }
 
-function readSideFromURL(): Side {
-  const raw = new URLSearchParams(window.location.search).get("side");
-  return raw === "claimant" || raw === "defendant" ? raw : null;
+// Scenario storage — real localStorage in the browser, in-memory
+// fallback when localStorage throws (private mode, disabled storage,
+// etc.). All scenario writes go through this single handle so a
+// failure mode is isolated to one try/catch path.
+const scenarioStorage: StorageLike = makeScenarioStorage();
+
+function makeScenarioStorage(): StorageLike {
+  try {
+    const probe = "__paliad_va_probe__";
+    window.localStorage.setItem(probe, "1");
+    window.localStorage.removeItem(probe);
+    return window.localStorage;
+  } catch {
+    return makeMemoryStorage();
+  }
 }
 
-function writeSideToURL(s: Side) {
+// URL writers — all four chip params route through this single helper
+// so the canonical query-string shape (no empty values, no trailing
+// `?`) is enforced in one place.
+function applyURLFilters(filters: {
+  proceeding?: string;
+  side?: Side;
+  target?: AppealTarget;
+  triggerDate?: string;
+}): void {
   const url = new URL(window.location.href);
-  if (s === null) url.searchParams.delete("side");
-  else url.searchParams.set("side", s);
-  window.history.replaceState(null, "", url.pathname + (url.search ? url.search : "") + url.hash);
+  const nextSearch = applyFiltersToSearch(url.search, filters);
+  window.history.replaceState(null, "", url.pathname + nextSearch + url.hash);
 }
 
 // t-paliad-301 / m/paliad#132: applies ROLE_LABELS to the side-row
@@ -181,26 +208,6 @@ function applyRoleLabels(proceedingType: string) {
   }
 }
 
-// Slice B1 — appeal-target URL state. Empty string = no target picked
-// (the row is hidden because the proceeding isn't an appeal). Any
-// other value must be one of APPEAL_TARGETS; unknown values are
-// rejected by readAppealTargetFromURL so a stale link can't break
-// the engine filter.
-function readAppealTargetFromURL(): AppealTarget {
-  const raw = new URLSearchParams(window.location.search).get("target") || "";
-  if ((APPEAL_TARGETS as readonly string[]).includes(raw)) {
-    return raw as AppealTarget;
-  }
-  return "";
-}
-
-function writeAppealTargetToURL(t: AppealTarget) {
-  const url = new URL(window.location.href);
-  if (t === "") url.searchParams.delete("target");
-  else url.searchParams.set("target", t);
-  window.history.replaceState(null, "", url.pathname + (url.search ? url.search : "") + url.hash);
-}
-
 // Default target on first picker entry into upc.apl. m: Endentscheidung
 // is the most-common appeal target; the chip group also defaults
 // "Endentscheidung" checked in verfahrensablauf.tsx. Keep these two in
@@ -217,54 +224,18 @@ const anchorOverrides = new Map<string, string>();
 function clearAnchorOverrides() { anchorOverrides.clear(); }
 
 // Per-event-card choices (t-paliad-265). Unbound on this page (no
-// project context), so persistence is URL-only via `?event_choices=`.
-// Format: comma-separated `submission_code:kind=value` tuples. Same
-// idiom as `?side=` + `?appellant=`.
-let perCardChoices: EventChoice[] = [];
+// project context). Persistence moved from URL → localStorage under
+// SCENARIO_KEYS.eventChoices (t-paliad-308 / m/paliad#137) — these
+// are per-user scenario tweaks, not the timeline kind, so a shared
+// link should NOT leak them into the recipient's view.
+let perCardChoices: EventChoice[] = readEventChoices(scenarioStorage);
 
-function readChoicesFromURL(): EventChoice[] {
-  const raw = new URLSearchParams(window.location.search).get("event_choices");
-  if (!raw) return [];
-  const out: EventChoice[] = [];
-  for (const tuple of raw.split(",")) {
-    const m = tuple.match(/^([^:]+):([^=]+)=(.+)$/);
-    if (!m) continue;
-    const kind = m[2] as ChoiceKind;
-    if (kind !== "appellant" && kind !== "include_ccr" && kind !== "skip") continue;
-    out.push({ submission_code: m[1], choice_kind: kind, choice_value: m[3] });
-  }
-  return out;
-}
-
-function writeChoicesToURL(choices: EventChoice[]) {
-  const url = new URL(window.location.href);
-  if (choices.length === 0) {
-    url.searchParams.delete("event_choices");
-  } else {
-    const enc = choices.map((c) => `${c.submission_code}:${c.choice_kind}=${c.choice_value}`).join(",");
-    url.searchParams.set("event_choices", enc);
-  }
-  window.history.replaceState(null, "", url.pathname + (url.search ? url.search : "") + url.hash);
-}
-
-// Show-hidden toggle state (t-paliad-290 / m/paliad#122). When ON, the
+// Show-hidden toggle (t-paliad-290 / m/paliad#122). When ON, the
 // calculator re-surfaces cards whose submission_code is in the active
 // skipRules set; they render faded with a "Wieder einblenden" chip.
-// URL-driven via ?show_hidden=1 so a shared link or reload preserves
-// the visibility. Default OFF — m's not asking to see hidden by
-// default, just to be able to.
-function readShowHiddenFromURL(): boolean {
-  return new URLSearchParams(window.location.search).get("show_hidden") === "1";
-}
-
-function writeShowHiddenToURL(on: boolean) {
-  const url = new URL(window.location.href);
-  if (on) url.searchParams.set("show_hidden", "1");
-  else url.searchParams.delete("show_hidden");
-  window.history.replaceState(null, "", url.pathname + (url.search ? url.search : "") + url.hash);
-}
-
-let showHidden = readShowHiddenFromURL();
+// Persistence moved from URL → localStorage (t-paliad-308) — it's a
+// per-user UX preference, not scenario state worth sharing in a link.
+let showHidden = readBoolFlag(scenarioStorage, SCENARIO_KEYS.showHidden);
 
 type ProcedureView = "timeline" | "columns";
 let procedureView: ProcedureView = "columns";
@@ -568,7 +539,7 @@ function syncInfAmendEnabled() {
   if (!ccr.checked) infAmend.checked = false;
 }
 
-function selectProceeding(btn: HTMLButtonElement) {
+function selectProceeding(btn: HTMLButtonElement, opts: { writeURL?: boolean } = {}) {
   document.querySelectorAll(".proceeding-btn").forEach((b) => b.classList.remove("active"));
   btn.classList.add("active");
   const nextType = btn.dataset.code || "";
@@ -578,20 +549,76 @@ function selectProceeding(btn: HTMLButtonElement) {
   if (selectedType !== nextType) clearAnchorOverrides();
   selectedType = nextType;
 
+  // Persist the picked proceeding to ?proceeding= so a refresh / shared
+  // link reproduces the same tile. writeURL=false on the load-time
+  // hydration path so we don't churn history.replaceState when the
+  // URL already carries the canonical value.
+  if (opts.writeURL !== false) {
+    applyURLFilters({ proceeding: selectedType });
+  }
+
   // Trigger-event label fires from the calc response (root rule).
   // Until step 3 renders, fall back to an em-dash placeholder.
   lastResponse = null;
   syncTriggerEventLabel();
 
-  void populateCourtPicker("court-picker-row", "court-picker", selectedType);
   syncFlagRows();
   syncAppealTargetRowVisibility();
   applyRoleLabels(selectedType);
+  // Restore flags from localStorage BEFORE the initial calc so the
+  // first /api/tools/fristenrechner POST already carries the user's
+  // stored flag state. Court_id is async (populateCourtPicker fetches
+  // courts from the API) so it restores via the .then() below + a
+  // follow-up recalc when the picker is ready.
+  restoreFlagsForProceeding();
 
   setProceedingPickerCollapsed(true, proceedingDisplayName(btn));
 
   showStep(2);
   scheduleCalc(0);
+
+  void populateCourtPicker("court-picker-row", "court-picker", selectedType).then(() => {
+    if (restoreCourtForProceeding()) scheduleCalc(0);
+  });
+}
+
+// restoreFlagsForProceeding seeds the proceeding-specific flag
+// checkboxes from localStorage. Mirrors syncFlagRows in scope — only
+// flags currently visible for the active proceeding are meaningful
+// (the hidden checkboxes still write to localStorage if toggled, but
+// that's impossible because they're not in the DOM as visible
+// controls). syncInfAmendEnabled enforces the upc.inf.cfi inf-amend
+// gating after the restore.
+function restoreFlagsForProceeding(): void {
+  const flagPairs: Array<[string, string]> = [
+    ["ccr-flag",       SCENARIO_KEYS.ccr],
+    ["inf-amend-flag", SCENARIO_KEYS.infAmend],
+    ["rev-amend-flag", SCENARIO_KEYS.revAmend],
+    ["rev-cci-flag",   SCENARIO_KEYS.revCci],
+  ];
+  for (const [domId, storageKey] of flagPairs) {
+    const cb = document.getElementById(domId) as HTMLInputElement | null;
+    if (!cb) continue;
+    cb.checked = readBoolFlag(scenarioStorage, storageKey);
+  }
+  syncInfAmendEnabled();
+}
+
+// restoreCourtForProceeding tries to apply the localStorage court_id
+// to the picker after populateCourtPicker resolves. Returns true iff
+// a value actually changed (so the caller can schedule a follow-up
+// calc). Skips silently when the picker is hidden, the stored ID isn't
+// in the options list (court rotated since last visit), or the picker
+// already happens to be on the stored value.
+function restoreCourtForProceeding(): boolean {
+  const courtPicker = document.getElementById("court-picker") as HTMLSelectElement | null;
+  const storedCourtId = readCourtId(scenarioStorage);
+  if (!courtPicker || !storedCourtId) return false;
+  const has = Array.from(courtPicker.options).some((o) => o.value === storedCourtId);
+  if (!has) return false;
+  if (courtPicker.value === storedCourtId) return false;
+  courtPicker.value = storedCourtId;
+  return true;
 }
 
 // Slice B1 (m/paliad#124 §18.1) — Berufung unification.
@@ -606,7 +633,7 @@ function syncAppealTargetRowVisibility() {
   row.style.display = visible ? "" : "none";
   if (!visible && currentAppealTarget !== "") {
     currentAppealTarget = "";
-    writeAppealTargetToURL("");
+    applyURLFilters({ target: "" });
     syncRadioGroup("appeal-target", "endentscheidung");
   }
 }
@@ -720,11 +747,11 @@ function showSideRadioCluster() {
 // already chosen and we never overwrite. When we do prefill, write the
 // derived side to the URL so reload + back/forward round-trip cleanly.
 function applySidePrefill(os: ProjectOurSide["our_side"] | undefined) {
-  if (readSideFromURL() !== null) return;
+  if (parseSideFromSearch(window.location.search) !== null) return;
   const next = ourSideToSide(os);
   if (next === null) return;
   currentSide = next;
-  writeSideToURL(next);
+  applyURLFilters({ side: next });
   syncRadioGroup("side", next);
   sidePrefilledFromProject = true;
   renderSideChip(next);
@@ -793,8 +820,8 @@ function initViewToggle() {
 // /api/tools/fristenrechner round-trip — perspective is a pure
 // projection of the last response, no backend involved.
 function initPerspectiveControls() {
-  currentSide = readSideFromURL();
-  currentAppealTarget = readAppealTargetFromURL();
+  currentSide = parseSideFromSearch(window.location.search);
+  currentAppealTarget = parseAppealTargetFromSearch(window.location.search);
   syncRadioGroup("side", currentSide ?? "");
   syncRadioGroup("appeal-target", currentAppealTarget || "endentscheidung");
   syncSideHintVisibility();
@@ -804,7 +831,7 @@ function initPerspectiveControls() {
       if (!input.checked) return;
       const v = input.value;
       currentSide = (v === "claimant" || v === "defendant") ? v : null;
-      writeSideToURL(currentSide);
+      applyURLFilters({ side: currentSide });
       syncSideHintVisibility();
       if (lastResponse) renderResults(lastResponse);
     });
@@ -822,7 +849,7 @@ function initPerspectiveControls() {
       } else {
         currentAppealTarget = "";
       }
-      writeAppealTargetToURL(currentAppealTarget);
+      applyURLFilters({ target: currentAppealTarget });
       scheduleCalc(0);
     });
   });
@@ -844,28 +871,57 @@ document.addEventListener("DOMContentLoaded", () => {
 
   const dateInput = document.getElementById("trigger-date") as HTMLInputElement | null;
   if (dateInput) {
-    dateInput.addEventListener("change", () => scheduleCalc());
-    dateInput.addEventListener("input", () => scheduleCalc());
+    // Hydrate trigger_date from URL on first paint so a refresh /
+    // shared link reproduces the same dated timeline. URL wins over
+    // the verfahrensablauf.tsx today-default that the <input> renders
+    // with. parseTriggerDateFromSearch validates the shape so a
+    // malformed link silently falls back to the today-default.
+    const urlDate = parseTriggerDateFromSearch(window.location.search);
+    if (urlDate) dateInput.value = urlDate;
+    const persistDate = () => {
+      applyURLFilters({ triggerDate: dateInput.value });
+    };
+    dateInput.addEventListener("change", () => { persistDate(); scheduleCalc(); });
+    dateInput.addEventListener("input", () => { persistDate(); scheduleCalc(); });
     dateInput.addEventListener("keydown", (e) => {
-      if ((e as KeyboardEvent).key === "Enter") scheduleCalc(0);
+      if ((e as KeyboardEvent).key === "Enter") { persistDate(); scheduleCalc(0); }
     });
   }
 
   const courtPicker = document.getElementById("court-picker") as HTMLSelectElement | null;
-  if (courtPicker) courtPicker.addEventListener("change", () => scheduleCalc(0));
+  if (courtPicker) courtPicker.addEventListener("change", () => {
+    writeCourtId(scenarioStorage, courtPicker.value);
+    scheduleCalc(0);
+  });
 
