test(timeline): allow timeline package in entity-location ArchRule

The entities_reside_in_domain_packages ArchUnit rule has a hardcoded allow-list of domain packages; add ..timeline.. so TimelineEvent passes. CI caught this — the new domain package was not yet whitelisted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
docs(timeline): register timeline domain in package tables and diagrams
2026-06-12 23:26:27 +02:00 · 2026-06-12 23:11:08 +02:00 · 2026-06-12 23:10:26 +02:00 · 2026-06-12 23:05:04 +02:00 · 2026-06-12 23:04:02 +02:00 · 2026-06-12 23:02:59 +02:00
13 changed files with 139 additions and 580 deletions
--- a/.gitea/workflows/nightly.yml
+++ b/.gitea/workflows/nightly.yml
@@ -161,147 +161,3 @@ jobs:
        # without first re-evaluating ADR-011.
        if: always()
        run: rm -f .env.staging
-
-  npm-audit:
-    # Independent parallel job — a deploy failure cannot mask the audit signal
-    # and a clean audit cannot hide a broken deploy. Intentionally no `needs:`.
-    #
-    # Scans dev deps too (no --omit=dev), which is deliberately broader than the
-    # PR gate (ci.yml §Security audit) that uses --omit=dev. A nightly broader
-    # result is NOT a PR gate failure — it catches dev-tooling advisories (esbuild,
-    # Vite, etc.) early. See docs/infrastructure/ci-gitea.md §Nightly audit vs PR gate.
-    #
-    # Required Gitea secrets:
-    #   NIGHTLY_AUDIT_TOKEN  — PAT with issues scope only. An issues-only token
-    #                          means a leak via logs/process-args cannot push
-    #                          branches, open PRs, or read repo contents (ADR-041).
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Assert jq is available
-        run: which jq || sudo apt-get install -y jq
-
-      - name: Run npm audit and file tracking issue on findings
-        # Never run under set -x — NIGHTLY_AUDIT_TOKEN in env would leak to logs.
-        env:
-          NIGHTLY_AUDIT_TOKEN: ${{ secrets.NIGHTLY_AUDIT_TOKEN }}
-        run: |
-          MARKER="Nightly npm audit: high-severity advisory"
-          GITEA_URL="${{ github.server_url }}"
-          REPO="${{ github.repository }}"
-          RUN_URL="${GITEA_URL}/${REPO}/actions/runs/${{ github.run_id }}"
-
-          # --- Self-test (mirrors ci.yml §Assert pattern) ---
-          # Tests the exact jq test() call used in the dedupe step, before any
-          # API call, so a broken matcher fails loudly early rather than silently
-          # opening duplicate issues. Proves the regex only — create-vs-update
-          # decision is exercised by the workflow_dispatch AC.
-          echo "{\"title\": \"${MARKER}\"}" \
-            | jq -e --arg m "$MARKER" '.title | test($m; "i")' > /dev/null \
-            || { echo "FAIL: self-test — jq test() missed tracking issue title"; exit 1; }
-          echo '{"title": "fix(deps): update dependency esbuild (CVE-2025-12345)"}' \
-            | jq -e --arg m "$MARKER" '.title | test($m; "i") | not' > /dev/null \
-            || { echo "FAIL: self-test — jq test() incorrectly matched unrelated title"; exit 1; }
-          echo "Self-test passed."
-
-          # --- Run audit ---
-          # No npm ci — audit reads only the lockfile (no network, no install).
-          set +e
-          (cd frontend && npm audit --audit-level=high --json > /tmp/audit.json)
-          AUDIT_EXIT=$?
-          set -e
-
-          if [ "$AUDIT_EXIT" -ne 0 ]; then
-            # --- Build issue body with jq (never string-concat advisory text) ---
-            # Advisory overview/title text is registry-controlled; string-concat
-            # would be an injection/escaping vector into the API body. Truncate
-            # raw excerpt to 500 chars so a pathological overview can't produce
-            # a multi-MB PATCH body.
-            ISSUE_BODY=$(jq -r \
-              --arg run_url "$RUN_URL" \
-              '
-              (.vulnerabilities // {}) as $vulns |
-              ($vulns | to_entries |
-                map(select(.value.severity == "high" or .value.severity == "critical")) |
-                map("- **" + .key + "** (" + .value.severity + ")") |
-                if length > 0 then join("\n") else "_See raw output for details._" end) as $pkg_list |
-              "## npm audit: high/critical advisories\n\n" + $pkg_list +
-              "\n\n**Run:** " + $run_url +
-              "\n\n<details><summary>Raw audit excerpt (first 500 chars)</summary>\n\n```\n" +
-              (tostring | .[0:500]) +
-              "\n```\n\n</details>"
-              ' /tmp/audit.json)
-
-            # --- Dedupe: fetch open security issues, match by title marker ---
-            # Renovate vuln PRs also carry the "security" label, so >1 open
-            # "security" issue WILL occur. Title-match (not just label) ensures
-            # we deduplicate only our own tracking issue.
-            OPEN_ISSUES=$(curl -sf \
-              -H "Authorization: token $NIGHTLY_AUDIT_TOKEN" \
-              "${GITEA_URL}/api/v1/repos/${REPO}/issues?state=open&type=issues&labels=security&limit=50")
-
-            MATCHED=$(echo "$OPEN_ISSUES" | jq \
-              --arg m "$MARKER" \
-              '[.[] | select(.title | test($m; "i"))] | sort_by(.created_at)')
-            MATCH_COUNT=$(echo "$MATCHED" | jq 'length')
-
-            if [ "$MATCH_COUNT" -gt 0 ]; then
