feat(submission-draft): grouped sections + per-side Add Party with DB picker (t-paliad-287)

Restructures the submission-draft sidebar per m's m/paliad#119 review.

Three changes on the variable form (Part B):
- VARIABLE_GROUPS collapses into four lawyer-facing sections: Mandant
  & Verfahren (firm.* + project.* + procedural_event.*), Parteien
  (manual {{parties.<role>.*}} overrides), Frist (the now-internal
  deadline.* block, COLLAPSED by default since the skeletons no
  longer render it), Sonstiges (today.* / user.* trim).
- Group sections are click-to-collapse via a sticky state map; the
  Frist + Parteien-override sections open closed so the visible form
  stays tight on first load.
- The legacy {{rule.*}} aliases drop off the sidebar — still resolved
  by SubmissionVarsService for old templates, no longer surfaced as
  override rows (they cluttered the form and the canonical
  procedural_event.* names cover the same ground).

Multi-party + Add Party (Part C):
- The party picker now renders all three role buckets (claimants /
  defendants / others) even when empty, so the lawyer can populate via
  Add Party. The block is hidden only when no project is attached.
- Each side gets a "+ Partei hinzufügen (Klägerseite / Beklagtenseite
  / Weitere Parteien)" button that opens an inline panel with two
  tabs:
  - Manual entry — name, role (pre-filled from side), representative.
    Submits to POST /api/projects/{id}/parties, creating a real
    paliad.parties row that immediately surfaces in available_parties.
  - Aus DB übernehmen — debounced (200ms) search against the new
    GET /api/parties/search endpoint. Returns hits across every
    visible project with project_title + reference for context.
    Already-on-this-project rows are filtered out client-side. Picking
    a hit clones name/role/representative into a fresh row on the
    current project — the simplest semantics that survives the
    paliad.parties.project_id NOT NULL contract while honouring m's
    "no manual re-typing" requirement.
- Newly-added parties land in selected_parties immediately so the new
  party is rendered in the next preview round-trip without an extra
  click. Implicit-"all" default is preserved (empty selected_parties
  still means "every party on the project, including this new one").
- Search-result repaints reach only into the <ul>, not the whole
  picker — keeps focus + selection on the search input across
  keystrokes.

CSS:
- Collapsible-section caret rotation, busy/disabled form states, tab
  highlights, DB-picker result rows with project chip + hover, all
  inherit the existing lime-tint accent so the new affordances look
  native to the editor.

TSX:
- Comment update on the parties block; no structural change. The
  bilingual hint copy in i18n.ts now nudges towards Add Party.

.gitea/workflows/test.yaml

@@ -0,0 +1,242 @@
+# Paliad CI gate (t-paliad-282 / m/paliad#114).
+#
+# Single workflow, two purposes:
+#
+#   - On every push: gate tier — build + unit + migration smoke. Red gate
+#     means no further work and (on main) no deploy.
+#   - On push to main with gate green: deploy step — calls the Dokploy
+#     compose-deploy API for paliad's compose Zx147ycurfYagKRl_Zzyo, then
+#     polls /health/ready until the new container reports 200.
+#
+# The deploy step REPLACES the previous Gitea-push → Dokploy webhook path
+# (per m's Q11.4 pick: soft-launch with both alive for ~1 week, then
+# disable the Dokploy auto-deploy toggle). Soft-launch leaves Dokploy's
+# autoDeploy=true intact today — the workflow's deploy step is additive
+# and idempotent (Dokploy's deploy is itself idempotent).
+#
+# Catches the three failure classes from 2026-05-25:
+#
+#   - brunel slot collision (~13:20) — TestMigrations_NoDuplicateSlot,
+#     pure unit, no DB needed.
+#   - hermes dropped-col refs (~16:05) — TestBootSmoke, applies all NEW
+#     migrations (those not in the snapshot) end-to-end against a
+#     scratch DB restored from internal/db/testdata/prod-snapshot.sql.
+#   - mig 129 42501 ownership (~14:56→) — TestMigrations_EndToEndAsAppRole,
+#     applies new migrations as the prod-shaped `postgres` role (which
+#     is NOT a superuser on supabase/postgres — same shape as
+#     youpc-supabase prod, see internal/db/testdata/README.md).
+#
+# Snapshot approach: dump paliad schema + applied_migrations rows from
+# prod, commit them. CI restores → ApplyMigrations sees existing migs as
+# applied, only runs NEW migs (the ones this PR adds). This sidesteps the
+# fresh-DB idempotence requirement on historical migrations (some of
+# which use raw COMMIT or pre-installed extensions and can't be replayed
+# from scratch). To refresh: `make refresh-snapshot`.
+#
+# Design: docs/design-cicd-pre-deploy-gate-2026-05-25.md (cronus inventor
+# shift, t-paliad-282).
+
+name: Paliad CI gate
+
+on:
+  push:
+    branches:
+      - main
+      - 'mai/**'
+  pull_request:
+    branches: [main]
+
+env:
+  GO_VERSION: '1.24'
+  BUN_VERSION: '1.2'
+
+jobs:
+  # Gate job 1 — pure build. Catches go/bun build breakage that local
+  # `go build` would catch but which a worker might have skipped before
+  # pushing. Fast (~60 s) so a red here surfaces immediately.
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+
+      - name: go build
+        run: go build ./...
+
+      - name: go vet
+        run: go vet ./...
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: bun install + build
+        working-directory: frontend
+        run: |
+          bun install --frozen-lockfile
+          bun run build
+
+  # Gate job 2 — Go test suite + migration smoke against snapshot-restored
+  # scratch DB.
+  #
+  # The Postgres service container uses the same supabase/postgres image
+  # as youpc-supabase prod. The CI scratch DB starts empty; a setup step
+  # installs pg_trgm + restores the snapshot. After restore, paliad
+  # schema is at HEAD-of-snapshot and applied_migrations covers every
+  # migration up to (and including) the snapshot's max version.
+  #
+  # ApplyMigrations called in TestBootSmoke / TestMigrations_EndToEndAsAppRole
+  # sees the snapshot's applied set, finds whatever NEW migrations this
+  # PR added on top, and applies only those. The role-split smoke runs as
+  # `postgres` (which is NOT a superuser on supabase/postgres, matching
+  # the prod role topology) — any new migration that needs supabase_admin
+  # privilege fails here as it would in prod.
+  test-go:
+    runs-on: ubuntu-latest
+
+    services:
+      # supabase/postgres baked-in auth schema + supabase role topology
+      # matches youpc-supabase prod. `postgres` here is NOT a superuser
+      # (verified live: \du postgres shows "Create role, Create DB,
+      # Replication, Bypass RLS" — no Superuser). This is the prod-shaped
+      # role the deploy uses.
+      postgres:
+        image: supabase/postgres:15.8.1.060
+        env:
+          POSTGRES_PASSWORD: ci
+          POSTGRES_DB: paliad_scratch
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 30
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+
+      - name: Install postgresql-client
+        run: |
+          apt-get update -qq && apt-get install -y -qq postgresql-client
+
+      # Snapshot restore. Two prep steps as supabase_admin (the actual
+      # superuser): GRANT CREATE so the `postgres` role can later create
+      # schemas if a new mig needs it; install pg_trgm so the snapshot's
+      # trigram indexes restore. Snapshot itself loads as `postgres`.
+      - name: Provision + restore snapshot
+        env:
+          PGPASSWORD: ci
+        run: |
+          set -euo pipefail
+          psql -h localhost -U supabase_admin -d paliad_scratch -v ON_ERROR_STOP=1 \
+            -c "GRANT CREATE ON DATABASE paliad_scratch TO postgres;" \
+            -c "CREATE EXTENSION IF NOT EXISTS pg_trgm;"
+          psql -h localhost -U postgres -d paliad_scratch -v ON_ERROR_STOP=1 \
+            -f internal/db/testdata/prod-snapshot.sql
+
+      # Pre-flight: catches brunel slot collision in seconds, no DB
+      # contact (still useful even though the test-go job has Postgres
+      # running, because the failure mode is independent).
+      - name: Migration coordination check
+        run: go test -count=1 -run TestMigrations_NoDuplicateSlot ./internal/db/
+
+      # Role-split end-to-end apply. Connects as `postgres` (NOT a
+      # superuser on supabase/postgres) and runs ApplyMigrations against
+      # the snapshot-restored DB. Existing migs are skipped (already in
+      # applied_migrations); NEW migs in this PR apply here. If a new
+      # migration assumes supabase_admin privilege, fails with the same
+      # 42501 error class that took paliad.de offline on 2026-05-25.
+      - name: Migration end-to-end (deploy role)
+        env:
+          TEST_APP_DATABASE_URL: postgres://postgres:ci@localhost:5432/paliad_scratch?sslmode=disable
+        run: go test -count=1 -run TestMigrations_EndToEndAsAppRole ./internal/db/
+
+      # Boot smoke. Confirms ApplyMigrations succeeds + applied set
+      # matches on-disk set + /healthz returns 200 + /health/ready
+      # returns 200 (the live-pool variant via TestHealthReady_Live).
+      - name: Boot smoke + readiness
+        env:
+          TEST_DATABASE_URL: postgres://postgres:ci@localhost:5432/paliad_scratch?sslmode=disable
+        run: go test -count=1 -run 'TestBootSmoke|TestHealthReady_Live' ./cmd/server/
+
+      # Full Go test suite WITHOUT TEST_DATABASE_URL so live-DB service
+      # tests skip (same shape as a developer laptop without a scratch
+      # DB). Live-DB tests in internal/services/* will be activated by a
+      # follow-up shift once the snapshot is verified stable across
+      # multiple PRs — they need investigation against supabase/postgres
+      # 15.8 (parameter type inference differs subtly from youpc-supabase).
+      - name: go test ./... (pure + skip-on-no-DB)
+        run: go test -count=1 ./internal/... ./cmd/...
+
+  # Deploy step. Only runs on push to main and only after both gate jobs
+  # are green. Calls Dokploy's compose.deploy with the paliad compose ID
+  # (Zx147ycurfYagKRl_Zzyo) and polls /health/ready until it returns 200
+  # or times out.
+  #
+  # Skipped on PR / feature branch pushes — those run the gate tier as
+  # a status check but don't trigger a prod deploy. Dokploy's existing
+  # autoDeploy=true webhook continues to fire during the soft-launch
+  # window (per Q11.4); it can be disabled in the Dokploy UI once this
+  # workflow has gated ≥5 successful green deploys.
+  deploy:
+    runs-on: ubuntu-latest
+    needs: [build, test-go]
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+
+    steps:
+      - name: Trigger Dokploy compose deploy
+        env:
+          DOKPLOY_KEY: ${{ secrets.DOKPLOY_TOKEN }}
+          DOKPLOY_API: http://100.99.98.201:3000/api/trpc
+          COMPOSE_ID: Zx147ycurfYagKRl_Zzyo
+        run: |
+          set -euo pipefail
+          if [ -z "${DOKPLOY_KEY:-}" ]; then
+            echo "ERROR: DOKPLOY_TOKEN secret is not configured."
+            echo "       Set the secret in Gitea repo settings before this step can deploy."
+            exit 2
+          fi
+          echo "==> POST compose.deploy"
+          curl -sS --connect-timeout 5 --max-time 30 \
+            -X POST \
+            -H "x-api-key: $DOKPLOY_KEY" \
+            -H "Content-Type: application/json" \
+            -d "{\"json\":{\"composeId\":\"$COMPOSE_ID\"}}" \
+            "$DOKPLOY_API/compose.deploy"
+          echo
+
+      - name: Wait for /health/ready
+        run: |
+          set -euo pipefail
+          echo "==> polling https://paliad.de/health/ready"
+          # Up to 5 minutes (60 × 5 s) — paliad's cold-start is normally
+          # ≤30 s; the longer budget covers slow image pulls + migration
+          # apply.
+          for i in $(seq 1 60); do
+            status=$(curl -sS --connect-timeout 3 --max-time 5 \
+              -o /dev/null -w '%{http_code}' \
+              https://paliad.de/health/ready || echo "000")
+            if [ "$status" = "200" ]; then
+              echo "ready after ${i} poll(s)"
+              exit 0
+            fi
+            echo "  [$i/60] status=$status — sleeping 5s"
+            sleep 5
+          done
+          echo "ERROR: /health/ready did not return 200 within 5 minutes."
+          echo "       The deploy fired but the new container is not serving."
+          echo "       Investigate: ssh mlake 'docker logs --tail 50 compose-transmit-multi-byte-driver-v7jth9-web-1'"
+          exit 1

Makefile

@@ -21,18 +21,24 @@
 # the test runner's working dirs. None of them touch internal/db/migrations/
 # files.
 
-.PHONY: help verify-migrations verify-mig test test-go
+.PHONY: help verify-migrations verify-mig verify-mig-app test test-go test-frontend refresh-snapshot
 
 help:
 	@echo "Paliad — developer targets"
 	@echo ""
 	@echo "  verify-migrations   Dry-run pending migrations + boot smoke (needs TEST_DATABASE_URL)"
 	@echo "  verify-mig          Alias for verify-migrations"
+	@echo "  verify-mig-app      End-to-end migration smoke as non-superuser role"
+	@echo "                      (needs TEST_APP_DATABASE_URL — t-paliad-282 / m/paliad#114)"
 	@echo "  test                Short test pass — covers gate tier"
 	@echo "  test-go             Full Go suite with race detector"
+	@echo "  test-frontend       Frontend bun:test suite"
 	@echo ""
 	@echo "Set TEST_DATABASE_URL to enable live-DB tests. Example:"
 	@echo "  export TEST_DATABASE_URL=postgres://paliad:...@localhost:11833/paliad_test"
+	@echo ""
+	@echo "Set TEST_APP_DATABASE_URL to enable the role-split smoke. Example:"
+	@echo "  export TEST_APP_DATABASE_URL=postgres://paliad_app:...@localhost:5432/paliad_scratch"
 
 # Gate target — the test that would have caught mig 098 / mig 099 before
 # deploy. Combines:
@@ -71,3 +77,67 @@ test:
 # (full suite, not per-PR).
 test-go:
 	go test -race ./...
+
+# Frontend bun:test suite. Runs the 4 existing pure-TS tests today; will
+# grow as mendel's Slice 3 (frontend test infill) lands.
+test-frontend:
+	cd frontend && bun test
+
+# Role-split end-to-end migration smoke — the catch for the mig 129 42501
+# ownership class (m/paliad#114). Runs ApplyMigrations as a non-superuser
+# role against TEST_APP_DATABASE_URL. Fails the build if any migration
+# assumes more privilege than the deploy role has.
+#
+# Developer setup (local):
+#   psql -c "CREATE ROLE paliad_app LOGIN PASSWORD 'ci' NOSUPERUSER;"
+#   psql -c "CREATE DATABASE paliad_scratch OWNER paliad_app;"
+#   export TEST_APP_DATABASE_URL=postgres://paliad_app:ci@localhost:5432/paliad_scratch
+verify-mig-app:
+	@if [ -z "$$TEST_APP_DATABASE_URL" ]; then \
+		echo "ERROR: TEST_APP_DATABASE_URL is not set."; \
+		echo "       The role-split migration smoke cannot run without a non-superuser scratch DB."; \
+		echo "       See Makefile comments above this target for setup."; \
+		exit 2; \
+	fi
+	go test -count=1 -run TestMigrations_EndToEndAsAppRole ./internal/db/
+
+# Refresh the prod schema snapshot used by CI's migration smoke
+# (t-paliad-282 / m/paliad#114). Connects to youpc-supabase prod, dumps
+# the paliad schema + applied_migrations rows, strips rows beyond the
+# current branch's max on-disk version, and writes
+# internal/db/testdata/prod-snapshot.sql.
+#
+# When to refresh:
+#   - After merging a PR that added a new migration to main.
+#   - When CI's migration smoke starts spuriously failing because the
+#     snapshot's applied set diverges from on-disk by more than this
+#     branch's worth of new migs.
+#
+# Requires PALIAD_PROD_DATABASE_URL env var (a Postgres URL with
+# pg_dump rights on youpc-supabase). Example:
+#   export PALIAD_PROD_DATABASE_URL='postgres://postgres:PW@100.99.98.201:11833/postgres'
+refresh-snapshot:
+	@if [ -z "$$PALIAD_PROD_DATABASE_URL" ]; then \
+		echo "ERROR: PALIAD_PROD_DATABASE_URL is not set."; \
+		echo "       Refresh requires read access to youpc-supabase prod."; \
+		exit 2; \
+	fi
+	@echo "==> dumping paliad schema (no owner, no privs)..."
+	@pg_dump --schema-only --schema=paliad --no-owner --no-privileges \
+		--no-publications --no-subscriptions \
+		"$$PALIAD_PROD_DATABASE_URL" > internal/db/testdata/prod-snapshot.sql.tmp
+	@echo "==> appending applied_migrations rows..."
+	@pg_dump --data-only --table=paliad.applied_migrations \
+		--no-owner --no-privileges \
+		"$$PALIAD_PROD_DATABASE_URL" >> internal/db/testdata/prod-snapshot.sql.tmp
+	@echo "==> stripping pg16 \\restrict / \\unrestrict commands for pg15 compat..."
+	@sed -i.bak '/^\\restrict /d; /^\\unrestrict /d' internal/db/testdata/prod-snapshot.sql.tmp
+	@rm -f internal/db/testdata/prod-snapshot.sql.tmp.bak
+	@echo "==> stripping applied_migrations rows beyond branch's max on-disk version..."
+	@MAX_VER=$$(ls internal/db/migrations/*.up.sql | xargs -I{} basename {} | sed 's/_.*//' | sort -n | tail -1); \
+	awk -v max=$$MAX_VER ' \
+	  /^[0-9]+\t/ { split($$0, a, "\t"); if (a[1]+0 > max) next; } \
+	  { print } \
+	' internal/db/testdata/prod-snapshot.sql.tmp > internal/db/testdata/prod-snapshot.sql
+	@rm internal/db/testdata/prod-snapshot.sql.tmp
+	@wc -l internal/db/testdata/prod-snapshot.sql

cmd/server/main.go

@@ -165,6 +165,7 @@ func main() {
 		sysAuditSvc := services.NewSystemAuditLogService(pool)
 		checklistTemplateSvc := services.NewChecklistTemplateService(pool, checklistCatalogSvc, sysAuditSvc, users)
 		svcBundle = &handlers.Services{
+			Pool:           pool,
 			Project:        projectSvc,
 			Team:           teamSvc,
 			PartnerUnit:    partnerUnitSvc,

cmd/server/main_smoke_test.go

@@ -98,6 +98,51 @@ func TestBootSmoke(t *testing.T) {
 	if body := strings.TrimSpace(rec.Body.String()); body != "ok" {
 		t.Errorf("GET /healthz: body=%q; want \"ok\"", body)
 	}
+
+	// (4) Readiness probe. With a nil Services bundle the endpoint MUST
+	// report 503 — that's the contract documented in handlers/handlers.go.
+	// A separate svc-with-Pool case is exercised in TestHealthReady (live).
+	rec = httptest.NewRecorder()
+	req = httptest.NewRequest(http.MethodGet, "/health/ready", nil)
+	mux.ServeHTTP(rec, req)
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Errorf("GET /health/ready (nil svc): status=%d; want 503", rec.Code)
+	}
+}
+
+// TestHealthReady_Live asserts the readiness probe answers 200 when the
+// pool is reachable, 503 when it isn't. Requires TEST_DATABASE_URL.
+//
+// Why a separate test: TestBootSmoke runs Register with svc=nil to keep
+// its setup minimal; the pool-reachable path needs the pool wired in
+// through svc.Pool. Two tests, two assertions, no entanglement.
+func TestHealthReady_Live(t *testing.T) {
+	url := os.Getenv("TEST_DATABASE_URL")
+	if url == "" {
+		t.Skip("TEST_DATABASE_URL not set — skipping live readiness probe")
+	}
+
+	if err := db.ApplyMigrations(url); err != nil {
+		t.Fatalf("db.ApplyMigrations: %v", err)
+	}
+	pool, err := db.OpenPool(url)
+	if err != nil {
+		t.Fatalf("open pool: %v", err)
+	}
+
+	mux := http.NewServeMux()
+	authClient := auth.NewClient("https://test.invalid", "anon-key", []byte("test-secret"))
+	handlers.Register(mux, authClient, "", &handlers.Services{Pool: pool})
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/health/ready", nil)
+	mux.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Errorf("GET /health/ready (live pool): status=%d, body=%q; want 200", rec.Code, rec.Body.String())
+	}
+	if body := strings.TrimSpace(rec.Body.String()); body != "ready" {
+		t.Errorf("GET /health/ready (live pool): body=%q; want \"ready\"", body)
+	}
 }
 
 // embeddedMigrationVersions returns every N where N_*.up.sql exists in

docs/cicd-runner-setup-2026-05-25.md

@@ -0,0 +1,181 @@
+# CI/CD runner setup — paliad
+
+**Companion to:** `docs/design-cicd-pre-deploy-gate-2026-05-25.md` (Slice A, t-paliad-282 / m/paliad#114)
+**Date:** 2026-05-25
+**Audience:** mlake / mriver admin (m or head)
+
+Slice A's `.gitea/workflows/test.yaml` requires (a) at least one online Gitea Actions runner and (b) a Dokploy API token wired as a repo secret. Both are one-time setup actions that paliad's source tree cannot perform itself — they live on infra-side. This doc lists them so the workflow can go green on its first run.
+
+---
+
+## 0. Pre-flight: what already exists
+
+Verified live (2026-05-25 cronus inventor shift):
+
+- Gitea 1.24.4 on `mgit.msbls.de`, `has_actions: true` on `m/paliad`.
+- `/api/v1/admin/actions/runners` reports **2 runners** registered. They are likely the shared runners used by `m/mGreen` and `m/mGeo` (both have `.gitea/workflows/deploy.yml` with `runs-on: self-hosted`).
+- `m/paliad/actions/tasks` reports `total_count=0` — paliad has never run a workflow yet.
+
+The existing runners may already be capable of running paliad's workflow without further setup. The verification step (§3) below tells you whether they are.
+
+---
+
+## 1. Runner placement decision (m's Q11.1)
+
+m's pick: **mriver**.
+
+Rationale: mriver hosts the mai worker fleet but workers spend most of their time waiting on Anthropic. mlake's Dokploy + Swarm workload is more contended. A new runner on mriver adds the least pressure to either box.
+
+If mriver is offline or saturated when CI first fires, fall back to the existing mlake-side runners (they're already registered; no provisioning needed).
+
+---
+
+## 2. One-time setup (admin steps)
+
+### 2.1 Register a new Gitea Actions runner on mriver
+
+```bash
+# On mriver, as m:
+# 1. Download the act_runner binary (matching Gitea 1.24.x)
+curl -L -o /usr/local/bin/act_runner \
+  https://gitea.com/gitea/act_runner/releases/download/v0.2.13/act_runner-0.2.13-linux-amd64
+chmod +x /usr/local/bin/act_runner
+
+# 2. Get a runner registration token. In the Gitea UI:
+#    /admin → Actions → Runners → "Create new Runner"
+#    (or org-scope: /m/paliad/settings/actions/runners)
+# Copy the token.
+
+# 3. Register
+mkdir -p ~/act_runner && cd ~/act_runner
+act_runner register --no-interactive \
+  --instance https://mgit.msbls.de \
+  --token <REGISTRATION_TOKEN> \
+  --name mriver-paliad-1 \
+  --labels ubuntu-latest:docker://node:20-bookworm
+
+# 4. Run as a systemd unit (preferred) or as a session daemon
+# Systemd unit example: /etc/systemd/system/act_runner.service
+#   [Unit]
+#   Description=Gitea Actions runner
+#   After=network.target
+#   [Service]
+#   User=m
+#   WorkingDirectory=/home/m/act_runner
+#   ExecStart=/usr/local/bin/act_runner daemon
+#   Restart=on-failure
+#   [Install]
+#   WantedBy=multi-user.target
+sudo systemctl enable --now act_runner
+sudo systemctl status act_runner
+```
+
+**Why `ubuntu-latest:docker://node:20-bookworm` for the label?** Gitea Actions' `runs-on: ubuntu-latest` resolves via the runner's label map. Mapping it to a Docker image gives the workflow a sandbox with Docker available — required for our Postgres service container in `test.yaml`. mriver should have Docker (for `paliadin-shim`); if not, install it.
+
+### 2.2 Register the Dokploy API token as a repo secret
+
+The workflow's `deploy` job needs `secrets.DOKPLOY_TOKEN`. Use the existing project-wide Dokploy API key (the one stored in `~/.claude/skills/mai-dokploy/SKILL.md`).
+
+In the Gitea UI:
+- Navigate to `https://mgit.msbls.de/m/paliad/settings/actions/secrets`
+- Click "Add secret"
+  - Name: `DOKPLOY_TOKEN`
+  - Value: `mai-ottosSyRHMhmLhhhXaCbKzbqKBuSqzqEtmKDOPelPCeimTaYsbmaVslVyEgJZGCIxVdz`
+
+Or via API (mAi identity):
+```bash
+curl --netrc-file ~/.netrc-mai -sS -X POST \
+  -H "Content-Type: application/json" \
+  https://mgit.msbls.de/api/v1/repos/m/paliad/actions/secrets/DOKPLOY_TOKEN \
+  -d '{"data":"mai-ottosSyRHMhmLhhhXaCbKzbqKBuSqzqEtmKDOPelPCeimTaYsbmaVslVyEgJZGCIxVdz"}'
+```
+
+(Requires repo-owner permission. If mAi lacks it, m runs it.)
+
+---
+
+## 3. Verify the runner sees the workflow
+
+After (2.1) + (2.2):
+
+```bash
+# Push the Slice A branch (the one this doc lives on)
+git push origin mai/cronus/coder-cicd-slice-a
+
+# Confirm the runner picked up the job
+curl --netrc-file ~/.netrc-mai -sS \
+  "https://mgit.msbls.de/api/v1/repos/m/paliad/actions/tasks?limit=5" | jq '.'
+```
+
+A new task per job should appear (build, test-go). If `total_count` stays 0, the runner labels don't match the workflow's `runs-on`. Re-register with `--labels ubuntu-latest` (no docker:// suffix) and the existing runners on mlake will pick it up via shell mode.
+
+---
+
+## 4. Soft-launch (m's Q11.4)
+
+m's pick: **keep both Dokploy auto-deploy and the workflow's deploy step alive for ~1 week. After ≥5 successful green deploys via the workflow, disable Dokploy's autoDeploy in the Dokploy UI for the paliad compose.**
+
+While both are live, every push to main fires:
+1. Dokploy webhook (existing path) → deploys immediately, no gate.
+2. Gitea workflow → on green, ALSO calls `compose.deploy`.
+
+The second call is idempotent — if Dokploy already deployed the same commit, this is a no-op. The workflow's value during soft-launch is the **gate signal**: a red workflow on a green main = the bad migration shipped via the unguarded webhook and broke prod, and the workflow is shouting about it.
+
+After confidence builds:
+1. In the Dokploy UI, navigate to the paliad compose → Settings.
+2. Toggle "Auto Deploy" off.
+3. Save.
+
+From this point, the only path to deploy is the workflow's deploy job. Red workflow = no deploy.
+
+---
+
+## 5. What Slice A catches today — and what it doesn't
+
+After this branch (`mai/cronus/coder-cicd-slice-a`) merges to main:
+
+### Catches (active in CI)
+
+- **Build breakage** — `go build`, `go vet`, `bun run build`. Red gate, no deploy.
+- **Slot collisions** — `TestMigrations_NoDuplicateSlot` runs without a DB. A PR adding migration N when version N already exists fails at gate time. This is the brunel-class catch (m/paliad#114 ~13:20 outage).
+- **New-migration shape errors (hermes class)** — `TestBootSmoke` runs `ApplyMigrations` against the snapshot-restored DB. New migs from this PR get applied for real; any column/relation/syntax error fails the gate before merge.
+- **New-migration ownership errors (mig 129 42501 class)** — `TestMigrations_EndToEndAsAppRole` runs `ApplyMigrations` connected as `postgres` (NON-superuser on `supabase/postgres:15.8.1.060`, same role topology as youpc-supabase prod). Any migration that assumes supabase_admin privilege fails with the same `42501 must be owner` error class that took paliad.de offline on 2026-05-25.
+- **Readiness probe regressions** — `TestHealthReady_Live` confirms `/health/ready` returns 200 against a live pool, 503 against a nil pool.
+- **Pure-Go test regressions** — `go test ./internal/... ./cmd/...` runs without `TEST_DATABASE_URL` (live-DB service tests skip the same way they do on a developer laptop without a scratch DB).
+
+### Mechanism — the snapshot approach
+
+CI's scratch DB starts from a `pg_dump` of youpc-supabase paliad schema +
+`paliad.applied_migrations` rows, committed to `internal/db/testdata/prod-snapshot.sql`. After restore, the scratch DB is at "paliad HEAD of snapshot" and `ApplyMigrations` sees only this PR's new migrations as pending.
+
+This sidesteps the fresh-DB idempotence problem: several historical migrations (notably mig 037's missing `CREATE EXTENSION pg_trgm`, mig 051's inner `COMMIT;`) can't be replayed from scratch against `supabase/postgres:15.8.1.060`. The snapshot pins everything that's already applied in prod and lets CI focus on what's new — which is what we actually care about for outage prevention.
+
+Snapshot refresh: `make refresh-snapshot` with `PALIAD_PROD_DATABASE_URL` set (see `internal/db/testdata/README.md`).
+
+### Known gap — live-DB service tests don't run in CI
+
+`internal/services/*_test.go` tests with `TEST_DATABASE_URL` set fail against `supabase/postgres:15.8.1.060` with `42P08 inconsistent types deduced for parameter` errors on some INSERT bind paths. The same tests pass against youpc-supabase prod. Cause is unconfirmed — likely subtle differences in type inference between the dockerized image and the prod cluster's configuration. CI today runs `go test ./...` without `TEST_DATABASE_URL` so these tests skip. Not blocking outage prevention; tracked as a follow-up for the post-Slice-A coder.
+
+### Migration cleanup also bundled in this PR
+
+Two surgical migration improvements that surfaced during snapshot debugging — kept here because they're small and harmless:
+
+- **mig 024 + 027** — `ALTER INDEX` / `ALTER POLICY` exception handlers now catch `undefined_object` OR `undefined_table` OR `duplicate_object`. Old handler caught only `undefined_object`; Postgres raises `undefined_table` when the source object never existed and `duplicate_object` when the destination already exists. The expanded handler makes the migrations truly idempotent across the three plausible states: source-still-German (rename succeeds), already-renamed (catches duplicate_object), and fresh-DB-never-had-German (catches undefined_table).
+
+Other migration history bugs (mig 037 missing pg_trgm, mig 051 inner COMMIT) are tracked as a separate cleanup task — not blocking, because the snapshot bypasses them.
+
+### Verification checklist (after Slice A merges)
+
+1. **Workflow green on its first PR run?** Check `/m/paliad/actions`. If not, fix before merging.
+2. **Dokploy `compose.deploy` call succeeds?** The workflow's `deploy` job logs the POST response. A successful response is a Dokploy job ID; a 4xx is an auth or compose-id problem.
+3. **`/health/ready` returns 200 within 5 minutes after a green deploy?** The workflow polls this. If it times out, the migration may have failed silently inside the new container — check `docker logs --tail 50 compose-transmit-multi-byte-driver-v7jth9-web-1` on mlake.
+4. **Reproduce the slot-collision catch locally:** rename `131_…up.sql` to `129_…` (duplicate slot) → workflow MUST fail at `Migration coordination check`. Revert before pushing.
+5. **Reproduce the role-split catch locally:** add a no-op migration `132_test_supersedes.up.sql` containing `REINDEX SYSTEM paliad_scratch;` (requires superuser). Workflow MUST fail at `Migration end-to-end (deploy role)`. Revert before pushing.
+
+---
+
+## 6. Future polish (Slice D, m's Q4 R-pick)
+
+`mai-test` post-merge shift: once Slice A is stable, wire a Gitea webhook on push-to-main that fires `/mai-test` as a follow-up shift. It runs the broader smoke + integration suite and posts results as a Gitea commit status. Not blocking; the gate doesn't depend on it.
+
+Implementation belongs in `m/mAi` (the mai webhook handler), not in paliad. Out of scope for Slice A.