   // Flag-checkbox listeners — each flip triggers a fresh calc so the
   // timeline re-projects with the new gating. ccr-flag additionally
-  // enables/disables the nested inf-amend row.
+  // enables/disables the nested inf-amend row. Each flip also writes
+  // through to localStorage so the choice survives a reload (URL stays
+  // clean; flags are scenario state, not filter chips — t-paliad-308).
   const ccrFlag = document.getElementById("ccr-flag") as HTMLInputElement | null;
   if (ccrFlag) ccrFlag.addEventListener("change", () => {
+    writeBoolFlag(scenarioStorage, SCENARIO_KEYS.ccr, ccrFlag.checked);
     syncInfAmendEnabled();
+    // Disabling ccr also unchecks inf-amend (see syncInfAmendEnabled).
+    // Mirror that into storage so the next reload doesn't repopulate a
+    // disabled checkbox as checked.
+    const infAmend = document.getElementById("inf-amend-flag") as HTMLInputElement | null;
+    if (infAmend) writeBoolFlag(scenarioStorage, SCENARIO_KEYS.infAmend, infAmend.checked);
     scheduleCalc(0);
   });
-  (["inf-amend-flag", "rev-amend-flag", "rev-cci-flag"]).forEach((id) => {
+  const flagStorageKeys: Record<string, string> = {
+    "inf-amend-flag": SCENARIO_KEYS.infAmend,
+    "rev-amend-flag": SCENARIO_KEYS.revAmend,
+    "rev-cci-flag":   SCENARIO_KEYS.revCci,
+  };
+  for (const [id, storageKey] of Object.entries(flagStorageKeys)) {
     const cb = document.getElementById(id) as HTMLInputElement | null;
-    if (cb) cb.addEventListener("change", () => scheduleCalc(0));
-  });
+    if (cb) cb.addEventListener("change", () => {
+      writeBoolFlag(scenarioStorage, storageKey, cb.checked);
+      scheduleCalc(0);
+    });
+  }
 
   document.getElementById("fristen-print-btn")?.addEventListener("click", () => window.print());
 
@@ -909,16 +965,17 @@ document.addEventListener("DOMContentLoaded", () => {
     });
   }
 
-  // t-paliad-290 — show-hidden toggle. Hydrate from URL, wire change
-  // to URL + recalc (the backend reshapes the response — we can't just
-  // re-render lastResponse since the hidden rows aren't in it when the
-  // toggle was OFF).
+  // t-paliad-290 — show-hidden toggle. Hydrated from localStorage at
+  // module load (showHidden); each flip writes back to localStorage
+  // and triggers a recalc (the backend reshapes the response — we
+  // can't just re-render lastResponse since the hidden rows aren't
+  // in it when the toggle was OFF).
   const showHiddenCb = document.getElementById("show-hidden-toggle") as HTMLInputElement | null;
   if (showHiddenCb) {
     showHiddenCb.checked = showHidden;
     showHiddenCb.addEventListener("change", () => {
       showHidden = showHiddenCb.checked;
-      writeShowHiddenToURL(showHidden);
+      writeBoolFlag(scenarioStorage, SCENARIO_KEYS.showHidden, showHidden);
       scheduleCalc(0);
     });
   }
@@ -926,11 +983,10 @@ document.addEventListener("DOMContentLoaded", () => {
   initViewToggle();
   initPerspectiveControls();
 
-  // t-paliad-265 — per-event-card choices. Unbound surface, so commits
-  // mutate the in-memory list + URL, then trigger a recalc. The
-  // popover module owns the popover lifecycle; this page owns the
-  // recalc + URL plumbing.
-  perCardChoices = readChoicesFromURL();
+  // t-paliad-265 — per-event-card choices. Unbound surface; persistence
+  // is localStorage-only (t-paliad-308) so a shared link doesn't carry
+  // the recipient's per-card tweaks. The popover module owns the
+  // popover lifecycle; this page owns the recalc + storage plumbing.
   const timelineEl = document.getElementById("timeline-container");
   if (timelineEl) {
     attachEventCardChoices({
@@ -941,14 +997,14 @@ document.addEventListener("DOMContentLoaded", () => {
           (c) => !(c.submission_code === choice.submission_code && c.choice_kind === choice.choice_kind),
         );
         perCardChoices.push(choice);
-        writeChoicesToURL(perCardChoices);
+        writeEventChoices(scenarioStorage, perCardChoices);
         scheduleCalc(0);
       },
       remove: (submissionCode, kind) => {
         perCardChoices = perCardChoices.filter(
           (c) => !(c.submission_code === submissionCode && c.choice_kind === kind),
         );
-        writeChoicesToURL(perCardChoices);
+        writeEventChoices(scenarioStorage, perCardChoices);
         scheduleCalc(0);
       },
     });
@@ -984,8 +1040,31 @@ document.addEventListener("DOMContentLoaded", () => {
     syncTriggerEventLabel();
   });
 
-  // Pre-select the first proceeding tile so users see a timeline
-  // immediately on landing — matches /tools/fristenrechner behaviour.
-  const firstBtn = document.querySelector<HTMLButtonElement>(".proceeding-btn");
-  if (firstBtn) selectProceeding(firstBtn);
+  // Pre-select the proceeding tile. URL wins: if ?proceeding= is set
+  // and points at a known tile, that tile is selected without rewriting
+  // the URL. Otherwise fall back to the first tile so users see a
+  // timeline immediately on landing — matches /tools/fristenrechner
+  // behaviour. The auto-pick does NOT write the URL so the default
+  // landing stays clean (`?proceeding=` only appears once the user
+  // makes an explicit choice). (t-paliad-308 / m/paliad#137)
+  const urlProceeding = parseProceedingFromSearch(window.location.search);
+  let initialBtn: HTMLButtonElement | null = null;
+  let urlHit = false;
+  if (urlProceeding) {
+    initialBtn = document.querySelector<HTMLButtonElement>(
+      `.proceeding-btn[data-code="${urlProceeding.replace(/"/g, '\\"')}"]`,
+    );
+    urlHit = initialBtn !== null;
+  }
+  if (!initialBtn) {
+    initialBtn = document.querySelector<HTMLButtonElement>(".proceeding-btn");
+  }
+  if (initialBtn) {
+    // writeURL=false when the URL either already carries this code
+    // (no churn) or has no proceeding (auto-default → don't pollute
+    // the clean URL). Only an unknown / stale ?proceeding= triggers
+    // a rewrite so the URL converges on the resolved tile.
+    const writeURL = urlProceeding !== "" && !urlHit;
+    selectProceeding(initialBtn, { writeURL });
+  }
 });