-              # Patch the oldest matched issue (append run URL to body).
-              ISSUE_NUMBER=$(echo "$MATCHED" | jq -r '.[0].number')
-              EXISTING_BODY=$(echo "$MATCHED" | jq -r '.[0].body')
-              NEW_BODY=$(jq -n \
-                --arg existing "$EXISTING_BODY" \
-                --arg run_url "$RUN_URL" \
-                '$existing + "\n\n---\n\nUpdated by run: " + $run_url')
-              PAYLOAD=$(jq -n --arg body "$NEW_BODY" '{"body": $body}')
-              curl -sf -X PATCH \
-                -H "Authorization: token $NIGHTLY_AUDIT_TOKEN" \
-                -H "Content-Type: application/json" \
-                -d "$PAYLOAD" \
-                "${GITEA_URL}/api/v1/repos/${REPO}/issues/${ISSUE_NUMBER}" > /dev/null
-              echo "Updated tracking issue #${ISSUE_NUMBER}"
-            else
-              # Closed prior issue that recurs → new issue (not reopened).
-              # A re-opened issue would obscure when the advisory was re-discovered.
-              PAYLOAD=$(jq -n \
-                --arg title "$MARKER" \
-                --arg body "$ISSUE_BODY" \
-                '{"title": $title, "body": $body}')
-              CREATED=$(curl -sf -X POST \
-                -H "Authorization: token $NIGHTLY_AUDIT_TOKEN" \
-                -H "Content-Type: application/json" \
-                -d "$PAYLOAD" \
-                "${GITEA_URL}/api/v1/repos/${REPO}/issues")
-              NEW_NUMBER=$(echo "$CREATED" | jq -r '.number')
-              echo "Opened new tracking issue #${NEW_NUMBER}"
-
-              # Labels are ignored on issue create in Gitea — add in a follow-up call.
-              LABEL_IDS=$(curl -sf \
-                -H "Authorization: token $NIGHTLY_AUDIT_TOKEN" \
-                "${GITEA_URL}/api/v1/repos/${REPO}/labels?limit=50" \
-                | jq '[.[] | select(.name == "security" or .name == "devops" or .name == "P1-high") | .id]')
-              curl -sf -X POST \
-                -H "Authorization: token $NIGHTLY_AUDIT_TOKEN" \
-                -H "Content-Type: application/json" \
-                -d "{\"labels\": $LABEL_IDS}" \
-                "${GITEA_URL}/api/v1/repos/${REPO}/issues/${NEW_NUMBER}/labels" > /dev/null
-            fi
-
-            exit "$AUDIT_EXIT"
-
-          else
-            # --- Heartbeat: proves the job ran and found nothing ---
-            # "No issue created" is only meaningful evidence when paired with a
-            # visible positive signal. Without this, a never-ran job is
-            # indistinguishable from a clean run.
-            #
-            # $GITHUB_STEP_SUMMARY availability is unproven on this runner
-            # (act_runner populates it, but this is the first run to verify it).
-            # Guard before use so an unset variable does not fail the clean-path.
-            MSG="✅ npm audit clean $(date -u)"
-            if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
-              echo "$MSG" >> "$GITHUB_STEP_SUMMARY"
-            fi
-            echo "$MSG"
-          fi
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -1,44 +0,0 @@
-name: Renovate
-
-# Runs Renovate daily to surface newly-published advisories via OSV.dev
-# (osvVulnerabilityAlerts) and open routine update PRs on a weekly batch
-# schedule (see renovate.json §schedule). Security/vulnerability PRs are
-# raised immediately regardless of the weekly schedule window.
-#
-# Required Gitea secrets (see docs/adr/041-renovate-runner-setup.md):
-#   RENOVATE_TOKEN  — PAT with scopes: contents + pull_request + issues
-#                     Belongs to a dedicated bot account. Branch protection
-#                     on main must forbid this bot pushing directly.
-#
-# Platform config is injected via env vars below; the renovate.json in the
-# repo root carries only dependency rules (no platform/endpoint/repos).
-#
-# Digest pin: renovatebot/github-action@8217b3fc286df088d7c27f3255fe8414463bc0fd
-# corresponds to release v46.1.15. Update by bumping both the digest and the
-# renovate-version when Renovate publishes a new release. Renovate itself
-# will open a PR to bump this digest once it runs.
-
-on:
-  schedule:
-    - cron: "0 3 * * *"  # daily at 03:00 UTC — cuts OSV-alert latency to ≤1 day
-  workflow_dispatch:
-
-jobs:
-  renovate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Run Renovate
-        # Pinned by digest — this action holds contents+pull_request+issues
-        # scopes; an unpinned tag is a supply-chain risk (see ADR-041).
-        uses: renovatebot/github-action@8217b3fc286df088d7c27f3255fe8414463bc0fd  # v46.1.15
-        with:
-          configurationFile: renovate.json
-          token: ${{ secrets.RENOVATE_TOKEN }}
-          renovate-version: "46.1.15"
-        env:
-          RENOVATE_PLATFORM: gitea
-          RENOVATE_ENDPOINT: https://git.raddatz.cloud
-          RENOVATE_REPOSITORIES: '["marcel/familienarchiv"]'
-          LOG_LEVEL: info
--- a/backend/src/main/java/org/raddatz/familienarchiv/timeline/TimelineEvent.java
+++ b/backend/src/main/java/org/raddatz/familienarchiv/timeline/TimelineEvent.java
@@ -99,11 +99,9 @@ public class TimelineEvent {
     * CWE-639 — see ADR-040).
     */
    @Column(name = "created_by", nullable = false)
-    @Schema(requiredMode = Schema.RequiredMode.REQUIRED)
    private UUID createdBy;