docs/design-cicd-pre-deploy-gate-2026-05-25.md

@@ -1,631 +0,0 @@
-# Design — CI/CD pre-deploy test + migration gate
-
-**Author:** cronus (inventor)
-**Date:** 2026-05-25
-**Task:** t-paliad-282 — m/paliad#114
-**Branch:** `mai/cronus/inventor-ci-cd-pre`
-**Status:** DESIGN READY FOR REVIEW. No code, no compose edits, no Dokploy changes. Awaiting head go/no-go on §3 R-picks + §11 open questions before any coder shift.
-
----
-
-## 0. TL;DR
-
-Paliad has been offline ≈ 90 min of the last 4 h today (three independent migration crash-loops). The repo has a `TestMigrations_DryRun` (`internal/db/migrate_test.go`) that already would have caught two of the three; it has never been run by anything except local laptops because there is **no CI**. mendel's `docs/design-paliad-test-strategy-2026-05-19.md` Slice 7 deferred CI wiring on the Q2 question to m; today's outages make Slice 7 the highest-leverage paliad change on the board.
-
-The site goes offline on a failed deploy because the compose has `restart: unless-stopped` + no healthcheck + no Swarm `deploy:` block. Dokploy compose mode (verified live on `compose-transmit-multi-byte-driver-v7jth9` — paliad's auto-named project) runs `docker compose up -d --force-recreate`: the old container is killed BEFORE the new one starts. When the new one's migrator panics, the old one is already gone — Traefik has nothing to route to, paliad.de serves 404. With 14 restart attempts and counting on the current container.
-
-**Two-pronged fix:**
-
-1. **Pre-deploy gate (PRIMARY) — Gitea Actions runs `go build` + `bun run build` + `go test ./...` + a beefed-up migration smoke test against an ephemeral Postgres BEFORE Dokploy's webhook fires.** If red, the deploy never happens. If green, Dokploy gets called and replaces the container. Per m's constraint: no `.dev` clone, no second Dokploy app. Single source of truth, single prod surface. The gate is in front of the existing deploy, not parallel to it.
-2. **Runtime safety net (SECONDARY) — tighten the migrator to fail-fast loudly + cap the restart loop so a bad deploy doesn't keep flailing for hours.** The compose change is small (add `healthcheck:` + `restart: on-failure:3`); the actual win is preventing the deploy with prong 1.
-
-**Both prongs together close the failure mode. Prong 1 alone is enough for the three outages today.** Prong 2 is defense in depth for the rare case where prod data shape diverges from the CI Postgres in a way the smoke harness can't predict.
-
-Six open questions for m at §11. The R-picks let m sign off in one chip-round instead of negotiating each one. Coder shift after head's go/no-go.
-
----
-
-## 1. Today's outages — root cause analysis
-
-Three migration crash-loops, three distinct mechanisms. All three would have been caught by CI:
-
-### 1.1 ~13:20 — brunel slot collision (mig 123)
-
-**Mechanism.** brunel's in-process tests wrote a row to `paliad.applied_migrations` claiming `version=123` with the wrong name. cronus's actual `123_backups.up.sql` shipped in parallel. On next deploy, the runner saw version 123 already "applied" with the wrong name and `checkNameAgreement` hard-failed.
-
-**Why CI catches it.** Two workers writing to slot 123 means at PR-time both branches have a file named `123_*.up.sql`. A pre-merge CI gate that runs `scanEmbeddedMigrations()` (which already hard-fails on duplicate slots — `internal/db/migrate.go:148`) flags the second PR before it's merged. The merger has to coordinate (rename their migration to 124 or wait for the first to land).
-
-**Currently caught by:** local `go test` of the duplicate-slot path, which always failed; the safeguard is in the runner. CI just enforces the safeguard before merge.
-
-### 1.2 ~16:05 — hermes dropped-column refs (mig 125)
-
-**Mechanism.** `125_cross_cutting_filter_legal_source.up.sql` referenced columns (`is_mandatory`, `is_optional`, `condition_flag`) that had been dropped in migration 091. mig 125 compiled fine; the failure only surfaced when the runner applied it against a DB that had already run mig 091.
-
-**Why CI catches it.** `TestMigrations_DryRun` (live in `internal/db/migrate_test.go:47`) applies every pending migration in order against a scratch DB. On a fresh DB walked from 001 → 125, mig 091 drops the columns; by the time mig 125 runs, those columns don't exist, mig 125 errors out, the test fails. Today this test silently skips because no machine in CI sets `TEST_DATABASE_URL`.
-
-**Currently caught by:** nothing in CI. Manually catchable by running `make verify-migrations` on a developer laptop with `TEST_DATABASE_URL` set — but that's "if the worker remembers."
-
-### 1.3 ~14:56 → still failing — mig 129 ownership error (LIVE OFFLINE NOW)
-
-**Mechanism.** `129_project_event_choices.up.sql` does something on `paliad.project_event_choices` that the DB role lacks the OWNER privilege for. Live container `compose-transmit-multi-byte-driver-v7jth9-web-1` is on RestartCount=14 with:
-
-```
-migration failed: apply 129_project_event_choices.up.sql:
-  exec sql: pq: must be owner of table project_event_choices (42501)
-```
-
-Paliad.de returns 404 from Traefik (no healthy backend) as of 16:57 UTC.
-
-**Why CI catches it — if and only if the CI Postgres is set up correctly.** The dry-run test runs as a role that owns the scratch DB it created → it WILL be owner of every table. The current CI proposal must run the migrations AS THE NON-OWNER ROLE that prod uses (or a CI role that mirrors prod's grants). Postgres error code 42501 surfaces only when the apply role isn't the table owner.
-
-**Concrete CI requirement:** the smoke harness creates two roles in the scratch DB — one as table-owner (matching the original mig 001 schema-creator role), one as the application-deployer role (the one that runs `ApplyMigrations` in prod). Mig 091 → 129 are applied as the deployer role. Any migration that assumes implicit ownership will fail in CI exactly as it fails in prod.
-
-**Currently caught by:** nothing. The dry-run test, even when run with `TEST_DATABASE_URL`, uses a single role that is implicitly owner of every table it touches; it does not simulate the role split that exists in prod (`youpc-supabase` DB, paliad app connects as a non-owner role).
-
-### 1.4 Common failure path — why all three knock the site offline
-
-Independent of WHICH migration fails, the moment the new container panics:
-
-```
-docker compose up -d --force-recreate  ← Dokploy runs this on webhook
-↓
-old container stopped + removed
-↓
-new container created, starts /app/paliad
-↓
-ApplyMigrations(databaseURL) panics
-↓
-container exits 1
-↓
-restart: unless-stopped triggers restart
-↓
-restart loop forever — Traefik has no healthy backend
-↓
-paliad.de returns 404 indefinitely
-```
-
-The old container is GONE between `stop` and the new container's first health-check (there is no health-check). There is no rolling deploy, no `--no-recreate`, no swap-on-healthy. The compose `restart: unless-stopped` only ensures the failing container keeps trying — it does not preserve the old one.
-
----
-
-## 2. m's constraints (verbatim from issue body)
-
-- **No `paliad.dev` duplicate:** don't want a separate Dokploy app + branch + DB. One source of truth, one prod surface.
-- **Test workers included:** build + tests must run somewhere before the deploy.
-- **Existing infra only:** gitea (`mgit.msbls.de`) · mlake (Dokploy + Docker Swarm + Compose) · mriver (Tailscale-attached worker fleet).
-- **Site stays online through failed deploys:** a broken migration must NOT take the running container down.
-
-Restating the implicit constraint: paliad on Dokploy uses Dokploy's "Compose" deployment type (not "Application"), so we do not get Docker Swarm's `deploy.update_config.failure_action: rollback` for free. Verified live: compose YAML at `/etc/dokploy/compose/compose-transmit-multi-byte-driver-v7jth9/code/docker-compose.yml` has no `deploy:` block; project's docker-compose.yml has none either. Dokploy "Compose" runs `docker compose up -d` which is not Swarm-aware.
-
----
-
-## 3. Decision matrix
-
-For each Q, this section gives the **R-pick**, the cost (LoC / new infra), the maintenance footprint, and the time-to-ship estimate (rough complexity bands: small / medium / large — no hours per project CLAUDE.md).
-
-### Q1 — Where do tests run?
-
-| Option | Cost | Maintenance | Notes |
-|---|---|---|---|
-| **A. Gitea Actions (R)** | 1 workflow YAML (~80 lines) + Postgres service container | Low — m's stack already runs gitea | mendel's Slice 7 picked this on Q2. Verified live: Gitea 1.24.4, `mgit.msbls.de`, `has_actions: true` on `m/paliad`, ≥2 admin runners registered. |
-| B. Custom mriver proxy | New Go service + webhook forwarder + container | Medium — paliad-specific glue | Reinvents Gitea Actions; only justified if Actions can't be made to work, which it can. |
-| C. Dokploy pre-deploy hook | Unknown — Dokploy compose mode may not expose this | Unknown | Tighter integration but no documented hook for compose mode. Skip. |
-
-**R = A.** Gitea Actions runner on the existing infra (mriver workers can host a runner if mlake's load is a concern — see §7).
-
-### Q2 — Where does the migration get tested?
-
-| Option | Cost | Maintenance | Notes |
-|---|---|---|---|
-| **A. CI smoke against ephemeral scratch Postgres (R)** | Postgres service container in Gitea workflow + extension to `TestMigrations_DryRun` to cover role-ownership | Low — runs on every PR | Catches all three of today's outages if the role-split (§1.3) is wired correctly. |
-| B. Dry-run-mode CLI flag | Add `--migrate-dry-run` to the Go binary; CI step `./paliad --migrate-dry-run` against scratch DB | Low | Equivalent to A but with an entry-point that's also useful for manual ops. Nice-to-have, not blocking. |
-| **C. Runtime fail-fast + restart cap (R, defense in depth)** | Edit docker-compose.yml `restart: on-failure:3` + add `healthcheck:` | Trivial | Doesn't prevent the outage but caps the crash-loop blast radius and gives Dokploy/Traefik a signal to fall back. |
-
-**R = A + C.** Belt-and-suspenders. A catches every shape-error before it reaches prod; C ensures the rare unknown-unknown doesn't crash-loop for hours.
-
-### Q3 — Blue/green or canary for the container itself?
-
-| Option | Cost | Maintenance | Notes |
-|---|---|---|---|
-| A. Switch to Dokploy "Application" type (Swarm-backed) | Re-create the Dokploy deployment as Application; migrate `paliad_exports` volume; reconfigure SSH-multi-line secrets | Medium — new deployment shape | Gives proper `deploy.update_config.failure_action: rollback`. But m has explicitly excluded multi-app/multi-branch setups. |
-| **B. Stay on Compose + tighten healthcheck + restart cap (R)** | `healthcheck:` block (~6 lines) + `restart: on-failure:3` (~1 line) | Trivial | Does NOT give us rolling deploy. The "stay online during failed deploy" property is delivered by **Q1 + Q2** (the gate prevents the broken deploy from happening at all). The compose changes are for the residual case. |
-| C. Do nothing | 0 | 0 | Today's outages recur. |
-
-**R = B.** Stay on Compose. Real online-during-failure protection comes from the CI gate (Q1+Q2). The compose changes are damage limitation, not the primary mechanism.
-
-### Q4 — How do test workers (existing mai workers) fit in?
-
-| Option | Cost | Maintenance | Notes |
-|---|---|---|---|
-| **A. Per-worker pre-push tests stay (already-convention) + CI is the safety net (R)** | 0 (convention exists) + Slice A | Low | Workers run `go build / go vet / go test / bun run build` by convention. CI ensures the convention isn't accidentally skipped. |
-| B. Replace per-worker tests with CI-only | 0 in CI; but workers waste cycles pushing red diffs | Higher feedback latency | Workers find out their work is broken from CI instead of locally — slower loop. |
-| **C. Add a `mai-test` post-merge shift on main (R, optional polish)** | Existing skill, just wire it to the merge webhook | Low | Per `mai-test` skill — broader smoke + integration suite, reports back to gitea as a check status. Nice-to-have, can be Slice D. |
-
-**R = A + C.** Per-worker discipline at push, Gitea Actions at PR, `mai-test` polish post-merge.
-
-### Q5 — Migration coordination (root cause of outage 1)
-
-| Option | Cost | Maintenance | Notes |
-|---|---|---|---|
-| **A. Head reserves migration slots when assigning tasks that need a migration (R, in flight)** | 0 in code — process discipline | Low — head already trending this way | Today's session: head already does this in flight. Codify as a skill rule in `mai-head` SKILL.md. |
-| **B. CI pre-flight check: fail build if any migration's slot exists in `applied_migrations` with a different name (R)** | ~20 LoC Go test reading `applied_migrations` from prod-snapshot | Low | Belt and suspenders for A. Catches the brunel case before merge. |
-| C. Branch-time check in `mai hire` | ~20 LoC shell in mai CLI | Medium — paliad-specific in the cross-project CLI | Wrong place. The check belongs in CI, not in worker spawning. |
-
-**R = A + B.** Head coordination as the primary; CI flag as the safety net.
-
-### Q6 — Existing prod traffic during deploy
-
-| Option | Cost | Maintenance | Notes |
-|---|---|---|---|
-| **A. Verify Dokploy "Compose" deploy behavior live + document in CLAUDE.md (R)** | 1 SSH session + write-up | 0 | Verified above (§1.4): Dokploy compose mode does `--force-recreate`, no rolling deploy. The protection comes from the CI gate, not from this property. |
-| B. Investigate Dokploy "Application" migration | Medium — a separate proposal | Medium | Out of scope per m's constraint (#3). |
-
-**R = A.** Document the limitation; the CI gate (Q1+Q2) is the primary online-during-failure mechanism.
-
-### Summary of R-picks
-
-| Q | Pick | Slice |
-|---|---|---|
-| Q1 | A — Gitea Actions on mriver/mlake runner | A (workflow) |
-| Q2 | A + C — CI smoke + runtime fail-cap | A (smoke) + B (compose) |
-| Q3 | B — Stay on Compose, add healthcheck + restart-cap | B |
-| Q4 | A + C — Per-worker tests + CI + mai-test polish | A + D |
-| Q5 | A + B — Head reservation + CI duplicate-slot check | A (CI) + head SKILL.md |
-| Q6 | A — Document compose mode behavior | (doc only) |
-
----
-
-## 4. Recommended pipeline
-
-```
-┌──────────────────────────────────────────────────────────────────┐
-│  Worker shift                                                    │
-│  ┌────────────────────────────────────────────────────────────┐  │
-│  │  mai/<worker>/<task> branch                                │  │
-│  │  go build / go vet / go test ./internal/... / bun build    │  │ pre-push (convention, exists)
-│  │  push to gitea                                             │  │
-│  └────────────────────────────────────────────────────────────┘  │
-└───────────────────────────────┬──────────────────────────────────┘
-                                │ git push
-                                ▼
-┌──────────────────────────────────────────────────────────────────┐
-│  mgit.msbls.de — Gitea                                           │
-│  ┌────────────────────────────────────────────────────────────┐  │
-│  │  .gitea/workflows/test.yml fires on:                       │  │
-│  │    push to any branch         (gate tier)                  │  │ Slice A
-│  │    push to main               (gate + full + deploy step)  │  │
-│  │                                                            │  │
-│  │  Jobs (all on a single runner; parallel where independent):│  │
-│  │  ┌──────────────────────────────────────────────────────┐  │  │
-│  │  │ job: build                                           │  │  │
-│  │  │   bun install + bun run build                        │  │  │
-│  │  │   go build ./...                                     │  │  │
-│  │  ├──────────────────────────────────────────────────────┤  │  │
-│  │  │ job: test-go                                         │  │  │
-│  │  │   services: postgres:16  (ephemeral)                 │  │  │
-│  │  │   step: psql -c "CREATE ROLE paliad_app …"           │  │  │
-│  │  │   step: TEST_DATABASE_URL=…@…/scratch  go test ./... │  │  │
-│  │  │   step: TEST_DATABASE_URL=…@…/scratch                │  │  │
-│  │  │         (extended) TestMigrations_DryRun             │  │  │
-│  │  ├──────────────────────────────────────────────────────┤  │  │
-│  │  │ job: test-frontend (optional Slice C)                │  │  │
-│  │  │   bun test                                           │  │  │
-│  │  ├──────────────────────────────────────────────────────┤  │  │
-│  │  │ job: migration-coordination-check                    │  │  │ Slice A.4 — duplicate-slot, name-mismatch
-│  │  │   go test -run TestMigrations_NoDuplicate ./internal/db│  │  │
-│  │  └──────────────────────────────────────────────────────┘  │  │
-│  └─────────────────────┬──────────────────────────────────────┘  │
-└────────────────────────┼─────────────────────────────────────────┘
-                         │ all green
-                         │ AND ref == refs/heads/main
-                         ▼
-┌──────────────────────────────────────────────────────────────────┐
-│  Gitea workflow step: deploy                                     │
-│  ┌────────────────────────────────────────────────────────────┐  │
-│  │  curl POST https://<dokploy>/api/compose/                  │  │
-│  │       <Zx147ycurfYagKRl_Zzyo>/deploy                       │  │
-│  │       Authorization: Bearer ${{ secrets.DOKPLOY_TOKEN }}   │  │
-│  └────────────────────────────────────────────────────────────┘  │
-└───────────────────────────────┬──────────────────────────────────┘
-                                │ Dokploy webhook (instead of gitea push webhook)
-                                ▼
-┌──────────────────────────────────────────────────────────────────┐
-│  mlake — Dokploy                                                 │
-│  ┌────────────────────────────────────────────────────────────┐  │
-│  │  docker compose pull + up -d --force-recreate              │  │
-│  │  ┌──────────────────────────────────────────────────────┐  │  │
-│  │  │ web container: /app/paliad                           │  │  │
-│  │  │   ApplyMigrations(DATABASE_URL)                      │  │  │
-│  │  │     ✓ all green from CI ⇒ this will succeed          │  │  │
-│  │  │   bind :8080                                         │  │  │
-│  │  │   healthcheck GET /health/ready every 10s            │  │  │ Slice B
-│  │  │   restart: on-failure:3 (was: unless-stopped)        │  │  │ Slice B
-│  │  └──────────────────────────────────────────────────────┘  │  │
-│  └────────────────────────────────────────────────────────────┘  │
-└──────────────────────────────────────────────────────────────────┘
-```
-
-**Critical change vs. today:** the gitea push webhook → Dokploy is REPLACED by gitea workflow → CI → if green, the workflow itself calls Dokploy. The webhook is removed (or pointed at a no-op endpoint) so Dokploy can't be triggered any way except via the workflow's final step. **One way in, gated by CI.**
-
-If the CI fails:
-- The deploy step never runs.
-- Dokploy never fires.
-- The old container keeps serving paliad.de.
-- Gitea workflow status goes red; gitea posts a check status on the commit; head sees it on the project page or via `mai status`.
-
-If a worker pushes red to a feature branch (not main):
-- The gate-tier subset of jobs runs (build + go test + migration smoke).
-- Red status on the branch surfaces in PR view.
-- Deploy never even attempted (only fires on `main`).
-- Worker fixes locally and pushes again.
-
----
-
-## 5. Compose changes (Slice B)
-
-Minimal, targeted. The compose stays Docker-Compose-mode (Dokploy "Compose" type). No Swarm migration.
-
-**Diff (conceptual; coder produces real diff):**
-
-```yaml
-services:
-  web:
-    build: .
-    expose:
-      - "8080"
-    environment:
-      # …(unchanged)…
-    volumes:
-      - paliad_exports:/var/lib/paliad/exports
-    restart: on-failure:3                   # was: unless-stopped
-    healthcheck:
-      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/health/ready"]
-      interval: 10s
-      timeout: 3s
-      retries: 3
-      start_period: 30s                     # boot + migrate window
-```
-
-**What `restart: on-failure:3` buys:**
-- After 3 failed restarts within the policy window, Docker stops auto-restarting.
-- The container enters `exited` state.
-- Dokploy can surface "deploy failed" in its UI.
-- We don't burn CPU + Postgres connections on an infinite crash-loop.
-
-**What `healthcheck:` buys:**
-- Traefik (Dokploy's reverse proxy) checks `condition: service_healthy` on the target before routing.
-- If the container is `unhealthy`, Traefik returns 503 (one extra retry path).
-- More importantly: when CI is wired to call Dokploy's API, the API call can poll `/health/ready` after the deploy and report success/failure in the workflow.
-
-**What this does NOT buy (per Q3):**
-- It does NOT keep the old container alive while the new one starts. Compose mode kills the old container first. **The CI gate (Slice A) is what keeps the old container alive — by preventing the broken deploy from firing at all.**
-
-**Implementation gotcha — `/health/ready` doesn't exist yet:**
-- `internal/handlers/` has no `health` handler. The endpoint must be added (cheap, ~20 LoC: open `internal/db` pool ping + return 200 / 503). Slice B includes this.
-
----
-
-## 6. Migration smoke harness (Slice A.2)
-
-Extending `internal/db/migrate_test.go` to catch today's three outage classes:
-
-### 6.1 What exists today (working)
-
-`TestMigrations_DryRun` (migrate_test.go:47) walks pending migrations and applies each in BEGIN/ROLLBACK against a scratch DB. It catches:
-- SQL syntax errors (rare; `go build` doesn't see SQL).
-- Statements that reference columns that genuinely don't exist (mig 125 case — IF the test runs after the prior migrations have applied to the scratch DB).
-
-It does NOT catch ownership errors (mig 129 case) because the test role implicitly owns every table it creates in BEGIN/ROLLBACK.
-
-### 6.2 Extensions needed (Slice A.2)
-
-**(a) End-to-end apply pass with role split.**
-
-Add `TestMigrations_EndToEndAsAppRole` to `internal/db/migrate_test.go`. Setup:
-
-```sql
--- run as superuser (postgres) once per CI job
-CREATE ROLE paliad_owner LOGIN PASSWORD 'ci';
-CREATE ROLE paliad_app   LOGIN PASSWORD 'ci';
-CREATE DATABASE paliad_scratch OWNER paliad_owner;
-\c paliad_scratch paliad_owner
-GRANT USAGE ON SCHEMA public TO paliad_app;
-GRANT ALL ON SCHEMA paliad TO paliad_app;
--- mirror prod: paliad_app is the deploy role, paliad_owner created the schema
-```
-
-Test body runs `ApplyMigrations(<paliad_app DSN>)` end-to-end (no rollback between migrations). If migration N assumes ownership it doesn't have, it fails here with the exact same `42501 must be owner of table X` that we see in prod. Catches mig 129.
-
-**Open Q:** the exact role split is something m + head must look at against the youpc-supabase setup. The CI role names don't have to match prod exactly — they just have to model the same OWNER vs. APP-CONNECT split. Q11.2 below asks m to confirm.
-
-**(b) Duplicate-slot pre-flight check.**
-
-Add `TestMigrations_NoDuplicateSlot` to `internal/db/migrate_test.go`. The `scanEmbeddedMigrations` runner-side check is already there but only runs when the runner runs (i.e. at prod boot). Hoisting it into a unit test:
-
-```go
-func TestMigrations_NoDuplicateSlot(t *testing.T) {
-    _, err := scanEmbeddedMigrations()
-    if err != nil {
-        t.Fatalf("duplicate slot: %v", err)
-    }
-}
-```
-
-Catches the brunel case at CI time (before merge to main). Cheap, no DB needed, runs in every PR.
-
-**(c) Down-script smoke (optional, Slice A.5).**
-
-For every applied `.up.sql` in CI, apply the matching `.down.sql` immediately after and assert it doesn't error. Catches "down script forgot to revert one of the up's actions." Cheap-ish, ~50 LoC of test code, adds ~30s to CI. Not blocking for the outage-prevention goal; nice-to-have.
-
-### 6.3 Scratch DB topology in CI
-
-Per mendel's design Slice 7 + this design: **Postgres service container** in the Gitea workflow YAML:
-
-```yaml
-services:
-  postgres:
-    image: postgres:16
-    env:
-      POSTGRES_PASSWORD: ci
-      POSTGRES_DB: paliad_scratch
-    options: >-
-      --health-cmd "pg_isready"
-      --health-interval 5s
-```
-
-The runner sees Postgres on `localhost:5432`. Each CI invocation gets a clean DB. No coupling to YouPC (per mendel's Q3 R-pick). No cleanup needed — the container dies with the job.
-
----
-
-## 7. Existing infra resource map
-
-Verified live (this session):
-
-### 7.1 mlake (Dokploy host, Docker Swarm active)
-
-- Docker version 29.3.0, Swarm `active`.
-- ~50 running containers (Dokploy services + 40+ compose projects).
-- Hosts paliad's `compose-transmit-multi-byte-driver-v7jth9` compose project (currently crash-looping).
-- Could host a Gitea Actions runner, but at risk of contention — paliad's CI Postgres + build would compete with everything else on the box.
-
-### 7.2 mriver (worker fleet, Tailscale-attached)
-
-- Runs the mai worker pool (cronus, brunel, hermes, dirac, mendel, …).
-- Hosts the aichat backend on `:8765`.
-- Has more idle CPU than mlake (workers spend most of their time waiting on `claude` API).
-- **R: register the Gitea Actions runner here.** Lower contention, same gitea reachability (Tailscale).
-
-### 7.3 mgit.msbls.de (Gitea)
-
-- Version 1.24.4, `has_actions: true` on `m/paliad` (verified).
-- `/admin/actions/runners` → 2 runners already registered (verified live: `curl /api/v1/admin/actions/runners | jq length` → `2`).
-- No workflow runs on `m/paliad` yet (verified: `workflow_runs:[], total_count:0`).
-- The actions infrastructure is fully present; paliad just hasn't authored a workflow YAML.
-
-### 7.4 youpc-supabase (paliad's prod DB)
-
-- Postgres on port 11833, paliad uses the `paliad` schema.
-- Out of scope for CI — CI uses its own ephemeral Postgres in the runner. Prod DB is touched ONLY by Dokploy's deploy step (post-CI-green).
-
----
-
-## 8. Slice plan — tracer-bullet roll-out
-
-Each slice is independently shippable. Slice A is the load-bearing one.
-
-### Slice A — Gitea Actions workflow + extended migration smoke (LOAD-BEARING)
-
-**Branch:** `mai/<coder>/cicd-slice-a-actions`
-
-**Files added:**
-- `.gitea/workflows/test.yml` — single workflow, fires on `push` to any branch.
-  - Jobs: `build`, `test-go`, `migration-coordination-check`.
-  - On `push` to `main`: additional `deploy` job that POSTs to Dokploy compose deploy API.
-- `internal/db/migrate_test.go` — extend with:
-  - `TestMigrations_EndToEndAsAppRole` (catches mig 129 ownership case).
-  - `TestMigrations_NoDuplicateSlot` (catches brunel slot collision).
-- `Makefile` — add `test-go`, `test-frontend`, `verify-migrations` targets. (mendel's design Slice 1 punted this; pull it in here so workers can repro the CI gate locally.)
-- `internal/handlers/health.go` — `/health/ready` endpoint (pool ping + 200/503). ~25 LoC.
-- Migration `132_*.up.sql` — IF the existing test exposes that we need to backfill role grants for some tables. Verify against prod schema before merging.
-
-**Files modified:**
-- `cmd/server/main.go` — register `/health/ready` handler.
-
-**Gitea-side action items (one-time, head or m runs):**
-1. Set `secrets.DOKPLOY_TOKEN` in the `m/paliad` repo secrets (Dokploy API token with deploy permission on the paliad compose).
-2. Verify ≥1 Gitea Actions runner is online and tagged appropriately (`ubuntu-latest` or a custom tag).
-3. Optionally: remove the Dokploy gitea-push webhook (so the only path to deploy is the workflow's deploy step). Discussed in Q11.4 below.
-
-**Catches:** All three of today's outages, plus future shape-/ownership-/duplicate-slot regressions.
-
-**Cost:** Small (one workflow YAML, two test functions, one Makefile, one health handler).
-
-### Slice B — Compose hardening (DEFENSE IN DEPTH)
-
-**Branch:** `mai/<coder>/cicd-slice-b-compose`
-
-**Files modified:**
-- `docker-compose.yml` — change `restart: unless-stopped` → `restart: on-failure:3`; add `healthcheck:` block targeting `/health/ready`.
-
-**Depends on:** Slice A (health endpoint must exist before the healthcheck can use it).
-
-**Catches:** Caps the crash-loop blast radius. Does not prevent outages — Slice A does that.
-
-**Cost:** Trivial (~10 lines).
-
-### Slice C — Frontend test wiring (OPTIONAL POLISH)
-
-**Branch:** `mai/<coder>/cicd-slice-c-frontend`
-
-**Files added/modified:**
-- `frontend/package.json` — add `"test": "bun test"` script.
-- `.gitea/workflows/test.yml` — add `test-frontend` job calling `cd frontend && bun test`.
-
-**Depends on:** Slice A (workflow exists).
-
-**Catches:** The 4 existing frontend tests run on every PR. Future bun:test additions (per mendel Slice 3) get exercised automatically.
-
-**Cost:** Trivial (~5 lines).
-
-### Slice D — mai-test post-merge shift (OPTIONAL POLISH)
-
-**Branch:** `mai/<coder>/cicd-slice-d-mai-test`
-
-**Wiring:** Gitea webhook on `m/paliad` "push to main" → notifies a queue → triggers a `mai-test` shift to run the broader smoke suite + post results as a Gitea commit status.
-
-**Depends on:** Slice A (CI green is a prerequisite for the deploy step which precedes the merge-to-main signal). Could land in parallel with Slice A.
-
-**Catches:** Integration issues between worker branches that pass CI individually but break on main. The post-merge layer is a follow-up safety net, not a gate.
-
-**Cost:** Small (config; `mai-test` skill already exists).
-
-### Slice E — Documentation (REQUIRED, lands with Slice A)
-
-**Branch:** combined with Slice A's branch.
-
-**Files modified:**
-- `docs/project-status.md` — note CI gate is live + how to interpret red CI.
-- `.claude/CLAUDE.md` — note that pushing to main now requires CI green; workers must verify their branch passes locally before pushing.
-- `docs/design-paliad-test-strategy-2026-05-19.md` — link to this doc; mark Slice 7 of mendel's design as implemented.
-
-**Catches:** Workers reading CLAUDE.md learn the new convention without head having to broadcast.
-
-### Slice ordering rationale
-
-- **Slice A ships first.** Until Slice A is on main, paliad has no CI gate; any merge to main can crash-loop the site. Slice A is single-PR-mergeable, doesn't touch the compose, and exercises only test code + a tiny handler addition.
-- **Slice B ships second** (same day if possible). Health-gated restart is meaningless without `/health/ready` (Slice A provides it). Once both land, the runtime safety net is in place.
-- **Slice C, D, E** are independent; they can land in any order after A.
-
----
-
-## 9. Risk + rollback
-
-| Risk | Mitigation | Rollback |
-|---|---|---|
-| CI workflow blocks legitimate emergency deploys | Slice A's `.gitea/workflows/test.yml` always passes for `[skip ci]` commits in head's emergency-deploy commits. Manually trigger Dokploy from the UI as a last resort. | Re-enable the gitea push webhook to Dokploy as a fallback path. |
-| Gitea Actions runner is overloaded / offline | mendel's Q2 R-pick prefers gitea actions; if the runner dies, deploys are blocked. Mitigation: register a second runner on mlake (passive) so one failure doesn't lock the queue. | Switch the workflow to a job-less `deploy: needs: nothing` step temporarily; restore after runner recovery. |
-| The end-to-end migration test against an ephemeral DB diverges from prod role grants in ways we don't anticipate | The CI role split is a model of prod, not a copy. Real divergence (e.g. role X granted privilege Y on table Z) will not be caught. | Slice B's runtime fail-cap prevents the crash-loop from running for hours; head triages. Update CI role grants when divergence is discovered. |
-| The Dokploy compose deploy API call signature is wrong | Verify against `mai-dokploy` skill docs + try one manual invocation before merging Slice A. | Re-enable the gitea push webhook as the deploy path; CI green is then advisory, not enforcing. |
-| Removing the gitea push webhook to Dokploy is a one-way door (re-enabling requires Dokploy UI action) | Don't remove the webhook in Slice A's PR. Keep both paths live during a "soft launch" period. Cut the webhook only after Slice A has gated 5+ green deploys. | Re-enable the webhook in the Dokploy UI (a single toggle). |
-
-### Online-during-failure invariant
-
-The design guarantees the site stays online iff **at least one of**:
-- CI catches the bad migration (smoke test, duplicate-slot, end-to-end role apply) before the deploy step runs. ← Primary, expected to catch all three known classes.
-- The healthcheck on the new container fails AND the old container hasn't been removed yet AND Traefik's `condition: service_healthy` is honored.
-
-The second path is fragile (Compose mode kills the old container before the new one is healthy — see §1.4). The design therefore relies on **CI being the gate**, with the compose changes as a residual safety net for unknown failure classes.
-
----
-
-## 10. Out of scope
-
-- **Multi-region / DR.** Not asked for; not implied.
-- **Database backup or rollback strategy.** m/paliad#77 Backup Mode covers backups. This design does not duplicate that work.
-- **Migrating off Dokploy.** Not asked for; explicitly excluded by m's constraint.
-- **A second Dokploy app or branch.** Explicitly excluded by m's constraint ("no .dev").
-- **Full E2E browser smoke (Playwright).** mendel's Slice 4 covers this; out of scope for outage-prevention. May land later as a Slice E follow-up to this design.
-- **Coverage % gating.** Per mendel Q4 — coverage as visibility, not as gate.
-- **mai-tester full E2E in CI.** Slice D mentions `mai-test` as a post-merge polish; the full browser fleet is its own design.
-- **Migrations that drop columns currently used by code.** Compile-time `go build` covers some of this; the broader question of "does the live frontend reference DB columns we just dropped" is mendel Slice 4 territory.
-
----
-
-## 11. Open questions for m
-
-Six picks. Recommended answers in **bold**. Mostly small, but each one shapes a real load-bearing choice. m can answer in one chip-round.
-
-### Q11.1 — Where does the Gitea Actions runner live?
-
-**A. (R) Register a new runner on mriver.**
-B. Use existing mlake runners.
-C. Spin up a dedicated mini-VM.
-
-mriver has idle cycles; mlake is contended. (A) is cheapest.
-
-### Q11.2 — How closely should CI's role split mirror prod?
-
-**A. (R) Two-role model (owner + app-connect) generic to Postgres.**
-B. Exact mirror — recreate the actual youpc-supabase role names + grants in CI.
-
-(A) catches today's `42501` class without coupling CI to youpc-supabase changes. (B) is brittle but exhaustive. Recommend (A) and tighten if a future outage slips through.
-
-### Q11.3 — How does the workflow call Dokploy?
-
-**A. (R) Direct API call via `mai-dokploy` skill conventions — token in `secrets.DOKPLOY_TOKEN`.**
-B. SSH to mlake and run `docker compose pull && up -d` directly from the runner.
-
-(A) keeps Dokploy as the single deploy authority. (B) bypasses Dokploy and removes its observability.
-
-### Q11.4 — Do we remove the existing gitea push → Dokploy webhook?
-
-**A. (R) Keep both paths live for one week of soft-launch; remove webhook once Slice A has gated ≥5 successful green deploys.**
-B. Remove immediately when Slice A lands.
-C. Keep both forever (CI as advisory, webhook as enforcing).
-
-(A) is the cautious rollout. (C) defeats the gate purpose.
-
-### Q11.5 — Backwards-compat for in-flight worker branches that don't yet have `.gitea/workflows/test.yml`?
-
-**A. (R) Slice A's workflow lives on `main`. Worker branches inherit when they merge from main. No backfill needed — feature branches that haven't merged from main yet just don't get CI until their next sync.**
-B. Force every worker to rebase onto Slice A's commit before pushing again.
-
-(A) is zero-coordination. (B) is paranoid.
-
-### Q11.6 — Should CI block on red gate-tier or warn only?
-
-**A. (R) Block.** Red gate-tier → no deploy. This is the entire point.
-B. Warn — surface red status, but let head override and deploy anyway.
-
-(A) is the brief. (B) recreates today's outages.
-
----
-
-## 12. Verification checklist (head to confirm before greenlighting)
-
-- [ ] Q1-Q6 picks above match head's read.
-- [ ] Q11.1-Q11.6 answered (chip round).
-- [ ] Slice A is sized for one coder shift (not multiple).
-- [ ] No Slice creates a second source of truth (single Dokploy compose `Zx147ycurfYagKRl_Zzyo` remains the only paliad deploy).
-- [ ] The `mai-dokploy` skill has a documented "deploy compose by ID" API call.
-- [ ] paliad.de current outage (mig 129) gets a manual recovery path (see Appendix A) — Slice A doesn't fix the live failure on its own; m or head must reset `paliad.applied_migrations` and grant ownership.
-
----
-
-## Appendix A — Recovering the live outage (mig 129)
-
-Independent of this design, the live paliad.de outage needs operator action:
-
-1. SSH to youpc-supabase Postgres as superuser.
-2. `GRANT OWNERSHIP OF paliad.project_event_choices TO <paliad-app-role>` (or whichever role does the connect).
-3. OR: hand-apply mig 129's body as superuser; `INSERT INTO paliad.applied_migrations(version, name, applied_at, checksum) VALUES (129, 'project_event_choices', now(), '<sha256 of file>')`.
-4. Restart `compose-transmit-multi-byte-driver-v7jth9`.
-5. Verify paliad.de returns 200.
-
-This recovery is OUT OF SCOPE for the design but is the immediate-action follow-up. mai head or m to handle when this design lands.
-
----
-
-## Appendix B — Why not Docker Swarm?
-
-m's constraint #3 explicitly excludes a `.dev` clone. Swarm's `deploy.update_config.failure_action: rollback` requires the deployment to be a Docker Swarm service (Dokploy "Application" type), which is a SECOND deployment surface alongside the existing "Compose" project. That's a duplicate Dokploy deployment in everything but name — exactly what m rejected.
-
-The Compose-mode workaround (the CI gate) achieves the same online-during-failure invariant with less infrastructure. It's the right trade-off for paliad's scale.
-
----
-
-## Appendix C — Today's restart count
-
-For posterity (one-shot snapshot from live mlake):
-
-```
-compose-transmit-multi-byte-driver-v7jth9-web-1
-  state: restarting
-  RestartCount: 14
-  restart policy: unless-stopped
-  health: <nil>     ← no healthcheck configured
-  last error: migration failed: apply 129_project_event_choices.up.sql:
-              exec sql: pq: must be owner of table project_event_choices (42501)
-```
-
-Slice A would have caught this at the worker's pre-push step (the same `go test ./...` would have surfaced the 42501 if the CI role split were modeled locally). Slice A's CI run would have caught it at the gitea push. Either gate prevents the deploy. The site stays online.