frontend/src/client/views/verfahrensablauf-state.test.ts

@@ -0,0 +1,309 @@
+// Unit tests for the /tools/verfahrensablauf URL + scenario-localStorage
+// state contract (t-paliad-308 / m/paliad#137). Run with `bun test`.
+//
+// The contract:
+//   1. URL params (proceeding, side, target, trigger_date) define which
+//      timeline kind the user is looking at — paste-able, shareable,
+//      refresh-resistant.
+//   2. localStorage (paliad.verfahrensablauf.scenario.*) holds the
+//      per-user scenario tweaks (event_choices, court_id, flags,
+//      show_hidden) — these never leak into a shared link.
+//   3. On hydrate, URL wins. localStorage fills the rest.
+
+import { describe, expect, test } from "bun:test";
+import {
+  APPEAL_TARGETS,
+  SCENARIO_KEYS,
+  SCENARIO_PREFIX,
+  URL_KEYS,
+  applyFiltersToSearch,
+  hydrate,
+  makeMemoryStorage,
+  parseAppealTargetFromSearch,
+  parseProceedingFromSearch,
+  parseSideFromSearch,
+  parseTriggerDateFromSearch,
+  readBoolFlag,
+  readCourtId,
+  readEventChoices,
+  readScenario,
+  writeBoolFlag,
+  writeCourtId,
+  writeEventChoices,
+} from "./verfahrensablauf-state";
+
+describe("URL parsers — filter chips", () => {
+  test("parseProceedingFromSearch returns empty string when absent", () => {
+    expect(parseProceedingFromSearch("")).toBe("");
+    expect(parseProceedingFromSearch("?side=claimant")).toBe("");
+  });
+
+  test("parseProceedingFromSearch echoes the raw value", () => {
+    expect(parseProceedingFromSearch("?proceeding=upc.inf.cfi")).toBe("upc.inf.cfi");
+    expect(parseProceedingFromSearch("?proceeding=upc.apl.unified&side=claimant")).toBe("upc.apl.unified");
+  });
+
+  test("parseSideFromSearch validates the enum", () => {
+    expect(parseSideFromSearch("?side=claimant")).toBe("claimant");
+    expect(parseSideFromSearch("?side=defendant")).toBe("defendant");
+    expect(parseSideFromSearch("?side=neither")).toBe(null);
+    expect(parseSideFromSearch("")).toBe(null);
+  });
+
+  test("parseAppealTargetFromSearch only accepts canonical slugs", () => {
+    for (const t of APPEAL_TARGETS) {
+      expect(parseAppealTargetFromSearch(`?target=${t}`)).toBe(t);
+    }
+    expect(parseAppealTargetFromSearch("?target=unknown")).toBe("");
+    expect(parseAppealTargetFromSearch("")).toBe("");
+  });
+
+  test("parseTriggerDateFromSearch validates the ISO-date shape", () => {
+    expect(parseTriggerDateFromSearch("?trigger_date=2026-05-26")).toBe("2026-05-26");
+    expect(parseTriggerDateFromSearch("?trigger_date=2024-02-29")).toBe("2024-02-29"); // leap year
+  });
+
+  test("parseTriggerDateFromSearch rejects malformed and impossible dates", () => {
+    expect(parseTriggerDateFromSearch("?trigger_date=2026-02-30")).toBe(""); // Feb 30
+    expect(parseTriggerDateFromSearch("?trigger_date=2026-13-01")).toBe(""); // month 13
+    expect(parseTriggerDateFromSearch("?trigger_date=tomorrow")).toBe("");
+    expect(parseTriggerDateFromSearch("?trigger_date=2026-5-26")).toBe(""); // 1-digit month
+    expect(parseTriggerDateFromSearch("")).toBe("");
+  });
+});
+
+describe("URL encoder — applyFiltersToSearch", () => {
+  test("empty filters preserve the existing query string", () => {
+    expect(applyFiltersToSearch("?other=keep", {})).toBe("?other=keep");
+  });
+
+  test("setting a filter writes the canonical key", () => {
+    expect(applyFiltersToSearch("", { proceeding: "upc.inf.cfi" })).toBe("?proceeding=upc.inf.cfi");
+    expect(applyFiltersToSearch("", { side: "claimant" })).toBe("?side=claimant");
+    expect(applyFiltersToSearch("", { target: "endentscheidung" })).toBe("?target=endentscheidung");
+    expect(applyFiltersToSearch("", { triggerDate: "2026-05-26" })).toBe("?trigger_date=2026-05-26");
+  });
+
+  test("setting null / empty / undefined deletes the key", () => {
+    expect(applyFiltersToSearch("?side=claimant", { side: null })).toBe("");
+    expect(applyFiltersToSearch("?proceeding=upc.inf.cfi", { proceeding: "" })).toBe("");
+    expect(applyFiltersToSearch("?target=endentscheidung", { target: "" })).toBe("");
+    expect(applyFiltersToSearch("?trigger_date=2026-05-26", { triggerDate: "" })).toBe("");
+  });
+
+  test("invalid trigger_date is deleted (never written as-is)", () => {
+    expect(applyFiltersToSearch("?trigger_date=2026-05-26", { triggerDate: "bogus" })).toBe("");
+  });
+
+  test("setting all four filters together emits all four keys", () => {
+    const out = applyFiltersToSearch("", {
+      proceeding: "upc.apl.unified",
+      side: "defendant",
+      target: "endentscheidung",
+      triggerDate: "2026-05-26",
+    });
+    expect(out).toContain("proceeding=upc.apl.unified");
+    expect(out).toContain("side=defendant");
+    expect(out).toContain("target=endentscheidung");
+    expect(out).toContain("trigger_date=2026-05-26");
+  });
+
+  test("other params (project, view) are preserved", () => {
+    const out = applyFiltersToSearch("?project=abc&view=timeline", { side: "claimant" });
+    expect(out).toContain("project=abc");
+    expect(out).toContain("view=timeline");
+    expect(out).toContain("side=claimant");
+  });
+
+  test("absent keys in the filter object don't touch existing URL values", () => {
+    // Only updating side — proceeding should be untouched.
+    const out = applyFiltersToSearch("?proceeding=upc.inf.cfi&side=defendant", { side: "claimant" });
+    expect(out).toContain("proceeding=upc.inf.cfi");
+    expect(out).toContain("side=claimant");
+  });
+});
+
+describe("URL round-trip — encode then parse yields the same value", () => {
+  test("proceeding", () => {
+    const enc = applyFiltersToSearch("", { proceeding: "upc.inf.cfi" });
+    expect(parseProceedingFromSearch(enc)).toBe("upc.inf.cfi");
+  });
+
+  test("side", () => {
+    const enc = applyFiltersToSearch("", { side: "defendant" });
+    expect(parseSideFromSearch(enc)).toBe("defendant");
+  });
+
+  test("target", () => {
+    const enc = applyFiltersToSearch("", { target: "kostenentscheidung" });
+    expect(parseAppealTargetFromSearch(enc)).toBe("kostenentscheidung");
+  });
+
+  test("trigger_date", () => {
+    const enc = applyFiltersToSearch("", { triggerDate: "2026-05-26" });
+    expect(parseTriggerDateFromSearch(enc)).toBe("2026-05-26");
+  });
+});
+
+describe("Scenario localStorage helpers", () => {
+  test("SCENARIO_PREFIX is paliad.verfahrensablauf.scenario and all keys live under it", () => {
+    expect(SCENARIO_PREFIX).toBe("paliad.verfahrensablauf.scenario");
+    for (const key of Object.values(SCENARIO_KEYS)) {
+      expect(key.startsWith(SCENARIO_PREFIX + ".")).toBe(true);
+    }
+  });
+
+  test("readEventChoices returns [] on empty storage", () => {
+    const s = makeMemoryStorage();
+    expect(readEventChoices(s)).toEqual([]);
+  });
+
+  test("writeEventChoices + readEventChoices round-trip", () => {
+    const s = makeMemoryStorage();
+    const choices = [
+      { submission_code: "upc.inf.cfi.r12", choice_kind: "appellant" as const, choice_value: "claimant" },
+      { submission_code: "upc.inf.cfi.r30", choice_kind: "include_ccr" as const, choice_value: "1" },
+    ];
+    writeEventChoices(s, choices);
+    expect(readEventChoices(s)).toEqual(choices);
+  });
+
+  test("writeEventChoices([]) clears the key (removeItem semantic, not empty string)", () => {
+    const s = makeMemoryStorage();
+    writeEventChoices(s, [{ submission_code: "r1", choice_kind: "skip", choice_value: "1" }]);
+    expect(s.getItem(SCENARIO_KEYS.eventChoices)).not.toBe(null);
+    writeEventChoices(s, []);
+    expect(s.getItem(SCENARIO_KEYS.eventChoices)).toBe(null);
+  });
+
+  test("readEventChoices ignores unknown choice_kind values", () => {
+    const s = makeMemoryStorage();
+    s.setItem(SCENARIO_KEYS.eventChoices, "r1:appellant=claimant,r2:bogus=x,r3:skip=1");
+    expect(readEventChoices(s)).toEqual([
+      { submission_code: "r1", choice_kind: "appellant", choice_value: "claimant" },
+      { submission_code: "r3", choice_kind: "skip", choice_value: "1" },
+    ]);
+  });
+
+  test("readCourtId returns '' on empty storage, echoes stored value otherwise", () => {
+    const s = makeMemoryStorage();
+    expect(readCourtId(s)).toBe("");
+    writeCourtId(s, "UPC-LD-MUC");
+    expect(readCourtId(s)).toBe("UPC-LD-MUC");
+  });
+
+  test("writeCourtId('') removes the key", () => {
+    const s = makeMemoryStorage();
+    writeCourtId(s, "UPC-LD-MUC");
+    expect(s.getItem(SCENARIO_KEYS.courtId)).toBe("UPC-LD-MUC");
+    writeCourtId(s, "");
+    expect(s.getItem(SCENARIO_KEYS.courtId)).toBe(null);
+  });
+
+  test("readBoolFlag / writeBoolFlag round-trip with removeItem on false", () => {
+    const s = makeMemoryStorage();
+    expect(readBoolFlag(s, SCENARIO_KEYS.ccr)).toBe(false);
+    writeBoolFlag(s, SCENARIO_KEYS.ccr, true);
+    expect(readBoolFlag(s, SCENARIO_KEYS.ccr)).toBe(true);
+    expect(s.getItem(SCENARIO_KEYS.ccr)).toBe("1");
+    writeBoolFlag(s, SCENARIO_KEYS.ccr, false);
+    expect(readBoolFlag(s, SCENARIO_KEYS.ccr)).toBe(false);
+    expect(s.getItem(SCENARIO_KEYS.ccr)).toBe(null);
+  });
+
+  test("readScenario returns all fields defaulted on empty storage", () => {
+    const s = makeMemoryStorage();
+    expect(readScenario(s)).toEqual({
+      eventChoices: [],
+      courtId: "",
+      ccr: false,
+      infAmend: false,
+      revAmend: false,
+      revCci: false,
+      showHidden: false,
+    });
+  });
+});
+
+describe("Hydration order — URL wins, localStorage fills the rest", () => {
+  test("URL fills filter chips, localStorage fills scenario state", () => {
+    const s = makeMemoryStorage();
+    writeCourtId(s, "UPC-LD-MUC");
+    writeBoolFlag(s, SCENARIO_KEYS.showHidden, true);
+    writeBoolFlag(s, SCENARIO_KEYS.ccr, true);
+    const out = hydrate(
+      "?proceeding=upc.inf.cfi&side=defendant&target=endentscheidung&trigger_date=2026-05-26",
+      s,
+    );
+    // URL-sourced
+    expect(out.proceeding).toBe("upc.inf.cfi");
+    expect(out.side).toBe("defendant");
+    expect(out.target).toBe("endentscheidung");
+    expect(out.triggerDate).toBe("2026-05-26");
+    // localStorage-sourced
+    expect(out.courtId).toBe("UPC-LD-MUC");
+    expect(out.showHidden).toBe(true);
+    expect(out.ccr).toBe(true);
+  });
+
+  test("absent URL → all filter fields are empty/null, localStorage still hydrates scenario", () => {
+    const s = makeMemoryStorage();
+    writeCourtId(s, "UPC-LD-MUC");
+    const out = hydrate("", s);
+    expect(out.proceeding).toBe("");
+    expect(out.side).toBe(null);
+    expect(out.target).toBe("");
+    expect(out.triggerDate).toBe("");
+    expect(out.courtId).toBe("UPC-LD-MUC");
+  });
+
+  test("absent localStorage → URL still fills filter chips, scenario defaults", () => {
+    const s = makeMemoryStorage();
+    const out = hydrate(
+      "?proceeding=upc.apl.unified&side=claimant&target=anordnung&trigger_date=2026-07-01",
+      s,
+    );
+    expect(out.proceeding).toBe("upc.apl.unified");
+    expect(out.side).toBe("claimant");
+    expect(out.target).toBe("anordnung");
+    expect(out.triggerDate).toBe("2026-07-01");
+    expect(out.courtId).toBe("");
+    expect(out.eventChoices).toEqual([]);
+    expect(out.showHidden).toBe(false);
+  });
+
+  test("a shared link doesn't leak the recipient's scenario state in", () => {
+    // Two storages: m's (loaded with court + flags) and a recipient's
+    // (empty). The same URL should reproduce filter chips identically
+    // but leave each user's scenario state untouched.
+    const mStorage = makeMemoryStorage();
+    writeCourtId(mStorage, "UPC-LD-MUC");
+    writeBoolFlag(mStorage, SCENARIO_KEYS.ccr, true);
+    const recipientStorage = makeMemoryStorage();
+
+    const sharedURL = "?proceeding=upc.inf.cfi&side=defendant&trigger_date=2026-05-26";
+
+    const mView = hydrate(sharedURL, mStorage);
+    const recipientView = hydrate(sharedURL, recipientStorage);
+
+    // Filter chips identical
+    expect(mView.proceeding).toBe(recipientView.proceeding);
+    expect(mView.side).toBe(recipientView.side);
+    expect(mView.triggerDate).toBe(recipientView.triggerDate);
+
+    // Scenario state diverges — recipient sees defaults
+    expect(mView.courtId).toBe("UPC-LD-MUC");
+    expect(recipientView.courtId).toBe("");
+    expect(mView.ccr).toBe(true);
+    expect(recipientView.ccr).toBe(false);
+  });
+});
+
+describe("URL key constants match the documented contract", () => {
+  test("URL_KEYS uses the spec'd snake_case names", () => {
+    expect(URL_KEYS.proceeding).toBe("proceeding");
+    expect(URL_KEYS.side).toBe("side");
+    expect(URL_KEYS.target).toBe("target");
+    expect(URL_KEYS.triggerDate).toBe("trigger_date");
+  });
+});