    @CreationTimestamp
-    @Schema(requiredMode = Schema.RequiredMode.REQUIRED)
    private LocalDateTime createdAt;

    /**
@@ -114,21 +112,18 @@ public class TimelineEvent {
     * stale. Same forgery rationale as {@link #createdBy}.
     */
    @Column(name = "updated_by", nullable = false)
-    @Schema(requiredMode = Schema.RequiredMode.REQUIRED)
    private UUID updatedBy;

    @UpdateTimestamp
-    @Schema(requiredMode = Schema.RequiredMode.REQUIRED)
    private LocalDateTime updatedAt;

    /**
-     * Optimistic-lock version for the multi-curator edit flow (#775). Object {@code Long}
+     * Optimistic-lock version for the multi-curator edit flow (issue 3). Object {@code Long}
     * (not primitive) so it is {@code null} before first persist; Hibernate sets {@code 0} on
     * insert. A concurrent-write conflict must be translated to {@code DomainException.conflict}
     * in the service layer (ADR-040) — otherwise it surfaces as HTTP 500 with Hibernate
     * internals (CWE-209).
     */
    @Version
-    @Schema(requiredMode = Schema.RequiredMode.REQUIRED)
    private Long version;
 }
--- a/backend/src/main/java/org/raddatz/familienarchiv/timeline/TimelineEventRepository.java
+++ b/backend/src/main/java/org/raddatz/familienarchiv/timeline/TimelineEventRepository.java
@@ -5,5 +5,5 @@ import org.springframework.data.jpa.repository.JpaRepository;
 import java.util.UUID;

 public interface TimelineEventRepository extends JpaRepository<TimelineEvent, UUID> {
-    // TODO(#777): findByPersonsContaining(Person) needed for the per-person filter
+    // TODO(issue 5): findByPersonsContaining(Person) needed for the per-person filter
 }
--- a/backend/src/main/resources/db/migration/V77__add_timeline_events.sql
+++ b/backend/src/main/resources/db/migration/V77__add_timeline_events.sql
@@ -56,9 +56,10 @@ CREATE TABLE timeline_event_documents (
 );

 -- Indexes added up-front (avoid the V62 FK-index retrofit debt): the two query columns plus
-- the inverse-side FK columns. timeline_event_id needs no extra index on either join table —
-- it is the leading column of the composite PK, so the PK index already serves those lookups.
+-- explicit indexes on all four FK columns.
 CREATE INDEX idx_timeline_events_event_date ON timeline_events (event_date);
 CREATE INDEX idx_timeline_events_type ON timeline_events (type);
 CREATE INDEX idx_timeline_event_persons_person_id ON timeline_event_persons (person_id);
+CREATE INDEX idx_timeline_event_persons_event_id ON timeline_event_persons (timeline_event_id);
 CREATE INDEX idx_timeline_event_documents_document_id ON timeline_event_documents (document_id);
+CREATE INDEX idx_timeline_event_documents_event_id ON timeline_event_documents (timeline_event_id);
--- a/docs/adr/040-timeline-domain-data-model.md
+++ b/docs/adr/040-timeline-domain-data-model.md
@@ -23,11 +23,11 @@ audit footprint deliberately diverges (see below).
 Curated timeline events are their own concern, not a Lesereise/`Geschichte` subtype.
 The domain owns `TimelineEvent`, `EventType`, and `TimelineEventRepository`.

-### 2. Responses (#775) will be views, not serialized entities
+### 2. Responses (issue 3) will be views, not serialized entities

 `TimelineEvent` has two LAZY `ManyToMany` collections (`persons`, `documents`) and
 `open-in-view` is `false` — exactly the shape that motivated ADR-036 for `geschichte`.
-#775 must assemble `TimelineEventView`/`TimelineEventSummary` inside the service
+Issue 3 must assemble `TimelineEventView`/`TimelineEventSummary` inside the service
 transaction; a serialized entity is a 500 waiting to happen. Decided up front so it is
 not retrofitted later.

@@ -64,7 +64,7 @@ inferred. This divergence is deliberate: a future "bug fix" must not relax it to
 `Document` has neither a version nor a creator. A curated entity edited by multiple curators
 warrants real protection, so `TimelineEvent` adds:

- `@Version Long version` — optimistic locking for the multi-curator edit flow (#775).
+- `@Version Long version` — optimistic locking for the multi-curator edit flow (issue 3).
  Object `Long` (not primitive) so it is `null` before first persist; Hibernate sets `0` on
  insert. The service **must** catch `ObjectOptimisticLockingFailureException` and translate
  it to `DomainException.conflict(...)`. Without that translation a concurrent-write conflict
@@ -82,7 +82,7 @@ session principal before every `save()`, or the timestamp moves while the "who"
 ### 7. `createdBy`/`updatedBy` are server-populated only — never bound from client input