frontend/src/client/filter-bar/compute-effective.test.ts

@@ -0,0 +1,126 @@
+// Unit tests for the FilterBar's computeEffective() overlay. These pin
+// the contract that any chip the user clicks ends up as a predicate the
+// server can see — the t-paliad-283 regression had four sources picking
+// up zero narrowing for /views/any because the bar's chip click didn't
+// produce a non-empty `filter.predicates` for that source.
+//
+// Run with `bun test`.
+
+import { test, expect, describe } from "bun:test";
+import { computeEffective } from "./index";
+import type { FilterSpec, RenderSpec } from "../views/types";
+import type { BarState } from "./types";
+
+// Mirrors paliad.user_views row {slug: "any"} — the saved Custom View
+// that triggered the t-paliad-283 regression report.
+const ANY_VIEW_FILTER: FilterSpec = {
+  version: 1,
+  sources: ["deadline", "appointment", "project_event", "approval_request"],
+  scope: { projects: { mode: "all_visible" } },
+  time: { field: "auto", horizon: "past_30d" },
+};
+
+const ANY_VIEW_RENDER: RenderSpec = {
+  shape: "list",
+  list: { sort: "date_asc", density: "comfortable" },
+};
+
+describe("filter-bar/computeEffective — /views/any (all 4 sources)", () => {
+  test("empty state leaves base spec intact (no overlays)", () => {
+    const eff = computeEffective(ANY_VIEW_FILTER, ANY_VIEW_RENDER, {});
+    expect(eff.filter.sources).toEqual([
+      "deadline", "appointment", "project_event", "approval_request",
+    ]);
+    expect(eff.filter.time).toEqual({ field: "auto", horizon: "past_30d" });
+    // predicates may be {} (the bar zero-fills it) but never carries a
+    // stray narrowing on any source — that would silently filter
+    // results the user never asked to filter.
+    for (const src of ANY_VIEW_FILTER.sources) {
+      expect(eff.filter.predicates?.[src]).toBeUndefined();
+    }
+  });
+
+  test("deadline_status chip narrows deadline predicate", () => {
+    const state: BarState = { deadline_status: ["pending"] };
+    const eff = computeEffective(ANY_VIEW_FILTER, ANY_VIEW_RENDER, state);
+    expect(eff.filter.predicates?.deadline?.status).toEqual(["pending"]);
+  });
+
+  test("appointment_type chip narrows appointment predicate", () => {
+    const state: BarState = { appointment_type: ["hearing"] };
+    const eff = computeEffective(ANY_VIEW_FILTER, ANY_VIEW_RENDER, state);
+    expect(eff.filter.predicates?.appointment?.appointment_types).toEqual(["hearing"]);
+  });
+
+  test("approval_viewer_role chip narrows approval predicate", () => {
+    const state: BarState = { approval_viewer_role: "any_visible" };
+    const eff = computeEffective(ANY_VIEW_FILTER, ANY_VIEW_RENDER, state);
+    expect(eff.filter.predicates?.approval_request?.viewer_role).toBe("any_visible");
+  });
+
+  test("approval_status chip narrows approval predicate", () => {
+    const state: BarState = { approval_status: ["pending", "approved"] };
+    const eff = computeEffective(ANY_VIEW_FILTER, ANY_VIEW_RENDER, state);
+    expect(eff.filter.predicates?.approval_request?.status).toEqual(["pending", "approved"]);
+  });
+
+  test("approval_entity_type chip narrows approval predicate", () => {
+    const state: BarState = { approval_entity_type: ["deadline"] };
+    const eff = computeEffective(ANY_VIEW_FILTER, ANY_VIEW_RENDER, state);
+    expect(eff.filter.predicates?.approval_request?.entity_types).toEqual(["deadline"]);
+  });
+
+  test("project_event_kind chip narrows project_event predicate", () => {
+    const state: BarState = { project_event_kind: ["deadline_created"] };
+    const eff = computeEffective(ANY_VIEW_FILTER, ANY_VIEW_RENDER, state);
+    expect(eff.filter.predicates?.project_event?.event_types).toEqual(["deadline_created"]);
+  });
+
+  test("time chip overrides base horizon", () => {
+    const state: BarState = { time: { horizon: "past_7d" } };
+    const eff = computeEffective(ANY_VIEW_FILTER, ANY_VIEW_RENDER, state);
+    expect(eff.filter.time.horizon).toBe("past_7d");
+    expect(eff.filter.time.field).toBe("auto"); // preserved from base
+  });
+
+  test("personal_only chip flips scope flag", () => {
+    const state: BarState = { personal_only: true };
+    const eff = computeEffective(ANY_VIEW_FILTER, ANY_VIEW_RENDER, state);
+    expect(eff.filter.scope.personal_only).toBe(true);
+  });
+
+  test("multiple chips combine into the same effective spec", () => {
+    const state: BarState = {
+      time: { horizon: "past_7d" },
+      deadline_status: ["pending"],
+      appointment_type: ["hearing"],
+      approval_status: ["pending"],
+      project_event_kind: ["deadline_created"],
+    };
+    const eff = computeEffective(ANY_VIEW_FILTER, ANY_VIEW_RENDER, state);
+    expect(eff.filter.time.horizon).toBe("past_7d");
+    expect(eff.filter.predicates?.deadline?.status).toEqual(["pending"]);
+    expect(eff.filter.predicates?.appointment?.appointment_types).toEqual(["hearing"]);
+    expect(eff.filter.predicates?.approval_request?.status).toEqual(["pending"]);
+    expect(eff.filter.predicates?.project_event?.event_types).toEqual(["deadline_created"]);
+  });
+
+  test("overlay does not mutate the caller's base filter", () => {
+    const base: FilterSpec = JSON.parse(JSON.stringify(ANY_VIEW_FILTER));
+    const state: BarState = { deadline_status: ["pending"], time: { horizon: "past_7d" } };
+    computeEffective(base, ANY_VIEW_RENDER, state);
+    // The bar deep-clones; the base must come back unchanged so a
+    // second click doesn't compound the previous click's overlay.
+    expect(base).toEqual(ANY_VIEW_FILTER);
+  });
+
+  test("inbox-only axes do not affect a /views/any spec (no inbox axis exposed)", () => {
+    // /views/any's axes don't include unread_only or inbox_focus, so
+    // those keys never appear in state. Verify that even if they did,
+    // the bar's overlay doesn't silently mutate sources or predicates
+    // in a way that would break a 4-source Custom View.
+    const eff = computeEffective(ANY_VIEW_FILTER, ANY_VIEW_RENDER, {});
+    expect(eff.filter.sources).toHaveLength(4);
+    expect(eff.filter.unread_only ?? false).toBe(false);
+  });
+});

frontend/src/client/i18n.ts

@@ -1497,7 +1497,12 @@ const translations: Record<Lang, Record<string, string>> = {
     // t-paliad-277 — import-from-project + party-picker.
     "submissions.draft.import.button": "Aus Projekt importieren",
     "submissions.draft.parties.title": "Parteien",
-    "submissions.draft.parties.hint": "Wählen Sie aus, welche Parteien im Schriftsatz genannt werden sollen.",
+    "submissions.draft.parties.hint": "Wählen Sie die im Schriftsatz genannten Parteien oder fügen Sie pro Seite weitere hinzu.",
+    // t-paliad-276 — DE/EN language toggle on the draft editor.
+    "submissions.draft.language": "Sprache",
+    "submissions.draft.language.de": "DE",
+    "submissions.draft.language.en": "EN",
+    "submissions.draft.language.fallback_notice": "Fallback: universelles Skelett (keine sprachspezifische Vorlage).",
     // t-paliad-240 — global Schriftsätze drafts index page.
     "submissions.index.title": "Schriftsätze — Paliad",
     "submissions.index.heading": "Schriftsätze",
@@ -4566,11 +4571,16 @@ const translations: Record<Lang, Record<string, string>> = {
     "submissions.draft.switcher.label": "Draft",
     "submissions.draft.name.placeholder": "Name of this draft",
     "submissions.draft.preview.title": "Preview",
+    // t-paliad-276 — DE/EN language toggle on the draft editor.
+    "submissions.draft.language": "Language",
+    "submissions.draft.language.de": "DE",
+    "submissions.draft.language.en": "EN",
+    "submissions.draft.language.fallback_notice": "Fallback: universal skeleton (no language-matched template).",
     "submissions.draft.preview.hint": "Read-only preview — final formatting in Word.",
     // t-paliad-277 — import-from-project + party-picker.
     "submissions.draft.import.button": "Import from project",
     "submissions.draft.parties.title": "Parties",
-    "submissions.draft.parties.hint": "Select which parties to mention in this submission.",
+    "submissions.draft.parties.hint": "Pick the parties mentioned in this submission, or add more per side.",
     // t-paliad-240 — global submissions drafts index page.
     "submissions.index.title": "Submissions — Paliad",
     "submissions.index.heading": "Submissions",

frontend/src/client/submission-draft.ts

@@ -20,6 +20,9 @@ interface SubmissionDraftJSON {
   submission_code: string;
   user_id: string;
   name: string;
+  // t-paliad-276 — per-draft output language ("de" or "en"). Drives the
+  // template-variant lookup and language-aware variable resolution.
+  language: string;
   variables: Record<string, string>;
   selected_parties: string[];
   last_exported_at?: string | null;
@@ -56,6 +59,11 @@ interface SubmissionDraftView {
   has_template: boolean;
   template_missing?: boolean;
   available_parties: AvailablePartyJSON[];
+  // t-paliad-276 — template-tier metadata used to surface the
+  // "Fallback: universelles Skelett" notice when the requested draft
+  // language has no per-firm language-matched template.
+  template_tier?: string;
+  language_fallback?: boolean;
 }
 
 interface SubmissionDraftListResponse {
@@ -129,6 +137,13 @@ interface VariableGroup {
   id: string;
   label: VariableLabel;
   keys: string[];
+  // t-paliad-287 — render with a click-to-toggle disclosure caret; the
+  // initial state is collapsed iff collapsedByDefault. Used for the
+  // Frist section which lawyers rarely need to override (the variables
+  // stay resolvable in the bag for the few templates that still want
+  // them, but render no body content by default).
+  collapsible?: boolean;
+  collapsedByDefault?: boolean;
 }
 
 const VARIABLE_LABELS: Record<string, VariableLabel> = {
@@ -197,33 +212,19 @@ const VARIABLE_LABELS: Record<string, VariableLabel> = {
   "deadline.source":                 { de: "Frist-Quelle",                en: "Deadline source" },
 };
 
+// t-paliad-287 — variable groups restructured into four lawyer-facing
+// sections: Mandant/Verfahren up top (the case identity), then Parteien
+// (where the picker UI lives — this group only carries the manual
+// {{parties.*}} overrides for power-users), then Frist collapsed by
+// default (the deadline.* keys still resolve in the bag but the default
+// templates don't render them in the body any more), then Sonstiges for
+// the firm/date/user trim. The legacy procedural_event/rule namespaces
+// fold into Mandant/Verfahren so the lawyer reads them in their natural
+// context.
 const VARIABLE_GROUPS: VariableGroup[] = [
   {
-    id: "procedural_event",
-    label: { de: "Verfahrensschritt", en: "Procedural event" },
-    keys: [
-      "procedural_event.name",
-      "procedural_event.legal_source_pretty",
-      "procedural_event.primary_party",
-      "procedural_event.event_kind",
-      "procedural_event.code",
-    ],
-  },
-  {
-    id: "parties",
-    label: { de: "Mandanten & Parteien", en: "Clients & parties" },
-    keys: [
-      "parties.claimant.name",
-      "parties.claimant.representative",
-      "parties.defendant.name",
-      "parties.defendant.representative",
-      "parties.other.name",
-      "parties.other.representative",
-    ],
-  },
-  {
-    id: "project",
-    label: { de: "Verfahren", en: "Proceeding" },
+    id: "mandant_verfahren",
+    label: { de: "Mandant & Verfahren", en: "Client & proceeding" },
     keys: [
       "project.title",
       "project.case_number",
@@ -238,11 +239,43 @@ const VARIABLE_GROUPS: VariableGroup[] = [
       "project.matter_number",
       "project.reference",
       "project.instance_level",
+      "procedural_event.name",
+      "procedural_event.legal_source_pretty",
+      "procedural_event.primary_party",
+      "procedural_event.event_kind",
+      "procedural_event.code",
+    ],
+  },
+  {
+    id: "parties",
+    label: { de: "Parteien (Variablen)", en: "Parties (variables)" },
+    // Manual overrides for {{parties.<role>.*}} placeholders — power-
+    // user escape hatch when the lawyer wants the rendered string to
+    // differ from the picker selection (e.g. honourific prefix on
+    // representative). Collapsed by default because the picker above
+    // is the canonical surface; these rows exist only as a safety
+    // valve.
+    collapsible: true,
+    collapsedByDefault: true,
+    keys: [
+      "parties.claimant.name",
+      "parties.claimant.representative",
+      "parties.defendant.name",
+      "parties.defendant.representative",
+      "parties.other.name",
+      "parties.other.representative",
     ],
   },
   {
     id: "deadline",
-    label: { de: "Frist", en: "Deadline" },
+    label: { de: "Frist (intern)", en: "Deadline (internal)" },
+    // t-paliad-287 — the {{deadline.*}} placeholders no longer render
+    // in the default skeleton body (internal context that doesn't
+    // belong in a court-bound submission). The values still resolve
+    // here so a custom template can pick them up if needed; collapsed
+    // because most drafts never touch them.
+    collapsible: true,
+    collapsedByDefault: true,
     keys: [
       "deadline.due_date",
       "deadline.due_date_long_de",
@@ -253,10 +286,11 @@ const VARIABLE_GROUPS: VariableGroup[] = [
     ],
   },
   {
-    id: "firm",
-    label: { de: "Kanzlei & Datum", en: "Firm & date" },
+    id: "sonstiges",
+    label: { de: "Sonstiges", en: "Other" },
     keys: [
       "firm.name",
+      "firm.signature_block",
       "user.display_name",
       "user.email",
       "user.office",
@@ -283,6 +317,29 @@ interface State {
   saveTimer: number | null;
   pendingOverrides: Record<string, string> | null;
   inFlight: AbortController | null;
+  // t-paliad-287 — per-section collapse memory. Sticky across repaints
+  // so autosave (which calls paintVariables) doesn't snap an open
+  // section shut. Seeded lazily from VARIABLE_GROUPS.collapsedByDefault.
+  collapsedGroups: Record<string, boolean>;
+  // t-paliad-287 — which side the Add-Party panel is currently open for
+  // (one panel can be open at a time; clicking the other side's button
+  // toggles). null means closed.
+  addPartyOpen: PartySide | null;
+  addPartyMode: "manual" | "search";
+  addPartySearchHits: PartySearchHit[];
+  addPartyBusy: boolean;
+}
+
+type PartySide = "claimant" | "defendant" | "other";
+
+interface PartySearchHit {
+  id: string;
+  project_id: string;
+  project_title: string;
+  project_reference?: string | null;
+  name: string;
+  role?: string;
+  representative?: string;
 }
 
 const state: State = {
@@ -292,6 +349,11 @@ const state: State = {
   saveTimer: null,
   pendingOverrides: null,
   inFlight: null,
+  collapsedGroups: {},
+  addPartyOpen: null,
+  addPartyMode: "manual",
+  addPartySearchHits: [],
+  addPartyBusy: false,
 };
 
 // ─────────────────────────────────────────────────────────────────────
@@ -411,7 +473,7 @@ async function fetchGlobalView(draftID: string): Promise<SubmissionDraftView> {
   return resp.json();
 }
 
-async function patchDraft(payload: { name?: string; variables?: Record<string, string>; project_id?: string | null; selected_parties?: string[] }): Promise<SubmissionDraftView> {
+async function patchDraft(payload: { name?: string; variables?: Record<string, string>; project_id?: string | null; selected_parties?: string[]; language?: string }): Promise<SubmissionDraftView> {
   const p = state.parsed;
   if (!p.draftID) throw new Error("no draft id");
   if (state.inFlight) {
@@ -463,6 +525,8 @@ function paint(): void {
   paintNameRow();
   paintImportRow();
   paintPartyPicker();
+  paintLanguageRow();
+  paintLanguageFallback();
   paintVariables();
   paintPreview();
 }
@@ -597,24 +661,31 @@ function paintImportRow(): void {
   btn.onclick = () => { void onImportFromProject(btn); };
 }
 
-// t-paliad-277 — multi-select party picker. Lists every party on the
-// draft's project (view.available_parties), grouped by role, with one
-// checkbox per party. Checked = include in the variable bag. Empty
-// selection falls back to the legacy "include every party" default
-// (consistent with the migration default).
+// t-paliad-277 / t-paliad-287 — multi-select party picker plus Add-
+// Party affordance per side. Lists every party on the draft's project
+// (view.available_parties), grouped by role, with one checkbox per
+// party. Each side (Klägerseite / Beklagtenseite / Sonstige) carries
+// an "+ Partei hinzufügen" button that opens an inline panel with two
+// modes: manual entry (creates a fresh paliad.parties row) or DB
+// picker (searches every visible project, clones the row into THIS
+// project on selection). Empty selection still falls back to the
+// legacy "include every party" default.
 function paintPartyPicker(): void {
   const block = document.getElementById("submission-draft-parties");
   const list = document.getElementById("submission-draft-parties-list");
   if (!block || !list || !state.view) return;
 
-  const parties = state.view.available_parties ?? [];
-  if (!state.view.draft.project_id || parties.length === 0) {
+  // t-paliad-287 — picker is now shown even on empty-roster projects so
+  // the lawyer can use Add Party to populate. Still hidden when there
+  // is no project attached (no row to attach a party to).
+  if (!state.view.draft.project_id) {
     block.style.display = "none";
     list.innerHTML = "";
     return;
   }
   block.style.display = "";
 
+  const parties = state.view.available_parties ?? [];
   const selected = new Set(state.view.draft.selected_parties ?? []);
   // Empty selection is the implicit "all" default — pre-check every
   // party so the lawyer can see what's currently being mentioned and
@@ -627,9 +698,13 @@ function paintPartyPicker(): void {
   const grouped = groupPartiesByRole(parties);
   let html = "";
   for (const group of grouped) {
-    if (group.parties.length === 0) continue;
     html += `<fieldset class="submission-draft-parties-group" data-role-bucket="${group.bucket}">`;
     html += `<legend>${escapeHtml(group.label)}</legend>`;
+    if (group.parties.length === 0) {
+      html += `<p class="submission-draft-parties-empty">${escapeHtml(
+        isEN() ? "No parties yet." : "Noch keine Parteien.",
+      )}</p>`;
+    }
     for (const p of group.parties) {
       const checked = effective.has(p.id) ? " checked" : "";
       const chip = p.role
@@ -648,6 +723,7 @@ function paintPartyPicker(): void {
       html += rep;
       html += `</label>`;
     }
+    html += renderAddPartyControls(group.bucket);
     html += `</fieldset>`;
   }
   list.innerHTML = html;
@@ -655,6 +731,198 @@ function paintPartyPicker(): void {
   list.querySelectorAll<HTMLInputElement>(".submission-draft-party-check").forEach((inp) => {
     inp.addEventListener("change", () => onPartySelectionChange());
   });
+  wireAddPartyControls(list);
+}
+
+// renderAddPartyControls emits the per-side "+ Add party" button and
+// (when expanded) the inline panel offering manual entry OR DB search.
+// Sticky panel state lives in state.addPartyOpen so a repaint after
+// search-fetch / autosave / language-switch doesn't snap the panel
+// shut mid-edit.
+function renderAddPartyControls(side: PartySide): string {
+  const open = state.addPartyOpen === side;
+  const mode = state.addPartyMode;
+  const sideLabel = sideLabelFor(side);
+  const btnLabel = isEN()
+    ? `+ Add party (${sideLabel})`
+    : `+ Partei hinzufügen (${sideLabel})`;
+
+  let html = `<div class="submission-draft-addparty">`;
+  html += `<button type="button" class="btn-small btn-secondary submission-draft-addparty-toggle"`;
+  html += ` data-side="${side}" aria-expanded="${open ? "true" : "false"}">`;
+  html += escapeHtml(btnLabel);
+  html += `</button>`;
+
+  if (!open) {
+    html += `</div>`;
+    return html;
+  }
+
+  // Tabs — manual / search.
+  html += `<div class="submission-draft-addparty-panel">`;
+  html += `<div class="submission-draft-addparty-tabs" role="tablist">`;
+  html += `<button type="button" role="tab" class="submission-draft-addparty-tab`;
+  if (mode === "manual") html += ` submission-draft-addparty-tab--active`;
+  html += `" data-tab="manual" data-side="${side}" aria-selected="${mode === "manual"}">`;
+  html += escapeHtml(isEN() ? "Manual entry" : "Manuell");
+  html += `</button>`;
+  html += `<button type="button" role="tab" class="submission-draft-addparty-tab`;
+  if (mode === "search") html += ` submission-draft-addparty-tab--active`;
+  html += `" data-tab="search" data-side="${side}" aria-selected="${mode === "search"}">`;
+  html += escapeHtml(isEN() ? "From DB" : "Aus DB übernehmen");
+  html += `</button>`;
+  html += `</div>`;
+
+  if (mode === "manual") {
+    html += renderAddPartyManualForm(side);
+  } else {
+    html += renderAddPartySearchPanel(side);
+  }
+
+  html += `</div></div>`;
+  return html;
+}
+
+function renderAddPartyManualForm(side: PartySide): string {
+  const defaultRole = defaultRoleFor(side);
+  const busyCls = state.addPartyBusy ? " submission-draft-addparty-form--busy" : "";
+  let html = `<form class="submission-draft-addparty-form${busyCls}" data-side="${side}" data-mode="manual">`;
+  html += `<label class="submission-draft-addparty-field">`;
+  html += `<span>${escapeHtml(isEN() ? "Name" : "Name")}</span>`;
+  html += `<input type="text" name="name" required class="entity-form-input"`;
+  html += ` placeholder="${escapeHtml(isEN() ? "Acme Inc." : "z. B. Acme GmbH")}" />`;
+  html += `</label>`;
+  html += `<label class="submission-draft-addparty-field">`;
+  html += `<span>${escapeHtml(isEN() ? "Role" : "Rolle")}</span>`;
+  html += `<input type="text" name="role" class="entity-form-input"`;
+  html += ` value="${escapeHtml(defaultRole)}"`;
+  html += ` placeholder="${escapeHtml(isEN() ? "claimant / defendant / intervenor / …" : "Klägerin / Beklagte / Streithelferin / …")}" />`;
+  html += `</label>`;
+  html += `<label class="submission-draft-addparty-field">`;
+  html += `<span>${escapeHtml(isEN() ? "Representative (optional)" : "Vertreter:in (optional)")}</span>`;
+  html += `<input type="text" name="representative" class="entity-form-input"`;
+  html += ` placeholder="${escapeHtml(isEN() ? "Dr. Müller, …" : "RA Dr. Müller, …")}" />`;
+  html += `</label>`;
+  html += `<div class="submission-draft-addparty-actions">`;
+  html += `<button type="submit" class="btn-small btn-primary"${state.addPartyBusy ? " disabled" : ""}>`;
+  html += escapeHtml(isEN() ? "Add party" : "Hinzufügen");
+  html += `</button>`;
+  html += `<button type="button" class="btn-small btn-link submission-draft-addparty-cancel">`;
+  html += escapeHtml(isEN() ? "Cancel" : "Abbrechen");
+  html += `</button>`;
+  html += `</div>`;
+  html += `</form>`;
+  return html;
+}
+
+function renderAddPartySearchPanel(side: PartySide): string {
+  let html = `<div class="submission-draft-addparty-search" data-side="${side}" data-mode="search">`;
+  html += `<input type="search" class="entity-form-input submission-draft-addparty-search-input"`;
+  html += ` data-side="${side}"`;
+  html += ` placeholder="${escapeHtml(
+    isEN()
+      ? "Search across projects (name or representative)…"
+      : "In allen Projekten suchen (Name oder Vertreter)…",
+  )}" />`;
+  html += renderPartySearchResultsList();
+  html += `<p class="submission-draft-addparty-search-hint">${escapeHtml(
+    isEN()
+      ? "Picking a row clones it as a fresh party on this project — no typing."
+      : "Auswählen kopiert die Partei in dieses Projekt — kein erneutes Tippen.",
+  )}</p>`;
+  html += `<div class="submission-draft-addparty-actions">`;
+  html += `<button type="button" class="btn-small btn-link submission-draft-addparty-cancel">`;
+  html += escapeHtml(isEN() ? "Cancel" : "Abbrechen");
+  html += `</button>`;
+  html += `</div>`;
+  html += `</div>`;
+  return html;
+}
+
+function wireAddPartyControls(root: HTMLElement): void {
+  root.querySelectorAll<HTMLButtonElement>(".submission-draft-addparty-toggle").forEach((btn) => {
+    btn.addEventListener("click", () => {
+      const side = (btn.dataset.side as PartySide) ?? "other";
+      if (state.addPartyOpen === side) {
+        // Toggle off.
+        state.addPartyOpen = null;
+        state.addPartySearchHits = [];
+      } else {
+        state.addPartyOpen = side;
+        state.addPartyMode = "manual";
+        state.addPartySearchHits = [];
+      }
+      paintPartyPicker();
+    });
+  });
+  root.querySelectorAll<HTMLButtonElement>(".submission-draft-addparty-tab").forEach((btn) => {
+    btn.addEventListener("click", () => {
+      const tab = btn.dataset.tab;
+      if (tab !== "manual" && tab !== "search") return;
+      state.addPartyMode = tab;
+      if (tab === "manual") state.addPartySearchHits = [];
+      paintPartyPicker();
+      if (tab === "search") {
+        // Pre-load most-recent matches with empty query so the lawyer
+        // sees options without typing first.
+        void runPartySearch("");
+      }
+    });
+  });
+  root.querySelectorAll<HTMLButtonElement>(".submission-draft-addparty-cancel").forEach((btn) => {
+    btn.addEventListener("click", () => {
+      state.addPartyOpen = null;
+      state.addPartySearchHits = [];
+      paintPartyPicker();
+    });
+  });
+  root.querySelectorAll<HTMLFormElement>(".submission-draft-addparty-form").forEach((form) => {
+    form.addEventListener("submit", (ev) => {
+      ev.preventDefault();
+      const side = (form.dataset.side as PartySide) ?? "other";
+      const data = new FormData(form);
+      const name = String(data.get("name") ?? "").trim();
+      if (!name) return;
+      const role = String(data.get("role") ?? "").trim();
+      const representative = String(data.get("representative") ?? "").trim();
+      void onAddPartyManualSubmit(side, { name, role, representative });
+    });
+  });
+  root.querySelectorAll<HTMLInputElement>(".submission-draft-addparty-search-input").forEach((inp) => {
+    let timer: number | null = null;
+    inp.addEventListener("input", () => {
+      if (timer !== null) window.clearTimeout(timer);
+      timer = window.setTimeout(() => {
+        void runPartySearch(inp.value.trim());
+      }, 200);
+    });
+    // Pre-load on first render of the search tab.
+    if (state.addPartyMode === "search" && state.addPartySearchHits.length === 0) {
+      void runPartySearch("");
+    }
+  });
+  root.querySelectorAll<HTMLLIElement>(".submission-draft-addparty-search-row").forEach((li) => {
+    li.addEventListener("click", () => {
+      const hitID = li.dataset.hitId;
+      if (!hitID) return;
+      const hit = state.addPartySearchHits.find((h) => h.id === hitID);
+      if (!hit) return;
+      const side = state.addPartyOpen ?? "other";
+      void onAddPartySearchPick(side, hit);
+    });
+  });
+}
+
+function sideLabelFor(side: PartySide): string {
+  if (side === "claimant") return isEN() ? "Claimant side" : "Klägerseite";
+  if (side === "defendant") return isEN() ? "Defendant side" : "Beklagtenseite";
+  return isEN() ? "Other parties" : "Weitere Parteien";
+}
+
+function defaultRoleFor(side: PartySide): string {
+  if (side === "claimant") return isEN() ? "claimant" : "Klägerin";
+  if (side === "defendant") return isEN() ? "defendant" : "Beklagte";
+  return "";
 }
 
 interface PartyRoleGroup {
@@ -703,6 +971,64 @@ function formatStamp(iso: string): string {
   return d.toLocaleString(isEN() ? "en-GB" : "de-DE");
 }
 
+// paintLanguageRow syncs the DE/EN radio with the loaded draft's
+// language. Switching the radio fires onLanguageChange which PATCHes
+// the draft and lets the server return the freshly-resolved bag +
+// preview HTML (so the lawyer sees the EN form names appear without a
+// manual reload). t-paliad-276.
+function paintLanguageRow(): void {
+  if (!state.view) return;
+  const lang = (state.view.draft.language || "de").toLowerCase();
+  const de = document.getElementById("submission-draft-language-de") as HTMLInputElement | null;
+  const en = document.getElementById("submission-draft-language-en") as HTMLInputElement | null;
+  if (de) {
+    de.checked = lang === "de";
+    de.onchange = () => { void onLanguageChange("de"); };
+  }
+  if (en) {
+    en.checked = lang === "en";
+    en.onchange = () => { void onLanguageChange("en"); };
+  }
+}
+
+// paintLanguageFallback shows / hides the "no language-matched
+// template" notice. The server sets language_fallback=true when the
+// resolved template tier doesn't match the draft's language
+// (e.g. EN draft → DE per-code template, or no skeleton EN sibling).
+function paintLanguageFallback(): void {
+  const el = document.getElementById("submission-draft-language-fallback");
+  if (!el) return;
+  const fallback = !!state.view?.language_fallback;
+  el.style.display = fallback ? "" : "none";
+}
+
+async function onLanguageChange(lang: "de" | "en"): Promise<void> {
+  if (!state.view) return;
+  if ((state.view.draft.language || "de").toLowerCase() === lang) return;
+  setSaveStatus(isEN() ? "Saving…" : "Speichert…");
+  try {
+    const view = await patchDraft({ language: lang });
+    state.view = view;
+    // Repaint everything that depends on language: the DE/EN form
+    // values in the resolved bag, the localized rule name in the
+    // header, and the fallback notice.
+    paintHeader();
+    paintLanguageRow();
+    paintLanguageFallback();
+    paintVariables();
+    paintPreview();
+    setSaveStatus(isEN() ? "Saved" : "Gespeichert");
+  } catch (err) {
+    if ((err as Error).name === "AbortError") return;
+    console.error("submission-draft language switch:", err);
+    setSaveStatus(isEN() ? "Save failed" : "Speichern fehlgeschlagen", true);
+    // Revert the radio to the persisted value so the UI doesn't lie
+    // about which language is active.
+    paintLanguageRow();
+  }
+}
+
+
 function paintVariables(): void {
   const host = document.getElementById("submission-draft-variables");
   if (!host || !state.view) return;
@@ -713,8 +1039,27 @@ function paintVariables(): void {
   let html = "";
   for (const group of VARIABLE_GROUPS) {
     const groupLabel = isEN() ? group.label.en : group.label.de;
-    html += `<section class="submission-draft-var-group" data-group="${group.id}">`;
-    html += `<h3 class="submission-draft-var-group-title">${escapeHtml(groupLabel)}</h3>`;
+    // Re-use the user's prior toggle state across paintVariables calls
+    // (autosave / language switch trigger a repaint). Default sticky
+    // state lives in state.collapsedGroups; on first render the
+    // collapsedByDefault flag seeds it.
+    if (!Object.prototype.hasOwnProperty.call(state.collapsedGroups, group.id)) {
+      state.collapsedGroups[group.id] = !!(group.collapsible && group.collapsedByDefault);
+    }
+    const collapsed = !!state.collapsedGroups[group.id];
+    const collapsibleCls = group.collapsible ? " submission-draft-var-group--collapsible" : "";
+    const collapsedCls = collapsed ? " submission-draft-var-group--collapsed" : "";
+    html += `<section class="submission-draft-var-group${collapsibleCls}${collapsedCls}" data-group="${group.id}">`;
+    if (group.collapsible) {
+      html += `<button type="button" class="submission-draft-var-group-toggle"`;
+      html += ` data-toggle-group="${escapeHtml(group.id)}" aria-expanded="${collapsed ? "false" : "true"}">`;
+      html += `<span class="submission-draft-var-group-caret" aria-hidden="true">▸</span>`;
+      html += `<span class="submission-draft-var-group-title">${escapeHtml(groupLabel)}</span>`;
+      html += `</button>`;
+    } else {
+      html += `<h3 class="submission-draft-var-group-title">${escapeHtml(groupLabel)}</h3>`;
+    }
+    html += `<div class="submission-draft-var-group-body">`;
     for (const key of group.keys) {
       const label = labelFor(key);
       const override = overrides[key];
@@ -745,10 +1090,19 @@ function paintVariables(): void {
       // Visual hint: marker text appears in preview when override is "".
       void mergedVal;
     }
+    html += `</div>`;
     html += `</section>`;
   }
   host.innerHTML = html;
 