frontend/src/client/views/verfahrensablauf-state.ts

@@ -0,0 +1,263 @@
+// /tools/verfahrensablauf URL + scenario-localStorage state contract
+// (t-paliad-308 / m/paliad#137). Splits the page's persisted state into
+// two namespaces:
+//
+//   URL params (filter chips — the timeline kind the user is looking
+//   at; paste-able, shareable, refresh-resistant):
+//     proceeding, side, target, trigger_date
+//
+//   localStorage `paliad.verfahrensablauf.scenario.*` (per-user
+//   scenario inputs — the noisy parts that don't belong in a URL):
+//     event_choices, court_id, ccr, inf_amend, rev_amend, rev_cci,
+//     show_hidden
+//
+// Hydration order: URL wins. On page load, URL fills the filter chips;
+// localStorage fills the rest. Filter-chip changes write to URL only.
+// Scenario changes write to localStorage only. A shared link from a
+// colleague reproduces the timeline kind (proceeding + side + target +
+// trigger_date) but never leaks the recipient's court / flag /
+// event_choices state in.
+//
+// All helpers in this module are pure: they take a search string (or a
+// StorageLike) and return values, no DOM. The wiring in
+// ../verfahrensablauf.ts mounts them onto window.location +
+// window.localStorage at runtime.
+
+import type { EventChoice, ChoiceKind } from "./event-card-choices";
+
+// ----- URL params (filter chips) ----------------------------------
+
+export type Side = "claimant" | "defendant" | null;
+
+export const APPEAL_TARGETS = [
+  "endentscheidung",
+  "kostenentscheidung",
+  "anordnung",
+  "schadensbemessung",
+  "bucheinsicht",
+] as const;
+export type AppealTarget = (typeof APPEAL_TARGETS)[number] | "";
+
+export const URL_KEYS = {
+  proceeding: "proceeding",
+  side: "side",
+  target: "target",
+  triggerDate: "trigger_date",
+} as const;
+
+// parseProceedingFromSearch extracts the proceeding code. Returns ""
+// if absent. No validation against the proceeding registry — that's
+// the caller's job (an unknown code from a stale link should leave
+// the first-tile auto-select fallback running).
+export function parseProceedingFromSearch(search: string): string {
+  const v = new URLSearchParams(search).get(URL_KEYS.proceeding);
+  return v ?? "";
+}
+
+export function parseSideFromSearch(search: string): Side {
+  const raw = new URLSearchParams(search).get(URL_KEYS.side);
+  return raw === "claimant" || raw === "defendant" ? raw : null;
+}
+
+export function parseAppealTargetFromSearch(search: string): AppealTarget {
+  const raw = new URLSearchParams(search).get(URL_KEYS.target) || "";
+  if ((APPEAL_TARGETS as readonly string[]).includes(raw)) {
+    return raw as AppealTarget;
+  }
+  return "";
+}
+
+// parseTriggerDateFromSearch validates the ISO-date shape so a
+// malformed link can't poison the date input. Accepts "YYYY-MM-DD"
+// only. Round-tripped against Date to reject 2026-02-30 etc.
+export function parseTriggerDateFromSearch(search: string): string {
+  const raw = new URLSearchParams(search).get(URL_KEYS.triggerDate) || "";
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(raw)) return "";
+  const d = new Date(raw + "T00:00:00Z");
+  if (Number.isNaN(d.getTime())) return "";
+  if (d.toISOString().slice(0, 10) !== raw) return "";
+  return raw;
+}
+
+// applyFiltersToSearch produces the canonical query string for the
+// four URL-owned params. Other params (e.g. ?view=, ?project=) are
+// preserved verbatim. Empty values are deleted, never written as
+// empty string, so the URL stays clean on the default.
+export function applyFiltersToSearch(
+  search: string,
+  filters: { proceeding?: string; side?: Side; target?: AppealTarget; triggerDate?: string },
+): string {
+  const params = new URLSearchParams(search);
+  if ("proceeding" in filters) {
+    if (filters.proceeding && filters.proceeding !== "") {
+      params.set(URL_KEYS.proceeding, filters.proceeding);
+    } else {
+      params.delete(URL_KEYS.proceeding);
+    }
+  }
+  if ("side" in filters) {
+    if (filters.side === "claimant" || filters.side === "defendant") {
+      params.set(URL_KEYS.side, filters.side);
+    } else {
+      params.delete(URL_KEYS.side);
+    }
+  }
+  if ("target" in filters) {
+    if (filters.target && filters.target !== "") {
+      params.set(URL_KEYS.target, filters.target);
+    } else {
+      params.delete(URL_KEYS.target);
+    }
+  }
+  if ("triggerDate" in filters) {
+    if (filters.triggerDate && /^\d{4}-\d{2}-\d{2}$/.test(filters.triggerDate)) {
+      params.set(URL_KEYS.triggerDate, filters.triggerDate);
+    } else {
+      params.delete(URL_KEYS.triggerDate);
+    }
+  }
+  const s = params.toString();
+  return s ? `?${s}` : "";
+}
+
+// ----- localStorage (scenario state) ------------------------------
+
+export const SCENARIO_PREFIX = "paliad.verfahrensablauf.scenario";
+export const SCENARIO_KEYS = {
+  eventChoices: `${SCENARIO_PREFIX}.event_choices`,
+  courtId: `${SCENARIO_PREFIX}.court_id`,
+  ccr: `${SCENARIO_PREFIX}.ccr`,
+  infAmend: `${SCENARIO_PREFIX}.inf_amend`,
+  revAmend: `${SCENARIO_PREFIX}.rev_amend`,
+  revCci: `${SCENARIO_PREFIX}.rev_cci`,
+  showHidden: `${SCENARIO_PREFIX}.show_hidden`,
+} as const;
+
+// StorageLike is the tiny subset of the Web Storage API the scenario
+// helpers actually use. Lets the tests pass a Map-backed fake without
+// pulling in a full localStorage polyfill.
+export interface StorageLike {
+  getItem(key: string): string | null;
+  setItem(key: string, value: string): void;
+  removeItem(key: string): void;
+}
+
+// readEventChoices is forgiving: malformed tuples or unknown
+// choice_kinds are dropped silently. Same shape as the legacy URL
+// codec (comma-separated `submission_code:kind=value`).
+export function readEventChoices(storage: StorageLike): EventChoice[] {
+  const raw = storage.getItem(SCENARIO_KEYS.eventChoices);
+  if (!raw) return [];
+  const out: EventChoice[] = [];
+  for (const tuple of raw.split(",")) {
+    const m = tuple.match(/^([^:]+):([^=]+)=(.+)$/);
+    if (!m) continue;
+    const kind = m[2] as ChoiceKind;
+    if (kind !== "appellant" && kind !== "include_ccr" && kind !== "skip") continue;
+    out.push({ submission_code: m[1], choice_kind: kind, choice_value: m[3] });
+  }
+  return out;
+}
+
+export function writeEventChoices(storage: StorageLike, choices: EventChoice[]): void {
+  if (choices.length === 0) {
+    storage.removeItem(SCENARIO_KEYS.eventChoices);
+    return;
+  }
+  const enc = choices
+    .map((c) => `${c.submission_code}:${c.choice_kind}=${c.choice_value}`)
+    .join(",");
+  storage.setItem(SCENARIO_KEYS.eventChoices, enc);
+}
+
+// readCourtId / writeCourtId — empty string == no court picked. The
+// "" value is stored as a removed key, not an empty string entry, so
+// reading it back yields null rather than "".
+export function readCourtId(storage: StorageLike): string {
+  return storage.getItem(SCENARIO_KEYS.courtId) ?? "";
+}
+
+export function writeCourtId(storage: StorageLike, courtId: string): void {
+  if (courtId === "") {
+    storage.removeItem(SCENARIO_KEYS.courtId);
+    return;
+  }
+  storage.setItem(SCENARIO_KEYS.courtId, courtId);
+}
+
+// Boolean flags — "1" / "0" string encoding, removeItem on default
+// (false for flags, also false for show_hidden) so the storage stays
+// uncluttered on a fresh page.
+export function readBoolFlag(storage: StorageLike, key: string): boolean {
+  return storage.getItem(key) === "1";
+}
+
+export function writeBoolFlag(storage: StorageLike, key: string, on: boolean): void {
+  if (on) storage.setItem(key, "1");
+  else storage.removeItem(key);
+}
+
+// Read all scenario state in one call — convenience for the page's
+// load-time hydration. Caller decides whether to apply each field
+// (e.g. court_id is proceeding-specific; the page may discard the
+// stored value if the active proceeding doesn't expose a court row).
+export interface ScenarioState {
+  eventChoices: EventChoice[];
+  courtId: string;
+  ccr: boolean;
+  infAmend: boolean;
+  revAmend: boolean;
+  revCci: boolean;
+  showHidden: boolean;
+}
+
+export function readScenario(storage: StorageLike): ScenarioState {
+  return {
+    eventChoices: readEventChoices(storage),
+    courtId: readCourtId(storage),
+    ccr: readBoolFlag(storage, SCENARIO_KEYS.ccr),
+    infAmend: readBoolFlag(storage, SCENARIO_KEYS.infAmend),
+    revAmend: readBoolFlag(storage, SCENARIO_KEYS.revAmend),
+    revCci: readBoolFlag(storage, SCENARIO_KEYS.revCci),
+    showHidden: readBoolFlag(storage, SCENARIO_KEYS.showHidden),
+  };
+}
+
+// ----- URL → localStorage hydration order -------------------------
+
+// The page's load-time contract: read URL filters, then read
+// scenario state from localStorage. URL wins on conflict — but the
+// only field that can conflict is none of them today (URL owns
+// proceeding/side/target/trigger_date; localStorage owns the rest).
+// The order matters for one edge case: if a future field migrates
+// from URL → localStorage with overlap, the URL value MUST be honored.
+
+export interface HydratedState extends ScenarioState {
+  proceeding: string;
+  side: Side;
+  target: AppealTarget;
+  triggerDate: string;
+}
+
+export function hydrate(search: string, storage: StorageLike): HydratedState {
+  const scenario = readScenario(storage);
+  return {
+    proceeding: parseProceedingFromSearch(search),
+    side: parseSideFromSearch(search),
+    target: parseAppealTargetFromSearch(search),
+    triggerDate: parseTriggerDateFromSearch(search),
+    ...scenario,
+  };
+}
+
+// makeMemoryStorage — tiny StorageLike for tests / SSR fallback.
+// Not used by the runtime page (which mounts real localStorage), but
+// kept here so test files have one well-known import.
+export function makeMemoryStorage(): StorageLike {
+  const store = new Map<string, string>();
+  return {
+    getItem: (k) => (store.has(k) ? store.get(k)! : null),
+    setItem: (k, v) => { store.set(k, v); },
+    removeItem: (k) => { store.delete(k); },
+  };
+}

frontend/src/styles/global.css

@@ -6230,7 +6230,7 @@ dialog.modal::backdrop {
     align-items: baseline;
     padding: 0.75rem 1rem;
     border-bottom: 1px solid var(--color-border);
-    background: var(--color-surface-2);
+    background: var(--color-surface-alt, #fafafa);
     flex-wrap: wrap;
     gap: 0.5rem;
 }
@@ -6388,7 +6388,7 @@ dialog.modal::backdrop {
 }
 
 .submissions-new-chip:hover {
-    background: var(--color-surface-muted);
+    background: var(--color-surface-alt, #f4f4f4);
 }
 
 .submissions-new-chip--active {
@@ -6426,7 +6426,7 @@ dialog.modal::backdrop {
 }
 
 .submissions-new-project-item:hover {
-    background: var(--color-surface-muted);
+    background: var(--color-surface-alt, #f4f4f4);
 }
 
 .submissions-new-project-title {
@@ -6441,7 +6441,7 @@ dialog.modal::backdrop {
     flex-wrap: wrap;
     padding: 0.75rem 1rem;
     margin: 0 0 1.25rem;
-    background: var(--color-bg-subtle);
+    background: var(--color-surface-alt, #f7f7f0);
     border: 1px solid var(--color-border);
     border-left: 4px solid var(--color-accent, #c6f41c);
     border-radius: 6px;
@@ -6464,7 +6464,7 @@ dialog.modal::backdrop {
     flex-wrap: wrap;
     padding: 0.5rem 0.6rem;
     margin-bottom: 0.75rem;
-    background: var(--color-bg-subtle);
+    background: var(--color-surface-alt, #f7f7f0);
     border: 1px solid var(--color-border);
     border-radius: 6px;
 }
@@ -6592,7 +6592,7 @@ dialog.modal::backdrop {
     border: 1px solid var(--color-border);
     border-radius: 6px;
     padding: 0.6rem;
-    background: var(--color-bg-subtle);
+    background: var(--color-surface-alt, #f7f7f0);
     display: flex;
     flex-direction: column;
     gap: 0.5rem;
@@ -6715,7 +6715,7 @@ dialog.modal::backdrop {
     margin-left: 0.3rem;
     padding: 0 0.4em;
     border-radius: 3px;
-    background: var(--color-bg-subtle);
+    background: var(--color-surface-alt, #f7f7f0);
     color: var(--color-text-muted);
 }
 
@@ -7922,7 +7922,7 @@ dialog.modal::backdrop {
 .collab-invite-hint {
     margin-top: 0.5rem;
     padding: 0.5rem 0.75rem;
-    background: var(--color-bg-lime-tint);
+    background: var(--color-surface-alt, var(--color-bg-lime-tint));
     border: 1px dashed var(--color-border);
     border-radius: var(--radius);
     font-size: 0.85rem;
@@ -16582,7 +16582,7 @@ dialog.quick-add-sheet::backdrop {
     width: 1.4rem;
     height: 1.4rem;
     border-radius: 50%;
-    background: var(--color-surface-muted);
+    background: var(--color-surface-alt, #f4f4f4);
     color: var(--color-text-muted);
     font-size: 0.85rem;
     font-weight: 600;
@@ -16636,7 +16636,7 @@ dialog.quick-add-sheet::backdrop {
     font-size: 0.72rem;
     padding: 0.1rem 0.45rem;
     border-radius: 999px;
-    background: var(--color-surface-muted);
+    background: var(--color-surface-alt, #f4f4f4);
     color: var(--color-text-muted);
     font-weight: 500;
     letter-spacing: 0.02em;
@@ -16658,7 +16658,7 @@ dialog.quick-add-sheet::backdrop {
 }
 
 .smart-timeline-kind-chip--projected {
-    background: var(--color-surface-muted);
+    background: var(--color-surface-alt, #f4f4f4);
     color: var(--color-text-muted);
     font-style: italic;
 }
@@ -16725,7 +16725,7 @@ dialog.quick-add-sheet::backdrop {
 
 .smart-timeline-add-choice:hover:not(:disabled) {
     border-color: var(--color-accent-fg);
-    background: var(--color-surface-2);
+    background: var(--color-surface-alt, #fafafa);
 }
 
 .smart-timeline-add-choice--primary {

internal/db/migrations/139_deadline_rules_unified_view.down.sql

@@ -1,7 +0,0 @@
--- 139_deadline_rules_unified_view (down) — Slice B.3, t-paliad-305
---
--- Drops the view. The underlying paliad.sequencing_rules /
--- procedural_events / legal_sources tables are untouched (they own the
--- data — the view is just a projection).
-
-DROP VIEW IF EXISTS paliad.deadline_rules_unified;

internal/db/migrations/139_deadline_rules_unified_view.up.sql

@@ -1,122 +0,0 @@
--- 139_deadline_rules_unified_view — Slice B.3 read cutover (t-paliad-305 / m/paliad#93)
---
--- Creates paliad.deadline_rules_unified — a Postgres VIEW that
--- re-projects paliad.sequencing_rules + paliad.procedural_events +
--- paliad.legal_sources back into the legacy paliad.deadline_rules
--- column shape.
---
--- Why a view instead of rewriting every SELECT in Go:
---
---   - 19 read sites across 11 service files reference
---     paliad.deadline_rules. Rewriting each by hand multiplies the
---     opportunity for off-by-one bugs in the JOIN.
---   - The view has the same column names + types as the legacy table,
---     so the change in Go is a 1-token substitution per query
---     (FROM paliad.deadline_rules → FROM paliad.deadline_rules_unified)
---     with no struct or scanner changes.
---   - When B.4 drops paliad.deadline_rules, this view stays — it
---     becomes the canonical legacy-shape reader for any code that
---     hasn't been migrated to direct sr/pe/ls reads.
---
--- Column mapping (per design §4.2):
---   - id, proceeding_type_id, parent_id, primary_party, duration_*,
---     timing, sequence_order, is_spawn/court_set/bilateral, priority,
---     rule_code, rule_codes, deadline_notes(_en), condition_expr,
---     choices_offered, applies_to_target, trigger_event_id,
---     spawn_proceeding_type_id, anchor_alt, alt_duration_*,
---     alt_rule_code, combine_op, lifecycle_state, draft_of,
---     published_at, is_active, created_at, updated_at, spawn_label
---       → from paliad.sequencing_rules
---   - submission_code           → procedural_events.code
---   - name, name_en, description→ procedural_events
---   - event_type                → procedural_events.event_kind (renamed)
---   - concept_id                → procedural_events
---   - legal_source              → legal_sources.citation (via legal_source_id FK)
---
--- The view is READ-ONLY by default. Writes still go to the underlying
--- tables — RuleEditorService is refactored in the same slice to write
--- directly to sr/pe/ls. paliad.deadline_rules is FROZEN from B.3 onward
--- (no new writes); the dual-write helper from B.2 is decommissioned.
-
--- The CHECK constraint on sequencing_rules.primary_party doesn't exist
--- yet (mig 135 only constrained deadline_rules.primary_party). The view
--- inherits whatever value sr.primary_party carries; mig 136's backfill
--- set sr.primary_party = dr.primary_party so the canonical four-value
--- vocab is already in place. A later slice can add the same CHECK to
--- sequencing_rules itself.
-
-CREATE OR REPLACE VIEW paliad.deadline_rules_unified AS
-SELECT
-    sr.id,
-    sr.proceeding_type_id,
-    sr.parent_id,
-    pe.code                    AS submission_code,
-    pe.name,
-    pe.name_en,
-    pe.description,
-    sr.primary_party,
-    pe.event_kind              AS event_type,
-    sr.duration_value,
-    sr.duration_unit,
-    sr.timing,
-    sr.alt_duration_value,
-    sr.alt_duration_unit,
-    sr.alt_rule_code,
-    sr.anchor_alt,
-    sr.combine_op,
-    sr.rule_code,
-    sr.deadline_notes,
-    sr.deadline_notes_en,
-    sr.sequence_order,
-    sr.is_spawn,
-    sr.spawn_label,
-    sr.spawn_proceeding_type_id,
-    sr.is_bilateral,
-    sr.is_court_set,
-    sr.priority,
-    sr.condition_expr,
-    pe.concept_id,
-    ls.citation                AS legal_source,
-    sr.trigger_event_id,
-    sr.rule_codes,
-    sr.choices_offered,
-    sr.applies_to_target,
-    sr.lifecycle_state,
-    sr.draft_of,
-    sr.published_at,
-    sr.is_active,
-    sr.created_at,
-    sr.updated_at
-  FROM paliad.sequencing_rules sr
-  JOIN paliad.procedural_events pe ON pe.id = sr.procedural_event_id
-  LEFT JOIN paliad.legal_sources  ls ON ls.id = pe.legal_source_id;
-
-COMMENT ON VIEW paliad.deadline_rules_unified IS
-    'Slice B.3 (mig 139, t-paliad-305): legacy-shape projection over '
-    'sequencing_rules + procedural_events + legal_sources. Read-only — '
-    'writes go directly to the three underlying tables via '
-    'RuleEditorService. Survives B.4 destructive drop of '
-    'paliad.deadline_rules; the view will then be the only '
-    'legacy-shape reader.';
-
--- Post-apply integrity check: confirm the view's row count matches the
--- live sequencing_rules row count. A mismatch would indicate either a
--- mid-deploy race (rare) or a JOIN issue (the LEFT JOIN to legal_sources
--- never drops rows, the INNER JOIN to procedural_events drops sr rows
--- whose procedural_event_id is NULL — but that column is NOT NULL on
--- the table so it can't happen). Belt-and-braces.
-DO $$
-DECLARE
-    v_view_count int;
-    v_sr_count   int;
-BEGIN
-    SELECT COUNT(*) INTO v_view_count FROM paliad.deadline_rules_unified;
-    SELECT COUNT(*) INTO v_sr_count   FROM paliad.sequencing_rules;
-    IF v_view_count <> v_sr_count THEN
-        RAISE EXCEPTION '[mig 139] FAILED POST: view row count % does not match sequencing_rules row count %. '
-            'Possible cause: a sequencing_rules row references a procedural_event_id that does not exist (NOT NULL FK should prevent this).',
-            v_view_count, v_sr_count;
-    END IF;
-    RAISE NOTICE '[mig 139] view OK — deadline_rules_unified rows = % (= sequencing_rules)',
-        v_view_count;
-END $$;