 Both are set from the session principal in the service, never from a request body. Binding
-them from client input is an authorship-forgery / mass-assignment vector (CWE-639). #775's
+them from client input is an authorship-forgery / mass-assignment vector (CWE-639). Issue 3's
 regression suite must include forgery cases on **both** write paths (`POST` body with
 `createdBy`, `PUT` body with `updatedBy`) — create and update are separate binding paths, so
 testing only one leaves half the vector open. The update test must assert `updatedBy` equals
@@ -108,8 +108,5 @@ the event intact (V71/ADR-032 hardening — a person delete must never 500).
  `timeline_events`). No rollback script, no rollback test.
 - The `timeline → document.DatePrecision` compile coupling is permanent until a shared-package
  refactor; precedent already exists (`importing/DocumentImporter`, `person`).
- The service/controller/DTO layer (#775) inherits the view-assembly, optimistic-lock
-  translation, forgery-guard, and permission obligations recorded above. It must also add a
-  service-level title-length check (new `ErrorCode`, e.g. `TIMELINE_TITLE_TOO_LONG`, mirroring
-  `GESCHICHTE_TITLE_TOO_LONG`) — `title` is `VARCHAR(255)`, and without the guard an over-long
-  title surfaces as a raw `DataIntegrityViolationException` → HTTP 500.
+- The service/controller/DTO layer (issue 3) inherits the view-assembly, optimistic-lock
+  translation, forgery-guard, and permission obligations recorded above.
--- a/docs/adr/041-renovate-runner-setup.md
+++ b/docs/adr/041-renovate-runner-setup.md
@@ -1,123 +0,0 @@
-# ADR-041 — Renovate runner stand-up: two-token model, OSV surfacing, digest pinning
-
-**Date:** 2026-06-13  
-**Status:** Accepted  
-**Issue:** [#818](https://git.raddatz.cloud/marcel/familienarchiv/issues/818)
-
---
-
-## Context
-
-Issue #817 (esbuild/cookie advisory) revealed that `main` had no early-warning
-mechanism for newly-published advisories. An advisory landed against already-pinned
-versions, turned the `npm audit --audit-level=high --omit=dev` gate red on `main`,
-and then ambushed the next unrelated PR (#774). The author who hit it did not cause
-it and had no warning.
-
-`renovate.json` existed but `renovatebot` had never actually run: there was no
-`.gitea/workflows/renovate.yml` and zero Renovate-authored PRs in the repo's entire
-history. The three `packageRules` (bucket4j / tiptap / privileged-digest) were
-silently inert.
-
-This ADR records the **negative space** — why specific design choices were made,
-so future maintainers do not "tidy up" toward a worse outcome.
-
---
-
-## Decision
-
-### Why there is no auto-provided `GITEA_TOKEN`
-
-Self-hosted Gitea runners do not auto-inject a `GITEA_TOKEN` equivalent.
-`docs/infrastructure/ci-gitea.md` (and its current line ~251) explicitly states the
-token "must be created manually." No existing workflow in this repo references
-`GITEA_TOKEN` for API calls — only for container registry auth (`docker login`).
-Both `RENOVATE_TOKEN` and `NIGHTLY_AUDIT_TOKEN` must be manually provisioned as
-Gitea secrets by a repository admin.
-
-### Why two tokens, not one
-
-The two jobs have different blast radii on token compromise:
-
-| Token | Scopes | Used by |
-|-------|--------|---------|
-| `RENOVATE_TOKEN` | `contents` + `pull_request` + `issues` | Renovate — must read/write files and open PRs |
-| `NIGHTLY_AUDIT_TOKEN` | `issues` only | Nightly audit — only needs to file a tracking issue |
-
-The nightly job's token appears in step `env:` and is passed to `curl -H`. A leak via
-runner logs, process arguments, or a misconfigured step would expose the token.
-An `issues`-only token cannot push branches, open PRs, or read repository contents —
-the leaked token's blast radius is limited to creating/editing issues.
-
-A single broad token would give any leak path full `contents` + `pull_request` write
-access to the repository. That risk is asymmetric with the upside (one fewer secret).
-
-Both tokens belong to one dedicated bot account (consistent authorship; one identity
-to audit and rotate). **Branch protection on `main` must forbid the bot pushing
-directly**, because a `contents`-scoped token can push to any unprotected branch.
-
-### Why the Renovate action is digest-pinned
-
-`renovatebot/github-action` executes with the `RENOVATE_TOKEN` in scope. That token
-carries `contents` + `pull_request` + `issues` — enough to read files, open PRs, and
-write issues. An unpinned `@v40` tag can be re-pointed by the upstream maintainer
-(or a compromised maintainer account) at any time. A pinned digest (`@<sha>`) cannot
-be silently modified; the SHA is immutable. This is the same threat model applied to
-all privileged CI steps in this repo (see the `matchFileNames` rule in `renovate.json`
-for `.gitea/workflows/**`).
-
-Renovate itself will open a PR to bump the digest when a new release ships, which is
-the intended update path.
-
-### Why `osvVulnerabilityAlerts` is the load-bearing detector on Gitea
-
-Renovate's `vulnerabilityAlerts` config key triggers off a *platform* vulnerability
-graph. GitHub exposes the GitHub Advisory Database via its API; **Gitea does not
-expose an equivalent vulnerability graph**. On self-hosted Gitea, `vulnerabilityAlerts`
-is effectively a label carrier — it attaches the configured labels to PRs that
-`osvVulnerabilityAlerts` already detected, but it is not an independent detector.
-
-`osvVulnerabilityAlerts: true` is the load-bearing flag: Renovate queries
-[OSV.dev](https://osv.dev) directly (platform-agnostic). The runner host must be able
-to reach OSV.dev over HTTPS — if egress is filtered, allow `osv.dev:443` or the flag
-silently no-ops.
-
-### Why the root `schedule` does not mute security PRs
-
-`"schedule": ["before 6am on monday"]` in `renovate.json` batches **routine** dependency
-updates (version bumps outside any security context) to a weekly window. This reduces
-noise from routine update PRs while still allowing review before merge.
-
-**Security and vulnerability PRs bypass the schedule by design** — Renovate raises
-them immediately regardless of the schedule window. A future "tidy-up" that removes
-or widens the schedule cannot mute vulnerability alerts; this is worth stating
-explicitly to prevent that misunderstanding.
-
-### Why `lockFileMaintenance` has no `automerge`
-
-`lockFileMaintenance` refreshes transitive pins weekly so the dependency tree drifts
-into fewer advisories over time. It is explicitly set without `automerge: true` because
-a weekly transitive pin refresh can silently break the build if a transitive dep
-introduces a breaking change. These PRs are small and should be reviewed.
-
-### Why there is no entry in `l2-containers.puml`
-
-`docs/architecture/c4/l2-containers.puml` documents long-lived infrastructure
-containers (services that run continuously). Renovate is a scheduled CI job that runs
-on a Gitea Actions runner and exits — it is not a long-lived container. Adding it to
-the container diagram would misrepresent the architecture. This omission is deliberate,
-not an oversight.
-
---
-
-## Consequences
-
- Newly-published advisories against our frontend dependencies are surfaced within
-  one day (daily Renovate cron) rather than at the next contributor PR.
- A nightly `npm audit` job provides an independent signal for dev-dependency advisories
-  that Renovate may not cover via OSV.
- Two secrets (`RENOVATE_TOKEN`, `NIGHTLY_AUDIT_TOKEN`) must be manually provisioned
-  and rotated annually (or on suspected compromise). See
-  `docs/infrastructure/ci-gitea.md` for the runbook.
- The bot account must be kept active and branch protection on `main` must forbid
-  it pushing directly. These are operational prerequisites, not code invariants.
--- a/docs/architecture/c4/l3-backend-timeline.puml
+++ b/docs/architecture/c4/l3-backend-timeline.puml
@@ -6,10 +6,10 @@ title Component Diagram: API Backend — Timeline (Zeitstrahl)
 ContainerDb(db, "PostgreSQL", "PostgreSQL 16")