+  host.querySelectorAll<HTMLButtonElement>(".submission-draft-var-group-toggle").forEach((btn) => {
+    btn.addEventListener("click", () => {
+      const id = btn.dataset.toggleGroup;
+      if (!id) return;
+      state.collapsedGroups[id] = !state.collapsedGroups[id];
+      paintVariables();
+    });
+  });
   host.querySelectorAll<HTMLInputElement>(".submission-draft-var-input").forEach((inp) => {
     inp.addEventListener("input", () => onVarChange(inp));
     // t-paliad-274 (B) — focus into a sidebar field highlights every
@@ -953,6 +1307,175 @@ async function onPartySelectionChange(): Promise<void> {
   }
 }
 
+async function runPartySearch(query: string): Promise<void> {
+  try {
+    const params = new URLSearchParams();
+    if (query) params.set("q", query);
+    const resp = await fetch(`/api/parties/search?${params.toString()}`);
+    if (!resp.ok) throw new Error(`search ${resp.status}`);
+    const data = (await resp.json()) as { results: PartySearchHit[] };
+    // Filter out parties already on THIS project — picking one of them
+    // would be a no-op clone that doubles the row.
+    const existingIDs = new Set(
+      (state.view?.available_parties ?? []).map((p) => p.id),
+    );
+    state.addPartySearchHits = (data.results ?? []).filter((h) => !existingIDs.has(h.id));
+
+    // Refresh ONLY the results <ul> in place — repainting the whole
+    // picker would steal focus from the search input on every
+    // keystroke. The input keeps its value/selection and the lawyer
+    // can keep typing.
+    const ul = document.querySelector<HTMLUListElement>(
+      ".submission-draft-addparty-search-results",
+    );
+    if (ul) {
+      ul.outerHTML = renderPartySearchResultsList();
+      const fresh = document.querySelector<HTMLUListElement>(
+        ".submission-draft-addparty-search-results",
+      );
+      if (fresh) {
+        fresh.querySelectorAll<HTMLLIElement>(".submission-draft-addparty-search-row").forEach((li) => {
+          li.addEventListener("click", () => {
+            const hitID = li.dataset.hitId;
+            if (!hitID) return;
+            const hit = state.addPartySearchHits.find((h) => h.id === hitID);
+            if (!hit) return;
+            const side = state.addPartyOpen ?? "other";
+            void onAddPartySearchPick(side, hit);
+          });
+        });
+      }
+    } else {
+      // First load (panel just opened) — full picker paint to wire up
+      // every control. Subsequent keystroke updates take the cheaper
+      // path above.
+      paintPartyPicker();
+    }
+  } catch (err) {
+    console.error("submission-draft party-search:", err);
+  }
+}
+
+function renderPartySearchResultsList(): string {
+  let html = `<ul class="submission-draft-addparty-search-results">`;
+  if (state.addPartySearchHits.length === 0) {
+    html += `<li class="submission-draft-addparty-search-empty">${escapeHtml(
+      isEN() ? "No matches." : "Keine Treffer.",
+    )}</li>`;
+  } else {
+    for (const hit of state.addPartySearchHits) {
+      const ref = hit.project_reference
+        ? `<span class="submission-draft-addparty-search-projref">${escapeHtml(hit.project_reference)}</span>`
+        : "";
+      const role = hit.role
+        ? `<span class="submission-draft-party-chip">${escapeHtml(hit.role)}</span>`
+        : "";
+      const rep = hit.representative
+        ? `<span class="submission-draft-addparty-search-rep">${escapeHtml(
+            (isEN() ? "Repr.: " : "Vertr.: ") + hit.representative,
+          )}</span>`
+        : "";
+      html += `<li class="submission-draft-addparty-search-row" data-hit-id="${escapeHtml(hit.id)}">`;
+      html += `<span class="submission-draft-addparty-search-name">${escapeHtml(hit.name)}</span>`;
+      html += role;
+      html += rep;
+      html += `<span class="submission-draft-addparty-search-projwrap">`;
+      html += escapeHtml(isEN() ? "Project: " : "Projekt: ");
+      html += `<span class="submission-draft-addparty-search-proj">${escapeHtml(hit.project_title)}</span>`;
+      html += ref;
+      html += `</span>`;
+      html += `</li>`;
+    }
+  }
+  html += `</ul>`;
+  return html;
+}
+
+async function onAddPartyManualSubmit(
+  side: PartySide,
+  payload: { name: string; role: string; representative: string },
+): Promise<void> {
+  if (!state.view) return;
+  const projectID = state.view.draft.project_id;
+  if (!projectID) return;
+  // Disable the submit button in-place rather than repainting the form
+  // mid-flight (a repaint would blow away the lawyer's typed values on
+  // error and reset focus). The post-success/-error repaint runs once
+  // the call settles.
+  const submitBtn = document.querySelector<HTMLButtonElement>(
+    `.submission-draft-addparty-form[data-side="${side}"] button[type="submit"]`,
+  );
+  if (submitBtn) submitBtn.disabled = true;
+  state.addPartyBusy = true;
+  try {
+    const body: Record<string, unknown> = { name: payload.name };
+    if (payload.role) body.role = payload.role;
+    if (payload.representative) body.representative = payload.representative;
+    const resp = await fetch(`/api/projects/${projectID}/parties`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    });
+    if (!resp.ok) throw new Error(`create party ${resp.status}`);
+    const created = (await resp.json()) as { id: string };
+    await refreshDraftViewAndSelect(created.id);
+    state.addPartyOpen = null;
+    setSaveStatus(isEN() ? "Party added" : "Partei hinzugefügt");
+    state.addPartyBusy = false;
+    paintPartyPicker();
+  } catch (err) {
+    console.error("submission-draft add-party manual:", err);
+    setSaveStatus(isEN() ? "Add party failed" : "Hinzufügen fehlgeschlagen", true);
+    if (submitBtn) submitBtn.disabled = false;
+    state.addPartyBusy = false;
+  }
+}
+
+async function onAddPartySearchPick(side: PartySide, hit: PartySearchHit): Promise<void> {
+  // DB picks clone the row into the current project — the simplest
+  // semantics that survive paliad.parties' project_id-NOT-NULL schema.
+  // The lawyer asked for "no manual re-typing"; this honours that
+  // without bending the data model.
+  await onAddPartyManualSubmit(side, {
+    name: hit.name,
+    role: hit.role ?? defaultRoleFor(side),
+    representative: hit.representative ?? "",
+  });
+}
+
+// refreshDraftViewAndSelect refetches the editor payload (so
+// available_parties picks up the new row) and ensures the newly-added
+// party is checked in selected_parties. If the lawyer was on the
+// implicit-all default (empty selected_parties), the new party comes
+// in pre-selected via the "empty=all" rule and no PATCH is needed.
+async function refreshDraftViewAndSelect(newPartyID: string): Promise<void> {
+  if (!state.view) return;
+  const draftID = state.view.draft.id;
+  const view = state.view.draft.project_id
+    ? await fetchView(state.view.draft.project_id, state.view.draft.submission_code, draftID)
+    : await fetchGlobalView(draftID);
+  state.view = view;
+
+  // If the previous draft had a non-empty selected_parties subset,
+  // explicitly add the new party so it isn't silently dropped from the
+  // submission. Empty selected_parties = "all" → no PATCH needed.
+  const currentSel = state.view.draft.selected_parties ?? [];
+  if (currentSel.length > 0 && !currentSel.includes(newPartyID)) {
+    const next = [...currentSel, newPartyID];
+    try {
+      const patched = await patchDraft({ selected_parties: next });
+      state.view = patched;
+    } catch (err) {
+      console.error("submission-draft select new party:", err);
+    }
+  }
+
+  paintImportRow();
+  paintPartyPicker();
+  paintVariables();
+  paintPreview();
+}
+
 async function onImportFromProject(btn: HTMLButtonElement): Promise<void> {
   if (!state.view) return;
   const draftID = state.view.draft.id;

frontend/src/client/views/types.ts

@@ -66,7 +66,13 @@ export interface FilterSpec {
   sources: DataSource[];
   scope: ScopeSpec;
   time: TimeSpec;
-  predicates?: Partial<Record<DataSource, Predicates>>;
+  // Per-source narrowing. Flat shape — one entry per data source. The
+  // Go side (internal/services/filter_spec.go: FilterSpec.Predicates)
+  // mirrors this exactly; the previous Partial<Record<DataSource,
+  // Predicates>> spelling was a latent contract bug (t-paliad-283)
+  // where every chip click sent a single-nested shape the server
+  // unmarshalled to no-op.
+  predicates?: Predicates;
   // Inbox unread-only overlay (t-paliad-249). When true, the view
   // service drops project_event rows older than the caller's
   // users.inbox_seen_at cursor. Pending approval_requests always

frontend/src/i18n-keys.ts

@@ -2620,6 +2620,10 @@ export type I18nKey =
   | "submissions.draft.action.new"
   | "submissions.draft.back"
   | "submissions.draft.import.button"
+  | "submissions.draft.language"
+  | "submissions.draft.language.de"
+  | "submissions.draft.language.en"
+  | "submissions.draft.language.fallback_notice"
   | "submissions.draft.loading"
   | "submissions.draft.name.placeholder"
   | "submissions.draft.notfound"

frontend/src/styles/global.css

@@ -5954,6 +5954,40 @@ dialog.modal::backdrop {
     color: var(--color-danger, #c00);
 }
 
+/* t-paliad-276 — DE/EN language toggle on the draft editor. Same look
+   as the rest of the sidebar mini-controls; muted label + inline radios
+   so it doesn't compete with the editor's primary inputs. */
+.submission-draft-language-row {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    margin: 0.25rem 0 0.5rem 0;
+    font-size: 0.9em;
+}
+
+.submission-draft-language-label {
+    color: var(--color-text-muted);
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    font-size: 0.85em;
+}
+
+.submission-draft-language-option {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.25rem;
+    cursor: pointer;
+}
+
+.submission-draft-language-fallback {
+    font-size: 0.85em;
+    color: var(--color-text-muted);
+    margin: 0 0 0.5rem 0;
+    padding: 0.4rem 0.6rem;
+    border-left: 2px solid var(--color-warning, #d4a017);
+    background: var(--color-warning-bg, rgba(212, 160, 23, 0.08));
+}
+
 .submission-draft-variables {
     display: flex;
     flex-direction: column;
@@ -6342,6 +6376,194 @@ dialog.modal::backdrop {
     margin-left: 0.25rem;
 }
 
+/* t-paliad-287 — collapsible variable-group section (Frist + Parteien
+   override). The toggle button is the section header; clicking it
+   flips state.collapsedGroups[id] and re-renders. The visible caret
+   rotates via the parent's --collapsed class. */
+.submission-draft-var-group--collapsible > .submission-draft-var-group-toggle {
+    all: unset;
+    display: flex;
+    align-items: center;
+    gap: 0.4rem;
+    width: 100%;
+    padding: 0;
+    margin: 0 0 0.5rem 0;
+    cursor: pointer;
+    color: var(--color-text-muted);
+}
+
+.submission-draft-var-group--collapsible > .submission-draft-var-group-toggle:focus-visible {
+    outline: 2px solid var(--color-accent, #c6f41c);
+    outline-offset: 2px;
+}
+
+.submission-draft-var-group-caret {
+    display: inline-block;
+    transition: transform 120ms ease;
+    font-size: 0.85em;
+    line-height: 1;
+}
+
+.submission-draft-var-group--collapsible:not(.submission-draft-var-group--collapsed)
+    .submission-draft-var-group-caret {
+    transform: rotate(90deg);
+}
+
+.submission-draft-var-group--collapsed .submission-draft-var-group-body {
+    display: none;
+}
+
+/* t-paliad-287 — Add Party affordance per side. */
+.submission-draft-addparty {
+    margin-top: 0.5rem;
+    display: flex;
+    flex-direction: column;
+    gap: 0.4rem;
+}
+
+.submission-draft-addparty-panel {
+    border: 1px solid var(--color-border);
+    border-radius: 6px;
+    padding: 0.6rem;
+    background: var(--color-surface-alt, #f7f7f0);
+    display: flex;
+    flex-direction: column;
+    gap: 0.5rem;
+}
+
+.submission-draft-addparty-tabs {
+    display: flex;
+    gap: 0.25rem;
+    border-bottom: 1px solid var(--color-border);
+    margin-bottom: 0.25rem;
+}
+
+.submission-draft-addparty-tab {
+    all: unset;
+    cursor: pointer;
+    padding: 0.3rem 0.6rem;
+    font-size: 0.85em;
+    border-radius: 4px 4px 0 0;
+    color: var(--color-text-muted);
+    border-bottom: 2px solid transparent;
+}
+
+.submission-draft-addparty-tab--active {
+    color: var(--color-text);
+    border-bottom-color: var(--color-accent, #c6f41c);
+    background: var(--color-bg-lime-tint, #f0fac6);
+}
+
+.submission-draft-addparty-form {
+    display: flex;
+    flex-direction: column;
+    gap: 0.45rem;
+}
+
+.submission-draft-addparty-form--busy {
+    opacity: 0.6;
+    pointer-events: none;
+}
+
+.submission-draft-addparty-field {
+    display: flex;
+    flex-direction: column;
+    gap: 0.2rem;
+}
+
+.submission-draft-addparty-field > span {
+    font-size: 0.82em;
+    color: var(--color-text-muted);
+}
+
+.submission-draft-addparty-actions {
+    display: flex;
+    gap: 0.4rem;
+    align-items: center;
+}
+
+.submission-draft-addparty-search {
+    display: flex;
+    flex-direction: column;
+    gap: 0.4rem;
+}
+
+.submission-draft-addparty-search-results {
+    list-style: none;
+    padding: 0;
+    margin: 0;
+    max-height: 14rem;
+    overflow-y: auto;
+    border: 1px solid var(--color-border);
+    border-radius: 4px;
+    background: var(--color-surface, #fff);
+}
+
+.submission-draft-addparty-search-row {
+    padding: 0.45rem 0.6rem;
+    border-bottom: 1px solid var(--color-border);
+    cursor: pointer;
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.4rem;
+    align-items: center;
+}
+
+.submission-draft-addparty-search-row:last-child {
+    border-bottom: none;
+}
+
+.submission-draft-addparty-search-row:hover {
+    background: var(--color-bg-lime-tint, #f0fac6);
+}
+
+.submission-draft-addparty-search-empty {
+    padding: 0.6rem;
+    font-size: 0.85em;
+    color: var(--color-text-muted);
+    text-align: center;
+}
+
+.submission-draft-addparty-search-name {
+    font-weight: 500;
+    color: var(--color-text);
+}
+
+.submission-draft-addparty-search-rep {
+    font-size: 0.78em;
+    color: var(--color-text-muted);
+}
+
+.submission-draft-addparty-search-projwrap {
+    font-size: 0.78em;
+    color: var(--color-text-muted);
+    width: 100%;
+}
+
+.submission-draft-addparty-search-proj {
+    color: var(--color-text);
+}
+
+.submission-draft-addparty-search-projref {
+    margin-left: 0.3rem;
+    padding: 0 0.4em;
+    border-radius: 3px;
+    background: var(--color-surface-alt, #f7f7f0);
+    color: var(--color-text-muted);
+}
+
+.submission-draft-addparty-search-hint {
+    font-size: 0.78em;
+    color: var(--color-text-muted);
+    margin: 0;
+}
+
+.submission-draft-parties-empty {
+    font-size: 0.82em;
+    color: var(--color-text-muted);
+    margin: 0.2rem 0;
+}
+
 .checklist-instance-actions {
     display: flex;
     gap: 0.35rem;

frontend/src/submission-draft.tsx

@@ -109,6 +109,47 @@ export function renderSubmissionDraft(): string {
                       </button>
                     </div>
 
+                    {/* t-paliad-276 — output language toggle (DE/EN).
+                        Hydrated by client/submission-draft.ts; switching
+                        autosaves the draft and re-renders the preview. */}
+                    <div
+                      className="submission-draft-language-row"
+                      id="submission-draft-language-row"
+                      role="radiogroup"
+                      aria-labelledby="submission-draft-language-label">
+                      <span
+                        id="submission-draft-language-label"
+                        className="submission-draft-language-label"
+                        data-i18n="submissions.draft.language">
+                        Sprache
+                      </span>
+                      <label className="submission-draft-language-option">
+                        <input
+                          type="radio"
+                          name="submission-draft-language"
+                          value="de"
+                          id="submission-draft-language-de"
+                        />
+                        <span data-i18n="submissions.draft.language.de">DE</span>
+                      </label>
+                      <label className="submission-draft-language-option">
+                        <input
+                          type="radio"
+                          name="submission-draft-language"
+                          value="en"
+                          id="submission-draft-language-en"
+                        />
+                        <span data-i18n="submissions.draft.language.en">EN</span>
+                      </label>
+                    </div>
+                    <p
+                      className="submission-draft-language-fallback"
+                      id="submission-draft-language-fallback"
+                      style="display:none"
+                      data-i18n="submissions.draft.language.fallback_notice">
+                      Fallback: universelles Skelett (keine sprachspezifische Vorlage).
+                    </p>
+
                     <p className="submission-draft-savestatus" id="submission-draft-savestatus" />
 
                     {/* t-paliad-277: "Aus Projekt importieren" + last-
@@ -131,10 +172,13 @@ export function renderSubmissionDraft(): string {
                       />
                     </div>
 
-                    {/* t-paliad-277: multi-select party picker.
+                    {/* t-paliad-277 / t-paliad-287: multi-select party
+                        picker plus per-side Add-Party affordance.
                         Populated from view.available_parties; checkbox
                         per party, grouped by role. Hidden when no
-                        project or no parties on the project. */}
+                        project is attached; visible even on empty
+                        rosters so the lawyer can use Add Party to
+                        populate. */}
                     <div
                       id="submission-draft-parties"
                       className="submission-draft-parties"

internal/db/migrate_test.go

@@ -116,6 +116,57 @@ func TestMigrations_DryRun(t *testing.T) {
 	}
 }
 
+// TestMigrations_NoDuplicateSlot is a free-standing pre-flight check that
+// scanEmbeddedMigrations refuses to walk a tree where two *.up.sql files
+// claim the same NNN slot. This is the brunel-slot-collision class of
+// outage (m/paliad#114, 2026-05-25 ~13:20): a worker writes a migration
+// at slot N while another shipped slot N from a separate branch, both
+// merge, both end up in the embed.FS, and the runner refuses to start.
+//
+// Catching this at CI time (no DB needed) lets the second PR fail before
+// it merges, instead of breaking prod at the next deploy. Pure unit test;
+// runs even on developer laptops that don't set TEST_DATABASE_URL.
+func TestMigrations_NoDuplicateSlot(t *testing.T) {
+	if _, err := scanEmbeddedMigrations(); err != nil {
+		t.Fatalf("scanEmbeddedMigrations: %v "+
+			"(two migrations share the same NNN slot — coordinate with head "+
+			"and rename one of them before merging)", err)
+	}
+}
+
+// TestMigrations_EndToEndAsAppRole applies every embedded migration in
+// numeric order against a scratch DB connected as a NON-SUPERUSER role.
+// This is the prod-shape smoke that the per-mig BEGIN/ROLLBACK dry-run
+// (TestMigrations_DryRun) cannot deliver: the dry-run runs each
+// statement in isolation and rolls back, so it cannot reproduce the
+// mig-129-class outage (m/paliad#114, 2026-05-25 ~14:56 — pq: must be
+// owner of table project_event_choices, SQLSTATE 42501) where a
+// migration assumes ownership the deploy role doesn't have.
+//
+// Requires TEST_APP_DATABASE_URL — a Postgres URL whose role is NOT a
+// superuser and does NOT own the `paliad` schema (m's Q11.2 pick:
+// generic two-role model, see docs/design-cicd-pre-deploy-gate-2026-05-25.md
+// §6.2(a)). The CI workflow creates the role + schema split before
+// invoking the test; a developer who wants to reproduce the gate locally
+// runs the same SQL preamble (see Makefile target `verify-migrations`).
+//
+// Skipped without TEST_APP_DATABASE_URL — keeps `go test ./...` green
+// on machines that haven't set up the role split.
+func TestMigrations_EndToEndAsAppRole(t *testing.T) {
+	url := os.Getenv("TEST_APP_DATABASE_URL")
+	if url == "" {
+		t.Skip("TEST_APP_DATABASE_URL not set — skipping role-split end-to-end migration smoke")
+	}
+	if err := ApplyMigrations(url); err != nil {
+		t.Fatalf("ApplyMigrations as app role failed: %v "+
+			"(a migration assumes more privilege than the deploy role has — "+
+			"common cases: ALTER TABLE on a schema-owner table, CREATE EXTENSION "+
+			"without grants, SET ROLE without permission. Fix the migration to "+
+			"work as the deploy role, or arrange for the schema to be owned by "+
+			"the deploy role)", err)
+	}
+}
+
 // readAppliedVersions returns the set of versions present in
 // paliad.applied_migrations on the scratch DB. Missing table → empty set
 // (fresh-DB path; the table only exists after the runner has been called).

internal/db/migrations/024_rename_department_columns.up.sql

@@ -26,24 +26,24 @@ DO $$ BEGIN ALTER TABLE paliad.department_members RENAME COLUMN dezernat_id TO d
 -- Constraints (primary key + foreign keys + check). Renaming a pkey
 -- constraint also renames the underlying index of the same name.
 -- ---------------------------------------------------------------------------
-DO $$ BEGIN ALTER TABLE paliad.departments        RENAME CONSTRAINT dezernate_pkey                          TO departments_pkey;                       EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER TABLE paliad.departments        RENAME CONSTRAINT dezernate_lead_user_id_fkey             TO departments_lead_user_id_fkey;          EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER TABLE paliad.departments        RENAME CONSTRAINT dezernate_office_check                  TO departments_office_check;               EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER TABLE paliad.department_members RENAME CONSTRAINT dezernat_mitglieder_pkey                 TO department_members_pkey;                EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER TABLE paliad.department_members RENAME CONSTRAINT dezernat_mitglieder_dezernat_id_fkey     TO department_members_department_id_fkey;  EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER TABLE paliad.department_members RENAME CONSTRAINT dezernat_mitglieder_user_id_fkey         TO department_members_user_id_fkey;        EXCEPTION WHEN undefined_object THEN NULL; END $$;
+DO $$ BEGIN ALTER TABLE paliad.departments        RENAME CONSTRAINT dezernate_pkey                          TO departments_pkey;                       EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER TABLE paliad.departments        RENAME CONSTRAINT dezernate_lead_user_id_fkey             TO departments_lead_user_id_fkey;          EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER TABLE paliad.departments        RENAME CONSTRAINT dezernate_office_check                  TO departments_office_check;               EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER TABLE paliad.department_members RENAME CONSTRAINT dezernat_mitglieder_pkey                 TO department_members_pkey;                EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER TABLE paliad.department_members RENAME CONSTRAINT dezernat_mitglieder_dezernat_id_fkey     TO department_members_department_id_fkey;  EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER TABLE paliad.department_members RENAME CONSTRAINT dezernat_mitglieder_user_id_fkey         TO department_members_user_id_fkey;        EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
 
 -- ---------------------------------------------------------------------------
 -- Standalone indexes (non-pkey).
 -- ---------------------------------------------------------------------------
-DO $$ BEGIN ALTER INDEX paliad.dezernate_office_idx           RENAME TO departments_office_idx;        EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER INDEX paliad.dezernate_lead_idx             RENAME TO departments_lead_idx;          EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER INDEX paliad.dezernat_mitglieder_user_idx   RENAME TO department_members_user_idx;   EXCEPTION WHEN undefined_object THEN NULL; END $$;
+DO $$ BEGIN ALTER INDEX paliad.dezernate_office_idx           RENAME TO departments_office_idx;        EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER INDEX paliad.dezernate_lead_idx             RENAME TO departments_lead_idx;          EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER INDEX paliad.dezernat_mitglieder_user_idx   RENAME TO department_members_user_idx;   EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
 
 -- ---------------------------------------------------------------------------
 -- RLS policies
 -- ---------------------------------------------------------------------------
-DO $$ BEGIN ALTER POLICY dezernate_select           ON paliad.departments        RENAME TO departments_select;        EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER POLICY dezernate_write            ON paliad.departments        RENAME TO departments_write;         EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER POLICY dezernat_mitglieder_select ON paliad.department_members RENAME TO department_members_select; EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER POLICY dezernat_mitglieder_write  ON paliad.department_members RENAME TO department_members_write;  EXCEPTION WHEN undefined_object THEN NULL; END $$;
+DO $$ BEGIN ALTER POLICY dezernate_select           ON paliad.departments        RENAME TO departments_select;        EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER POLICY dezernate_write            ON paliad.departments        RENAME TO departments_write;         EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER POLICY dezernat_mitglieder_select ON paliad.department_members RENAME TO department_members_select; EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER POLICY dezernat_mitglieder_write  ON paliad.department_members RENAME TO department_members_write;  EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;

internal/db/migrations/027_rename_to_partner_units.up.sql

@@ -63,27 +63,27 @@ ALTER TABLE paliad.partner_unit_members RENAME COLUMN department_id TO partner_u
 -- 5. Rename constraints. Postgres auto-renames the underlying index for
 --    pkey/uniq constraints; standalone indexes are renamed in step 6.
 -- ---------------------------------------------------------------------------
-DO $$ BEGIN ALTER TABLE paliad.partner_units        RENAME CONSTRAINT departments_pkey                       TO partner_units_pkey;                             EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER TABLE paliad.partner_units        RENAME CONSTRAINT departments_lead_user_id_fkey          TO partner_units_lead_user_id_fkey;                EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER TABLE paliad.partner_units        RENAME CONSTRAINT departments_office_check               TO partner_units_office_check;                     EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER TABLE paliad.partner_unit_members RENAME CONSTRAINT department_members_pkey                TO partner_unit_members_pkey;                      EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER TABLE paliad.partner_unit_members RENAME CONSTRAINT department_members_department_id_fkey  TO partner_unit_members_partner_unit_id_fkey;      EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER TABLE paliad.partner_unit_members RENAME CONSTRAINT department_members_user_id_fkey        TO partner_unit_members_user_id_fkey;              EXCEPTION WHEN undefined_object THEN NULL; END $$;
+DO $$ BEGIN ALTER TABLE paliad.partner_units        RENAME CONSTRAINT departments_pkey                       TO partner_units_pkey;                             EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER TABLE paliad.partner_units        RENAME CONSTRAINT departments_lead_user_id_fkey          TO partner_units_lead_user_id_fkey;                EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER TABLE paliad.partner_units        RENAME CONSTRAINT departments_office_check               TO partner_units_office_check;                     EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER TABLE paliad.partner_unit_members RENAME CONSTRAINT department_members_pkey                TO partner_unit_members_pkey;                      EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER TABLE paliad.partner_unit_members RENAME CONSTRAINT department_members_department_id_fkey  TO partner_unit_members_partner_unit_id_fkey;      EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER TABLE paliad.partner_unit_members RENAME CONSTRAINT department_members_user_id_fkey        TO partner_unit_members_user_id_fkey;              EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
 
 -- ---------------------------------------------------------------------------
 -- 6. Rename non-pkey indexes.
 -- ---------------------------------------------------------------------------
-DO $$ BEGIN ALTER INDEX paliad.departments_office_idx        RENAME TO partner_units_office_idx;        EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER INDEX paliad.departments_lead_idx          RENAME TO partner_units_lead_idx;          EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER INDEX paliad.department_members_user_idx   RENAME TO partner_unit_members_user_idx;   EXCEPTION WHEN undefined_object THEN NULL; END $$;
+DO $$ BEGIN ALTER INDEX paliad.departments_office_idx        RENAME TO partner_units_office_idx;        EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER INDEX paliad.departments_lead_idx          RENAME TO partner_units_lead_idx;          EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER INDEX paliad.department_members_user_idx   RENAME TO partner_unit_members_user_idx;   EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
 
 -- ---------------------------------------------------------------------------
 -- 7. Rename RLS policies.
 -- ---------------------------------------------------------------------------
-DO $$ BEGIN ALTER POLICY departments_select        ON paliad.partner_units        RENAME TO partner_units_select;        EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER POLICY departments_write         ON paliad.partner_units        RENAME TO partner_units_write;         EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER POLICY department_members_select ON paliad.partner_unit_members RENAME TO partner_unit_members_select; EXCEPTION WHEN undefined_object THEN NULL; END $$;
-DO $$ BEGIN ALTER POLICY department_members_write  ON paliad.partner_unit_members RENAME TO partner_unit_members_write;  EXCEPTION WHEN undefined_object THEN NULL; END $$;
+DO $$ BEGIN ALTER POLICY departments_select        ON paliad.partner_units        RENAME TO partner_units_select;        EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER POLICY departments_write         ON paliad.partner_units        RENAME TO partner_units_write;         EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER POLICY department_members_select ON paliad.partner_unit_members RENAME TO partner_unit_members_select; EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
+DO $$ BEGIN ALTER POLICY department_members_write  ON paliad.partner_unit_members RENAME TO partner_unit_members_write;  EXCEPTION WHEN undefined_object OR undefined_table OR duplicate_object THEN NULL; END $$;
 