internal/handlers/submissions.go

@@ -200,7 +200,7 @@ func loadSubmissionCatalog(ctx context.Context, projectProceedingTypeID *int) ([
 		        pt.code                AS proceeding_code,
 		        pt.name                AS proceeding_name,
 		        pt.name_en             AS proceeding_name_en
-		   FROM paliad.deadline_rules_unified dr
+		   FROM paliad.deadline_rules dr
 		   JOIN paliad.proceeding_types pt ON pt.id = dr.proceeding_type_id
 		  WHERE dr.is_active = true
 		    AND dr.lifecycle_state = 'published'

internal/services/backup_service_live_test.go

@@ -1,99 +0,0 @@
-package services
-
-import (
-	"bytes"
-	"context"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jmoiron/sqlx"
-	_ "github.com/lib/pq"
-)
-
-// TestResolveOrgSheets_LiveSchemaSnapshot probes the live paliad schema
-// the way the backup runner does at the start of every run, then asserts
-// that every spec the registry declares either keeps all its ORDER BY
-// columns or — if any are missing — composes a fallback SELECT that the
-// DB can still execute. Catches the m/paliad#140 class of bug
-// (hardcoded ORDER BY against a renamed column) before deploy.
-//
-// Skipped when TEST_DATABASE_URL is unset. Read-only: opens a
-// REPEATABLE READ tx, never writes.
-func TestResolveOrgSheets_LiveSchemaSnapshot(t *testing.T) {
-	url := os.Getenv("TEST_DATABASE_URL")
-	if url == "" {
-		t.Skip("TEST_DATABASE_URL not set — skipping live DB test")
-	}
-	pool, err := sqlx.Connect("postgres", url)
-	if err != nil {
-		t.Fatalf("connect: %v", err)
-	}
-	defer pool.Close()
-
-	ctx := context.Background()
-	specs := orgSheetSpecs()
-	sheets, err := resolveOrgSheets(ctx, pool, specs)
-	if err != nil {
-		t.Fatalf("resolveOrgSheets: %v", err)
-	}
-	if len(sheets) != len(specs) {
-		t.Fatalf("resolved %d sheets, want %d", len(sheets), len(specs))
-	}
-
-	// Each resolved SELECT must run cleanly against the live schema.
-	// We LIMIT 1 inside a sub-SELECT so we don't materialise the full
-	// table (some are large) but still exercise the ORDER BY clause.
-	for _, sq := range sheets {
-		wrapped := `SELECT * FROM (` + sq.SQL + `) _wrap LIMIT 1`
-		if _, err := pool.QueryxContext(ctx, wrapped, sq.Args...); err != nil {
-			t.Errorf("sheet %q SQL failed: %v\nSQL: %s", sq.SheetName, err, sq.SQL)
-		}
-	}
-}
-
-// TestWriteOrg_LiveSmoke runs the full ExportService.WriteOrg pipeline
-// against a real DB: schema probe, REPEATABLE READ tx, every sheet
-// query, xlsx + json + per-sheet CSV assembly, outer zip framing.
-// Discards the bytes — this is a "does it crash" smoke, the bug class
-// it catches is exactly the one from m/paliad#140 (hardcoded ORDER BY
-// against a missing column).
-//
-// Skipped when TEST_DATABASE_URL is unset.
-func TestWriteOrg_LiveSmoke(t *testing.T) {
-	url := os.Getenv("TEST_DATABASE_URL")
-	if url == "" {
-		t.Skip("TEST_DATABASE_URL not set — skipping live DB test")
-	}
-	pool, err := sqlx.Connect("postgres", url)
-	if err != nil {
-		t.Fatalf("connect: %v", err)
-	}
-	defer pool.Close()
-
-	svc := NewExportService(pool, "test-firm")
-	var buf bytes.Buffer
-	meta, err := svc.WriteOrg(context.Background(), &buf, ExportSpec{
-		ActorID:    uuid.New(),
-		ActorEmail: "backup-smoke@test.local",
-		ActorLabel: "Backup Smoke",
-	})
-	if err != nil {
-		t.Fatalf("WriteOrg: %v", err)
-	}
-	if buf.Len() == 0 {
-		t.Fatalf("WriteOrg wrote no bytes")
-	}
-	// Spot-check meta fills.
-	if meta.Scope != ExportScopeOrg {
-		t.Errorf("meta.Scope = %q, want %q", meta.Scope, ExportScopeOrg)
-	}
-	if len(meta.RowCounts) != len(orgSheetSpecs()) {
-		t.Errorf("meta.RowCounts has %d entries, want %d (one per sheet)", len(meta.RowCounts), len(orgSheetSpecs()))
-	}
-	// The bytes are a zip; the first 4 bytes are PK\x03\x04 for a non-empty zip.
-	if buf.Len() >= 4 && !strings.HasPrefix(buf.String()[:4], "PK\x03\x04") {
-		t.Errorf("bundle bytes don't look like a zip (first bytes: %x)", buf.Bytes()[:4])
-	}
-}

internal/services/backup_service_test.go

@@ -6,10 +6,8 @@ package services
 // it would live in backup_service_live_test.go under TEST_DATABASE_URL.
 // This file covers the bits that don't need a database:
 //
-//   - orgSheetSpecs registry shape: no duplicates, no excluded
+//   - orgSheetQueries registry shape: no duplicates, no excluded
 //     paliadin sheets, predictable prefix split between entity and ref.
-//   - composeOrgSheetSQL drift-resistance: missing ORDER BY cols drop,
-//     SQL override path bypasses the builder, all-missing → no clause.
 //   - LocalDiskStore Put / Get / Delete round-trip, key validation,
 //     URI traversal rejection.
 
@@ -24,216 +22,60 @@ import (
 )
 
 // ---------------------------------------------------------------------------
-// orgSheetSpecs registry
+// orgSheetQueries registry
 // ---------------------------------------------------------------------------
 
-func TestOrgSheetSpecs_NoDuplicates(t *testing.T) {
+func TestOrgSheetQueries_NoDuplicates(t *testing.T) {
 	seen := map[string]bool{}
-	for _, sp := range orgSheetSpecs() {
-		if seen[sp.SheetName] {
-			t.Fatalf("duplicate sheet name in orgSheetSpecs: %q", sp.SheetName)
+	for _, sq := range orgSheetQueries() {
+		if seen[sq.SheetName] {
+			t.Fatalf("duplicate sheet name in orgSheetQueries: %q", sq.SheetName)
 		}
-		seen[sp.SheetName] = true
+		seen[sq.SheetName] = true
 	}
 }
 
-func TestOrgSheetSpecs_ExcludesPaliadinTables(t *testing.T) {
+func TestOrgSheetQueries_ExcludesPaliadinTables(t *testing.T) {
 	// m's t-paliad-214 Q5 decision + this design's §11 Q3 default:
 	// paliadin_turns and paliadin_aichat_conversation must be ABSENT
 	// from the registry (structural exclusion, not just column-drop).
-	for _, sp := range orgSheetSpecs() {
-		name := sp.SheetName
+	for _, sq := range orgSheetQueries() {
+		name := sq.SheetName
 		if strings.Contains(name, "paliadin") {
-			t.Fatalf("orgSheetSpecs leaked paliadin sheet: %q (m's Q3 mandates structural exclusion)", name)
+			t.Fatalf("orgSheetQueries leaked paliadin sheet: %q (m's Q3 mandates structural exclusion)", name)
 		}
-		if strings.Contains(sp.Table, "paliadin") {
-			t.Fatalf("orgSheetSpecs[%q].Table references a paliadin table: %s", name, sp.Table)
-		}
-		// Belt-and-braces: SQL override bodies (the few sheets that
-		// bypass the Table+OrderBy builder) also can't pull paliadin
-		// tables in through UNION/subquery.
-		if strings.Contains(sp.SQL, "paliadin_turns") || strings.Contains(sp.SQL, "paliadin_aichat_conversation") {
-			t.Fatalf("orgSheetSpecs[%q] SQL references a paliadin table: %s", name, sp.SQL)
+		// Belt-and-braces: SQL bodies should not reference the tables
+		// either (no UNION joins, no subqueries pulling them in).
+		if strings.Contains(sq.SQL, "paliadin_turns") || strings.Contains(sq.SQL, "paliadin_aichat_conversation") {
+			t.Fatalf("orgSheetQueries[%q] SQL references a paliadin table: %s", name, sq.SQL)
 		}
 	}
 }
 
-func TestOrgSheetSpecs_RefSheetsPrefixed(t *testing.T) {
+func TestOrgSheetQueries_RefSheetsPrefixed(t *testing.T) {
 	// Every sheet whose data is read-only reference material is
 	// expected to use the `ref__` prefix. The writer's downstream
 	// consumers rely on this convention to group reference data
 	// visually in the workbook.
-	for _, sp := range orgSheetSpecs() {
-		if !strings.HasPrefix(sp.SheetName, "ref__") {
+	for _, sq := range orgSheetQueries() {
+		if !strings.HasPrefix(sq.SheetName, "ref__") {
 			continue
 		}
 		// Reference sheets shouldn't carry per-row WHERE clauses (they
-		// dump the whole reference table for portability). Only
-		// applies to the SQL-override path; the Table+OrderBy builder
-		// never emits a WHERE.
-		if sp.SQL != "" && strings.Contains(strings.ToUpper(sp.SQL), "WHERE") {
-			t.Fatalf("orgSheetSpecs[%q] is ref__ but has a WHERE clause; reference sheets dump the whole table", sp.SheetName)
+		// dump the whole reference table for portability).
+		if strings.Contains(strings.ToUpper(sq.SQL), "WHERE") {
+			t.Fatalf("orgSheetQueries[%q] is ref__ but has a WHERE clause; reference sheets dump the whole table", sq.SheetName)
 		}
 	}
 }
 