 System_Boundary(backend, "API Backend (Spring Boot)") {
-    Component(timelineRepo, "TimelineEventRepository", "Spring Data JPA", "Reads and writes TimelineEvent rows and their persons/documents join tables (timeline_event_persons, timeline_event_documents). Issue #774 ships the repository empty; the per-person filter query lands in #777.")
+    Component(timelineRepo, "TimelineEventRepository", "Spring Data JPA", "Reads and writes TimelineEvent rows and their persons/documents join tables (timeline_event_persons, timeline_event_documents). Issue #774 ships the repository empty; the per-person filter query lands in a later issue.")

-    Component(timelineSvc, "TimelineEventService", "Spring Service (planned, #775)", "Will own curated-event CRUD: assemble TimelineEventView/Summary inside the transaction (lazy ManyToMany + open-in-view=false, per ADR-036/ADR-040), populate createdBy/updatedBy from the session principal, and translate optimistic-lock conflicts to DomainException.conflict.")
-    Component(timelineCtrl, "TimelineEventController", "Spring MVC (planned, #775)", "Will expose /api/timeline reads (READ_ALL) and writes (WRITE_ALL). createdBy/updatedBy are never bound from request bodies (CWE-639).")
+    Component(timelineSvc, "TimelineEventService", "Spring Service (planned, issue 3)", "Will own curated-event CRUD: assemble TimelineEventView/Summary inside the transaction (lazy ManyToMany + open-in-view=false, per ADR-036/ADR-040), populate createdBy/updatedBy from the session principal, and translate optimistic-lock conflicts to DomainException.conflict.")
+    Component(timelineCtrl, "TimelineEventController", "Spring MVC (planned, issue 3)", "Will expose /api/timeline reads (READ_ALL) and writes (WRITE_ALL). createdBy/updatedBy are never bound from request bodies (CWE-639).")
 }