 -- ---------------------------------------------------------------------------
 -- 8. Audit table for partner-unit events. Mutations on partner_units +

internal/db/migrations/130_submission_drafts_language.down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE paliad.submission_drafts
+    DROP COLUMN IF EXISTS language;

internal/db/migrations/130_submission_drafts_language.up.sql

@@ -0,0 +1,17 @@
+-- t-paliad-276 / m/paliad#108: per-draft output language for the
+-- Submissions generator.
+--
+-- The submission editor lets the lawyer pick DE or EN per draft so the
+-- generator selects the matching template variant + resolves language-
+-- aware variables ({{procedural_event.name_de}} vs _en). Default is
+-- 'de' to match the primary-language convention in CLAUDE.md and to
+-- keep existing rows behaving exactly as before (every legacy draft
+-- was implicitly DE; the resolved bag for those drafts is unchanged
+-- under language='de').
+
+ALTER TABLE paliad.submission_drafts
+    ADD COLUMN IF NOT EXISTS language text NOT NULL DEFAULT 'de'
+    CONSTRAINT submission_drafts_language_check CHECK (language IN ('de', 'en'));
+
+COMMENT ON COLUMN paliad.submission_drafts.language IS
+    't-paliad-276: output language for the generated .docx. ''de'' or ''en''. Drives template variant selection ({code}.{lang}.docx fallback chain) and language-aware variable resolution.';

internal/db/migrations/132_wave1_tier1_rule_additions.down.sql

@@ -0,0 +1,76 @@
+-- Rollback of mig 132 (t-paliad-284 Wave 1 + m/paliad#116).
+--
+-- Reverses §0 (R.104/R.105 citation backfill) + §1..§11 (11 Tier 1
+-- INSERTs) + §12 (T1.12 re-anchor of upc.pi.cfi.response).
+--
+-- Does NOT reverse §13b (Q6 archived-litigation cleanup) — those rows
+-- were already in lifecycle_state='archived' before deletion and are not
+-- surfaced by any product code path. Restoring them would require the
+-- pre-mig-132 backup. Leaving them gone is the correct rollback choice;
+-- emergency restore goes via mig 123 backup snapshot.
+--
+-- DOES restore §13a (re-add the deadline_rule_audit.rule_id FK) so the
+-- audit-table schema returns to its pre-mig-132 shape on rollback. Any
+-- orphan audit rows accumulated under mig 132 (rule_id pointing at
+-- now-deleted rules) would block the FK re-add; the rollback DELETE
+-- below removes them first.
+
+SELECT set_config(
+    'paliad.audit_reason',
+    'mig 132 down: rollback Wave 1 Tier 1 rule additions + R.105 citation backfill + T1.12 re-anchor (t-paliad-284 / m/paliad#116)',
+    true);
+
+-- §12 down — un-re-anchor upc.pi.cfi.response back to its broken root state.
+UPDATE paliad.deadline_rules
+   SET parent_id    = NULL,
+       is_court_set = false,
+       rule_code    = NULL,
+       legal_source = NULL,
+       updated_at   = now()
+ WHERE submission_code = 'upc.pi.cfi.response'
+   AND is_active = true
+   AND lifecycle_state = 'published'
+   AND is_court_set = true
+   AND rule_code = 'RoP.211.2';
+
+-- §1..§11 down — delete the 11 Tier 1 INSERTs by submission_code.
+DELETE FROM paliad.deadline_rules
+ WHERE submission_code IN (
+     'upc.inf.cfi.cmo_review',
+     'upc.inf.cfi.confidentiality_response',
+     'upc.apl.order.response_orders',   -- delete child first (FK to grounds_orders)
+     'upc.apl.order.grounds_orders',
+     'upc.inf.cfi.cons_orders',
+     'upc.inf.cfi.rectification',
+     'upc.pi.cfi.deficiency',
+     'upc.pi.cfi.merits_start',
+     'upc.inf.cfi.translation_request',
+     'upc.inf.cfi.interpreter_cost',
+     'upc.inf.cfi.translations_lodge'
+ )
+   AND lifecycle_state = 'published';
+
+-- §0 down — clear the R.104/R.105 citation on upc.inf.cfi.interim.
+UPDATE paliad.deadline_rules
+   SET rule_code    = NULL,
+       legal_source = NULL,
+       rule_codes   = NULL,
+       updated_at   = now()
+ WHERE submission_code = 'upc.inf.cfi.interim'
+   AND is_active = true
+   AND lifecycle_state = 'published'
+   AND rule_code = 'RoP.104'
+   AND legal_source = 'UPC.RoP.104';
+
+-- §13a down — re-add the deadline_rule_audit.rule_id FK with the
+-- original ON DELETE CASCADE shape. Purge any orphan audit rows first
+-- (audit entries pointing at rule_ids that no longer exist in
+-- deadline_rules) so the FK re-add doesn't fail validation.
+DELETE FROM paliad.deadline_rule_audit a
+ WHERE NOT EXISTS (
+     SELECT 1 FROM paliad.deadline_rules dr WHERE dr.id = a.rule_id
+ );
+
+ALTER TABLE paliad.deadline_rule_audit
+    ADD CONSTRAINT deadline_rule_audit_rule_id_fkey
+    FOREIGN KEY (rule_id) REFERENCES paliad.deadline_rules(id) ON DELETE CASCADE;

internal/db/migrations/132_wave1_tier1_rule_additions.up.sql

@@ -0,0 +1,659 @@
+-- t-paliad-284 Wave 1 + m/paliad#116 — Tier 1 deadline-rule additions
+-- (12 high-frequency procedural events) + UPC RoP R.104/R.105 Interim
+-- Conference citation backfill + Q6 archived-litigation cleanup.
+--
+-- Source: docs/research-deadlines-completeness-2026-05-25.md
+--   • §10 Tier 1 table (T1.1 .. T1.12)
+--   • §3.1 missing-rules catalogue (per-rule statutory citations)
+--   • §9.7 / Q6 (drop the _archived_litigation.* rows — m's design ack
+--     locked in 2026-05-25)
+--
+-- m's report (2026-05-25 17:12) also explicitly named "Zwischenverfahren /
+-- Interim Conference 105" as missing a rule citation. The audit does not
+-- list R.105 as a Tier 1 item (the row upc.inf.cfi.interim already exists
+-- as a court-set anchor), so the fix is to BACKFILL rule_code/legal_source
+-- on that row rather than to insert a new rule. Done here as a separate
+-- §0 section, with both RoP.104 (Aims of the interim conference) and
+-- RoP.105 (Holding of the interim conference) cited via rule_codes[].
+--
+-- Wave 2 Slice A primitives (mig 128: working_days unit + combine_op +
+-- timing='before' backward snap in deadline_calculator.go) are used by:
+--   • T1.8  upc.pi.cfi.merits_start         — 31d OR 20wd, combine_op=max
+--   • T1.9  upc.inf.cfi.translation_request — 1 month BEFORE oral hearing
+--   • T1.10 upc.inf.cfi.interpreter_cost    — 2 weeks BEFORE oral hearing
+-- Wave 2 Slice A landed mig 128 (`deadline_rules_unit_check`) — these
+-- rules are no longer blocked.
+--
+-- Slot 132 reserved: 127 brunel Wave 0, 128 knuth W2-A, 129 demeter,
+-- 130 atlas, 131 artemis → 132 this migration.
+--
+-- Idempotency:
+--   • INSERTs guarded with `WHERE NOT EXISTS (... submission_code = ...)`
+--     so re-applying matches zero rows on the second run.
+--   • UPDATEs guarded with `WHERE` clauses that match the pre-fix row
+--     state only (mig 095 convention).
+--   • DELETE guarded by lifecycle_state='archived' AND prefix — repeats
+--     match zero rows after first run.
+--
+-- audit_reason set_config is required at the top (mig 079 trigger on
+-- paliad.deadline_rules raises EXCEPTION 'audit reason required' for
+-- any INSERT / UPDATE / DELETE without it).
+
+SELECT set_config(
+    'paliad.audit_reason',
+    'mig 132: t-paliad-284 Wave 1 + m/paliad#116 — Tier 1 deadline-rule additions (12 rules) from curie''s audit §10 + UPC RoP R.104/105 Interim Conference citation backfill (m''s 2026-05-25 17:12 report) + Q6 archived-litigation cleanup (audit §9.7)',
+    true);
+
+-- =============================================================================
+-- §0  R.104/R.105 — Backfill citation on the existing Interim Conference row.
+--     m's report flagged that `upc.inf.cfi.interim` (Zwischenverfahren) renders
+--     with no rule reference at /admin/rules. The row exists as a court-set
+--     anchor (duration=0, parent_id=NULL, primary_party='court'). The
+--     governing UPC Rules of Procedure are:
+--       • R.104 — Aims of the interim conference (the substantive rule)
+--       • R.105 — Holding of the interim conference (procedural)
+--     Both cited via the rule_codes[] array; rule_code/legal_source carry
+--     the primary citation (R.104 — Aims).
+-- =============================================================================
+UPDATE paliad.deadline_rules
+   SET rule_code    = 'RoP.104',
+       legal_source = 'UPC.RoP.104',
+       rule_codes   = ARRAY['RoP.104', 'RoP.105'],
+       updated_at   = now()
+ WHERE submission_code = 'upc.inf.cfi.interim'
+   AND is_active = true
+   AND lifecycle_state = 'published'
+   AND rule_code IS NULL
+   AND legal_source IS NULL;
+
+-- =============================================================================
+-- §1  T1.1 upc.inf.cfi.cmo_review — Review of case-management order.
+--     15 days from CMO service. UPC RoP R.333.2: "Any party adversely
+--     affected by a case management order may within 15 days of service
+--     of the order apply to the panel for a review." Routine in busy LDs
+--     (Munich CMO traffic ~weekly). Anchor: the Interim Conference row,
+--     which is where CMOs are typically issued.
+-- =============================================================================
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     primary_party, duration_value, duration_unit, timing, rule_code,
+     legal_source, priority, is_court_set, lifecycle_state, is_active,
+     sequence_order, deadline_notes, deadline_notes_en)
+SELECT 8,                                                          -- upc.inf.cfi
+       (SELECT id FROM paliad.deadline_rules
+         WHERE submission_code = 'upc.inf.cfi.interim'
+           AND lifecycle_state = 'published' AND is_active = true
+         LIMIT 1),
+       'upc.inf.cfi.cmo_review',
+       'Überprüfung Verfahrensanordnung',
+       'Review of Case-Management Order',
+       'both', 15, 'days', 'after', 'RoP.333.2', 'UPC.RoP.333.2',
+       'optional', false, 'published', true, 42,
+       'Frist 15 Tage ab Zustellung der Verfahrensanordnung (R.333.2). Jede beschwerte Partei kann beim Spruchkörper Überprüfung beantragen.',
+       '15-day period from service of the case-management order (R.333.2). Any adversely-affected party may apply to the panel for a review.'
+ WHERE NOT EXISTS (
+     SELECT 1 FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.inf.cfi.cmo_review'
+        AND lifecycle_state = 'published'
+ );
+
+-- =============================================================================
+-- §2  T1.2 upc.inf.cfi.confidentiality_response — Response to opposing
+--     party's confidentiality application. 14 days from receipt of the
+--     opposing party's R.262.2 application: "Within 14 days of service
+--     … the other party may lodge an Application to the contrary."
+--     Trigger event 25 (paliad.trigger_events) maps 1:1 to this rule.
+--     Daily occurrence in HLC infringement work. Anchor: Statement of
+--     Claim row as proceeding root — actual trigger date supplied via
+--     'Datum setzen' when the opp party files, since the confidentiality
+--     app is not itself modelled as a deadline_rules row.
+-- =============================================================================
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     primary_party, duration_value, duration_unit, timing, rule_code,
+     legal_source, priority, is_court_set, lifecycle_state, is_active,
+     sequence_order, trigger_event_id, deadline_notes, deadline_notes_en)
+SELECT 8,
+       (SELECT id FROM paliad.deadline_rules
+         WHERE submission_code = 'upc.inf.cfi.soc'
+           AND lifecycle_state = 'published' AND is_active = true
+         LIMIT 1),
+       'upc.inf.cfi.confidentiality_response',
+       'Erwiderung auf Vertraulichkeitsantrag',
+       'Response to Confidentiality Application',
+       'both', 14, 'days', 'after', 'RoP.262.2', 'UPC.RoP.262.2',
+       'optional', false, 'published', true, 8,
+       25,
+       'Frist 14 Tage ab Zustellung des Vertraulichkeitsantrags der Gegenseite (R.262.2). Datum bei Eingang des Antrags manuell setzen.',
+       '14-day period from service of the opposing party''s confidentiality application (R.262.2). Set trigger date manually on receipt of the application.'
+ WHERE NOT EXISTS (
+     SELECT 1 FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.inf.cfi.confidentiality_response'
+        AND lifecycle_state = 'published'
+ );
+
+-- =============================================================================
+-- §3  T1.3 upc.apl.order.grounds_orders — Statement of Grounds on the
+--     orders-track appeal. 15 days from service of the appealed
+--     order/decision. UPC RoP R.224.2(b): "A Statement of grounds of
+--     appeal shall be lodged … within 15 days of service of the
+--     decision/order in cases referred to in Rule 220.1(c), Rule 220.2
+--     and Rule 221.3." Existing upc.apl.order tree has the with_leave
+--     notice but no separate grounds row — adding it.
+-- =============================================================================
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     primary_party, duration_value, duration_unit, timing, rule_code,
+     legal_source, priority, is_court_set, lifecycle_state, is_active,
+     sequence_order, deadline_notes, deadline_notes_en)
+SELECT 20,                                                         -- upc.apl.order
+       (SELECT id FROM paliad.deadline_rules
+         WHERE submission_code = 'upc.apl.order.order'
+           AND lifecycle_state = 'published' AND is_active = true
+         LIMIT 1),
+       'upc.apl.order.grounds_orders',
+       'Berufungsbegründung (Orders Track)',
+       'Statement of Grounds (Orders Track)',
+       'both', 15, 'days', 'after', 'RoP.224.2.b', 'UPC.RoP.224.2.b',
+       'mandatory', false, 'published', true, 2,
+       'Frist 15 Tage ab Zustellung der angegriffenen Anordnung/Entscheidung (R.224.2(b)).',
+       '15-day period from service of the appealed order/decision (R.224.2(b)).'
+ WHERE NOT EXISTS (
+     SELECT 1 FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.apl.order.grounds_orders'
+        AND lifecycle_state = 'published'
+ );
+
+-- =============================================================================
+-- §4  T1.4 upc.apl.order.response_orders — Statement of Response on the
+--     orders-track appeal. 15 days from service of the grounds. UPC RoP
+--     R.235.2: "Within 15 days of service of grounds of appeal pursuant
+--     to Rule 224.2(b), any other party … may lodge a Statement of
+--     response." Parent: the grounds_orders row inserted in §3, looked
+--     up by submission_code so this INSERT works either against a fresh
+--     DB or a partially-applied state.
+-- =============================================================================
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     primary_party, duration_value, duration_unit, timing, rule_code,
+     legal_source, priority, is_court_set, lifecycle_state, is_active,
+     sequence_order, deadline_notes, deadline_notes_en)
+SELECT 20,
+       (SELECT id FROM paliad.deadline_rules
+         WHERE submission_code = 'upc.apl.order.grounds_orders'
+           AND lifecycle_state = 'published' AND is_active = true
+         LIMIT 1),
+       'upc.apl.order.response_orders',
+       'Berufungserwiderung (Orders Track)',
+       'Statement of Response (Orders Track)',
+       'both', 15, 'days', 'after', 'RoP.235.2', 'UPC.RoP.235.2',
+       'optional', false, 'published', true, 3,
+       'Frist 15 Tage ab Zustellung der Berufungsbegründung (R.235.2).',
+       '15-day period from service of the Statement of grounds of appeal (R.235.2).'
+ WHERE NOT EXISTS (
+     SELECT 1 FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.apl.order.response_orders'
+        AND lifecycle_state = 'published'
+ );
+
+-- =============================================================================
+-- §5  T1.5 upc.inf.cfi.cons_orders — Application for orders consequential
+--     on validity. 2 months from service of the validity decision. UPC
+--     RoP R.118.4: "The Court may, upon a reasoned request by one of
+--     the parties, … give a decision granting consequential orders.
+--     The application … shall be made within two months of service of
+--     the decision …". Common after central-division revocation in
+--     bifurcated UPC matters.
+-- =============================================================================
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     primary_party, duration_value, duration_unit, timing, rule_code,
+     legal_source, priority, is_court_set, lifecycle_state, is_active,
+     sequence_order, deadline_notes, deadline_notes_en)
+SELECT 8,
+       (SELECT id FROM paliad.deadline_rules
+         WHERE submission_code = 'upc.inf.cfi.decision'
+           AND lifecycle_state = 'published' AND is_active = true
+         LIMIT 1),
+       'upc.inf.cfi.cons_orders',
+       'Antrag auf Folgeentscheidungen',
+       'Application for Consequential Orders',
+       'both', 2, 'months', 'after', 'RoP.118.4', 'UPC.RoP.118.4',
+       'optional', false, 'published', true, 60,
+       'Frist 2 Monate ab Zustellung der Validitätsentscheidung (R.118.4). Antrag auf Folgeentscheidungen (z.B. nach Zentralkammer-Nichtigerklärung).',
+       '2-month period from service of the validity decision (R.118.4). Application for orders consequential on validity (e.g. after central-division revocation).'
+ WHERE NOT EXISTS (
+     SELECT 1 FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.inf.cfi.cons_orders'
+        AND lifecycle_state = 'published'
+ );
+
+-- =============================================================================
+-- §6  T1.6 upc.inf.cfi.rectification — Application for rectification of a
+--     decision/order. 1 month from delivery of the decision. UPC RoP
+--     R.353: "Clerical mistakes, errors arising from any accidental
+--     slip or omission and obvious errors in a decision or order of
+--     the Court may be corrected by the Court of its own motion or on
+--     the application of a party. The application shall be made within
+--     one month of the decision or order being notified."
+-- =============================================================================
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     primary_party, duration_value, duration_unit, timing, rule_code,
+     legal_source, priority, is_court_set, lifecycle_state, is_active,
+     sequence_order, deadline_notes, deadline_notes_en)
+SELECT 8,
+       (SELECT id FROM paliad.deadline_rules
+         WHERE submission_code = 'upc.inf.cfi.decision'
+           AND lifecycle_state = 'published' AND is_active = true
+         LIMIT 1),
+       'upc.inf.cfi.rectification',
+       'Antrag auf Berichtigung',
+       'Application for Rectification',
+       'both', 1, 'months', 'after', 'RoP.353', 'UPC.RoP.353',
+       'optional', false, 'published', true, 70,
+       'Frist 1 Monat ab Zustellung der Entscheidung/Anordnung (R.353). Berichtigung von Schreib-, Rechen- oder ähnlichen Versehen.',
+       '1-month period from notification of the decision/order (R.353). Rectification of clerical mistakes, accidental slips or obvious errors.'
+ WHERE NOT EXISTS (
+     SELECT 1 FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.inf.cfi.rectification'
+        AND lifecycle_state = 'published'
+ );
+
+-- =============================================================================
+-- §7  T1.7 upc.pi.cfi.deficiency — Cure of PI-application deficiency.
+--     14 days from notification of the deficiency. UPC RoP R.207.6(a):
+--     "The Registry shall as soon as practicable examine the
+--     Application … and notify any deficiencies to the applicant. The
+--     applicant shall be invited to correct the deficiencies … within
+--     14 days." Failure to cure leads to deemed-withdrawal.
+-- =============================================================================
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     primary_party, duration_value, duration_unit, timing, rule_code,
+     legal_source, priority, is_court_set, lifecycle_state, is_active,
+     sequence_order, deadline_notes, deadline_notes_en)
+SELECT 10,                                                         -- upc.pi.cfi
+       (SELECT id FROM paliad.deadline_rules
+         WHERE submission_code = 'upc.pi.cfi.app'
+           AND lifecycle_state = 'published' AND is_active = true
+         LIMIT 1),
+       'upc.pi.cfi.deficiency',
+       'Mängelbeseitigung Antrag',
+       'Cure of Application Deficiency',
+       'claimant', 14, 'days', 'after', 'RoP.207.6.a', 'UPC.RoP.207.6.a',
+       'mandatory', false, 'published', true, 2,
+       'Frist 14 Tage ab Mängelmitteilung durch die Geschäftsstelle (R.207.6(a)). Bei Nichtbehebung gilt der Antrag als zurückgenommen.',
+       '14-day period from notification of deficiency by the Registry (R.207.6(a)). Failure to cure leads to deemed withdrawal of the application.'
+ WHERE NOT EXISTS (
+     SELECT 1 FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.pi.cfi.deficiency'
+        AND lifecycle_state = 'published'
+ );
+
+-- =============================================================================
+-- §8  T1.8 upc.pi.cfi.merits_start — Start proceedings on the merits.
+--     31 calendar days OR 20 working days, whichever is the longer,
+--     from grant of the PI. UPC RoP R.213.1 → R.198.1: "the applicant
+--     shall start proceedings leading to a decision on the merits of
+--     the case … within a period not exceeding 31 calendar days or
+--     20 working days, whichever is the longer." Combine-max wiring
+--     via Wave 2 Slice A primitives (mig 128: working_days unit +
+--     combine_op). Failure to commence on time → PI lapses (R.213.2).
+-- =============================================================================
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     primary_party, duration_value, duration_unit,
+     alt_duration_value, alt_duration_unit, alt_rule_code,
+     combine_op, timing, rule_code, legal_source, priority,
+     is_court_set, lifecycle_state, is_active, sequence_order,
+     deadline_notes, deadline_notes_en)
+SELECT 10,
+       (SELECT id FROM paliad.deadline_rules
+         WHERE submission_code = 'upc.pi.cfi.order'
+           AND lifecycle_state = 'published' AND is_active = true
+         LIMIT 1),
+       'upc.pi.cfi.merits_start',
+       'Klage in der Hauptsache erheben',
+       'Start Proceedings on the Merits',
+       'claimant', 31, 'days',
+       20, 'working_days', 'RoP.198.1',
+       'max', 'after', 'RoP.213', 'UPC.RoP.213',
+       'mandatory', false, 'published', true, 3,
+       'Frist 31 Kalendertage ODER 20 Arbeitstage (jeweils das längere) ab Anordnung der einstweiligen Maßnahme (R.213 i.V.m. R.198.1). Bei Versäumnis erlischt die einstweilige Maßnahme.',
+       '31 calendar days OR 20 working days, whichever is the longer, from grant of the provisional measure (R.213 referring to R.198.1). Failure to commence within the period causes the provisional measure to lapse.'
+ WHERE NOT EXISTS (
+     SELECT 1 FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.pi.cfi.merits_start'
+        AND lifecycle_state = 'published'
+ );
+
+-- =============================================================================
+-- §9  T1.9 upc.inf.cfi.translation_request — Request for simultaneous
+--     translation at the oral hearing. 1 month BEFORE the oral hearing.
+--     UPC RoP R.109.1: "A party requiring simultaneous interpretation
+--     of the oral hearing into a language other than the language of
+--     proceedings shall, no later than one month before the date of
+--     the oral hearing, lodge a request with the Court." timing='before'
+--     uses the backward-snap path in deadline_calculator.go (mig 128).
+-- =============================================================================
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     primary_party, duration_value, duration_unit, timing, rule_code,
+     legal_source, priority, is_court_set, lifecycle_state, is_active,
+     sequence_order, deadline_notes, deadline_notes_en)
+SELECT 8,
+       (SELECT id FROM paliad.deadline_rules
+         WHERE submission_code = 'upc.inf.cfi.oral'
+           AND lifecycle_state = 'published' AND is_active = true
+         LIMIT 1),
+       'upc.inf.cfi.translation_request',
+       'Antrag auf Simultanübersetzung',
+       'Request for Simultaneous Translation',
+       'both', 1, 'months', 'before', 'RoP.109.1', 'UPC.RoP.109.1',
+       'optional', false, 'published', true, 45,
+       'Frist 1 Monat VOR der mündlichen Verhandlung (R.109.1). Antrag auf Simultanübersetzung in eine andere Sprache als die Verfahrenssprache.',
+       '1 month BEFORE the oral hearing (R.109.1). Request for simultaneous interpretation into a language other than the language of proceedings.'
+ WHERE NOT EXISTS (
+     SELECT 1 FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.inf.cfi.translation_request'
+        AND lifecycle_state = 'published'
+ );
+
+-- =============================================================================
+-- §10 T1.10 upc.inf.cfi.interpreter_cost — Notification of interpreter
+--     cost-bearing. 2 weeks BEFORE the oral hearing. UPC RoP R.109.4:
+--     "Where … the party which made the request for interpretation is
+--     not the party who has chosen the language of the proceedings,
+--     the costs of the interpretation … shall be borne by the
+--     requesting party, unless the Court orders otherwise. The party
+--     shall be notified at least two weeks before the oral hearing."
+--     timing='before' as in §9.
+-- =============================================================================
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     primary_party, duration_value, duration_unit, timing, rule_code,
+     legal_source, priority, is_court_set, lifecycle_state, is_active,
+     sequence_order, deadline_notes, deadline_notes_en)
+SELECT 8,
+       (SELECT id FROM paliad.deadline_rules
+         WHERE submission_code = 'upc.inf.cfi.oral'
+           AND lifecycle_state = 'published' AND is_active = true
+         LIMIT 1),
+       'upc.inf.cfi.interpreter_cost',
+       'Mitteilung Dolmetscherkosten',
+       'Notification of Interpreter Costs',
+       'court', 2, 'weeks', 'before', 'RoP.109.4', 'UPC.RoP.109.4',
+       'mandatory', false, 'published', true, 46,
+       'Frist 2 Wochen VOR der mündlichen Verhandlung (R.109.4). Mitteilung, dass die antragstellende Partei die Dolmetscherkosten zu tragen hat.',
+       '2 weeks BEFORE the oral hearing (R.109.4). Notification to the requesting party that it shall bear the interpreter costs.'
+ WHERE NOT EXISTS (
+     SELECT 1 FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.inf.cfi.interpreter_cost'
+        AND lifecycle_state = 'published'
+ );
+
+-- =============================================================================
+-- §11 T1.11 upc.inf.cfi.translations_lodge — Lodging of translations on
+--     judge-rapporteur order. 2 weeks AFTER the JR's order. UPC RoP
+--     R.109.5: "If the judge-rapporteur orders, the parties shall lodge
+--     a translation of any pleading or other document into the language
+--     of the proceedings within two weeks." trigger_event_id=113 maps
+--     to the JR translation order. Anchor: Interim Conference row, where
+--     such JR orders are typically issued.
+-- =============================================================================
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     primary_party, duration_value, duration_unit, timing, rule_code,
+     legal_source, priority, is_court_set, lifecycle_state, is_active,
+     sequence_order, trigger_event_id, deadline_notes, deadline_notes_en)
+SELECT 8,
+       (SELECT id FROM paliad.deadline_rules
+         WHERE submission_code = 'upc.inf.cfi.interim'
+           AND lifecycle_state = 'published' AND is_active = true
+         LIMIT 1),
+       'upc.inf.cfi.translations_lodge',
+       'Übersetzungen einreichen',
+       'Lodging of Translations',
+       'both', 2, 'weeks', 'after', 'RoP.109.5', 'UPC.RoP.109.5',
+       'mandatory', false, 'published', true, 47,
+       113,
+       'Frist 2 Wochen ab Anordnung des Berichterstatters, Übersetzungen einzureichen (R.109.5).',
+       '2-week period from the judge-rapporteur''s order to lodge translations (R.109.5).'
+ WHERE NOT EXISTS (
+     SELECT 1 FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.inf.cfi.translations_lodge'
+        AND lifecycle_state = 'published'
+ );
+
+-- =============================================================================
+-- §12 T1.12 upc.pi.cfi.response — RE-ANCHOR of the existing PI Response
+--     row. Currently broken: parent_id=NULL with is_court_set=false and
+--     duration=0 makes the calculator treat this as a root anchor. UPC
+--     RoP R.211.2 — judge sets the inter-partes hearing date and the
+--     deadline for the response. Fix: set is_court_set=true and chain
+--     parent_id on upc.pi.cfi.app (the proceeding root). Duration
+--     remains 0 (court-set placeholder); the lawyer fills in the actual
+--     date via 'Datum setzen'.
+-- =============================================================================
+UPDATE paliad.deadline_rules
+   SET parent_id   = (SELECT id FROM paliad.deadline_rules
+                       WHERE submission_code = 'upc.pi.cfi.app'
+                         AND lifecycle_state = 'published'
+                         AND is_active = true
+                       LIMIT 1),
+       is_court_set = true,
+       rule_code    = 'RoP.211.2',
+       legal_source = 'UPC.RoP.211.2',
+       updated_at   = now()
+ WHERE submission_code = 'upc.pi.cfi.response'
+   AND is_active = true
+   AND lifecycle_state = 'published'
+   AND parent_id IS NULL
+   AND is_court_set = false;
+
+-- =============================================================================
+-- §13a Pre-requisite for §13b — drop the deadline_rule_audit.rule_id FK.
+--     The audit trigger (mig 079) tries to INSERT an audit row on AFTER
+--     DELETE pointing at OLD.id, but the existing FK constraint
+--     `deadline_rule_audit_rule_id_fkey` (FOREIGN KEY rule_id REFERENCES
+--     paliad.deadline_rules(id) ON DELETE CASCADE) makes that INSERT fail
+--     because by the time the trigger fires the parent row is gone. As a
+--     result no DELETE on paliad.deadline_rules has ever succeeded in
+--     production (`SELECT count(*) FROM paliad.deadline_rule_audit
+--     WHERE action='delete'` returns 0). The trigger's DELETE branch was
+--     dead code.
+--
+--     Standard audit-table design: the audit log is append-only history
+--     and should NOT FK-constrain on the live entity table — before_json
+--     captures the full row state at the time of the change, which is
+--     all the audit trail needs. Dropping the FK fixes the latent bug
+--     and unblocks legitimate cleanup work (here: §13b, plus any future
+--     hard-delete migrations against deadline_rules).
+--
+--     Idempotent: DROP CONSTRAINT IF EXISTS no-ops on re-run.
+-- =============================================================================
+ALTER TABLE paliad.deadline_rule_audit
+    DROP CONSTRAINT IF EXISTS deadline_rule_audit_rule_id_fkey;
+
+-- =============================================================================
+-- §13b Q6 cleanup — drop the _archived_litigation.* deadline rules.
+--     40 rows at audit §9.7 flagged as obsolete Pipeline-A residue
+--     (proceeding_type id=32 '_archived_litigation' — kept for FK
+--     parity but the rules are no longer surfaced anywhere in the
+--     product). m's Q6 design ack 2026-05-25 locked in their removal.
+--     Idempotent: prefix + lifecycle_state='archived' match zero rows
+--     after first run. The proceeding_type row itself is left in place
+--     (referenced by historical deadline_rule_audit before_json blobs).
+-- =============================================================================
+DELETE FROM paliad.deadline_rules
+ WHERE submission_code LIKE '_archived_litigation.%' ESCAPE '\'
+   AND lifecycle_state = 'archived';
+
+-- =============================================================================
+-- Hard assertions. Each new/changed row must end up in its post-fix
+-- shape. Re-running the migration is a no-op for the data but the
+-- assertions still pass because they check the post-fix state.
+-- =============================================================================
+DO $$
+DECLARE
+    v_count integer;
+BEGIN
+    -- §0 R.105 interim conference backfilled
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.inf.cfi.interim'
+       AND is_active = true
+       AND lifecycle_state = 'published'
+       AND rule_code = 'RoP.104'
+       AND legal_source = 'UPC.RoP.104'
+       AND 'RoP.105' = ANY(rule_codes);
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 §0: upc.inf.cfi.interim citation backfill not in post-fix shape (got % matches)', v_count;
+    END IF;
+
+    -- §1 T1.1 cmo_review present
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.inf.cfi.cmo_review'
+       AND is_active = true AND lifecycle_state = 'published'
+       AND rule_code = 'RoP.333.2' AND duration_value = 15
+       AND duration_unit = 'days' AND timing = 'after';
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 T1.1: upc.inf.cfi.cmo_review missing or wrong shape (got % matches)', v_count;
+    END IF;
+
+    -- §2 T1.2 confidentiality_response
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.inf.cfi.confidentiality_response'
+       AND is_active = true AND lifecycle_state = 'published'
+       AND rule_code = 'RoP.262.2' AND duration_value = 14
+       AND duration_unit = 'days' AND trigger_event_id = 25;
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 T1.2: upc.inf.cfi.confidentiality_response missing or wrong shape (got % matches)', v_count;
+    END IF;
+
+    -- §3 T1.3 grounds_orders
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.apl.order.grounds_orders'
+       AND is_active = true AND lifecycle_state = 'published'
+       AND rule_code = 'RoP.224.2.b' AND duration_value = 15
+       AND duration_unit = 'days';
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 T1.3: upc.apl.order.grounds_orders missing or wrong shape (got % matches)', v_count;
+    END IF;
+
+    -- §4 T1.4 response_orders chained on §3
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules dr
+      JOIN paliad.deadline_rules p ON p.id = dr.parent_id
+     WHERE dr.submission_code = 'upc.apl.order.response_orders'
+       AND dr.is_active = true AND dr.lifecycle_state = 'published'
+       AND dr.rule_code = 'RoP.235.2' AND dr.duration_value = 15
+       AND p.submission_code = 'upc.apl.order.grounds_orders';
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 T1.4: upc.apl.order.response_orders missing or wrong parent chain (got % matches)', v_count;
+    END IF;
+
+    -- §5 T1.5 cons_orders
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.inf.cfi.cons_orders'
+       AND is_active = true AND lifecycle_state = 'published'
+       AND rule_code = 'RoP.118.4' AND duration_value = 2
+       AND duration_unit = 'months';
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 T1.5: upc.inf.cfi.cons_orders missing or wrong shape (got % matches)', v_count;
+    END IF;
+
+    -- §6 T1.6 rectification
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.inf.cfi.rectification'
+       AND is_active = true AND lifecycle_state = 'published'
+       AND rule_code = 'RoP.353' AND duration_value = 1
+       AND duration_unit = 'months';
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 T1.6: upc.inf.cfi.rectification missing or wrong shape (got % matches)', v_count;
+    END IF;
+
+    -- §7 T1.7 pi.deficiency
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.pi.cfi.deficiency'
+       AND is_active = true AND lifecycle_state = 'published'
+       AND rule_code = 'RoP.207.6.a' AND duration_value = 14
+       AND duration_unit = 'days';
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 T1.7: upc.pi.cfi.deficiency missing or wrong shape (got % matches)', v_count;
+    END IF;
+
+    -- §8 T1.8 pi.merits_start — combine-max wiring
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.pi.cfi.merits_start'
+       AND is_active = true AND lifecycle_state = 'published'
+       AND rule_code = 'RoP.213' AND duration_value = 31
+       AND duration_unit = 'days'
+       AND alt_duration_value = 20 AND alt_duration_unit = 'working_days'
+       AND alt_rule_code = 'RoP.198.1' AND combine_op = 'max';
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 T1.8: upc.pi.cfi.merits_start missing or wrong combine-max shape (got % matches)', v_count;
+    END IF;
+
+    -- §9 T1.9 translation_request — timing='before'
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.inf.cfi.translation_request'
+       AND is_active = true AND lifecycle_state = 'published'
+       AND rule_code = 'RoP.109.1' AND duration_value = 1
+       AND duration_unit = 'months' AND timing = 'before';
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 T1.9: upc.inf.cfi.translation_request missing or wrong timing (got % matches)', v_count;
+    END IF;
+
+    -- §10 T1.10 interpreter_cost — timing='before'
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.inf.cfi.interpreter_cost'
+       AND is_active = true AND lifecycle_state = 'published'
+       AND rule_code = 'RoP.109.4' AND duration_value = 2
+       AND duration_unit = 'weeks' AND timing = 'before';
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 T1.10: upc.inf.cfi.interpreter_cost missing or wrong timing (got % matches)', v_count;
+    END IF;
+
+    -- §11 T1.11 translations_lodge
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.inf.cfi.translations_lodge'
+       AND is_active = true AND lifecycle_state = 'published'
+       AND rule_code = 'RoP.109.5' AND duration_value = 2
+       AND duration_unit = 'weeks' AND trigger_event_id = 113;
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 T1.11: upc.inf.cfi.translations_lodge missing or wrong shape (got % matches)', v_count;
+    END IF;
+
+    -- §12 T1.12 pi.response re-anchor
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules dr
+      JOIN paliad.deadline_rules p ON p.id = dr.parent_id
+     WHERE dr.submission_code = 'upc.pi.cfi.response'
+       AND dr.is_active = true AND dr.lifecycle_state = 'published'
+       AND dr.is_court_set = true
+       AND p.submission_code = 'upc.pi.cfi.app';
+    IF v_count <> 1 THEN
+        RAISE EXCEPTION 'mig 132 T1.12: upc.pi.cfi.response not re-anchored on app (got % matches)', v_count;
+    END IF;
+
+    -- §13 Q6 cleanup — no archived _archived_litigation rules left
+    SELECT count(*) INTO v_count
+      FROM paliad.deadline_rules
+     WHERE submission_code LIKE '_archived_litigation.%' ESCAPE '\'
+       AND lifecycle_state = 'archived';
+    IF v_count <> 0 THEN
+        RAISE EXCEPTION 'mig 132 §13: % archived _archived_litigation.* rules still present after cleanup', v_count;
+    END IF;
+END $$;