-func TestOrgSheetSpecs_OrderByForDeterminism(t *testing.T) {
-	// Every sheet must declare a stable sort: either OrderBy on the
-	// Table+OrderBy path, or ORDER BY in the SQL override. Keeps the
-	// byte-deterministic contract from t-paliad-214 §3 across runs.
-	//
-	// (Drift removes ORDER BY columns at runtime, but only ones that
-	// no longer exist in the schema — the spec-level declaration is
-	// still required so we know what *should* be ordered.)
-	for _, sp := range orgSheetSpecs() {
-		if sp.SQL != "" {
-			if !strings.Contains(strings.ToUpper(sp.SQL), "ORDER BY") {
-				t.Fatalf("orgSheetSpecs[%q] SQL override missing ORDER BY (determinism contract): %s", sp.SheetName, sp.SQL)
-			}
-			continue
+func TestOrgSheetQueries_OrderByForDeterminism(t *testing.T) {
+	// Every sheet must specify an ORDER BY so the byte-deterministic
+	// contract from t-paliad-214 §3 holds across runs.
+	for _, sq := range orgSheetQueries() {
+		if !strings.Contains(strings.ToUpper(sq.SQL), "ORDER BY") {
+			t.Fatalf("orgSheetQueries[%q] missing ORDER BY (determinism contract): %s", sq.SheetName, sq.SQL)
 		}
-		if len(sp.OrderBy) == 0 {
-			t.Fatalf("orgSheetSpecs[%q] has no OrderBy and no SQL override (determinism contract)", sp.SheetName)
-		}
-	}
-}
-
-// ---------------------------------------------------------------------------
-// composeOrgSheetSQL — drift-resistant SQL builder
-// ---------------------------------------------------------------------------
-
-func TestComposeOrgSheetSQL_AllColumnsPresent(t *testing.T) {
-	spec := orgSheetSpec{
-		SheetName: "appointments",
-		Table:     "paliad.appointments",
-		OrderBy:   []string{"id"},
-	}
-	cols := map[string]map[string]struct{}{
-		"appointments": {"id": {}, "project_id": {}},
-	}
-	got, dropped := composeOrgSheetSQL(spec, cols)
-	want := "SELECT * FROM paliad.appointments ORDER BY id"
-	if got != want {
-		t.Fatalf("got SQL %q, want %q", got, want)
-	}
-	if len(dropped) != 0 {
-		t.Fatalf("expected no dropped columns, got %v", dropped)
-	}
-}
-
-func TestComposeOrgSheetSQL_DropsMissingOrderByColumn(t *testing.T) {
-	// The original bug from m/paliad#138 reproduced in unit form:
-	// orderBy references a column the table doesn't have.
-	spec := orgSheetSpec{
-		SheetName: "appointment_caldav_targets",
-		Table:     "paliad.appointment_caldav_targets",
-		OrderBy:   []string{"appointment_id", "calendar_binding_id"}, // wrong: real col is binding_id
-	}
-	cols := map[string]map[string]struct{}{
-		"appointment_caldav_targets": {
-			"appointment_id": {},
-			"binding_id":     {},
-		},
-	}
-	got, dropped := composeOrgSheetSQL(spec, cols)
-	want := "SELECT * FROM paliad.appointment_caldav_targets ORDER BY appointment_id"
-	if got != want {
-		t.Fatalf("got SQL %q, want %q", got, want)
-	}
-	if len(dropped) != 1 || dropped[0] != "calendar_binding_id" {
-		t.Fatalf("expected dropped=[calendar_binding_id], got %v", dropped)
-	}
-}
-
-func TestComposeOrgSheetSQL_AllOrderByMissing_NoClause(t *testing.T) {
-	// If every declared ORDER BY column is gone, the builder still
-	// produces a runnable SELECT — without ORDER BY. The export
-	// succeeds; the order across runs is no longer deterministic for
-	// this sheet until the spec is updated. WARN log alerts the
-	// operator (verified in TestResolveOrgSheets_LogsWarnings).
-	spec := orgSheetSpec{
-		SheetName: "ghost",
-		Table:     "paliad.ghost",
-		OrderBy:   []string{"missing_a", "missing_b"},
-	}
-	cols := map[string]map[string]struct{}{
-		"ghost": {"unrelated": {}},
-	}
-	got, dropped := composeOrgSheetSQL(spec, cols)
-	want := "SELECT * FROM paliad.ghost"
-	if got != want {
-		t.Fatalf("got SQL %q, want %q", got, want)
-	}
-	if len(dropped) != 2 {
-		t.Fatalf("expected 2 dropped columns, got %v", dropped)
-	}
-}
-
-func TestComposeOrgSheetSQL_SQLOverride_BypassesBuilder(t *testing.T) {
-	// When a sheet declares SQL, the builder MUST NOT touch it — even
-	// if the column knowledge would suggest a change. Custom
-	// projections (documents drops ai_extracted) and special-case
-	// joins both rely on this.
-	spec := orgSheetSpec{
-		SheetName: "documents",
-		Table:     "paliad.documents", // should be ignored
-		OrderBy:   []string{"id"},     // should be ignored
-		SQL:       "SELECT id, title FROM paliad.documents ORDER BY id",
-	}
-	cols := map[string]map[string]struct{}{
-		"documents": {}, // empty → would drop everything if builder ran
-	}
-	got, dropped := composeOrgSheetSQL(spec, cols)
-	if got != spec.SQL {
-		t.Fatalf("SQL override mutated: got %q, want %q", got, spec.SQL)
-	}
-	if len(dropped) != 0 {
-		t.Fatalf("override path should never report drops; got %v", dropped)
-	}
-}
-
-func TestComposeOrgSheetSQL_UnknownTable_DropsAllOrderBy(t *testing.T) {
-	// A table missing entirely from the schema snapshot is treated as
-	// "no columns known" — every ORDER BY column gets dropped, but
-	// the SELECT still emits (so a stale registry doesn't crash the
-	// backup; the operator gets WARNs to fix it).
-	spec := orgSheetSpec{
-		SheetName: "renamed_table",
-		Table:     "paliad.renamed_table",
-		OrderBy:   []string{"id"},
-	}
-	got, dropped := composeOrgSheetSQL(spec, map[string]map[string]struct{}{})
-	want := "SELECT * FROM paliad.renamed_table"
-	if got != want {
-		t.Fatalf("got SQL %q, want %q", got, want)
-	}
-	if len(dropped) != 1 || dropped[0] != "id" {
-		t.Fatalf("expected dropped=[id], got %v", dropped)
-	}
-}
-
-func TestComposeOrgSheetSQL_PreservesOrderByOrder(t *testing.T) {
-	// Multi-column OrderBy must keep its declared order, with kept
-	// columns concatenated in the same sequence. Determinism contract
-	// from t-paliad-214 §3 depends on this.
-	spec := orgSheetSpec{
-		SheetName: "partner_unit_members",
-		Table:     "paliad.partner_unit_members",
-		OrderBy:   []string{"partner_unit_id", "missing_middle", "user_id"},
-	}
-	cols := map[string]map[string]struct{}{
-		"partner_unit_members": {
-			"partner_unit_id": {},
-			"user_id":         {},
-		},
-	}
-	got, dropped := composeOrgSheetSQL(spec, cols)
-	want := "SELECT * FROM paliad.partner_unit_members ORDER BY partner_unit_id, user_id"
-	if got != want {
-		t.Fatalf("got SQL %q, want %q", got, want)
-	}
-	if len(dropped) != 1 || dropped[0] != "missing_middle" {
-		t.Fatalf("expected dropped=[missing_middle], got %v", dropped)
 	}
 }
 

internal/services/deadline_rule_service.go

@@ -55,13 +55,13 @@ func (s *DeadlineRuleService) List(ctx context.Context, proceedingTypeID *int) (
 	if proceedingTypeID != nil {
 		err = s.db.SelectContext(ctx, &rules,
 			`SELECT `+ruleColumns+`
-			   FROM paliad.deadline_rules_unified
+			   FROM paliad.deadline_rules
 			  WHERE proceeding_type_id = $1 AND is_active = true
 			  ORDER BY sequence_order`, *proceedingTypeID)
 	} else {
 		err = s.db.SelectContext(ctx, &rules,
 			`SELECT `+ruleColumns+`
-			   FROM paliad.deadline_rules_unified
+			   FROM paliad.deadline_rules
 			  WHERE is_active = true
 			  ORDER BY proceeding_type_id, sequence_order`)
 	}
@@ -100,7 +100,7 @@ func (s *DeadlineRuleService) hydrateConceptDefaultEventTypes(ctx context.Contex
 	}
 	query, args, err := sqlx.In(
 		`SELECT dr.id AS rule_id, j.event_type_id
-		   FROM paliad.deadline_rules_unified dr
+		   FROM paliad.deadline_rules dr
 		   JOIN paliad.proceeding_types pt ON pt.id = dr.proceeding_type_id
 		   JOIN paliad.deadline_concept_event_types j
 		         ON j.concept_id = dr.concept_id
@@ -152,7 +152,7 @@ func (s *DeadlineRuleService) GetRuleTree(ctx context.Context, proceedingTypeCod
 	var rules []models.DeadlineRule
 	if err := s.db.SelectContext(ctx, &rules,
 		`SELECT `+ruleColumns+`
-		   FROM paliad.deadline_rules_unified
+		   FROM paliad.deadline_rules
 		  WHERE proceeding_type_id = $1 AND is_active = true
 		  ORDER BY sequence_order`, pt.ID); err != nil {
 		return nil, fmt.Errorf("list rules for %q: %w", proceedingTypeCode, err)
@@ -175,10 +175,10 @@ func (s *DeadlineRuleService) GetFullTimeline(ctx context.Context, proceedingTyp
 	var rules []models.DeadlineRule
 	err := s.db.SelectContext(ctx, &rules, `
 		WITH RECURSIVE tree AS (
-			SELECT * FROM paliad.deadline_rules_unified
+			SELECT * FROM paliad.deadline_rules
 			 WHERE proceeding_type_id = $1 AND parent_id IS NULL AND is_active = true
 			UNION ALL
-			SELECT dr.* FROM paliad.deadline_rules_unified dr
+			SELECT dr.* FROM paliad.deadline_rules dr
 			JOIN tree t ON dr.parent_id = t.id
 			WHERE dr.is_active = true
 		)
@@ -196,7 +196,7 @@ func (s *DeadlineRuleService) GetByIDs(ctx context.Context, ids []uuid.UUID) ([]
 	}
 	query, args, err := sqlx.In(
 		`SELECT `+ruleColumns+`
-		   FROM paliad.deadline_rules_unified
+		   FROM paliad.deadline_rules
 		  WHERE id IN (?) AND is_active = true
 		  ORDER BY sequence_order`, ids)
 	if err != nil {
@@ -264,7 +264,7 @@ func (s *DeadlineRuleService) ListByTriggerEvent(ctx context.Context, triggerEve
 	var rules []models.DeadlineRule
 	if err := s.db.SelectContext(ctx, &rules,
 		`SELECT `+ruleColumns+`
-		   FROM paliad.deadline_rules_unified
+		   FROM paliad.deadline_rules
 		  WHERE trigger_event_id = $1
 		    AND is_active = true
 		  ORDER BY sequence_order`, triggerEventID); err != nil {
@@ -292,7 +292,7 @@ func (s *DeadlineRuleService) ListByProceedingTypeIDs(ctx context.Context, ids [
 	}
 	query, args, err := sqlx.In(
 		`SELECT `+ruleColumns+`
-		   FROM paliad.deadline_rules_unified
+		   FROM paliad.deadline_rules
 		  WHERE proceeding_type_id IN (?)
 		    AND is_active = true
 		  ORDER BY proceeding_type_id, sequence_order`, ids)
@@ -327,7 +327,7 @@ func (s *DeadlineRuleService) ListByConcept(ctx context.Context, conceptID uuid.
 	var rules []models.DeadlineRule
 	if err := s.db.SelectContext(ctx, &rules,
 		`SELECT `+ruleColumns+`
-		   FROM paliad.deadline_rules_unified
+		   FROM paliad.deadline_rules
 		  WHERE concept_id = $1
 		    AND is_active = true
 		  ORDER BY proceeding_type_id NULLS LAST, sequence_order`, conceptID); err != nil {

internal/services/deadline_service.go

@@ -272,7 +272,7 @@ func (s *DeadlineService) ListVisibleForUser(ctx context.Context, userID uuid.UU
 		       ar.requester_kind AS requester_kind
 		  FROM paliad.deadlines f
 		  JOIN paliad.projects p ON p.id = f.project_id
-		  LEFT JOIN paliad.deadline_rules_unified r ON r.id = f.rule_id
+		  LEFT JOIN paliad.deadline_rules r ON r.id = f.rule_id
 		  LEFT JOIN paliad.approval_requests ar ON ar.id = f.pending_request_id
 		 WHERE ` + strings.Join(conds, " AND ") + `
 		 ORDER BY f.due_date ASC, f.created_at DESC`

internal/services/event_deadline_service.go

@@ -168,7 +168,7 @@ func (s *EventDeadlineService) Calculate(ctx context.Context, triggerEventID int
 		       COALESCE(timing, 'after') AS timing,
 		       deadline_notes, deadline_notes_en, alt_duration_value, alt_duration_unit,
 		       combine_op, rule_codes
-		  FROM paliad.deadline_rules_unified
+		  FROM paliad.deadline_rules
 		 WHERE trigger_event_id = $1 AND is_active = true
 		 ORDER BY sequence_order`, triggerEventID)
 	if err != nil {

internal/services/export_service.go

@@ -46,7 +46,6 @@ import (
 	"encoding/csv"
 	"fmt"
 	"io"
-	"log/slog"
 	"regexp"
 	"sort"
 	"strings"
@@ -298,10 +297,7 @@ func (s *ExportService) WriteOrg(ctx context.Context, w io.Writer, spec ExportSp
 	// is just bookkeeping that releases the snapshot.
 	defer func() { _ = tx.Rollback() }()
 