 System_Ext(documentDomain, "Document domain", "Provides DatePrecision (shared value type) and Document references for linked letters")
--- a/docs/infrastructure/ci-gitea.md
+++ b/docs/infrastructure/ci-gitea.md
@@ -462,82 +462,3 @@ jobs:
          name: e2e-results
          path: frontend/test-results/e2e/
 ```
-
---
-
-## Renovate + Nightly Audit — Token Model
-
-> See [ADR-041](../adr/041-renovate-runner-setup.md) for full rationale.
-
-### Two-token model
-
-This repo uses two separate tokens for automated dependency work, both manually
-provisioned as Gitea secrets. There is **no auto-provided `GITEA_TOKEN`** on
-self-hosted Gitea runners — it must be created manually (see §Context Variable Names
-table above).
-
-| Secret | Scopes | Job | Reason |
-|--------|--------|-----|--------|
-| `RENOVATE_TOKEN` | `contents` + `pull_request` + `issues` | `renovate.yml` | Renovate needs to read/write files and open PRs |
-| `NIGHTLY_AUDIT_TOKEN` | `issues` only | `nightly.yml` → `npm-audit` job | Only needs to file a tracking issue; an `issues`-only token cannot push branches or read contents — limits blast radius on leak |
-
-Both tokens belong to a single dedicated bot account. **Branch protection on `main`
-must forbid the bot pushing directly**, because a `contents`-scoped token can push
-to any unprotected branch.
-
-### PAT rotation cadence
-
-Rotate both tokens:
- **Annually** (calendar reminder)
- **Immediately** on suspected compromise (runner log leak, accidental `set -x`, etc.)
-
-Tokens are stored exclusively as Gitea secrets. Never commit them to `.env` files or
-log them. The nightly audit step passes its token via `env:` at the step level, reads
-it as `$NIGHTLY_AUDIT_TOKEN` in the shell, and never runs the API `curl` under
-`set -x`.
-
-### OSV vs platform alerts on Gitea
-
-Renovate's `vulnerabilityAlerts` config key requires a *platform* vulnerability graph.
-**Gitea does not expose one** — it has no equivalent to the GitHub Advisory Database
-API. On this runner, `vulnerabilityAlerts` is a label carrier only: it attaches
-`security` and `P1-high` labels to PRs that `osvVulnerabilityAlerts` already raised.
-
-`osvVulnerabilityAlerts: true` is the load-bearing detector. Renovate queries
-[OSV.dev](https://osv.dev) directly, which works regardless of platform. The runner
-host must be able to reach `osv.dev:443`. If egress is filtered and OSV.dev is
-unreachable, the flag silently no-ops — verify egress when standing up the runner.
-
-### Nightly audit vs PR gate (divergence)
-
-| Gate | Command | Dev deps | When |
-|------|---------|----------|------|
-| PR gate (`ci.yml`) | `npm audit --audit-level=high --omit=dev` | ❌ excluded | Every PR |
-| Nightly audit (`nightly.yml`) | `npm audit --audit-level=high` | ✅ included | Nightly + `workflow_dispatch` |
-
-The nightly job is **deliberately broader** — it catches dev-tooling advisories
-(esbuild, Vite, vitest, etc.) that the PR gate ignores. A red nightly audit job does
-**not** mean the PR gate is broken; the two signals are independent.
-
-### Runbook: nightly-opened tracking issue
-
-When the `npm-audit` job opens or updates the tracking issue
-"Nightly npm audit: high-severity advisory":
-
-1. **Triage severity.** Check the advisory page (link in the issue body). Is it
-   exploitable in production? A dev-only dep (e.g. esbuild, prettier) has no
-   production attack surface — treat as low urgency.
-
-2. **Pin or upgrade.** If a non-breaking upgrade is available, update
-   `frontend/package.json` and regenerate the lockfile. Open a PR.
-
-3. **Override if justified.** If the advisory does not apply (dev-only dep, no
-   exploitable path), add an `npm audit` override in `package.json`:
-   ```json
-   "overrides": { "esbuild": ">=0.25.4" }
-   ```
-   Document the rationale in the PR body. See #817 for the reference decision tree.
-
-4. **Close the tracking issue** once the advisory is resolved or overridden and the
-   nightly job runs clean (verify via the `✅ npm audit clean` heartbeat in the job
-   summary).
--- a/docs/infrastructure/self-hosted-catalogue.md
+++ b/docs/infrastructure/self-hosted-catalogue.md
@@ -151,7 +151,7 @@ receivers:
 name: Renovate
 on:
  schedule:
-    - cron: '0 3 * * *'  # daily at 03:00 UTC — cuts OSV-alert latency to ≤1 day
+    - cron: '0 3 * * 1'  # every Monday at 3am
  workflow_dispatch:

 jobs:
@@ -160,58 +160,32 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: Run Renovate
-        # Pin by digest — this action holds contents+pull_request+issues token;
-        # an unpinned tag is a supply-chain risk. Update digest + renovate-version
-        # together when Renovate publishes a new release.
-        uses: renovatebot/github-action@8217b3fc286df088d7c27f3255fe8414463bc0fd  # v46.1.15
+        uses: renovatebot/github-action@v40
        with:
          configurationFile: renovate.json
-          token: ${{ secrets.RENOVATE_TOKEN }}
-          renovate-version: "46.1.15"
-        env:
-          RENOVATE_PLATFORM: gitea
-          RENOVATE_ENDPOINT: https://gitea.example.com   # replace with your Gitea URL
-          RENOVATE_REPOSITORIES: '["org/repo"]'          # replace with your repo slug
-          LOG_LEVEL: info
+          token: ${{ secrets.GITEA_TOKEN }}
+          renovate-version: latest
 ```

-> **Token:** `RENOVATE_TOKEN` must be a PAT on a dedicated bot account with scopes
-> `contents` + `pull_request` + `issues`. **Do not reuse** `GITEA_TOKEN` — that variable
-> is not auto-provided on self-hosted Gitea runners and must be manually created anyway;
-> using a single broad token violates least-privilege. See ADR-041.
-
 ### Renovate Configuration