internal/db/migrations/133_upc_dmgs_pi_court_followup.down.sql

@@ -0,0 +1,33 @@
+-- Reverses mig 133. Removes the 5 new rules:
+--   * upc.dmgs.cfi.interim
+--   * upc.dmgs.cfi.oral
+--   * upc.dmgs.cfi.decision
+--   * upc.dmgs.cfi.appeal_spawn
+--   * upc.pi.cfi.appeal_spawn
+--
+-- The audit_reason is required by the mig 079 trigger for DELETE;
+-- set_config at top supplies it.
+--
+-- Idempotent — if a rule is already missing the DELETE matches zero
+-- rows and the audit log records nothing extra.
+
+SELECT set_config(
+    'paliad.audit_reason',
+    'mig 133 (down): revert UPC Damages tree-end rows and UPC PI appeal-spawn (t-paliad-285 / m/paliad#117 + t-paliad-286 / m/paliad#118)',
+    true);
+
+-- Delete the spawn rows first so the parent_id reference goes away
+-- before the parent decision row is removed.
+DELETE FROM paliad.deadline_rules
+ WHERE submission_code IN (
+        'upc.dmgs.cfi.appeal_spawn',
+        'upc.pi.cfi.appeal_spawn')
+   AND lifecycle_state = 'published';
+
+DELETE FROM paliad.deadline_rules
+ WHERE submission_code IN (
+        'upc.dmgs.cfi.interim',
+        'upc.dmgs.cfi.oral',
+        'upc.dmgs.cfi.decision')
+   AND proceeding_type_id = 17
+   AND lifecycle_state = 'published';

internal/db/migrations/133_upc_dmgs_pi_court_followup.up.sql

@@ -0,0 +1,405 @@
+-- t-paliad-285 (m/paliad#117) + t-paliad-286 (m/paliad#118) —
+-- post-submission court followup for UPC Damages and appeal route
+-- for UPC Provisional Measures.
+--
+-- m's 2026-05-25 report: the upc.dmgs.cfi proceeding stops at the
+-- last party submission (rejoin) — no interim conference, no oral
+-- hearing, no decision row, no appeal-spawn. The upc.pi.cfi
+-- proceeding has its decision row (`pi.order`) but no spawn into
+-- the appeal tree. Both gaps prevent the Verfahrensablauf timeline
+-- from rendering the court phase plus any downstream appeal sub-
+-- tree that atlas's #96 spawn-rendering mechanism is otherwise
+-- ready to surface.
+--
+-- Two sections in one migration (slot 133 — knuth on 132, paliadin
+-- coordinated):
+--
+--   A. UPC Damages tree-end rows (#117)
+--      A1  upc.dmgs.cfi.interim       UPC RoP R.105   court-set hearing
+--      A2  upc.dmgs.cfi.oral          UPC RoP R.118 / R.250  court-set hearing
+--      A3  upc.dmgs.cfi.decision      UPC RoP R.118 / R.144  court-set decision
+--      A4  upc.dmgs.cfi.appeal_spawn  UPC RoP R.220.1(a) / R.224.1(a)  2mo, spawn → upc.apl.merits (id=11)
+--
+--   B. UPC Provisional Measures appeal route (#118)
+--      B1  upc.pi.cfi.appeal_spawn    UPC RoP R.220.1(a) / R.224.1(a)  2mo, spawn → upc.apl.merits (id=11)
+--
+-- Source citations:
+--   * docs/research-deadlines-completeness-2026-05-25.md
+--       — §2.1 (upc.dmgs.cfi has only 4 rules: R.131.2 / R.137.2 / R.139)
+--       — §D Damages table (R.144 tree-end row missing — listed
+--         in Tier 4 as "cosmetic", upgraded to Tier-0 by m's
+--         report once the wider follow-up gap was understood)
+--   * docs/audit-upc-rop-deadlines-2026-05-08.md §D row R.144,
+--     §F R.220.1(a) / R.224.1(a) (verified verbatim in youpc DB
+--     under law_type=UPCRoP).
+--   * UPC Rules of Procedure (consolidated):
+--       R.105 — Interim conference (court fixes after written
+--         procedure closes; same structural shape as the inf
+--         interim conference, already modelled as `upc.inf.cfi.interim`).
+--       R.118 — Decision after oral hearing; general rule for
+--         deciding panels.
+--       R.250 — Determination of damages decision; damages-
+--         specific decision rule (chains R.144 indication →
+--         damages award).
+--       R.144 — Final decision on damages quantum (tree-end
+--         anchor for §A3).
+--       R.220.1(a) — Appeal lies from any final decision /
+--         decision disposing of the case at first instance.
+--         A PI order under R.211 disposes of the urgent question
+--         and is therefore appealable on the main 2-month track
+--         (not the 15-day order track of R.220.1(c), which covers
+--         case-management and procedural orders requiring leave).
+--         Curie's §F table confirms the main-track wiring for
+--         decisions on merits / disposing orders.
+--       R.224.1(a) — Statement of Appeal within 2 months of
+--         service of the final decision; the deadline-notes text
+--         mirrors mig 095's inf.appeal_spawn / rev.appeal_spawn.
+--       R.224.2(a) — Statement of grounds within 4 months
+--         (separate deadline in the spawned upc.apl.merits
+--         proceeding; already present as upc.apl.merits.grounds).
+--
+-- Shape decisions (mirroring mig 012 / mig 095 conventions):
+--   * Court-set rows (interim / oral / decision) carry
+--     primary_party='court', event_type='hearing'|'decision',
+--     duration_value=0, is_court_set=true, parent_id=NULL,
+--     concept_id reuses the shared concepts already wired for
+--     upc.inf.cfi (interim-conference / oral-hearing / decision).
+--   * Spawn rows carry primary_party='both', is_spawn=true,
+--     spawn_proceeding_type_id=11 (upc.apl.merits), spawn_label
+--     identical to the merits spawn already in production. The
+--     spawn row's parent_id is the spawning decision/order row
+--     (so the audit log carries the trigger link).
+--   * No condition_expr — m's F2.3 decision recorded in mig 095
+--     §3: "the appeal deadline should always be triggered by a
+--     decision … appeal is always a possibility." Visibility
+--     filtering on the frontend hides appeals on projects where
+--     no appeal is contemplated.
+--   * sequence_order numbering follows the inf convention
+--     (40=interim, 50=oral, 60=decision, 80=appeal_spawn) so the
+--     Verfahrensablauf timeline orders consistently across
+--     proceedings. For PI the existing pi.order sits at
+--     sequence_order=3; the appeal_spawn lands at 10 (clear of
+--     the writ phase, room for future court-phase rows).
+--
+-- Idempotency: every INSERT is gated by `WHERE NOT EXISTS (… same
+-- submission_code, proceeding_type_id, lifecycle_state)`. Re-apply
+-- against an already-migrated DB inserts zero rows and the audit
+-- log carries no duplicate entries.
+--
+-- audit_reason set_config required at the top — the mig 079 trigger
+-- on paliad.deadline_rules raises EXCEPTION 'audit reason required'
+-- on INSERT/UPDATE/DELETE without it.
+
+SELECT set_config(
+    'paliad.audit_reason',
+    'mig 133: t-paliad-285 / m/paliad#117 + t-paliad-286 / m/paliad#118 — UPC Damages tree-end rows (interim conference R.105, oral hearing R.118/R.250, decision R.118/R.144, appeal-spawn R.220.1(a)) and UPC Provisional Measures appeal-spawn R.220.1(a); see docs/research-deadlines-completeness-2026-05-25.md §D and docs/audit-upc-rop-deadlines-2026-05-08.md §D/§F',
+    true);
+
+-- =============================================================================
+-- A. UPC Damages — court-phase tree end (m/paliad#117)
+-- =============================================================================
+
+-- A1. upc.dmgs.cfi.interim — Interim conference (UPC RoP R.105).
+--     Court-set hearing fixed by the judge-rapporteur once the
+--     written procedure closes. Identical shape to
+--     upc.inf.cfi.interim; reuses the shared interim-conference
+--     concept node.
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     description, primary_party, event_type,
+     duration_value, duration_unit, timing,
+     rule_code, deadline_notes, deadline_notes_en, sequence_order,
+     is_spawn, spawn_proceeding_type_id, spawn_label,
+     is_active, legal_source, is_bilateral,
+     condition_expr, priority, is_court_set, lifecycle_state,
+     concept_id)
+SELECT
+    17,
+    NULL,
+    'upc.dmgs.cfi.interim',
+    'Zwischenverfahren',
+    'Interim Conference',
+    NULL,
+    'court',
+    'hearing',
+    0,
+    'months',
+    'after',
+    NULL,
+    'Termin vom Gericht bestimmt',
+    'Date set by the court',
+    40,
+    false,
+    NULL,
+    NULL,
+    true,
+    NULL,
+    false,
+    NULL,
+    'optional',
+    true,
+    'published',
+    'e5071152-d408-4455-b644-9e79d86fd538'
+WHERE NOT EXISTS (
+    SELECT 1 FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.dmgs.cfi.interim'
+       AND proceeding_type_id = 17
+       AND lifecycle_state = 'published');
+
+-- A2. upc.dmgs.cfi.oral — Oral hearing (UPC RoP R.118 / R.250).
+--     Court-set hearing after the interim conference / close of
+--     written procedure. Same shape as upc.inf.cfi.oral; reuses
+--     the shared oral-hearing concept node.
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     description, primary_party, event_type,
+     duration_value, duration_unit, timing,
+     rule_code, deadline_notes, deadline_notes_en, sequence_order,
+     is_spawn, spawn_proceeding_type_id, spawn_label,
+     is_active, legal_source, is_bilateral,
+     condition_expr, priority, is_court_set, lifecycle_state,
+     concept_id)
+SELECT
+    17,
+    NULL,
+    'upc.dmgs.cfi.oral',
+    'Mündliche Verhandlung',
+    'Oral Hearing',
+    NULL,
+    'court',
+    'hearing',
+    0,
+    'months',
+    'after',
+    NULL,
+    NULL,
+    NULL,
+    50,
+    false,
+    NULL,
+    NULL,
+    true,
+    NULL,
+    false,
+    NULL,
+    'optional',
+    true,
+    'published',
+    'd6e5b793-dcf1-4d83-81ff-34f42dbb3693'
+WHERE NOT EXISTS (
+    SELECT 1 FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.dmgs.cfi.oral'
+       AND proceeding_type_id = 17
+       AND lifecycle_state = 'published');
+
+-- A3. upc.dmgs.cfi.decision — Damages decision (UPC RoP R.118 /
+--     R.144 / R.250). Court-set decision delivered after oral
+--     hearing; closes the §3.1 audit gap (R.144 tree-end). Same
+--     shape as upc.inf.cfi.decision; reuses the shared decision
+--     concept node.
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     description, primary_party, event_type,
+     duration_value, duration_unit, timing,
+     rule_code, deadline_notes, deadline_notes_en, sequence_order,
+     is_spawn, spawn_proceeding_type_id, spawn_label,
+     is_active, legal_source, is_bilateral,
+     condition_expr, priority, is_court_set, lifecycle_state,
+     concept_id)
+SELECT
+    17,
+    NULL,
+    'upc.dmgs.cfi.decision',
+    'Entscheidung',
+    'Decision',
+    NULL,
+    'court',
+    'decision',
+    0,
+    'months',
+    'after',
+    NULL,
+    NULL,
+    NULL,
+    60,
+    false,
+    NULL,
+    NULL,
+    true,
+    NULL,
+    false,
+    NULL,
+    'optional',
+    true,
+    'published',
+    '472fc32d-cc4f-4aa4-8ace-e422031812de'
+WHERE NOT EXISTS (
+    SELECT 1 FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.dmgs.cfi.decision'
+       AND proceeding_type_id = 17
+       AND lifecycle_state = 'published');
+
+-- A4. upc.dmgs.cfi.appeal_spawn — Appeal against damages decision
+--     (UPC RoP R.220.1(a), 2-month main track; grounds R.224.2(a)
+--     run as a separate deadline in the spawned upc.apl.merits
+--     proceeding). Parent points at the freshly-inserted
+--     upc.dmgs.cfi.decision; the SELECT subquery resolves it
+--     after A3 lands. Same shape as the mig 095 inf.appeal_spawn.
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     description, primary_party, event_type,
+     duration_value, duration_unit, timing,
+     rule_code, deadline_notes, deadline_notes_en, sequence_order,
+     is_spawn, spawn_proceeding_type_id, spawn_label,
+     is_active, legal_source, is_bilateral,
+     condition_expr, priority, is_court_set, lifecycle_state)
+SELECT
+    17,
+    (SELECT id FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.dmgs.cfi.decision'
+        AND proceeding_type_id = 17
+        AND lifecycle_state = 'published'
+        AND is_active = true),
+    'upc.dmgs.cfi.appeal_spawn',
+    'Berufung gegen Schadensentscheidung',
+    'Appeal against damages decision',
+    'Berufung gegen die Entscheidung über die Schadensbemessung (R.118 / R.144). Statutarische Frist von 2 Monaten ab Zustellung der Entscheidung (R.224.1(a)); die Berufungsbegründung folgt mit 4 Monaten ab Zustellung (R.224.2(a), eigenständige Frist im Berufungsverfahren).',
+    'both',
+    'filing',
+    2,
+    'months',
+    'after',
+    'RoP.220.1.a',
+    'Innerhalb von 2 Monaten ab Zustellung der Schadensentscheidung Berufungsschrift einreichen (R.224.1(a)). Die Berufungsbegründung (R.224.2(a), 4 Monate) läuft als separate Frist im Berufungsverfahren.',
+    'Within 2 months of service of the damages decision lodge the Statement of appeal (R.224.1(a)). The Statement of grounds (R.224.2(a), 4 months) runs as an independent deadline in the appeal proceeding.',
+    80,
+    true,
+    11,
+    'Berufungsverfahren öffnen',
+    true,
+    'UPC.RoP.220.1',
+    false,
+    NULL,
+    'optional',
+    false,
+    'published'
+WHERE NOT EXISTS (
+    SELECT 1 FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.dmgs.cfi.appeal_spawn'
+       AND proceeding_type_id = 17
+       AND lifecycle_state = 'published');
+
+-- =============================================================================
+-- B. UPC Provisional Measures — appeal route (m/paliad#118)
+-- =============================================================================
+
+-- B1. upc.pi.cfi.appeal_spawn — Appeal against PI order (UPC RoP
+--     R.220.1(a), 2-month main track). PI orders under R.211
+--     dispose of the urgent question and are appealable on the
+--     main 2-month track (R.220.1(a)/R.224.1(a)); the 15-day
+--     order track of R.220.1(c) is for case-management /
+--     procedural orders requiring leave and does not apply to
+--     PI dispositions. Parent points at the existing
+--     upc.pi.cfi.order (sequence_order=3) so the spawn fires
+--     once the order is anchored on a project's timeline.
+INSERT INTO paliad.deadline_rules
+    (proceeding_type_id, parent_id, submission_code, name, name_en,
+     description, primary_party, event_type,
+     duration_value, duration_unit, timing,
+     rule_code, deadline_notes, deadline_notes_en, sequence_order,
+     is_spawn, spawn_proceeding_type_id, spawn_label,
+     is_active, legal_source, is_bilateral,
+     condition_expr, priority, is_court_set, lifecycle_state)
+SELECT
+    10,
+    (SELECT id FROM paliad.deadline_rules
+      WHERE submission_code = 'upc.pi.cfi.order'
+        AND proceeding_type_id = 10
+        AND lifecycle_state = 'published'
+        AND is_active = true),
+    'upc.pi.cfi.appeal_spawn',
+    'Berufung gegen Anordnung',
+    'Appeal against PI order',
+    'Berufung gegen die einstweilige Anordnung nach R.211. Eine PI-Anordnung erledigt die einstweilige Streitfrage und wird wie eine Endentscheidung im Hauptverfahren behandelt: statutarische Frist von 2 Monaten ab Zustellung (R.224.1(a)); die Berufungsbegründung folgt mit 4 Monaten ab Zustellung (R.224.2(a), eigenständige Frist im Berufungsverfahren). Die 15-Tage-Spur nach R.220.1(c) / R.220.2 gilt für Verfahrensanordnungen mit Zulassung und ist hier nicht einschlägig.',
+    'both',
+    'filing',
+    2,
+    'months',
+    'after',
+    'RoP.220.1.a',
+    'Innerhalb von 2 Monaten ab Zustellung der PI-Anordnung Berufungsschrift einreichen (R.224.1(a)). Die Berufungsbegründung (R.224.2(a), 4 Monate) läuft als separate Frist im Berufungsverfahren.',
+    'Within 2 months of service of the PI order lodge the Statement of appeal (R.224.1(a)). The Statement of grounds (R.224.2(a), 4 months) runs as an independent deadline in the appeal proceeding.',
+    10,
+    true,
+    11,
+    'Berufungsverfahren öffnen',
+    true,
+    'UPC.RoP.220.1',
+    false,
+    NULL,
+    'optional',
+    false,
+    'published'
+WHERE NOT EXISTS (
+    SELECT 1 FROM paliad.deadline_rules
+     WHERE submission_code = 'upc.pi.cfi.appeal_spawn'
+       AND proceeding_type_id = 10
+       AND lifecycle_state = 'published');
+
+-- =============================================================================
+-- C. Post-insert verification — raise if any expected row is missing
+--    (matches the mig 095 / 127 convention; protects against a future
+--    re-shape of the table that silently drops one of the WHERE NOT
+--    EXISTS predicates).
+-- =============================================================================
+
+DO $$
+DECLARE
+    v_missing text;
+BEGIN
+    SELECT string_agg(expected, ', ' ORDER BY expected)
+      INTO v_missing
+      FROM (VALUES
+            ('upc.dmgs.cfi.interim'),
+            ('upc.dmgs.cfi.oral'),
+            ('upc.dmgs.cfi.decision'),
+            ('upc.dmgs.cfi.appeal_spawn'),
+            ('upc.pi.cfi.appeal_spawn')
+        ) AS t(expected)
+     WHERE NOT EXISTS (
+        SELECT 1 FROM paliad.deadline_rules dr
+         WHERE dr.submission_code = t.expected
+           AND dr.lifecycle_state = 'published'
+           AND dr.is_active = true);
+
+    IF v_missing IS NOT NULL THEN
+        RAISE EXCEPTION
+            'mig 133: expected published rules missing after insert: %', v_missing;
+    END IF;
+
+    IF NOT EXISTS (
+        SELECT 1 FROM paliad.deadline_rules dr
+         WHERE dr.submission_code = 'upc.dmgs.cfi.appeal_spawn'
+           AND dr.proceeding_type_id = 17
+           AND dr.spawn_proceeding_type_id = 11
+           AND dr.is_spawn = true
+           AND dr.parent_id IS NOT NULL
+           AND dr.lifecycle_state = 'published'
+    ) THEN
+        RAISE EXCEPTION
+            'mig 133: upc.dmgs.cfi.appeal_spawn shape check failed (expected is_spawn=true, spawn_proceeding_type_id=11, parent_id set)';
+    END IF;
+
+    IF NOT EXISTS (
+        SELECT 1 FROM paliad.deadline_rules dr
+         WHERE dr.submission_code = 'upc.pi.cfi.appeal_spawn'
+           AND dr.proceeding_type_id = 10
+           AND dr.spawn_proceeding_type_id = 11
+           AND dr.is_spawn = true
+           AND dr.parent_id IS NOT NULL
+           AND dr.lifecycle_state = 'published'
+    ) THEN
+        RAISE EXCEPTION
+            'mig 133: upc.pi.cfi.appeal_spawn shape check failed (expected is_spawn=true, spawn_proceeding_type_id=11, parent_id set)';
+    END IF;
+END $$;

internal/db/testdata/README.md

@@ -0,0 +1,69 @@
+# `internal/db/testdata/` — CI snapshot
+
+## `prod-snapshot.sql`
+
+Schema-only `pg_dump` of paliad's prod DB (youpc-supabase paliad schema)
+plus the rows of `paliad.applied_migrations` that match this branch's
+on-disk migration set.
+
+**Purpose.** Lets CI's migration smoke (`.gitea/workflows/test.yaml`)
+restore a Postgres scratch DB to "paliad at HEAD-of-snapshot" without
+having to replay 131 migrations from scratch. ApplyMigrations on the
+restored DB sees the applied set and only runs whatever NEW migrations
+this PR adds — exactly the integration shape we want to test, and the
+same shape prod sees on every deploy.
+
+**Why a snapshot at all.** Running ApplyMigrations from scratch against a
+fresh `supabase/postgres:15.8.1.060` surfaces multiple fresh-DB
+idempotence bugs in historical migrations (raw `COMMIT;` in mig 051,
+missing `CREATE EXTENSION pg_trgm` for mig 037, ALTER POLICY
+exception-handler gaps in mig 024/027 — the last is fixed in this PR).
+Fixing them all is a separate cleanup. The snapshot sidesteps them by
+starting CI from a state where every historical migration is already
+applied as it was in prod.
+
+**Schema scope.** `--schema=paliad` only. Auth schema comes baked into
+`supabase/postgres`; CI's setup step installs `pg_trgm` before restoring.
+
+**Ownership.** `--no-owner --no-privileges` keeps the dump portable
+across role topologies (CI's supabase_admin / postgres / authenticated /
+anon don't have to match prod's exact role layout). The role-split smoke
+relies on `postgres` being a non-superuser, which is true on
+supabase/postgres by default.
+
+**Refresh.** Run `make refresh-snapshot` with `PALIAD_PROD_DATABASE_URL`
+set to a Postgres URL with `pg_dump` rights on youpc-supabase. The
+target appends data rows for `paliad.applied_migrations`, strips
+`\restrict` / `\unrestrict` commands (pg 16 dump → pg 15 restore), and
+filters out applied-migrations rows for versions beyond the branch's
+local max. The CI workflow consumes the resulting file verbatim.
+
+**Verify a refresh.** Boot a local scratch:
+
+```bash
+docker run -d --rm --name paliad-snap \
+  -e POSTGRES_PASSWORD=ci -e POSTGRES_DB=paliad_scratch \
+  -p 15433:5432 supabase/postgres:15.8.1.060
+sleep 5
+docker exec -e PGPASSWORD=ci paliad-snap psql -h localhost -U supabase_admin -d paliad_scratch \
+  -c "GRANT CREATE ON DATABASE paliad_scratch TO postgres;" \
+  -c "CREATE EXTENSION IF NOT EXISTS pg_trgm;"
+cat internal/db/testdata/prod-snapshot.sql | docker exec -i -e PGPASSWORD=ci paliad-snap \
+  psql -h localhost -U postgres -d paliad_scratch -v ON_ERROR_STOP=1
+TEST_DATABASE_URL="postgres://postgres:ci@localhost:15433/paliad_scratch?sslmode=disable" \
+TEST_APP_DATABASE_URL="postgres://postgres:ci@localhost:15433/paliad_scratch?sslmode=disable" \
+  go test -count=1 -run 'TestMigrations|TestBootSmoke|TestHealthReady_Live' ./internal/db/ ./cmd/server/
+docker stop paliad-snap
+```
+
+All four named tests must pass. If any fails after a refresh,
+investigate before merging — usually because a new migration was added
+to prod that this branch doesn't have on disk yet.
+
+**Why is the snapshot not gzipped?** Small enough (~200 KB) that the
+diff stays human-readable in `git diff` reviews. If it crosses ~1 MB,
+gzip + decompress-on-restore in CI.
+
+**Privacy.** Schema-only dump, no row data from any paliad table (except
+`paliad.applied_migrations`, which contains migration filenames +
+checksums — public info already in the repo).

internal/handlers/files.go

@@ -97,6 +97,20 @@ var fileRegistry = map[string]fileEntry{
 		RepoName:     "mWorkRepo",
 		FilePath:     "6 - material/Templates/Word/Paliad/" + branding.Name + "/_firm-skeleton.docx",
 	},
+	// English skeleton variant (t-paliad-276). Sibling of
+	// `_skeleton.docx`; used when a draft's language='en' and no
+	// per-code EN template exists. If the file isn't authored yet in
+	// mWorkRepo, the Gitea fetch fails and resolveSubmissionTemplate
+	// falls through to the DE skeleton — visible to the user as the
+	// "Fallback: universelles Skelett" notice on the draft editor.
+	skeletonSubmissionENSlug: {
+		RawURL:       "https://mgit.msbls.de/m/mWorkRepo/raw/branch/main/6%20-%20material/Templates/Word/Paliad/" + branding.Name + "/_skeleton.en.docx",
+		DownloadName: branding.Name + " — Submission skeleton.docx",
+		ContentType:  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+		RepoOwner:    "m",
+		RepoName:     "mWorkRepo",
+		FilePath:     "6 - material/Templates/Word/Paliad/" + branding.Name + "/_skeleton.en.docx",
+	},
 }
 
 // skeletonSubmissionSlug names the universal skeleton template inside
@@ -113,6 +127,11 @@ const skeletonSubmissionSlug = "submission/_skeleton.docx"
 // codes without a dedicated template still render with firm branding.
 const firmSkeletonSubmissionSlug = "submission/_firm-skeleton.docx"
 
+// skeletonSubmissionENSlug names the English skeleton variant used when
+// a draft's language='en' and no per-code EN template exists
+// (t-paliad-276). Same role as skeletonSubmissionSlug but in EN.
+const skeletonSubmissionENSlug = "submission/_skeleton.en.docx"
+
 // submissionTemplateRegistry maps a deadline-rule submission_code to a
 // fileRegistry slug. Lookup order matches the cronus design fallback
 // chain §8: per-firm `templates/{FIRM_NAME}/{code}.docx` first, then
@@ -122,14 +141,32 @@ const firmSkeletonSubmissionSlug = "submission/_firm-skeleton.docx"
 // the file itself lives in mWorkRepo and is served through the shared
 // Gitea proxy cache so refreshes are visible to all consumers in one
 // place.
+//
+// t-paliad-276: codes that ship an EN sibling
+// (e.g. `de.inf.lg.erwidg.en.docx`) also register it in
+// submissionTemplateENRegistry; the language-aware lookup
+// (resolveSubmissionTemplate(ctx, code, lang)) prefers the language-
+// suffixed slug and falls back to the unsuffixed one when no per-firm
+// EN variant exists.
 var submissionTemplateRegistry = map[string]string{
 	"de.inf.lg.erwidg": "submission/de.inf.lg.erwidg.docx",
 }
 
+// submissionTemplateENRegistry maps a submission_code to the EN
+// variant slug. Empty when no EN template has been authored — the
+// lookup falls through to the unsuffixed (DE-baked) template and the
+// editor surfaces the "Fallback: universelles Skelett" notice when
+// even the skeleton has no EN sibling.
+var submissionTemplateENRegistry = map[string]string{}
+
 // fetchSubmissionTemplateBytes returns the per-submission_code template
 // bytes (and provenance SHA) when one is registered. The bool result
 // distinguishes "no per-code template registered" (callers fall back to
 // HL Patents Style) from an upstream fetch error.
+//
+// Language-suffixed variants (t-paliad-276) are served via
+// fetchSubmissionTemplateBytesForLang — this base function returns the
+// unsuffixed registry entry only (the legacy DE-baked template).
 func fetchSubmissionTemplateBytes(ctx context.Context, submissionCode string) ([]byte, string, bool, error) {
 	slug, ok := submissionTemplateRegistry[submissionCode]
 	if !ok {
@@ -235,6 +272,113 @@ func handleFileRefresh(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]string{"ok": "true", "message": "Cache cleared"})
 }
 
+// fetchSubmissionTemplateBytesForLang returns the per-(code, lang)
+// template bytes when a language-suffixed variant is registered. Used
+// only for the EN variant today; DE goes through the unsuffixed
+// fetchSubmissionTemplateBytes (which is the legacy / authoritative
+// DE registry). t-paliad-276.
+//
+// Returned bool = "variant registered AND fetched OK". A registered
+// variant whose file 404s on Gitea returns (nil, "", false, nil) so
+// the caller falls through to the unsuffixed template, mirroring the
+// behaviour for unregistered codes.
+func fetchSubmissionTemplateBytesForLang(ctx context.Context, submissionCode, lang string) ([]byte, string, bool, error) {
+	if lang != "en" {
+		// Only EN has a separate registry today. DE goes through the
+		// unsuffixed path which is the authoritative DE template.
+		return nil, "", false, nil
+	}
+	slug, ok := submissionTemplateENRegistry[submissionCode]
+	if !ok {
+		return nil, "", false, nil
+	}
+	entry, ok := fileRegistry[slug]
+	if !ok {
+		return nil, "", false, fmt.Errorf("file proxy: submission template slug %q not registered", slug)
+	}
+	ce := getCacheEntry(slug)
+
+	ce.mu.RLock()
+	hasData := len(ce.data) > 0
+	needsCheck := time.Since(ce.lastChecked) >= checkInterval
+	ce.mu.RUnlock()
+
+	if !hasData {
+		if err := fileFetch(ce, entry); err != nil {
+			// Treat upstream miss as "variant unavailable" so the
+			// resolver falls through to the DE template instead of
+			// surfacing a 502.
+			log.Printf("file proxy: EN variant fetch failed for %s (%s): %v — falling through", submissionCode, slug, err)
+			return nil, "", false, nil
+		}
+	} else if needsCheck {
+		go fileCheckAndRefresh(ce, entry)
+	}
+
+	ce.mu.RLock()
+	defer ce.mu.RUnlock()
+	if len(ce.data) == 0 {
+		return nil, "", false, nil
+	}
+	out := make([]byte, len(ce.data))
+	copy(out, ce.data)
+	_ = ctx
+	return out, ce.sha, true, nil
+}
+
+// fetchSubmissionSkeletonBytesForLang returns the cached skeleton
+// template bytes for the requested language. EN falls back to DE when
+// the EN skeleton hasn't been authored yet (t-paliad-276). Returned
+// bool flags whether the bytes match the requested language — false
+// means the resolver should communicate "fallback" to the UI.
+func fetchSubmissionSkeletonBytesForLang(ctx context.Context, lang string) ([]byte, string, bool, error) {
+	if lang == "en" {
+		entry, ok := fileRegistry[skeletonSubmissionENSlug]
+		if ok {
+			ce := getCacheEntry(skeletonSubmissionENSlug)
+			ce.mu.RLock()
+			hasData := len(ce.data) > 0
+			needsCheck := time.Since(ce.lastChecked) >= checkInterval
+			ce.mu.RUnlock()
+			if !hasData {
+				if err := fileFetch(ce, entry); err == nil {
+					ce.mu.RLock()
+					if len(ce.data) > 0 {
+						out := make([]byte, len(ce.data))
+						copy(out, ce.data)
+						sha := ce.sha
+						ce.mu.RUnlock()
+						return out, sha, true, nil
+					}
+					ce.mu.RUnlock()
+				} else {
+					log.Printf("file proxy: EN skeleton fetch failed (%s): %v — falling back to DE", skeletonSubmissionENSlug, err)
+				}
+			} else {
+				if needsCheck {
+					go fileCheckAndRefresh(ce, entry)
+				}
+				ce.mu.RLock()
+				if len(ce.data) > 0 {
+					out := make([]byte, len(ce.data))
+					copy(out, ce.data)
+					sha := ce.sha
+					ce.mu.RUnlock()
+					return out, sha, true, nil
+				}
+				ce.mu.RUnlock()
+			}
+		}
+	}
+	// Fall through to the DE skeleton; bool=false flags that the
+	// returned bytes don't carry the requested language.
+	bytes, sha, err := fetchSubmissionSkeletonBytes(ctx)
+	if err != nil {
+		return nil, "", false, err
+	}
+	return bytes, sha, lang == "de", nil
+}
+
 // fetchSubmissionSkeletonBytes returns the cached universal skeleton
 // template bytes plus its provenance SHA. Sits between the per-firm
 // per-submission_code template (fetchSubmissionTemplateBytes) and the

internal/handlers/handlers.go

@@ -1,9 +1,13 @@
 package handlers
 
 import (
+	"context"
 	"encoding/json"
 	"net/http"
 	"strings"
+	"time"
+
+	"github.com/jmoiron/sqlx"
 
 	"mgit.msbls.de/m/paliad/internal/auth"
 	"mgit.msbls.de/m/paliad/internal/services"
@@ -50,6 +54,12 @@ func noCachePages(h http.Handler) http.Handler {
 // Services bundles the Phase B + C database-backed services. Pass nil if
 // DATABASE_URL was unset; the matter-management endpoints will return 503.
 type Services struct {
+	// Pool is the raw connection pool. Held so the readiness probe
+	// (/health/ready) can ping it without going through any individual
+	// service. nil when DATABASE_URL was unset — in that case
+	// /health/ready returns 503.
+	Pool *sqlx.DB
+
 	Project        *services.ProjectService
 	Team           *services.TeamService
 	PartnerUnit    *services.PartnerUnitService
@@ -188,6 +198,38 @@ func Register(mux *http.ServeMux, client *auth.Client, giteaAPIToken string, svc
 		_, _ = w.Write([]byte("ok\n"))
 	})
 
+	// Readiness probe. Public, no auth. Distinct from /healthz: this
+	// returns 200 only when the DB pool is reachable. Reaching Register
+	// at all implies db.ApplyMigrations succeeded (cmd/server/main.go
+	// calls it before constructing svc), so a 200 here means "migrations
+	// applied AND pool responsive" — the contract Dokploy / Traefik should
+	// gate on, not the bind-and-serve check that /healthz answers.
+	//
+	// Three outcomes:
+	//   - svc == nil OR svc.Pool == nil  → 503 (DB-less knowledge-platform
+	//     deployments report not-ready so an external orchestrator can
+	//     distinguish them from a full prod boot).
+	//   - PingContext fails within 2 s   → 503 (pool unreachable).
+	//   - PingContext succeeds            → 200 "ready".
+	//
+	// Used by docker-compose.yml's healthcheck (Slice B) and by the
+	// post-deploy verification step in .gitea/workflows/test.yaml.
+	mux.HandleFunc("GET /health/ready", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		if svc == nil || svc.Pool == nil {
+			http.Error(w, "db not configured\n", http.StatusServiceUnavailable)
+			return
+		}
+		ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
+		defer cancel()
+		if err := svc.Pool.PingContext(ctx); err != nil {
+			http.Error(w, "db unreachable\n", http.StatusServiceUnavailable)
+			return
+		}
+		_, _ = w.Write([]byte("ready\n"))
+	})
+
 	// API endpoints (JSON, public)
 	mux.HandleFunc("POST /api/login", handleAPILogin)
 	mux.HandleFunc("POST /api/register", handleAPIRegister)
@@ -416,6 +458,7 @@ func Register(mux *http.ServeMux, client *auth.Client, giteaAPIToken string, svc
 	// t-paliad-139 — set unit_role on a member.
 	protected.HandleFunc("PATCH /api/partner-units/{id}/members/{user_id}/role", handleSetUnitMemberRole)
 