-	sheets, err := resolveOrgSheets(ctx, tx, orgSheetSpecs())
-	if err != nil {
-		return meta, err
-	}
+	sheets := orgSheetQueries()
 	if err := s.writeBundle(ctx, tx, w, sheets, &meta); err != nil {
 		return meta, err
 	}
@@ -1142,7 +1138,7 @@ func personalSheetQueries(actorID uuid.UUID) []sheetQuery {
 		},
 		{
 			SheetName: "ref__deadline_rules",
-			SQL:       `SELECT * FROM paliad.deadline_rules_unified ORDER BY id`,
+			SQL:       `SELECT * FROM paliad.deadline_rules ORDER BY id`,
 		},
 		{
 			SheetName: "ref__deadline_concepts",
@@ -1522,7 +1518,7 @@ SELECT 'partner_unit_default'::text AS source,
 		{SheetName: "ref__proceeding_types", SQL: `SELECT * FROM paliad.proceeding_types ORDER BY id`},
 		{SheetName: "ref__event_types", SQL: `SELECT * FROM paliad.event_types ORDER BY id`},
 		{SheetName: "ref__event_categories", SQL: `SELECT * FROM paliad.event_categories ORDER BY id`},
-		{SheetName: "ref__deadline_rules", SQL: `SELECT * FROM paliad.deadline_rules_unified ORDER BY id`},
+		{SheetName: "ref__deadline_rules", SQL: `SELECT * FROM paliad.deadline_rules ORDER BY id`},
 		{SheetName: "ref__deadline_concepts", SQL: `SELECT * FROM paliad.deadline_concepts ORDER BY id`},
 		{SheetName: "ref__courts", SQL: `SELECT * FROM paliad.courts ORDER BY id`},
 		{SheetName: "ref__countries", SQL: `SELECT * FROM paliad.countries ORDER BY code`},
@@ -1564,249 +1560,73 @@ SELECT 'partner_unit_default'::text AS source,
 // secret|token|password|api_key|private_key on every sheet as a
 // belt-and-braces filter. user_caldav_config.password_encrypted is
 // explicitly named in DropColumns too.
-//
-// Drift-resistance (m/paliad#140): each spec declares its desired
-// ORDER BY columns as a list. At backup time the exporter probes
-// information_schema.columns for the live schema; any ORDER BY column
-// that no longer exists is dropped (logged WARN). This way a column
-// rename or removal never breaks a backup — the worst case is a sheet
-// that loses sort stability until the spec is updated. A sheet whose
-// ORDER BY columns are all gone still exports, just in pg's natural
-// (unspecified) order.
-//
-// Custom column projections (e.g. documents drops ai_extracted) live
-// in the SQL override field; if set, it bypasses the Table+OrderBy
-// builder entirely. Use it sparingly — every override re-introduces
-// drift risk for that sheet.
-
-// orgSheetSpec declares one org-scope sheet for the drift-resistant
-// builder. Either set SQL (free-form override) or set Table+OrderBy
-// (let the builder compose `SELECT * FROM <Table> ORDER BY <existing>`).
-type orgSheetSpec struct {
-	// SheetName lands in the workbook sheet and the JSON top-level key.
-	SheetName string
-	// Table is schema-qualified (e.g. "paliad.appointments"). Used only
-	// when SQL is empty. The schema/table form must be valid SQL
-	// identifiers — the builder splits on the dot, no quoting.
-	Table string
-	// OrderBy is the *desired* sort columns. Missing columns are
-	// dropped silently-with-a-WARN at build time; remaining columns
-	// keep their declared order. Empty/all-missing → no ORDER BY (still
-	// deterministic-within-a-snapshot under the REPEATABLE READ tx, but
-	// the order across runs may differ).
-	OrderBy []string
-	// SQL is an explicit override; if non-empty, Table+OrderBy are
-	// ignored entirely. Use only when the projection cannot be
-	// expressed as SELECT * (e.g. documents drops the ai_extracted
-	// jsonb column).
-	SQL string
-	// Args are positional arguments. Only meaningful with SQL override;
-	// the Table+OrderBy path takes no args.
-	Args []any
-	// DropColumns is an explicit list of column names to drop from the
-	// result regardless of the PII deny-regex.
-	DropColumns []string
-}
-
-func orgSheetSpecs() []orgSheetSpec {
-	return []orgSheetSpec{
+func orgSheetQueries() []sheetQuery {
+	return []sheetQuery{
 		// --- entity sheets (alphabetical) ---
-		{SheetName: "appointment_caldav_targets", Table: "paliad.appointment_caldav_targets", OrderBy: []string{"appointment_id", "binding_id"}},
-		{SheetName: "appointments", Table: "paliad.appointments", OrderBy: []string{"id"}},
-		{SheetName: "approval_policies", Table: "paliad.approval_policies", OrderBy: []string{"id"}},
-		{SheetName: "approval_requests", Table: "paliad.approval_requests", OrderBy: []string{"id"}},
+		{SheetName: "appointment_caldav_targets", SQL: `SELECT * FROM paliad.appointment_caldav_targets ORDER BY appointment_id, calendar_binding_id`},
+		{SheetName: "appointments", SQL: `SELECT * FROM paliad.appointments ORDER BY id`},
+		{SheetName: "approval_policies", SQL: `SELECT * FROM paliad.approval_policies ORDER BY id`},
+		{SheetName: "approval_requests", SQL: `SELECT * FROM paliad.approval_requests ORDER BY id`},
 		// backups is self-reflexive — including it makes "what backups
 		// have we taken" recoverable from any prior backup. Tiny table.
-		{SheetName: "backups", Table: "paliad.backups", OrderBy: []string{"started_at", "id"}},
-		{SheetName: "caldav_sync_log", Table: "paliad.caldav_sync_log", OrderBy: []string{"occurred_at", "id"}},
-		{SheetName: "checklist_instances", Table: "paliad.checklist_instances", OrderBy: []string{"id"}},
-		{SheetName: "checklist_shares", Table: "paliad.checklist_shares", OrderBy: []string{"id"}},
-		{SheetName: "checklists", Table: "paliad.checklists", OrderBy: []string{"id"}},
-		{SheetName: "deadline_rule_audit", Table: "paliad.deadline_rule_audit", OrderBy: []string{"changed_at", "id"}},
-		{SheetName: "deadlines", Table: "paliad.deadlines", OrderBy: []string{"id"}},
+		{SheetName: "backups", SQL: `SELECT * FROM paliad.backups ORDER BY started_at, id`},
+		{SheetName: "caldav_sync_log", SQL: `SELECT * FROM paliad.caldav_sync_log ORDER BY occurred_at, id`},
+		{SheetName: "checklist_instances", SQL: `SELECT * FROM paliad.checklist_instances ORDER BY id`},
+		{SheetName: "checklist_shares", SQL: `SELECT * FROM paliad.checklist_shares ORDER BY id`},
+		{SheetName: "checklists", SQL: `SELECT * FROM paliad.checklists ORDER BY id`},
+		{SheetName: "deadline_rule_audit", SQL: `SELECT * FROM paliad.deadline_rule_audit ORDER BY changed_at, id`},
+		{SheetName: "deadlines", SQL: `SELECT * FROM paliad.deadlines ORDER BY id`},
 		// documents: ai_extracted jsonb dropped (verbose AI prompts;
 		// matches the personal/project precedent). Binaries are not in
-		// the export — only metadata. Uses SQL override because the
-		// projection isn't SELECT *.
+		// the export — only metadata.
 		{
 			SheetName: "documents",
 			SQL: `SELECT id, project_id, title, doc_type, file_path, file_size, mime_type, uploaded_by, created_at, updated_at
 				    FROM paliad.documents
 				ORDER BY id`,
 		},
-		{SheetName: "email_broadcasts", Table: "paliad.email_broadcasts", OrderBy: []string{"id"}},
-		{SheetName: "email_template_versions", Table: "paliad.email_template_versions", OrderBy: []string{"id"}},
-		{SheetName: "email_templates", Table: "paliad.email_templates", OrderBy: []string{"key", "lang"}},
-		{SheetName: "firm_dashboard_default", Table: "paliad.firm_dashboard_default", OrderBy: []string{"id"}},
-		{SheetName: "invitations", Table: "paliad.invitations", OrderBy: []string{"sent_at", "id"}},
-		{SheetName: "notes", Table: "paliad.notes", OrderBy: []string{"id"}},
-		{SheetName: "parties", Table: "paliad.parties", OrderBy: []string{"id"}},
-		{SheetName: "partner_unit_events", Table: "paliad.partner_unit_events", OrderBy: []string{"id"}},
-		{SheetName: "partner_unit_members", Table: "paliad.partner_unit_members", OrderBy: []string{"partner_unit_id", "user_id"}},
-		{SheetName: "partner_units", Table: "paliad.partner_units", OrderBy: []string{"id"}},
-		{SheetName: "policy_audit_log", Table: "paliad.policy_audit_log", OrderBy: []string{"created_at", "id"}},
-		{SheetName: "project_events", Table: "paliad.project_events", OrderBy: []string{"id"}},
-		{SheetName: "project_partner_units", Table: "paliad.project_partner_units", OrderBy: []string{"project_id", "partner_unit_id"}},
-		{SheetName: "project_teams", Table: "paliad.project_teams", OrderBy: []string{"project_id", "user_id"}},
-		{SheetName: "projects", Table: "paliad.projects", OrderBy: []string{"id"}},
-		{SheetName: "reminder_log", Table: "paliad.reminder_log", OrderBy: []string{"sent_at", "id"}},
-		{SheetName: "submission_drafts", Table: "paliad.submission_drafts", OrderBy: []string{"id"}},
-		{SheetName: "system_audit_log", Table: "paliad.system_audit_log", OrderBy: []string{"created_at", "id"}},
+		{SheetName: "email_broadcasts", SQL: `SELECT * FROM paliad.email_broadcasts ORDER BY id`},
+		{SheetName: "email_template_versions", SQL: `SELECT * FROM paliad.email_template_versions ORDER BY id`},
+		{SheetName: "email_templates", SQL: `SELECT * FROM paliad.email_templates ORDER BY id`},
+		{SheetName: "firm_dashboard_default", SQL: `SELECT * FROM paliad.firm_dashboard_default ORDER BY id`},
+		{SheetName: "invitations", SQL: `SELECT * FROM paliad.invitations ORDER BY sent_at, id`},
+		{SheetName: "notes", SQL: `SELECT * FROM paliad.notes ORDER BY id`},
+		{SheetName: "parties", SQL: `SELECT * FROM paliad.parties ORDER BY id`},
+		{SheetName: "partner_unit_events", SQL: `SELECT * FROM paliad.partner_unit_events ORDER BY id`},
+		{SheetName: "partner_unit_members", SQL: `SELECT * FROM paliad.partner_unit_members ORDER BY partner_unit_id, user_id`},
+		{SheetName: "partner_units", SQL: `SELECT * FROM paliad.partner_units ORDER BY id`},
+		{SheetName: "policy_audit_log", SQL: `SELECT * FROM paliad.policy_audit_log ORDER BY changed_at, id`},
+		{SheetName: "project_events", SQL: `SELECT * FROM paliad.project_events ORDER BY id`},
+		{SheetName: "project_partner_units", SQL: `SELECT * FROM paliad.project_partner_units ORDER BY project_id, partner_unit_id`},
+		{SheetName: "project_teams", SQL: `SELECT * FROM paliad.project_teams ORDER BY project_id, user_id`},
+		{SheetName: "projects", SQL: `SELECT * FROM paliad.projects ORDER BY id`},
+		{SheetName: "reminder_log", SQL: `SELECT * FROM paliad.reminder_log ORDER BY sent_at, id`},
+		{SheetName: "submission_drafts", SQL: `SELECT * FROM paliad.submission_drafts ORDER BY id`},
+		{SheetName: "system_audit_log", SQL: `SELECT * FROM paliad.system_audit_log ORDER BY created_at, id`},
 		{
 			SheetName:   "user_caldav_config",
-			Table:       "paliad.user_caldav_config",
-			OrderBy:     []string{"user_id"},
+			SQL:         `SELECT * FROM paliad.user_caldav_config ORDER BY user_id`,
 			DropColumns: []string{"password_encrypted"}, // belt-and-braces; piiColumnDenyRegex also catches it
 		},
-		{SheetName: "user_calendar_bindings", Table: "paliad.user_calendar_bindings", OrderBy: []string{"user_id", "calendar_path"}},
-		{SheetName: "user_card_layouts", Table: "paliad.user_card_layouts", OrderBy: []string{"id"}},
-		{SheetName: "user_dashboard_layouts", Table: "paliad.user_dashboard_layouts", OrderBy: []string{"user_id"}},
-		{SheetName: "user_pinned_projects", Table: "paliad.user_pinned_projects", OrderBy: []string{"user_id", "project_id"}},
-		{SheetName: "user_views", Table: "paliad.user_views", OrderBy: []string{"id"}},
-		{SheetName: "users", Table: "paliad.users", OrderBy: []string{"id"}},
+		{SheetName: "user_calendar_bindings", SQL: `SELECT * FROM paliad.user_calendar_bindings ORDER BY user_id, calendar_path`},
+		{SheetName: "user_card_layouts", SQL: `SELECT * FROM paliad.user_card_layouts ORDER BY id`},
+		{SheetName: "user_dashboard_layouts", SQL: `SELECT * FROM paliad.user_dashboard_layouts ORDER BY user_id`},
+		{SheetName: "user_pinned_projects", SQL: `SELECT * FROM paliad.user_pinned_projects ORDER BY user_id, project_id`},
+		{SheetName: "user_views", SQL: `SELECT * FROM paliad.user_views ORDER BY id`},
+		{SheetName: "users", SQL: `SELECT * FROM paliad.users ORDER BY id`},
 