-The `renovate.json` in the repo root carries only dependency rules — platform and
-endpoint config is injected via `env:` in the workflow above. Keep the two concerns
-separate so the config file remains portable.
-
 ```json
+// renovate.json
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "osvVulnerabilityAlerts": true,
-  "dependencyDashboard": true,
-  "schedule": ["before 6am on monday"],
-  "vulnerabilityAlerts": {
-    "labels": ["security", "P1-high"]
-  },
-  "lockFileMaintenance": {
-    "enabled": true,
-    "schedule": ["before 6am on monday"]
-  },
+  "platform": "gitea",
+  "endpoint": "https://gitea.example.com",
+  "repositories": ["org/familienarchiv"],
+  "automerge": true,
+  "automergeType": "pr",
  "packageRules": [
    {
-      "matchPackageNames": ["com.example:my-dep"],
-      "automerge": true,
-      "matchUpdateTypes": ["patch"]
+      "matchUpdateTypes": ["patch"],
+      "automerge": true
    }
  ]
 }
 ```

-> **Do not add `automerge: true` at the root.** Security and digest-bump PRs should
-> always be reviewed manually. Per-rule `automerge` on patch-level routine deps is fine.
-
 ---

 ## Secrets Management -- age + git-crypt
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -558,9 +558,9 @@
 			}
 		},
 		"node_modules/@esbuild/aix-ppc64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
-			"integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.7.tgz",
+			"integrity": "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==",
 			"cpu": [
 				"ppc64"
 			],
@@ -574,9 +574,9 @@
 			}
 		},
 		"node_modules/@esbuild/android-arm": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
-			"integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.7.tgz",
+			"integrity": "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==",
 			"cpu": [
 				"arm"
 			],
@@ -590,9 +590,9 @@
 			}
 		},
 		"node_modules/@esbuild/android-arm64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
-			"integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.7.tgz",
+			"integrity": "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==",
 			"cpu": [
 				"arm64"
 			],
@@ -606,9 +606,9 @@
 			}
 		},
 		"node_modules/@esbuild/android-x64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
-			"integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.7.tgz",
+			"integrity": "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==",
 			"cpu": [
 				"x64"
 			],
@@ -622,9 +622,9 @@
 			}
 		},
 		"node_modules/@esbuild/darwin-arm64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
-			"integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.7.tgz",
+			"integrity": "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==",
 			"cpu": [
 				"arm64"
 			],
@@ -638,9 +638,9 @@
 			}
 		},
 		"node_modules/@esbuild/darwin-x64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
-			"integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.7.tgz",
+			"integrity": "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==",
 			"cpu": [
 				"x64"
 			],
@@ -654,9 +654,9 @@
 			}
 		},
 		"node_modules/@esbuild/freebsd-arm64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
-			"integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.7.tgz",
+			"integrity": "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==",
 			"cpu": [
 				"arm64"
 			],
@@ -670,9 +670,9 @@
 			}
 		},
 		"node_modules/@esbuild/freebsd-x64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
-			"integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.7.tgz",
+			"integrity": "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==",
 			"cpu": [
 				"x64"
 			],
@@ -686,9 +686,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-arm": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
-			"integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.7.tgz",
+			"integrity": "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==",
 			"cpu": [
 				"arm"
 			],
@@ -702,9 +702,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-arm64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
-			"integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.7.tgz",
+			"integrity": "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==",
 			"cpu": [
 				"arm64"
 			],
@@ -718,9 +718,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-ia32": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
-			"integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.7.tgz",
+			"integrity": "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==",
 			"cpu": [
 				"ia32"
 			],
@@ -734,9 +734,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-loong64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
-			"integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.7.tgz",
+			"integrity": "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==",
 			"cpu": [
 				"loong64"
 			],
@@ -750,9 +750,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-mips64el": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
-			"integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.7.tgz",
+			"integrity": "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==",
 			"cpu": [
 				"mips64el"
 			],
@@ -766,9 +766,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-ppc64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
-			"integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.7.tgz",
+			"integrity": "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==",
 			"cpu": [
 				"ppc64"
 			],
@@ -782,9 +782,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-riscv64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
-			"integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.7.tgz",
+			"integrity": "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==",
 			"cpu": [
 				"riscv64"
 			],
@@ -798,9 +798,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-s390x": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
-			"integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.7.tgz",
+			"integrity": "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==",
 			"cpu": [
 				"s390x"
 			],
@@ -814,9 +814,9 @@
 			}
 		},
 		"node_modules/@esbuild/linux-x64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