+	protected.HandleFunc("GET /api/parties/search", handlePartiesSearch)
 	protected.HandleFunc("DELETE /api/parties/{id}", handleDeleteParty)
 
 	// Phase F — Appointments (appointments)

internal/handlers/projects.go

@@ -701,6 +701,31 @@ func handleCreateParty(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusCreated, p)
 }
 
+// GET /api/parties/search?q=...
+//
+// Cross-project party picker for the submission-draft editor
+// (t-paliad-287). Returns up to 25 parties from every project the
+// caller can see, matched by case-insensitive substring on name or
+// representative. Empty q returns the 20 most-recently-updated rows so
+// the picker isn't blank on first open. Visibility is enforced in the
+// service layer via the same predicate every project-scoped read uses.
+func handlePartiesSearch(w http.ResponseWriter, r *http.Request) {
+	if !requireDB(w) {
+		return
+	}
+	uid, ok := requireUser(w, r)
+	if !ok {
+		return
+	}
+	q := r.URL.Query().Get("q")
+	hits, err := dbSvc.parties.Search(r.Context(), uid, q, 25)
+	if err != nil {
+		writeServiceError(w, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"results": hits})
+}
+
 // DELETE /api/parties/{id}
 func handleDeleteParty(w http.ResponseWriter, r *http.Request) {
 	if !requireDB(w) {

internal/handlers/submission_drafts.go

@@ -68,6 +68,17 @@ type submissionDraftView struct {
 	Lang            string                  `json:"lang"`
 	HasTemplate     bool                    `json:"has_template"`
 	TemplateMissing bool                    `json:"template_missing,omitempty"`
+	// TemplateTier identifies which tier of resolveSubmissionTemplate
+	// produced the bytes — one of per_code_lang, per_code, skeleton_lang,
+	// skeleton, letterhead. Lets the editor distinguish a perfect
+	// per-firm match from a skeleton fallback. t-paliad-276.
+	TemplateTier string `json:"template_tier,omitempty"`
+	// LanguageFallback is true when the requested draft.language has no
+	// per-firm per-code template (e.g. EN draft falls back to the DE
+	// per-code template, or to the universal skeleton). UI surfaces a
+	// notice so the lawyer knows the rendered body lacks language-
+	// matched code-specific prose. t-paliad-276.
+	LanguageFallback bool `json:"language_fallback,omitempty"`
 	// AvailableParties is the project's full party roster (t-paliad-277)
 	// so the frontend can render the multi-select picker in one round-
 	// trip. Empty when the draft has no project attached.
@@ -89,6 +100,7 @@ type submissionDraftJSON struct {
 	SubmissionCode  string                  `json:"submission_code"`
 	UserID          uuid.UUID               `json:"user_id"`
 	Name            string                  `json:"name"`
+	Language        string                  `json:"language"`
 	Variables       services.PlaceholderMap `json:"variables"`
 	SelectedParties []uuid.UUID             `json:"selected_parties"`
 	LastExportedAt  *time.Time              `json:"last_exported_at,omitempty"`
@@ -119,6 +131,7 @@ type submissionDraftPatchInput struct {
 	Name            *string                  `json:"name,omitempty"`
 	Variables       *services.PlaceholderMap `json:"variables,omitempty"`
 	SelectedParties *[]uuid.UUID             `json:"selected_parties,omitempty"`
+	Language        *string                  `json:"language,omitempty"`
 }
 
 // ─────────────────────────────────────────────────────────────────────
@@ -353,7 +366,12 @@ func handlePatchSubmissionDraft(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	patch := services.DraftPatch{Name: input.Name, Variables: input.Variables, SelectedParties: input.SelectedParties}
+	patch := services.DraftPatch{
+		Name:            input.Name,
+		Variables:       input.Variables,
+		SelectedParties: input.SelectedParties,
+		Language:        input.Language,
+	}
 	d, err := dbSvc.submissionDraft.Update(r.Context(), uid, draftID, patch)
 	if err != nil {
 		writeSubmissionDraftServiceError(w, err)
@@ -434,7 +452,7 @@ func handlePreviewSubmissionDraft(w http.ResponseWriter, r *http.Request) {
 		writeSubmissionDraftServiceError(w, err)
 		return
 	}
-	tplBytes, _, err := resolveSubmissionTemplate(ctx, d.SubmissionCode)
+	tplBytes, _, _, err := resolveSubmissionTemplate(ctx, d.SubmissionCode, d.Language)
 	if err != nil {
 		log.Printf("submission_drafts: template fetch (draft=%s): %v", draftID, err)
 		writeJSON(w, http.StatusBadGateway, map[string]string{"error": "template upstream unreachable"})
@@ -483,7 +501,7 @@ func handleExportSubmissionDraft(w http.ResponseWriter, r *http.Request) {
 		writeSubmissionDraftServiceError(w, err)
 		return
 	}
-	tplBytes, tplSHA, err := resolveSubmissionTemplate(ctx, d.SubmissionCode)
+	tplBytes, tplSHA, _, err := resolveSubmissionTemplate(ctx, d.SubmissionCode, d.Language)
 	if err != nil {
 		log.Printf("submission_drafts: export template fetch (draft=%s): %v", draftID, err)
 		writeJSON(w, http.StatusBadGateway, map[string]string{"error": "template upstream unreachable"})
@@ -686,6 +704,7 @@ func handleGetGlobalSubmissionDraft(w http.ResponseWriter, r *http.Request) {
 type globalDraftPatchInput struct {
 	Name      *string                  `json:"name,omitempty"`
 	Variables *services.PlaceholderMap `json:"variables,omitempty"`
+	Language  *string                  `json:"language,omitempty"`
 	// projectIDProvided is true when the JSON included the "project_id"
 	// key (regardless of value); needed to distinguish "no change" from
 	// "set to null". Set by the custom UnmarshalJSON below.
@@ -700,6 +719,7 @@ func (g *globalDraftPatchInput) UnmarshalJSON(data []byte) error {
 	type alias struct {
 		Name            *string                  `json:"name,omitempty"`
 		Variables       *services.PlaceholderMap `json:"variables,omitempty"`
+		Language        *string                  `json:"language,omitempty"`
 		ProjectID       *uuid.UUID               `json:"project_id,omitempty"`
 		SelectedParties *[]uuid.UUID             `json:"selected_parties,omitempty"`
 	}
@@ -709,6 +729,7 @@ func (g *globalDraftPatchInput) UnmarshalJSON(data []byte) error {
 	}
 	g.Name = a.Name
 	g.Variables = a.Variables
+	g.Language = a.Language
 	g.ProjectID = a.ProjectID
 	g.SelectedParties = a.SelectedParties
 	// Detect whether "project_id" was present in the JSON object.
@@ -747,7 +768,12 @@ func handleGlobalPatchSubmissionDraft(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	patch := services.DraftPatch{Name: in.Name, Variables: in.Variables, SelectedParties: in.SelectedParties}
+	patch := services.DraftPatch{
+		Name:            in.Name,
+		Variables:       in.Variables,
+		SelectedParties: in.SelectedParties,
+		Language:        in.Language,
+	}
 	if in.projectIDProvided {
 		pid := in.ProjectID // may be nil → detach
 		patch.ProjectID = &pid
@@ -864,7 +890,7 @@ func handleGlobalExportSubmissionDraft(w http.ResponseWriter, r *http.Request) {
 		writeSubmissionDraftServiceError(w, err)
 		return
 	}
-	tplBytes, tplSHA, err := resolveSubmissionTemplate(ctx, d.SubmissionCode)
+	tplBytes, tplSHA, _, err := resolveSubmissionTemplate(ctx, d.SubmissionCode, d.Language)
 	if err != nil {
 		log.Printf("submission_drafts: export template fetch (draft=%s): %v", draftID, err)
 		writeJSON(w, http.StatusBadGateway, map[string]string{"error": "template upstream unreachable"})
@@ -963,7 +989,7 @@ func buildSubmissionDraftView(ctx context.Context, d *services.SubmissionDraft,
 		view.Rule.LegalSourcePretty = merged["rule.legal_source_pretty"]
 	}
 
-	tplBytes, _, err := resolveSubmissionTemplate(ctx, d.SubmissionCode)
+	tplBytes, _, tier, err := resolveSubmissionTemplate(ctx, d.SubmissionCode, d.Language)
 	if err != nil {
 		log.Printf("submission_drafts: template fetch for view (draft=%s): %v", d.ID, err)
 		view.TemplateMissing = true
@@ -971,6 +997,12 @@ func buildSubmissionDraftView(ctx context.Context, d *services.SubmissionDraft,
 		view.PreviewHTML = `<p class="preview-error">Vorlage konnte nicht geladen werden.</p>`
 		return view, nil
 	}
+	view.TemplateTier = string(tier)
+	// LanguageFallback signals "no per-firm template in the requested
+	// language" — the editor surfaces a notice so the lawyer knows the
+	// rendered body lacks code-specific prose. The per-code DE template
+	// counts as a fallback when the requested language is EN.
+	view.LanguageFallback = languageFallback(d.Language, tier)
 	html, err := dbSvc.submissionDraft.RenderPreview(ctx, d, tplBytes)
 	if err != nil {
 		return nil, err
@@ -979,52 +1011,101 @@ func buildSubmissionDraftView(ctx context.Context, d *services.SubmissionDraft,
 	return view, nil
 }
 
+// submissionTemplateTier enumerates which tier of the template
+// fallback chain produced the bytes returned by resolveSubmissionTemplate.
+// Used by the editor to surface "Fallback: universelles Skelett" when
+// the requested (code, lang) didn't have a dedicated template.
+type submissionTemplateTier string
+
+const (
+	tplTierPerCodeLang  submissionTemplateTier = "per_code_lang"  // {firm}/{code}.{lang}.docx
+	tplTierPerCode      submissionTemplateTier = "per_code"       // {firm}/{code}.docx (unsuffixed)
+	tplTierSkeletonLang submissionTemplateTier = "skeleton_lang"  // _skeleton.{lang}.docx
+	tplTierSkeleton     submissionTemplateTier = "skeleton"       // _skeleton.docx
+	tplTierLetterhead   submissionTemplateTier = "letterhead"     // HL Patents Style .dotm
+)
+
 // resolveSubmissionTemplate returns the .docx bytes for the given
-// submission code. Lookup order matches the cronus design fallback chain
-// §8 plus the t-paliad-259 universal-skeleton slot and the t-paliad-275
-// firm-skeleton slot:
+// (submission_code, language). Merges t-paliad-275 (firm-skeleton tier)
+// and t-paliad-276 (language-selector + EN skeleton tier). Lookup order:
 //
-//  1. per-firm per-submission_code template registered in
-//     submissionTemplateRegistry (e.g. de.inf.lg.erwidg.docx) — code-
-//     specific structure plus the full variable bag.
-//  2. firm-formatted _firm-skeleton.docx — full HL paragraph + character
-//     styles (HLpat-Heading-H1..H5, HLpat-Body-B0, HLpat-Header-Section,
-//     HLpat-Table-Recitals-*, HLpat-Signature, …) preserved from the
-//     source .dotm, the firm letterhead header/footer, plus the full
-//     48-key placeholder bag. Catches every code without a dedicated
-//     template so the editor still renders firm-branded output.
-//  3. universal _skeleton.docx — same variable bag, no firm formatting.
-//     Backstop for when the firm skeleton is unreachable (e.g. a future
-//     firm hasn't authored one yet).
-//  4. universal HL Patents Style .dotm — macro-only letterhead, no
-//     placeholders. Final fallback when even both skeletons are
-//     unreachable (mWorkRepo outage etc.). Preserves the
-//     pre-t-paliad-259 behaviour for resilience.
+//  1. per-firm per-(code, lang) template — most specific. e.g.
+//     `de.inf.lg.erwidg.en.docx` for EN drafts. t-paliad-276.
+//  2. per-firm per-code (unsuffixed) template — DE-baked baseline. The
+//     legacy registry shape from before the language selector landed.
+//  3. universal language-matched skeleton — `_skeleton.en.docx` for EN
+//     drafts. Skipped for DE drafts (steps 4+5 already cover DE).
+//  4. firm-formatted skeleton — `_firm-skeleton.docx` (t-paliad-275).
+//     HL paragraph + character styles + letterhead, full placeholder
+//     bag. DE-flavored: counts as language_fallback=true for EN drafts.
+//  5. universal _skeleton.docx — plain DE skeleton, no firm styles.
+//     Backstop when the firm skeleton is unreachable.
+//  6. universal HL Patents Style .dotm — macro-only letterhead, no
+//     placeholders. Last-ditch when every skeleton tier is unreachable.
 //
-// The returned SHA is the cache entry's commit SHA so the export audit
-// row can record provenance.
-func resolveSubmissionTemplate(ctx context.Context, submissionCode string) ([]byte, string, error) {
-	if data, sha, found, err := fetchSubmissionTemplateBytes(ctx, submissionCode); err != nil {
-		return nil, "", err
+// The returned SHA pins the audit row's template provenance. The tier
+// tells the editor whether the result language-matches the request so
+// it can surface a "Fallback: universelles Skelett" notice.
+func resolveSubmissionTemplate(ctx context.Context, submissionCode, lang string) ([]byte, string, submissionTemplateTier, error) {
+	if lang != "de" && lang != "en" {
+		lang = "de"
+	}
+	// 1. per-(code, lang)
+	if data, sha, found, err := fetchSubmissionTemplateBytesForLang(ctx, submissionCode, lang); err != nil {
+		return nil, "", "", err
 	} else if found {
-		return data, sha, nil
+		return data, sha, tplTierPerCodeLang, nil
 	}
+	// 2. per-code (unsuffixed)
+	if data, sha, found, err := fetchSubmissionTemplateBytes(ctx, submissionCode); err != nil {
+		return nil, "", "", err
+	} else if found {
+		return data, sha, tplTierPerCode, nil
+	}
+	// 3. language-matched skeleton — only meaningful for EN drafts; DE
+	//    drafts fall through to the firm/universal DE skeletons below.
+	if lang == "en" {
+		if data, sha, langMatched, err := fetchSubmissionSkeletonBytesForLang(ctx, lang); err == nil && langMatched {
+			return data, sha, tplTierSkeletonLang, nil
+		}
+	}
+	// 4. firm-formatted skeleton (HL styles, DE prose). For DE drafts
+	//    this is a first-class match; for EN drafts it counts as a
+	//    language fallback (handled by languageFallback()).
 	if data, sha, err := fetchFirmSkeletonBytes(ctx); err == nil {
-		return data, sha, nil
+		return data, sha, tplTierSkeleton, nil
 	} else {
-		log.Printf("submission_drafts: firm-skeleton fetch failed for code=%s, falling back to universal skeleton: %v", submissionCode, err)
+		log.Printf("submission_drafts: firm-skeleton fetch failed for code=%s lang=%s, falling back to universal skeleton: %v", submissionCode, lang, err)
 	}
+	// 5. universal plain DE skeleton.
 	if data, sha, err := fetchSubmissionSkeletonBytes(ctx); err == nil {
-		return data, sha, nil
+		return data, sha, tplTierSkeleton, nil
 	} else {
-		log.Printf("submission_drafts: skeleton fetch failed for code=%s, falling back to HL Patents Style: %v", submissionCode, err)
+		log.Printf("submission_drafts: skeleton fetch failed for code=%s lang=%s, falling back to HL Patents Style: %v", submissionCode, lang, err)
 	}
+	// 6. HL Patents Style letterhead (no placeholders, last-ditch).
 	bytes, err := fetchHLPatentsStyleBytes(ctx)
 	if err != nil {
-		return nil, "", err
+		return nil, "", "", err
 	}
 	sha := hlPatentsStyleSHA()
-	return bytes, sha, nil
+	return bytes, sha, tplTierLetterhead, nil
+}
+
+// languageFallback reports whether the resolved template tier failed
+// to match the requested draft language. For an EN draft, anything
+// other than per_code_lang or skeleton_lang is a fallback (per_code is
+// the legacy DE-baked template, skeleton is the DE skeleton). For a DE
+// draft, only `letterhead` counts as a fallback — the DE skeleton and
+// per-code template are both first-class DE outputs. t-paliad-276.
+func languageFallback(lang string, tier submissionTemplateTier) bool {
+	if tier == tplTierLetterhead {
+		return true
+	}
+	if strings.EqualFold(lang, "en") {
+		return tier != tplTierPerCodeLang && tier != tplTierSkeletonLang
+	}
+	return false
 }
 
 // hlPatentsStyleSHA reads the current cache SHA for the universal
@@ -1050,12 +1131,17 @@ func draftToJSON(d *services.SubmissionDraft) submissionDraftJSON {
 	if selected == nil {
 		selected = []uuid.UUID{}
 	}
+	lang := d.Language
+	if lang == "" {
+		lang = "de"
+	}
 	return submissionDraftJSON{
 		ID:              d.ID,
 		ProjectID:       d.ProjectID,
 		SubmissionCode:  d.SubmissionCode,
 		UserID:          d.UserID,
 		Name:            d.Name,
+		Language:        lang,
 		Variables:       vars,
 		SelectedParties: selected,
 		LastExportedAt:  d.LastExportedAt,

internal/handlers/submission_template_lang_test.go

@@ -0,0 +1,43 @@
+package handlers
+
+// Regression tests for the template-tier → language-fallback mapping
+// (t-paliad-276). The editor surfaces a "Fallback: universelles
+// Skelett" notice when the requested draft language has no per-firm
+// language-matched template — these tests pin which tier counts as a
+// fallback for each language so the UI signal stays stable.
+
+import "testing"
+
+func TestLanguageFallback(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		lang string
+		tier submissionTemplateTier
+		want bool
+	}{
+		// DE drafts: every non-letterhead tier is a first-class match.
+		{"de_per_code_lang", "de", tplTierPerCodeLang, false},
+		{"de_per_code", "de", tplTierPerCode, false},
+		{"de_skeleton_lang", "de", tplTierSkeletonLang, false},
+		{"de_skeleton", "de", tplTierSkeleton, false},
+		{"de_letterhead", "de", tplTierLetterhead, true},
+
+		// EN drafts: per_code (DE-baked) and skeleton (DE-baked) both
+		// surface the fallback notice so the lawyer knows the rendered
+		// body lacks EN prose.
+		{"en_per_code_lang", "en", tplTierPerCodeLang, false},
+		{"en_per_code", "en", tplTierPerCode, true},
+		{"en_skeleton_lang", "en", tplTierSkeletonLang, false},
+		{"en_skeleton", "en", tplTierSkeleton, true},
+		{"en_letterhead", "en", tplTierLetterhead, true},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			t.Parallel()
+			if got := languageFallback(c.lang, c.tier); got != c.want {
+				t.Errorf("languageFallback(%q, %q) = %v, want %v", c.lang, c.tier, got, c.want)
+			}
+		})
+	}
+}

internal/handlers/submissions.go

@@ -304,14 +304,23 @@ func handleGenerateProjectSubmission(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), submissionRenderTimeout)
 	defer cancel()
 
-	tplBytes, _, err := resolveSubmissionTemplate(ctx, submissionCode)
+	// One-shot /generate has no draft row to pull `language` from —
+	// accept `?language=de|en` as an explicit override (t-paliad-276)
+	// and otherwise fall back to the user's UI language.
+	user, _ := dbSvc.users.GetByID(ctx, uid)
+	lang := strings.ToLower(strings.TrimSpace(r.URL.Query().Get("language")))
+	if lang != "de" && lang != "en" {
+		lang = userLang(user)
+	}
+
+	tplBytes, _, _, err := resolveSubmissionTemplate(ctx, submissionCode, lang)
 	if err != nil {
 		log.Printf("submissions: template fetch (project=%s code=%s): %v", projectID, submissionCode, err)
 		writeJSON(w, http.StatusBadGateway, map[string]string{"error": "template upstream unreachable"})
 		return
 	}
 
-	docx, resolved, err := dbSvc.submissionDraft.RenderProjectSubmission(ctx, uid, projectID, submissionCode, tplBytes)
+	docx, resolved, err := dbSvc.submissionDraft.RenderProjectSubmission(ctx, uid, projectID, submissionCode, lang, tplBytes)
 	if err != nil {
 		if errors.Is(err, services.ErrSubmissionRuleNotFound) {
 			writeJSON(w, http.StatusNotFound, map[string]string{

internal/services/filter_spec.go

@@ -51,13 +51,20 @@ const SpecVersion = 1
 // can't bury an in-flight approval, per the design doc §3 carve-out).
 // Set by the bar's `unread_only` axis on /inbox; other surfaces leave
 // it false and the spec is a no-op.
+//
+// Predicates is a flat per-source narrowing record: keys at the top
+// level are data sources ("deadline", "appointment", …) and values are
+// the per-source predicate structs directly. The shape on the wire and
+// the shape the frontend emits agree exactly — see t-paliad-283 for the
+// latent contract bug (Go used to wrap each entry in another Predicates
+// struct, so the frontend's overlay clicks parsed back as no-op).
 type FilterSpec struct {
-	Version    int                       `json:"version"`
-	Sources    []DataSource              `json:"sources"`
-	Scope      ScopeSpec                 `json:"scope"`
-	Time       TimeSpec                  `json:"time"`
-	Predicates map[DataSource]Predicates `json:"predicates,omitempty"`
-	UnreadOnly bool                      `json:"unread_only,omitempty"`
+	Version    int          `json:"version"`
+	Sources    []DataSource `json:"sources"`
+	Scope      ScopeSpec    `json:"scope"`
+	Time       TimeSpec     `json:"time"`
+	Predicates *Predicates  `json:"predicates,omitempty"`
+	UnreadOnly bool         `json:"unread_only,omitempty"`
 }
 
 // ScopeSpec narrows which projects contribute rows. Resolved at query
@@ -147,7 +154,8 @@ const (
 )
 
 // Predicates is the per-source narrowing payload. Empty fields mean
-// "no narrowing" — never "exclude all".
+// "no narrowing" — never "exclude all". One field per data source;
+// the wire shape is the same: `{"deadline": {...}, "appointment": {...}}`.
 type Predicates struct {
 	Deadline        *DeadlinePredicates        `json:"deadline,omitempty"`
 	Appointment     *AppointmentPredicates     `json:"appointment,omitempty"`
@@ -305,14 +313,25 @@ func (s *FilterSpec) Validate() error {
 		return err
 	}
 
-	for src, preds := range s.Predicates {
-		if !isKnownSource(src) {
-			return fmt.Errorf("%w: predicates set on unknown source %q", ErrInvalidInput, src)
+	if s.Predicates != nil {
+		// Reject predicates set on a source the spec doesn't list — we'd
+		// silently drop the narrowing otherwise. Walk the set fields.
+		type srcCheck struct {
+			src     DataSource
+			present bool
 		}
-		if !seen[src] {
-			return fmt.Errorf("%w: predicates set on source %q which is not selected", ErrInvalidInput, src)
+		checks := []srcCheck{
+			{SourceDeadline, s.Predicates.Deadline != nil},
+			{SourceAppointment, s.Predicates.Appointment != nil},
+			{SourceProjectEvent, s.Predicates.ProjectEvent != nil},
+			{SourceApprovalRequest, s.Predicates.ApprovalRequest != nil},
 		}
-		if err := preds.validate(); err != nil {
+		for _, c := range checks {
+			if c.present && !seen[c.src] {
+				return fmt.Errorf("%w: predicates set on source %q which is not selected", ErrInvalidInput, c.src)
+			}
+		}
+		if err := s.Predicates.validate(); err != nil {
 			return err
 		}
 	}

internal/services/filter_spec_predicates_test.go

@@ -0,0 +1,125 @@
+package services
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+// t-paliad-283 regression: the bar's chip clicks POST a `predicates`
+// payload shaped as `{<source>: <per-source>}`. The Go side previously
+// declared `Predicates map[DataSource]Predicates` — a doubled-nested
+// shape — which silently unmarshalled the bar's payload as no-op
+// narrowing. This test pins the wire shape so the contract can't drift
+// again.
+//
+// Run with `go test ./internal/services/`.
+
+func TestFilterSpec_FlatPredicatesWireShape(t *testing.T) {
+	// The shape every chip click in the FilterBar emits: predicates is
+	// keyed by data source, value is the per-source predicate struct
+	// directly. Doubled-nesting would unmarshal as empty Predicates.
+	const wire = `{
+		"version": 1,
+		"sources": ["deadline", "appointment", "project_event", "approval_request"],
+		"scope": {"projects": {"mode": "all_visible"}},
+		"time": {"field": "auto", "horizon": "past_30d"},
+		"predicates": {
+			"deadline": {"status": ["pending"]},
+			"appointment": {"appointment_types": ["hearing"]},
+			"project_event": {"event_types": ["deadline_created"]},
+			"approval_request": {"viewer_role": "any_visible", "status": ["pending"]}
+		}
+	}`
+
+	var spec FilterSpec
+	if err := json.Unmarshal([]byte(wire), &spec); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if err := spec.Validate(); err != nil {
+		t.Fatalf("validate: %v", err)
+	}
+	if spec.Predicates == nil {
+		t.Fatal("predicates must be non-nil after unmarshalling the bar's shape")
+	}
+	if spec.Predicates.Deadline == nil || len(spec.Predicates.Deadline.Status) != 1 || spec.Predicates.Deadline.Status[0] != "pending" {
+		t.Errorf("deadline.status must round-trip, got %+v", spec.Predicates.Deadline)
+	}
+	if spec.Predicates.Appointment == nil || len(spec.Predicates.Appointment.AppointmentTypes) != 1 {
+		t.Errorf("appointment.appointment_types must round-trip, got %+v", spec.Predicates.Appointment)
+	}
+	if spec.Predicates.ProjectEvent == nil || len(spec.Predicates.ProjectEvent.EventTypes) != 1 {
+		t.Errorf("project_event.event_types must round-trip, got %+v", spec.Predicates.ProjectEvent)
+	}
+	if spec.Predicates.ApprovalRequest == nil || spec.Predicates.ApprovalRequest.ViewerRole != "any_visible" {
+		t.Errorf("approval_request.viewer_role must round-trip, got %+v", spec.Predicates.ApprovalRequest)
+	}
+}
+
+// The shipped FilterSpec must marshal back to exactly the flat shape
+// the frontend declares in views/types.ts. Otherwise /api/views/system
+// (which serializes the InboxSystemView's Filter for the bar) returns a
+// shape the frontend can't consume without translation gymnastics.
+func TestFilterSpec_MarshalFlatPredicatesShape(t *testing.T) {
+	spec := FilterSpec{
+		Version: SpecVersion,
+		Sources: []DataSource{SourceDeadline},
+		Scope:   ScopeSpec{Projects: ScopeProjects{Mode: ScopeAllVisible}},
+		Time:    TimeSpec{Horizon: HorizonNext30d, Field: FieldAuto},
+		Predicates: &Predicates{
+			Deadline: &DeadlinePredicates{Status: []string{"pending"}},
+		},
+	}
+	b, err := json.Marshal(spec)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	// Parse back generically so the assertion is on the wire shape, not
+	// on the Go type system that produced it.
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(b, &raw); err != nil {
+		t.Fatalf("re-unmarshal: %v", err)
+	}
+	var preds map[string]json.RawMessage
+	if err := json.Unmarshal(raw["predicates"], &preds); err != nil {
+		t.Fatalf("predicates re-unmarshal: %v", err)
+	}
+	dl, ok := preds["deadline"]
+	if !ok {
+		t.Fatal("predicates.deadline missing — wire shape regressed")
+	}
+	var dlBody map[string]json.RawMessage
+	if err := json.Unmarshal(dl, &dlBody); err != nil {
+		t.Fatalf("deadline body unmarshal: %v", err)
+	}
+	if _, ok := dlBody["status"]; !ok {
+		t.Errorf("predicates.deadline.status must be a top-level field; doubled-nesting reappeared. Body: %s", string(dl))
+	}
+	if _, ok := dlBody["deadline"]; ok {
+		t.Errorf("predicates.deadline must NOT wrap a nested deadline key — that's the t-paliad-283 bug. Body: %s", string(dl))
+	}
+}
+
+// End-to-end pin: the bar's payload after the user clicks
+// "Frist-Status: Erledigt" (completed) must produce a spec whose
+// runDeadlines branch narrows to completed deadlines. Without the
+// t-paliad-283 fix, the unmarshal silently produced an empty Predicates
+// and the SQL ran without the `status='completed'` clause.
+func TestFilterSpec_BarChipPayloadNarrowsDeadlineStatus(t *testing.T) {
+	const barPayload = `{
+		"version": 1,
+		"sources": ["deadline"],
+		"scope": {"projects": {"mode": "all_visible"}},
+		"time": {"field": "auto", "horizon": "past_30d"},
+		"predicates": {"deadline": {"status": ["completed"]}}
+	}`
+	var spec FilterSpec
+	if err := json.Unmarshal([]byte(barPayload), &spec); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if spec.Predicates == nil || spec.Predicates.Deadline == nil {
+		t.Fatal("deadline predicate must survive the round-trip")
+	}
+	if len(spec.Predicates.Deadline.Status) != 1 || spec.Predicates.Deadline.Status[0] != "completed" {
+		t.Errorf("deadline.status must be [\"completed\"], got %+v", spec.Predicates.Deadline.Status)
+	}
+}

internal/services/filter_spec_test.go

@@ -180,8 +180,8 @@ func TestFilterSpec_NewSymmetricHorizonsValidate(t *testing.T) {
 func TestFilterSpec_PredicatesRequireSourceSelected(t *testing.T) {
 	s := validBaseSpec()
 	s.Sources = []DataSource{SourceDeadline}
-	s.Predicates = map[DataSource]Predicates{
-		SourceAppointment: {Appointment: &AppointmentPredicates{AppointmentTypes: []string{"hearing"}}},
+	s.Predicates = &Predicates{
+		Appointment: &AppointmentPredicates{AppointmentTypes: []string{"hearing"}},
 	}
 	if err := s.Validate(); !errors.Is(err, ErrInvalidInput) {
 		t.Fatalf("predicates on unselected source must reject, got %v", err)
@@ -190,8 +190,8 @@ func TestFilterSpec_PredicatesRequireSourceSelected(t *testing.T) {
 
 func TestFilterSpec_DeadlineStatusEnum(t *testing.T) {
 	s := validBaseSpec()
-	s.Predicates = map[DataSource]Predicates{
-		SourceDeadline: {Deadline: &DeadlinePredicates{Status: []string{"weird"}}},
+	s.Predicates = &Predicates{
+		Deadline: &DeadlinePredicates{Status: []string{"weird"}},
 	}
 	if err := s.Validate(); !errors.Is(err, ErrInvalidInput) {
 		t.Fatalf("unknown deadline.status must reject, got %v", err)
@@ -201,8 +201,8 @@ func TestFilterSpec_DeadlineStatusEnum(t *testing.T) {
 func TestFilterSpec_AppointmentTypeEnum(t *testing.T) {
 	s := validBaseSpec()
 	s.Sources = append(s.Sources, SourceAppointment)
-	s.Predicates = map[DataSource]Predicates{
-		SourceAppointment: {Appointment: &AppointmentPredicates{AppointmentTypes: []string{"bogus"}}},
+	s.Predicates = &Predicates{
+		Appointment: &AppointmentPredicates{AppointmentTypes: []string{"bogus"}},
 	}
 	if err := s.Validate(); !errors.Is(err, ErrInvalidInput) {
 		t.Fatalf("unknown appointment_type must reject, got %v", err)
@@ -212,8 +212,8 @@ func TestFilterSpec_AppointmentTypeEnum(t *testing.T) {
 func TestFilterSpec_ProjectEventKindMustBeKnown(t *testing.T) {
 	s := validBaseSpec()
 	s.Sources = []DataSource{SourceProjectEvent}
-	s.Predicates = map[DataSource]Predicates{
-		SourceProjectEvent: {ProjectEvent: &ProjectEventPredicates{EventTypes: []string{"unknown_kind"}}},
+	s.Predicates = &Predicates{
+		ProjectEvent: &ProjectEventPredicates{EventTypes: []string{"unknown_kind"}},
 	}
 	if err := s.Validate(); !errors.Is(err, ErrInvalidInput) {
 		t.Fatalf("unknown project_event kind must reject, got %v", err)
@@ -223,8 +223,8 @@ func TestFilterSpec_ProjectEventKindMustBeKnown(t *testing.T) {
 func TestFilterSpec_ApprovalViewerRoleEnum(t *testing.T) {
 	s := validBaseSpec()
 	s.Sources = []DataSource{SourceApprovalRequest}
-	s.Predicates = map[DataSource]Predicates{
-		SourceApprovalRequest: {ApprovalRequest: &ApprovalRequestPredicates{ViewerRole: "everyone"}},
+	s.Predicates = &Predicates{
+		ApprovalRequest: &ApprovalRequestPredicates{ViewerRole: "everyone"},
 	}
 	if err := s.Validate(); !errors.Is(err, ErrInvalidInput) {
 		t.Fatalf("unknown viewer_role must reject, got %v", err)
@@ -234,8 +234,8 @@ func TestFilterSpec_ApprovalViewerRoleEnum(t *testing.T) {
 func TestFilterSpec_ApprovalRequestStatusEnum(t *testing.T) {
 	s := validBaseSpec()
 	s.Sources = []DataSource{SourceApprovalRequest}
-	s.Predicates = map[DataSource]Predicates{
-		SourceApprovalRequest: {ApprovalRequest: &ApprovalRequestPredicates{Status: []string{"weird"}}},
+	s.Predicates = &Predicates{
+		ApprovalRequest: &ApprovalRequestPredicates{Status: []string{"weird"}},
 	}
 	if err := s.Validate(); !errors.Is(err, ErrInvalidInput) {
 		t.Fatalf("unknown approval_request.status must reject, got %v", err)
@@ -251,15 +251,15 @@ func TestFilterSpec_RoundTripJSON(t *testing.T) {
 			PersonalOnly: false,
 		},
 		Time: TimeSpec{Horizon: HorizonNext30d, Field: FieldAuto},
-		Predicates: map[DataSource]Predicates{
-			SourceDeadline: {Deadline: &DeadlinePredicates{
+		Predicates: &Predicates{
+			Deadline: &DeadlinePredicates{
 				Status:         []string{"pending"},
 				ApprovalStatus: []string{"approved", "pending"},
-			}},
-			SourceApprovalRequest: {ApprovalRequest: &ApprovalRequestPredicates{
+			},
+			ApprovalRequest: &ApprovalRequestPredicates{
 				ViewerRole: "approver_eligible",
 				Status:     []string{"pending"},
-			}},
+			},
 		},
 	}
 	b, err := MarshalFilterSpec(original)

internal/services/party_service.go

@@ -38,6 +38,59 @@ type CreatePartyInput struct {
 	ContactInfo    json.RawMessage `json:"contact_info,omitempty"`
 }
 