 		// --- reference data (alphabetical, prefixed ref__) ---
-		{SheetName: "ref__countries", Table: "paliad.countries", OrderBy: []string{"code"}},
-		{SheetName: "ref__courts", Table: "paliad.courts", OrderBy: []string{"id"}},
-		{SheetName: "ref__deadline_concept_event_types", Table: "paliad.deadline_concept_event_types", OrderBy: []string{"concept_id", "event_type_id"}},
-		{SheetName: "ref__deadline_concepts", Table: "paliad.deadline_concepts", OrderBy: []string{"id"}},
-		{SheetName: "ref__deadline_event_types", Table: "paliad.deadline_event_types", OrderBy: []string{"deadline_id", "event_type_id"}},
-		{SheetName: "ref__deadline_rules", Table: "paliad.deadline_rules_unified", OrderBy: []string{"id"}},
-		{SheetName: "ref__event_categories", Table: "paliad.event_categories", OrderBy: []string{"id"}},
-		{SheetName: "ref__event_category_concepts", Table: "paliad.event_category_concepts", OrderBy: []string{"event_category_id", "concept_id"}},
-		{SheetName: "ref__event_types", Table: "paliad.event_types", OrderBy: []string{"id"}},
-		{SheetName: "ref__holidays", Table: "paliad.holidays", OrderBy: []string{"date", "country"}},
-		{SheetName: "ref__proceeding_types", Table: "paliad.proceeding_types", OrderBy: []string{"id"}},
-		{SheetName: "ref__trigger_events", Table: "paliad.trigger_events", OrderBy: []string{"id"}},
+		{SheetName: "ref__countries", SQL: `SELECT * FROM paliad.countries ORDER BY code`},
+		{SheetName: "ref__courts", SQL: `SELECT * FROM paliad.courts ORDER BY id`},
+		{SheetName: "ref__deadline_concept_event_types", SQL: `SELECT * FROM paliad.deadline_concept_event_types ORDER BY concept_id, event_type_id`},
+		{SheetName: "ref__deadline_concepts", SQL: `SELECT * FROM paliad.deadline_concepts ORDER BY id`},
+		{SheetName: "ref__deadline_event_types", SQL: `SELECT * FROM paliad.deadline_event_types ORDER BY rule_id, event_type_id`},
+		{SheetName: "ref__deadline_rules", SQL: `SELECT * FROM paliad.deadline_rules ORDER BY id`},
+		{SheetName: "ref__event_categories", SQL: `SELECT * FROM paliad.event_categories ORDER BY id`},
+		{SheetName: "ref__event_category_concepts", SQL: `SELECT * FROM paliad.event_category_concepts ORDER BY category_id, concept_id`},
+		{SheetName: "ref__event_types", SQL: `SELECT * FROM paliad.event_types ORDER BY id`},
+		{SheetName: "ref__holidays", SQL: `SELECT * FROM paliad.holidays ORDER BY date, country`},
+		{SheetName: "ref__proceeding_types", SQL: `SELECT * FROM paliad.proceeding_types ORDER BY id`},
+		{SheetName: "ref__trigger_events", SQL: `SELECT * FROM paliad.trigger_events ORDER BY id`},
 	}
 }
-
-// composeOrgSheetSQL turns one orgSheetSpec into the final SQL string,
-// using a per-table column set (typically loaded once per backup run
-// from information_schema.columns). Returns the SQL and the list of
-// ORDER BY columns that were dropped because they don't exist in the
-// live schema.
-//
-// Pure function — no DB access — so the missing-column behaviour is
-// unit-testable without a fixture database.
-//
-// Rules:
-//   - If spec.SQL is non-empty, return it unchanged (override path).
-//   - Otherwise build `SELECT * FROM <Table> [ORDER BY <kept-cols>]`.
-//   - Columns are kept in their declared order; missing ones recorded
-//     in `dropped` and omitted from ORDER BY.
-//   - If no ORDER BY columns survive, the ORDER BY clause is omitted.
-//
-// knownCols maps unqualified table names (e.g. "appointments") to the
-// set of columns they have. A table missing from knownCols is treated
-// as "no columns known" — every declared ORDER BY column gets dropped.
-func composeOrgSheetSQL(spec orgSheetSpec, knownCols map[string]map[string]struct{}) (sqlText string, dropped []string) {
-	if spec.SQL != "" {
-		return spec.SQL, nil
-	}
-	unqualified := spec.Table
-	if i := strings.IndexByte(unqualified, '.'); i >= 0 {
-		unqualified = unqualified[i+1:]
-	}
-	cols := knownCols[unqualified]
-	kept := make([]string, 0, len(spec.OrderBy))
-	for _, c := range spec.OrderBy {
-		if _, ok := cols[c]; ok {
-			kept = append(kept, c)
-		} else {
-			dropped = append(dropped, c)
-		}
-	}
-	var b strings.Builder
-	b.WriteString("SELECT * FROM ")
-	b.WriteString(spec.Table)
-	if len(kept) > 0 {
-		b.WriteString(" ORDER BY ")
-		b.WriteString(strings.Join(kept, ", "))
-	}
-	return b.String(), dropped
-}
-
-// loadOrgSheetColumns probes information_schema.columns once for every
-// table referenced by Table+OrderBy specs. Returns a lookup
-// {table_name → {column_name → {}}} restricted to the paliad schema.
-//
-// The queryer is whatever runs the backup's read snapshot — typically
-// the REPEATABLE READ tx opened in WriteOrg, so the schema snapshot
-// matches the row snapshot.
-func loadOrgSheetColumns(ctx context.Context, queryer sqlx.QueryerContext, specs []orgSheetSpec) (map[string]map[string]struct{}, error) {
-	tableSet := map[string]struct{}{}
-	for _, sp := range specs {
-		if sp.Table == "" {
-			continue // SQL-override sheets carry their own column refs
-		}
-		t := sp.Table
-		if i := strings.IndexByte(t, '.'); i >= 0 {
-			t = t[i+1:]
-		}
-		tableSet[t] = struct{}{}
-	}
-	if len(tableSet) == 0 {
-		return map[string]map[string]struct{}{}, nil
-	}
-	tables := make([]string, 0, len(tableSet))
-	for t := range tableSet {
-		tables = append(tables, t)
-	}
-	rows, err := queryer.QueryxContext(ctx, `
-		SELECT table_name, column_name
-		  FROM information_schema.columns
-		 WHERE table_schema = 'paliad'
-		   AND table_name = ANY($1)
-	`, tables)
-	if err != nil {
-		return nil, fmt.Errorf("probe paliad columns: %w", err)
-	}
-	defer rows.Close()
-	out := make(map[string]map[string]struct{}, len(tableSet))
-	for rows.Next() {
-		var table, column string
-		if err := rows.Scan(&table, &column); err != nil {
-			return nil, fmt.Errorf("scan paliad columns: %w", err)
-		}
-		set, ok := out[table]
-		if !ok {
-			set = map[string]struct{}{}
-			out[table] = set
-		}
-		set[column] = struct{}{}
-	}
-	if err := rows.Err(); err != nil {
-		return nil, fmt.Errorf("iterate paliad columns: %w", err)
-	}
-	return out, nil
-}
-
-// resolveOrgSheets materialises an org-scope spec list into the
-// concrete []sheetQuery that writeBundle expects. Composes each
-// spec's SQL via composeOrgSheetSQL using a schema snapshot loaded
-// from the same queryer. Logs WARN per dropped ORDER BY column.
-func resolveOrgSheets(ctx context.Context, queryer sqlx.QueryerContext, specs []orgSheetSpec) ([]sheetQuery, error) {
-	knownCols, err := loadOrgSheetColumns(ctx, queryer, specs)
-	if err != nil {
-		return nil, err
-	}
-	out := make([]sheetQuery, 0, len(specs))
-	for _, sp := range specs {
-		sqlText, dropped := composeOrgSheetSQL(sp, knownCols)
-		for _, c := range dropped {
-			slog.Warn("backup: ORDER BY column dropped (not in schema)",
-				"sheet", sp.SheetName,
-				"table", sp.Table,
-				"column", c,
-			)
-		}
-		out = append(out, sheetQuery{
-			SheetName:   sp.SheetName,
-			SQL:         sqlText,
-			Args:        sp.Args,
-			DropColumns: sp.DropColumns,
-		})
-	}
-	return out, nil
-}

internal/services/fristenrechner.go

@@ -169,7 +169,7 @@ func (c *paliadCatalog) LoadRuleByID(ctx context.Context, ruleID string) (*model
 	var rule models.DeadlineRule
 	err := c.rules.db.GetContext(ctx, &rule,
 		`SELECT `+ruleColumns+`
-		   FROM paliad.deadline_rules_unified
+		   FROM paliad.deadline_rules
 		  WHERE id = $1 AND is_active = true`, ruleID)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, lp.ErrUnknownRule
@@ -200,7 +200,7 @@ func (c *paliadCatalog) LoadRuleByCode(ctx context.Context, proceedingCode, subm
 	var rule models.DeadlineRule
 	err = c.rules.db.GetContext(ctx, &rule,
 		`SELECT `+ruleColumns+`
-		   FROM paliad.deadline_rules_unified
+		   FROM paliad.deadline_rules
 		  WHERE proceeding_type_id = $1 AND submission_code = $2 AND is_active = true`,
 		pt.ID, submissionCode)
 	if errors.Is(err, sql.ErrNoRows) {
@@ -311,7 +311,7 @@ func (c *paliadCatalog) LookupEvents(ctx context.Context, axes lp.EventLookupAxe
 		       pt.trigger_event_label_de AS pt_trigger_event_label_de,
 		       pt.trigger_event_label_en AS pt_trigger_event_label_en,
 		       pt.appeal_target AS pt_appeal_target
-		  FROM paliad.deadline_rules_unified dr
+		  FROM paliad.deadline_rules dr
 		  JOIN paliad.proceeding_types pt ON pt.id = dr.proceeding_type_id
 		 WHERE ` + strings.Join(where, "\n   AND ") + `
 		 ORDER BY dr.proceeding_type_id, dr.sequence_order`

internal/services/projection_service.go

@@ -1767,7 +1767,7 @@ func (s *ProjectionService) lookupRuleBySubmissionCode(ctx context.Context, ptID
 	var rule models.DeadlineRule
 	err := s.db.GetContext(ctx, &rule,
 		`SELECT `+ruleColumns+`
-		   FROM paliad.deadline_rules_unified
+		   FROM paliad.deadline_rules
 		  WHERE proceeding_type_id = $1 AND submission_code = $2 AND is_active = true`,
 		ptID, code)
 	if errors.Is(err, sql.ErrNoRows) {
@@ -1784,7 +1784,7 @@ func (s *ProjectionService) lookupRuleByID(ctx context.Context, id uuid.UUID) (*
 	var rule models.DeadlineRule
 	err := s.db.GetContext(ctx, &rule,
 		`SELECT `+ruleColumns+`
-		   FROM paliad.deadline_rules_unified
+		   FROM paliad.deadline_rules
 		  WHERE id = $1`, id)
 	if err != nil {
 		return nil, fmt.Errorf("lookup rule by id: %w", err)

internal/services/rule_editor_orphans.go

@@ -117,7 +117,7 @@ func (s *RuleEditorService) ListOrphans(ctx context.Context) ([]Orphan, error) {
 		}
 		if err := s.db.SelectContext(ctx, &cs, `
 			SELECT id, rule_code, name, name_en
-			  FROM paliad.deadline_rules_unified
+			  FROM paliad.deadline_rules
 			 WHERE id = ANY($1::uuid[])`, pq.Array(uuidStrs)); err != nil {
 			return nil, fmt.Errorf("list orphan candidate rules: %w", err)
 		}

internal/services/rule_editor_service.go

@@ -636,7 +636,7 @@ func (s *RuleEditorService) ListRules(ctx context.Context, f ListRulesFilter) ([
 		where = "WHERE " + strings.Join(conds, " AND ")
 	}
 	query := `SELECT ` + ruleColumns + `
-		   FROM paliad.deadline_rules_unified
+		   FROM paliad.deadline_rules
 		   ` + where + `
 		  ORDER BY proceeding_type_id NULLS LAST, sequence_order
 		  LIMIT ` + addArg(f.Limit) + ` OFFSET ` + addArg(f.Offset)
@@ -656,7 +656,7 @@ func (s *RuleEditorService) GetByID(ctx context.Context, id uuid.UUID) (*models.
 func (s *RuleEditorService) getByID(ctx context.Context, id uuid.UUID) (*models.DeadlineRule, error) {
 	var r models.DeadlineRule
 	err := s.db.GetContext(ctx, &r,
-		`SELECT `+ruleColumns+` FROM paliad.deadline_rules_unified WHERE id = $1`, id)
+		`SELECT `+ruleColumns+` FROM paliad.deadline_rules WHERE id = $1`, id)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, ErrRuleNotFound
 	}
@@ -715,7 +715,7 @@ func (s *RuleEditorService) validateSpawnNoCycle(ctx context.Context, ruleID *uu
 		visited[current] = true
 		var nexts []sql.NullInt64
 		q := `SELECT DISTINCT spawn_proceeding_type_id::bigint
-		        FROM paliad.deadline_rules_unified
+		        FROM paliad.deadline_rules
 		       WHERE proceeding_type_id = $1
 		         AND is_spawn = true
 		         AND spawn_proceeding_type_id IS NOT NULL

internal/services/submission_vars.go

@@ -243,7 +243,7 @@ func (s *SubmissionVarsService) loadPublishedRule(ctx context.Context, submissio
 	var rule models.DeadlineRule
 	err := s.db.GetContext(ctx, &rule,
 		`SELECT `+ruleColumns+`
-		   FROM paliad.deadline_rules_unified
+		   FROM paliad.deadline_rules
 		  WHERE submission_code = $1
 		    AND lifecycle_state = 'published'
 		    AND is_active = true