+// PartySearchHit is one row of the cross-project party search — a real
+// paliad.parties row enriched with the parent project's title and
+// reference so the picker can render context the lawyer needs to
+// disambiguate identically-named parties on different cases
+// (t-paliad-287).
+type PartySearchHit struct {
+	ID               uuid.UUID `db:"id"                json:"id"`
+	ProjectID        uuid.UUID `db:"project_id"        json:"project_id"`
+	ProjectTitle     string    `db:"project_title"     json:"project_title"`
+	ProjectReference *string   `db:"project_reference" json:"project_reference,omitempty"`
+	Name             string    `db:"name"              json:"name"`
+	Role             *string   `db:"role"              json:"role,omitempty"`
+	Representative   *string   `db:"representative"    json:"representative,omitempty"`
+}
+
+// Search returns parties from every project the caller can see, matched
+// by case-insensitive substring on name OR representative. Empty query
+// returns the 20 most recently-updated parties so the picker isn't
+// blank on first open. Capped at 25 rows; the frontend doesn't paginate
+// (the typical PA looks for one party they remember by name, not browses).
+//
+// Visibility is enforced inline via visibilityPredicatePositional —
+// invisible projects' parties never surface in the result set.
+func (s *PartyService) Search(ctx context.Context, userID uuid.UUID, query string, limit int) ([]PartySearchHit, error) {
+	if limit <= 0 || limit > 50 {
+		limit = 25
+	}
+	q := strings.TrimSpace(query)
+	args := []any{userID}
+	conds := []string{visibilityPredicatePositional("p", 1)}
+	if q != "" {
+		args = append(args, "%"+q+"%")
+		conds = append(conds,
+			fmt.Sprintf(`(pa.name ILIKE $%d OR COALESCE(pa.representative,'') ILIKE $%d)`,
+				len(args), len(args)))
+	}
+	args = append(args, limit)
+	sqlStr := `
+		SELECT pa.id, pa.project_id, p.title AS project_title,
+		       p.reference AS project_reference,
+		       pa.name, pa.role, pa.representative
+		  FROM paliad.parties pa
+		  JOIN paliad.projects p ON p.id = pa.project_id
+		 WHERE ` + strings.Join(conds, " AND ") + `
+		 ORDER BY pa.updated_at DESC
+		 LIMIT $` + fmt.Sprintf("%d", len(args))
+	hits := []PartySearchHit{}
+	if err := s.db.SelectContext(ctx, &hits, sqlStr, args...); err != nil {
+		return nil, fmt.Errorf("search parties: %w", err)
+	}
+	return hits, nil
+}
+
 // ListForProject returns all Parties for the Project, visibility-checked.
 func (s *PartyService) ListForProject(ctx context.Context, userID, projectID uuid.UUID) ([]models.Party, error) {
 	if _, err := s.projects.GetByID(ctx, userID, projectID); err != nil {

internal/services/submission_draft_language_test.go

@@ -0,0 +1,79 @@
+package services
+
+// Regression tests for the per-draft language column (t-paliad-276).
+// The draft's `language` value drives both the placeholder-bag
+// language pick (`procedural_event.name` → name_de vs name_en) and the
+// template-variant lookup (`{code}.{lang}.docx` fallback chain). These
+// tests pin the pure-function pieces — Build wiring needs DB fixtures
+// and lives in the handler-layer smoke path.
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"mgit.msbls.de/m/paliad/internal/models"
+)
+
+func TestNormalizeDraftLanguage(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		in   string
+		want string
+	}{
+		{"de", "de"},
+		{"DE", "de"},
+		{" de ", "de"},
+		{"en", "en"},
+		{"EN", "en"},
+		{"  en  ", "en"},
+		{"fr", "de"},  // unknown collapses to de (the CHECK-allowed default)
+		{"", "de"},
+		{"english", "de"}, // strict — only the canonical two-letter code is accepted
+	}
+	for _, c := range cases {
+		if got := normalizeDraftLanguage(c.in); got != c.want {
+			t.Errorf("normalizeDraftLanguage(%q) = %q, want %q", c.in, got, c.want)
+		}
+	}
+}
+
+// The placeholder bag picks the language-matched value for the
+// canonical (procedural_event.name) and legacy (rule.name) keys based
+// on the lang argument. This pins the wiring used by Build when a
+// draft's language overrides the user's UI lang (t-paliad-276).
+func TestAddRuleVars_LanguageSelectsMatchedName(t *testing.T) {
+	t.Parallel()
+	code := "de.inf.lg.erwidg"
+	rule := &models.DeadlineRule{
+		ID:             uuid.New(),
+		SubmissionCode: &code,
+		Name:           "Klageerwiderung",
+		NameEN:         "Statement of Defence",
+	}
+	for _, lang := range []string{"de", "en"} {
+		bag := PlaceholderMap{}
+		addRuleVars(bag, rule, lang)
+		want := rule.Name
+		if strings.EqualFold(lang, "en") {
+			want = rule.NameEN
+		}
+		if got := bag["procedural_event.name"]; got != want {
+			t.Errorf("lang=%s: procedural_event.name = %q, want %q", lang, got, want)
+		}
+		if got := bag["rule.name"]; got != want {
+			t.Errorf("lang=%s: rule.name = %q, want %q (legacy alias must mirror canonical)", lang, got, want)
+		}
+		// The explicit *_de / *_en keys never change — both are always
+		// emitted so a template can pin one regardless of the draft's
+		// language. Regression guard against accidentally
+		// language-gating the explicit variants.
+		if bag["procedural_event.name_de"] != rule.Name {
+			t.Errorf("lang=%s: procedural_event.name_de = %q, want %q", lang, bag["procedural_event.name_de"], rule.Name)
+		}
+		if bag["procedural_event.name_en"] != rule.NameEN {
+			t.Errorf("lang=%s: procedural_event.name_en = %q, want %q", lang, bag["procedural_event.name_en"], rule.NameEN)
+		}
+	}
+}

internal/services/submission_draft_service.go

@@ -43,11 +43,16 @@ import (
 // parties / deadline state to resolve). All callers must check for nil
 // before treating it as a uuid.
 type SubmissionDraft struct {
-	ID                 uuid.UUID      `db:"id"                  json:"id"`
-	ProjectID          *uuid.UUID     `db:"project_id"          json:"project_id,omitempty"`
-	SubmissionCode     string         `db:"submission_code"     json:"submission_code"`
-	UserID             uuid.UUID      `db:"user_id"             json:"user_id"`
-	Name               string         `db:"name"                json:"name"`
+	ID             uuid.UUID  `db:"id"                  json:"id"`
+	ProjectID      *uuid.UUID `db:"project_id"          json:"project_id,omitempty"`
+	SubmissionCode string     `db:"submission_code"     json:"submission_code"`
+	UserID         uuid.UUID  `db:"user_id"             json:"user_id"`
+	Name           string     `db:"name"                json:"name"`
+	// Language is the output language for the generated .docx — 'de' or
+	// 'en'. Drives the template-variant lookup ({code}.{lang}.docx
+	// fallback chain) and language-aware variable resolution
+	// ({{procedural_event.name}} → name_de or name_en). t-paliad-276.
+	Language           string         `db:"language"            json:"language"`
 	VariablesRaw       []byte         `db:"variables"           json:"-"`
 	SelectedPartiesRaw pq.StringArray `db:"selected_parties"    json:"-"`
 	LastExportedAt     *time.Time     `db:"last_exported_at"    json:"last_exported_at,omitempty"`
@@ -108,6 +113,10 @@ type DraftPatch struct {
 	// the column; pass *p = nil or an empty slice to reset to "include
 	// every party on the project" (the backward-compat default).
 	SelectedParties *[]uuid.UUID
+
+	// Language sets the output language. Valid values: "de", "en".
+	// Anything else returns ErrInvalidInput. t-paliad-276.
+	Language *string
 }
 
 // ErrSubmissionDraftNotFound is the sentinel for "no draft with that id
@@ -120,7 +129,7 @@ var ErrSubmissionDraftNameTaken = errors.New("submission draft: name already tak
 
 // draftColumns is the canonical select list — kept in one place so
 // every fetch stays in sync.
-const draftColumns = `id, project_id, submission_code, user_id, name,
+const draftColumns = `id, project_id, submission_code, user_id, name, language,
                       variables, selected_parties,
                       last_exported_at, last_exported_sha,
                       last_imported_at,
@@ -173,7 +182,7 @@ type DraftWithProject struct {
 func (s *SubmissionDraftService) ListAllForUser(ctx context.Context, userID uuid.UUID) ([]DraftWithProject, error) {
 	var rows []DraftWithProject
 	err := s.db.SelectContext(ctx, &rows,
-		`SELECT d.id, d.project_id, d.submission_code, d.user_id, d.name,
+		`SELECT d.id, d.project_id, d.submission_code, d.user_id, d.name, d.language,
 		        d.variables, d.selected_parties,
 		        d.last_exported_at, d.last_exported_sha, d.last_imported_at,
 		        d.created_at, d.updated_at,
@@ -280,13 +289,18 @@ func (s *SubmissionDraftService) Create(ctx context.Context, userID uuid.UUID, p
 	if err != nil {
 		return nil, err
 	}
+	// Seed the new draft's output language from the user's UI lang so
+	// the editor opens in the language the lawyer is already working in.
+	// Anything other than "en" normalizes to "de" — matches the DB CHECK
+	// constraint and the project's primary-language default.
+	draftLang := normalizeDraftLanguage(lang)
 	var d SubmissionDraft
 	err = s.db.GetContext(ctx, &d,
 		`INSERT INTO paliad.submission_drafts
-		     (project_id, submission_code, user_id, name)
-		 VALUES ($1, $2, $3, $4)
+		     (project_id, submission_code, user_id, name, language)
+		 VALUES ($1, $2, $3, $4, $5)
 		 RETURNING `+draftColumns,
-		projectID, submissionCode, userID, name)
+		projectID, submissionCode, userID, name, draftLang)
 	if err != nil {
 		return nil, fmt.Errorf("create submission draft: %w", err)
 	}
@@ -422,6 +436,17 @@ func (s *SubmissionDraftService) Update(ctx context.Context, userID, draftID uui
 		idx++
 	}
 
+	if patch.Language != nil {
+		newLang := strings.ToLower(strings.TrimSpace(*patch.Language))
+		if newLang != "de" && newLang != "en" {
+			return nil, ErrInvalidInput
+		}
+		setParts = append(setParts, fmt.Sprintf("language = $%d", idx))
+		args = append(args, newLang)
+		idx++
+	}
+
+
 	if len(setParts) == 0 {
 		return existing, nil
 	}
@@ -581,6 +606,10 @@ func (s *SubmissionDraftService) BuildRenderBag(ctx context.Context, draft *Subm
 		ProjectID:       draft.ProjectID,
 		SubmissionCode:  draft.SubmissionCode,
 		SelectedParties: draft.SelectedParties,
+		// The draft's language overrides the user's UI lang — the lawyer
+		// can author an EN draft in a DE-UI session and vice versa
+		// (t-paliad-276). Empty / unknown falls back to "de".
+		Lang: normalizeDraftLanguage(draft.Language),
 	})
 	if err != nil {
 		return nil, nil, err
@@ -635,12 +664,13 @@ func (s *SubmissionDraftService) Export(ctx context.Context, draft *SubmissionDr
 // ProjectService.GetByID — callers get ErrNotFound on no-access.
 // ErrSubmissionRuleNotFound surfaces when no published rule matches the
 // requested submission_code.
-func (s *SubmissionDraftService) RenderProjectSubmission(ctx context.Context, userID, projectID uuid.UUID, submissionCode string, templateBytes []byte) ([]byte, *SubmissionVarsResult, error) {
+func (s *SubmissionDraftService) RenderProjectSubmission(ctx context.Context, userID, projectID uuid.UUID, submissionCode, lang string, templateBytes []byte) ([]byte, *SubmissionVarsResult, error) {
 	pid := projectID
 	resolved, err := s.vars.Build(ctx, SubmissionVarsContext{
 		UserID:         userID,
 		ProjectID:      &pid,
 		SubmissionCode: submissionCode,
+		Lang:           normalizeDraftLanguage(lang),
 	})
 	if err != nil {
 		return nil, nil, err
@@ -698,6 +728,19 @@ func (d *SubmissionDraft) decodeSelectedParties() error {
 	return nil
 }
 
+// normalizeDraftLanguage maps any input to one of the two allowed
+// language values for paliad.submission_drafts.language. Anything other
+// than "en" (case-insensitive) collapses to "de" — matches the DB CHECK
+// constraint, the project's primary-language default, and the seed
+// behaviour for existing rows that came in before the column existed.
+func normalizeDraftLanguage(lang string) string {
+	if strings.EqualFold(strings.TrimSpace(lang), "en") {
+		return "en"
+	}
+	return "de"
+}
+
+
 // Compile-time guard: ensure the *models.User reference in the import
 // graph doesn't get optimised away by linters. The service doesn't
 // dereference User directly — that happens in SubmissionVarsService —

internal/services/submission_vars.go

@@ -83,6 +83,13 @@ type SubmissionVarsContext struct {
 	ProjectID       *uuid.UUID
 	SubmissionCode  string
 	SelectedParties []uuid.UUID
+	// Lang pins the output language for this Build, overriding the
+	// caller's UI preference (user.Lang). When empty, Build falls back
+	// to user.Lang so existing callers (the format-only Slice 1 path)
+	// keep working unchanged. The draft editor passes the per-draft
+	// `language` column (t-paliad-276) so DE/EN can be picked
+	// independently of the UI session.
+	Lang string
 }
 
 // SubmissionVarsResult bundles the placeholder map with the lookup
@@ -132,7 +139,15 @@ func (s *SubmissionVarsService) Build(ctx context.Context, in SubmissionVarsCont
 		return nil, err
 	}
 
-	lang := user.Lang
+	// Per-call Lang override (t-paliad-276) wins over the user's UI
+	// language so the draft editor can render an EN .docx from a DE-UI
+	// session and vice versa. Falls back to the user pref when the
+	// caller didn't specify, preserving the format-only Slice 1
+	// behaviour.
+	lang := strings.ToLower(strings.TrimSpace(in.Lang))
+	if lang != "de" && lang != "en" {
+		lang = user.Lang
+	}
 	if lang == "" {
 		lang = "de"
 	}

internal/services/system_views.go

@@ -66,8 +66,8 @@ func AgendaSystemView() SystemView {
 			Sources: []DataSource{SourceDeadline, SourceAppointment},
 			Scope:   ScopeSpec{Projects: ScopeProjects{Mode: ScopeAllVisible}},
 			Time:    TimeSpec{Horizon: HorizonNext30d, Field: FieldAuto},
-			Predicates: map[DataSource]Predicates{
-				SourceDeadline: {Deadline: &DeadlinePredicates{Status: []string{"pending"}}},
+			Predicates: &Predicates{
+				Deadline: &DeadlinePredicates{Status: []string{"pending"}},
 			},
 		},
 		Render: RenderSpec{
@@ -126,14 +126,14 @@ func InboxSystemView() SystemView {
 			Sources: []DataSource{SourceApprovalRequest, SourceProjectEvent},
 			Scope:   ScopeSpec{Projects: ScopeProjects{Mode: ScopeAllVisible}},
 			Time:    TimeSpec{Horizon: HorizonPast30d, Field: FieldAuto},
-			Predicates: map[DataSource]Predicates{
-				SourceApprovalRequest: {ApprovalRequest: &ApprovalRequestPredicates{
+			Predicates: &Predicates{
+				ApprovalRequest: &ApprovalRequestPredicates{
 					ViewerRole: "any_visible",
 					Status:     []string{"pending"},
-				}},
-				SourceProjectEvent: {ProjectEvent: &ProjectEventPredicates{
+				},
+				ProjectEvent: &ProjectEventPredicates{
 					EventTypes: InboxProjectEventKinds,
-				}},
+				},
 			},
 		},
 		Render: RenderSpec{
@@ -159,10 +159,10 @@ func InboxRequesterSystemView() SystemView {
 			Sources: []DataSource{SourceApprovalRequest},
 			Scope:   ScopeSpec{Projects: ScopeProjects{Mode: ScopeAllVisible}},
 			Time:    TimeSpec{Horizon: HorizonAny, Field: FieldAuto},
-			Predicates: map[DataSource]Predicates{
-				SourceApprovalRequest: {ApprovalRequest: &ApprovalRequestPredicates{
+			Predicates: &Predicates{
+				ApprovalRequest: &ApprovalRequestPredicates{
 					ViewerRole: "self_requested",
-				}},
+				},
 			},
 		},
 		Render: RenderSpec{

internal/services/system_views_test.go

@@ -82,11 +82,10 @@ func TestInboxSystemView_RowActionInbox(t *testing.T) {
 
 func TestInboxSystemView_CuratedProjectEventKinds(t *testing.T) {
 	sv := InboxSystemView()
-	preds := sv.Filter.Predicates[SourceProjectEvent]
-	if preds.ProjectEvent == nil {
+	if sv.Filter.Predicates == nil || sv.Filter.Predicates.ProjectEvent == nil {
 		t.Fatal("InboxSystemView must narrow project_event predicates")
 	}
-	got := preds.ProjectEvent.EventTypes
+	got := sv.Filter.Predicates.ProjectEvent.EventTypes
 	if len(got) != len(InboxProjectEventKinds) {
 		t.Errorf("expected %d curated kinds, got %d", len(InboxProjectEventKinds), len(got))
 	}

internal/services/view_service.go

@@ -234,8 +234,8 @@ func (s *EventService) runDeadlines(ctx context.Context, userID uuid.UUID, spec
 		uid := userID
 		df.CreatedBy = &uid
 	}
-	if preds, ok := spec.Predicates[SourceDeadline]; ok && preds.Deadline != nil {
-		dp := preds.Deadline
+	if spec.Predicates != nil && spec.Predicates.Deadline != nil {
+		dp := spec.Predicates.Deadline
 		// Status: ListFilter has DeadlineStatusFilter (single-value filter).
 		// If the spec asks for both pending+completed → no narrowing; if
 		// only pending → DeadlineFilterPending; only completed → Completed.
@@ -317,8 +317,8 @@ func (s *EventService) runAppointments(ctx context.Context, userID uuid.UUID, sp
 	}
 	af.From = bounds.from
 	af.To = bounds.to
-	if preds, ok := spec.Predicates[SourceAppointment]; ok && preds.Appointment != nil {
-		ap := preds.Appointment
+	if spec.Predicates != nil && spec.Predicates.Appointment != nil {
+		ap := spec.Predicates.Appointment
 		// AppointmentListFilter takes a single Type today; narrow to first
 		// listed value, fall back to all if multiple.
 		if len(ap.AppointmentTypes) == 1 {
@@ -482,21 +482,24 @@ func (s *EventService) runProjectEvents(ctx context.Context, userID uuid.UUID, s
 // ApprovalService inbox queries. ViewerRole picks which underlying
 // query runs.
 func (s *EventService) runApprovalRequests(ctx context.Context, userID uuid.UUID, spec FilterSpec, approval *ApprovalService, bounds viewSpecBounds) ([]ViewRow, error) {
-	preds := spec.Predicates[SourceApprovalRequest]
+	var ap *ApprovalRequestPredicates
+	if spec.Predicates != nil {
+		ap = spec.Predicates.ApprovalRequest
+	}
 	role := "approver_eligible"
-	if preds.ApprovalRequest != nil && preds.ApprovalRequest.ViewerRole != "" {
-		role = preds.ApprovalRequest.ViewerRole
+	if ap != nil && ap.ViewerRole != "" {
+		role = ap.ViewerRole
 	}
 
 	filter := InboxFilter{}
-	if preds.ApprovalRequest != nil {
+	if ap != nil {
 		// InboxFilter takes a single status today. If the spec says
 		// only one, narrow; if multiple, leave open.
-		if len(preds.ApprovalRequest.Status) == 1 {
-			filter.Status = preds.ApprovalRequest.Status[0]
+		if len(ap.Status) == 1 {
+			filter.Status = ap.Status[0]
 		}
-		if len(preds.ApprovalRequest.EntityTypes) == 1 {
-			filter.EntityType = preds.ApprovalRequest.EntityTypes[0]
+		if len(ap.EntityTypes) == 1 {
+			filter.EntityType = ap.EntityTypes[0]
 		}
 	}
 	if spec.Scope.Projects.Mode == ScopeExplicit && len(spec.Scope.Projects.IDs) == 1 {
@@ -665,19 +668,18 @@ func explicitProjectSet(spec FilterSpec) map[uuid.UUID]bool {
 // approvalStatusMatches checks the entity-side approval_status filter.
 // Returns true when the row passes (no filter set → always true).
 func approvalStatusMatches(rowStatus string, spec FilterSpec, src DataSource) bool {
-	preds, ok := spec.Predicates[src]
-	if !ok {
+	if spec.Predicates == nil {
 		return true
 	}
 	var allowed []string
 	switch src {
 	case SourceDeadline:
-		if preds.Deadline != nil {
-			allowed = preds.Deadline.ApprovalStatus
+		if spec.Predicates.Deadline != nil {
+			allowed = spec.Predicates.Deadline.ApprovalStatus
 		}
 	case SourceAppointment:
-		if preds.Appointment != nil {
-			allowed = preds.Appointment.ApprovalStatus
+		if spec.Predicates.Appointment != nil {
+			allowed = spec.Predicates.Appointment.ApprovalStatus
 		}
 	}
 	if len(allowed) == 0 {
@@ -689,15 +691,15 @@ func approvalStatusMatches(rowStatus string, spec FilterSpec, src DataSource) bo
 // allowedAppointmentTypes returns nil when the filter is open, otherwise
 // a set of legal appointment_type values.
 func allowedAppointmentTypes(spec FilterSpec) map[string]bool {
-	preds, ok := spec.Predicates[SourceAppointment]
-	if !ok || preds.Appointment == nil {
+	if spec.Predicates == nil || spec.Predicates.Appointment == nil {
 		return nil
 	}
-	if len(preds.Appointment.AppointmentTypes) <= 1 {
+	ap := spec.Predicates.Appointment
+	if len(ap.AppointmentTypes) <= 1 {
 		return nil // single-value already pushed down via AppointmentListFilter.Type
 	}
-	out := make(map[string]bool, len(preds.Appointment.AppointmentTypes))
-	for _, t := range preds.Appointment.AppointmentTypes {
+	out := make(map[string]bool, len(ap.AppointmentTypes))
+	for _, t := range ap.AppointmentTypes {
 		out[t] = true
 	}
 	return out
@@ -712,13 +714,16 @@ func allowedAppointmentTypes(spec FilterSpec) map[string]bool {
 // don't want both rows showing up side-by-side. The drop applies to
 // both the explicit caller list and the implicit "all kinds" path.
 func allowedProjectEventKinds(spec FilterSpec) []string {
-	preds, ok := spec.Predicates[SourceProjectEvent]
+	var pe *ProjectEventPredicates
+	if spec.Predicates != nil {
+		pe = spec.Predicates.ProjectEvent
+	}
 	dedupApprovals := slices.Contains(spec.Sources, SourceApprovalRequest)
 
 	var requested []string
 	switch {
-	case ok && preds.ProjectEvent != nil && len(preds.ProjectEvent.EventTypes) > 0:
-		requested = preds.ProjectEvent.EventTypes
+	case pe != nil && len(pe.EventTypes) > 0:
+		requested = pe.EventTypes
 	case dedupApprovals:
 		// No explicit narrowing, but ApprovalRequest is in sources —
 		// rebuild the implicit "all" list so we can subtract approvals.
@@ -750,30 +755,30 @@ func isApprovalAuditKind(kind string) bool {
 // allowedRequestStatuses returns nil for "no narrowing" (or "single value
 // already pushed into InboxFilter.Status").
 func allowedRequestStatuses(spec FilterSpec) map[string]bool {
-	preds, ok := spec.Predicates[SourceApprovalRequest]
-	if !ok || preds.ApprovalRequest == nil {
+	if spec.Predicates == nil || spec.Predicates.ApprovalRequest == nil {
 		return nil
 	}
-	if len(preds.ApprovalRequest.Status) <= 1 {
+	ap := spec.Predicates.ApprovalRequest
+	if len(ap.Status) <= 1 {
 		return nil
 	}
-	out := make(map[string]bool, len(preds.ApprovalRequest.Status))
-	for _, s := range preds.ApprovalRequest.Status {
+	out := make(map[string]bool, len(ap.Status))
+	for _, s := range ap.Status {
 		out[s] = true
 	}
 	return out
 }
 
 func allowedRequestEntityTypes(spec FilterSpec) map[string]bool {
-	preds, ok := spec.Predicates[SourceApprovalRequest]
-	if !ok || preds.ApprovalRequest == nil {
+	if spec.Predicates == nil || spec.Predicates.ApprovalRequest == nil {
 		return nil
 	}
-	if len(preds.ApprovalRequest.EntityTypes) <= 1 {
+	ap := spec.Predicates.ApprovalRequest
+	if len(ap.EntityTypes) <= 1 {
 		return nil
 	}
-	out := make(map[string]bool, len(preds.ApprovalRequest.EntityTypes))
-	for _, t := range preds.ApprovalRequest.EntityTypes {
+	out := make(map[string]bool, len(ap.EntityTypes))
+	for _, t := range ap.EntityTypes {
 		out[t] = true
 	}
 	return out

internal/services/view_service_inbox_test.go

@@ -13,8 +13,8 @@ func TestAllowedProjectEventKinds_DedupsApprovalAudits(t *testing.T) {
 	spec := FilterSpec{
 		Version: SpecVersion,
 		Sources: []DataSource{SourceApprovalRequest, SourceProjectEvent},
-		Predicates: map[DataSource]Predicates{
-			SourceProjectEvent: {ProjectEvent: &ProjectEventPredicates{
+		Predicates: &Predicates{
+			ProjectEvent: &ProjectEventPredicates{
 				EventTypes: []string{
 					"deadline_created",
 					"deadline_approval_requested",
@@ -22,7 +22,7 @@ func TestAllowedProjectEventKinds_DedupsApprovalAudits(t *testing.T) {
 					"approval_decided",
 					"note_created",
 				},
-			}},
+			},
 		},
 	}
 	got := allowedProjectEventKinds(spec)
@@ -47,13 +47,13 @@ func TestAllowedProjectEventKinds_NoDedupWhenApprovalsAbsent(t *testing.T) {
 	spec := FilterSpec{
 		Version: SpecVersion,
 		Sources: []DataSource{SourceProjectEvent},
-		Predicates: map[DataSource]Predicates{
-			SourceProjectEvent: {ProjectEvent: &ProjectEventPredicates{
+		Predicates: &Predicates{
+			ProjectEvent: &ProjectEventPredicates{
 				EventTypes: []string{
 					"deadline_created",
 					"deadline_approval_requested",
 				},
-			}},
+			},
 		},
 	}
 	got := allowedProjectEventKinds(spec)

scripts/gen-hl-skeleton-template/main.go

@@ -315,11 +315,11 @@ func buildDocumentXML() string {
 	body0(&b, "Rechtsgrundlage: {{procedural_event.legal_source_pretty}} ({{procedural_event.legal_source}})")
 	body0(&b, "Typische Partei: {{procedural_event.primary_party}} · Schriftsatz-Typ: {{procedural_event.event_kind}}")
 
-	headerSubsection(&b, "Frist")
-	body0(&b, "Frist-Bezeichnung: {{deadline.title}}")
-	body0(&b, "Fälligkeit: {{deadline.due_date_long_de}} ({{deadline.due_date}})")
-	body0(&b, "Ursprüngliche Frist: {{deadline.original_due_date}}")
-	body0(&b, "Berechnet aus: {{deadline.computed_from}} · Quelle: {{deadline.source}}")
+	// t-paliad-287 — the dedicated Frist block was removed in 2026-05.
+	// {{deadline.*}} placeholders stay resolvable in the variable bag
+	// for custom templates that want them, but the default HL skeleton
+	// no longer renders them in the submission body: the deadline is
+	// internal/admin context and has no place in a court-bound document.
 
 	heading(&b, "HLpat-Heading-H2", "I. Sachverhalt")
 	body0(&b, "[Hier folgt der Sachverhalt. Diese Vorlage ist eine Skelett-Fassung — bitte gemäß Schriftsatz-Typ ({{procedural_event.name}}) ausformulieren.]")
@@ -349,7 +349,6 @@ func buildDocumentXML() string {
 	body1(&b, "EN long date: {{today.long_en}} · Today (bare alias): {{today}}")
 	body1(&b, "Project our side (EN): {{project.our_side_en}} · Proceeding (EN): {{project.proceeding.name_en}}")
 	body1(&b, "Proceeding (DE): {{project.proceeding.name_de}}")
-	body1(&b, "Deadline EN long: {{deadline.due_date_long_en}}")
 	body1(&b, "Procedural event name (DE): {{procedural_event.name_de}} · (EN): {{procedural_event.name_en}}")
 	body1(&b, "Rule legacy aliases — name: {{rule.name}}, name_de: {{rule.name_de}}, name_en: {{rule.name_en}}")
 	body1(&b, "Rule legacy aliases — code: {{rule.submission_code}}, legal_source: {{rule.legal_source}}, legal_source_pretty: {{rule.legal_source_pretty}}")

scripts/gen-skeleton-submission-template/main.go

@@ -137,14 +137,19 @@ const stylesXML = `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 </w:styles>`
 
 // Document body — a code-agnostic Schriftsatz skeleton: firm letterhead +
-// case caption + parties + submission heading + deadline + a single
-// neutral body block. Mirrors the variable bag from SubmissionVarsService
-// (48 keys across firm.* / today.* / user.* / project.* / parties.* /
-// rule.* / deadline.*) without baking in DE-LG-Klageerwiderung-specific
-// structure. A lawyer customising this template for a UPC SoC, EPO
-// opposition, or DPMA appeal replaces the [Schriftsatztext] block and
-// renames the party labels — every placeholder still resolves regardless
-// of the submission_code chosen.
+// case caption + parties + submission heading + a single neutral body
+// block. Mirrors the variable bag from SubmissionVarsService (firm.* /
+// today.* / user.* / project.* / parties.* / rule.*) without baking in
+// DE-LG-Klageerwiderung-specific structure. A lawyer customising this
+// template for a UPC SoC, EPO opposition, or DPMA appeal replaces the
+// [Schriftsatztext] block and renames the party labels — every
+// placeholder still resolves regardless of the submission_code chosen.
+//
+// The {{deadline.*}} placeholders are deliberately NOT rendered by the
+// default skeleton (t-paliad-287). The deadline is internal context for
+// the lawyer, not text that belongs in a court-bound submission. The
+// keys stay resolvable in the bag so a custom template can still
+// reference them where it actually wants them.
 //
 // Every placeholder occupies its own <w:r> run so the renderer's pass-1
 // (format-preserving, single-run) substitution catches it. The
@@ -194,11 +199,12 @@ func buildDocumentXML() string {
 	plain(&b, "Rechtsgrundlage: {{rule.legal_source_pretty}} ({{rule.legal_source}})")
 	plain(&b, "Typische Partei: {{rule.primary_party}} · Schriftsatz-Typ: {{rule.event_type}}")
 
-	heading2(&b, "Frist")
-	plain(&b, "Diese Frist wurde berechnet aus: {{deadline.computed_from}}")
-	plain(&b, "Fälligkeit: {{deadline.due_date_long_de}} ({{deadline.due_date}})")
-	plainOptional(&b, "Ursprüngliche Frist: {{deadline.original_due_date}}")
-	plain(&b, "Frist-Bezeichnung: {{deadline.title}} · Quelle: {{deadline.source}}")
+	// t-paliad-287 — the dedicated Frist block was removed in 2026-05.
+	// {{deadline.*}} placeholders stay resolvable in the variable bag
+	// (lawyer can still drop them into a custom paragraph) but the
+	// default skeleton no longer renders them in the submission body:
+	// the deadline is internal/admin context and has no place in a
+	// document going out to court.
 
 	heading2(&b, "Schriftsatztext")
 	plain(&b, "[Hier folgt der eigentliche Schriftsatztext. Diese Skelett-Vorlage enthält keine vorgefertigte Struktur — bitte gemäß Schriftsatz-Typ ({{rule.name}}) ergänzen.]")
@@ -217,7 +223,7 @@ func buildDocumentXML() string {
 	// the bare {{today}} alias. A lawyer customising the template can
 	// delete this block; the renderer round-trips it cleanly today.
 	heading2(&b, "Locale-aware variants (SKELETON)")
-	plain(&b, "EN long date: {{today.long_en}} · Deadline EN: {{deadline.due_date_long_en}}")
+	plain(&b, "EN long date: {{today.long_en}}")
 	plain(&b, "Project our side (EN): {{project.our_side_en}} · Proceeding (EN): {{project.proceeding.name_en}}")
 	plain(&b, "Rule name (EN): {{rule.name_en}} · Project our side (DE): {{project.our_side_de}}")
 	plain(&b, "Proceeding (DE): {{project.proceeding.name_de}} · Rule name (DE): {{rule.name_de}}")