-			"integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.7.tgz",
+			"integrity": "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==",
 			"cpu": [
 				"x64"
 			],
@@ -830,9 +830,9 @@
 			}
 		},
 		"node_modules/@esbuild/netbsd-arm64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
-			"integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.7.tgz",
+			"integrity": "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==",
 			"cpu": [
 				"arm64"
 			],
@@ -846,9 +846,9 @@
 			}
 		},
 		"node_modules/@esbuild/netbsd-x64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
-			"integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.7.tgz",
+			"integrity": "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==",
 			"cpu": [
 				"x64"
 			],
@@ -862,9 +862,9 @@
 			}
 		},
 		"node_modules/@esbuild/openbsd-arm64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
-			"integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.7.tgz",
+			"integrity": "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==",
 			"cpu": [
 				"arm64"
 			],
@@ -878,9 +878,9 @@
 			}
 		},
 		"node_modules/@esbuild/openbsd-x64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
-			"integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.7.tgz",
+			"integrity": "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==",
 			"cpu": [
 				"x64"
 			],
@@ -894,9 +894,9 @@
 			}
 		},
 		"node_modules/@esbuild/openharmony-arm64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
-			"integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.7.tgz",
+			"integrity": "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==",
 			"cpu": [
 				"arm64"
 			],
@@ -910,9 +910,9 @@
 			}
 		},
 		"node_modules/@esbuild/sunos-x64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
-			"integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.7.tgz",
+			"integrity": "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==",
 			"cpu": [
 				"x64"
 			],
@@ -926,9 +926,9 @@
 			}
 		},
 		"node_modules/@esbuild/win32-arm64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
-			"integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.7.tgz",
+			"integrity": "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==",
 			"cpu": [
 				"arm64"
 			],
@@ -942,9 +942,9 @@
 			}
 		},
 		"node_modules/@esbuild/win32-ia32": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
-			"integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.7.tgz",
+			"integrity": "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==",
 			"cpu": [
 				"ia32"
 			],
@@ -958,9 +958,9 @@
 			}
 		},
 		"node_modules/@esbuild/win32-x64": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
-			"integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.7.tgz",
+			"integrity": "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==",
 			"cpu": [
 				"x64"
 			],
@@ -5531,16 +5531,12 @@
 			"license": "MIT"
 		},
 		"node_modules/cookie": {
-			"version": "1.1.1",
-			"resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
-			"integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+			"version": "0.6.0",
+			"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
+			"integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
 			"license": "MIT",
 			"engines": {
-				"node": ">=18"
-			},
-			"funding": {
-				"type": "opencollective",
-				"url": "https://opencollective.com/express"
+				"node": ">= 0.6"
 			}
 		},
 		"node_modules/cross-spawn": {
@@ -5803,9 +5799,9 @@
 			}
 		},
 		"node_modules/esbuild": {
-			"version": "0.28.1",
-			"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
-			"integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.7.tgz",
+			"integrity": "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==",
 			"hasInstallScript": true,
 			"license": "MIT",
 			"bin": {
@@ -5815,32 +5811,32 @@
 				"node": ">=18"
 			},
 			"optionalDependencies": {
-				"@esbuild/aix-ppc64": "0.28.1",
-				"@esbuild/android-arm": "0.28.1",
-				"@esbuild/android-arm64": "0.28.1",
-				"@esbuild/android-x64": "0.28.1",
-				"@esbuild/darwin-arm64": "0.28.1",
-				"@esbuild/darwin-x64": "0.28.1",
-				"@esbuild/freebsd-arm64": "0.28.1",
-				"@esbuild/freebsd-x64": "0.28.1",
-				"@esbuild/linux-arm": "0.28.1",
-				"@esbuild/linux-arm64": "0.28.1",
-				"@esbuild/linux-ia32": "0.28.1",
-				"@esbuild/linux-loong64": "0.28.1",
-				"@esbuild/linux-mips64el": "0.28.1",
-				"@esbuild/linux-ppc64": "0.28.1",
-				"@esbuild/linux-riscv64": "0.28.1",
-				"@esbuild/linux-s390x": "0.28.1",
-				"@esbuild/linux-x64": "0.28.1",
-				"@esbuild/netbsd-arm64": "0.28.1",
-				"@esbuild/netbsd-x64": "0.28.1",
-				"@esbuild/openbsd-arm64": "0.28.1",
-				"@esbuild/openbsd-x64": "0.28.1",
-				"@esbuild/openharmony-arm64": "0.28.1",
-				"@esbuild/sunos-x64": "0.28.1",
-				"@esbuild/win32-arm64": "0.28.1",
-				"@esbuild/win32-ia32": "0.28.1",
-				"@esbuild/win32-x64": "0.28.1"
+				"@esbuild/aix-ppc64": "0.27.7",
+				"@esbuild/android-arm": "0.27.7",
+				"@esbuild/android-arm64": "0.27.7",
+				"@esbuild/android-x64": "0.27.7",
+				"@esbuild/darwin-arm64": "0.27.7",
+				"@esbuild/darwin-x64": "0.27.7",
+				"@esbuild/freebsd-arm64": "0.27.7",
+				"@esbuild/freebsd-x64": "0.27.7",
+				"@esbuild/linux-arm": "0.27.7",
+				"@esbuild/linux-arm64": "0.27.7",
+				"@esbuild/linux-ia32": "0.27.7",
+				"@esbuild/linux-loong64": "0.27.7",
+				"@esbuild/linux-mips64el": "0.27.7",
+				"@esbuild/linux-ppc64": "0.27.7",
+				"@esbuild/linux-riscv64": "0.27.7",
+				"@esbuild/linux-s390x": "0.27.7",
+				"@esbuild/linux-x64": "0.27.7",
+				"@esbuild/netbsd-arm64": "0.27.7",
+				"@esbuild/netbsd-x64": "0.27.7",
+				"@esbuild/openbsd-arm64": "0.27.7",
+				"@esbuild/openbsd-x64": "0.27.7",
+				"@esbuild/openharmony-arm64": "0.27.7",
+				"@esbuild/sunos-x64": "0.27.7",
+				"@esbuild/win32-arm64": "0.27.7",
+				"@esbuild/win32-ia32": "0.27.7",
+				"@esbuild/win32-x64": "0.27.7"
 			}
 		},
 		"node_modules/escalade": {
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -73,9 +73,5 @@
 		"vite-plugin-static-copy": "^4.1.0",
 		"vitest": "^4.0.10",
 		"vitest-browser-svelte": "^2.0.1"
-	},
-	"overrides": {
-		"esbuild": "0.28.1",
-		"cookie": ">=0.7.0"
 	}
 }
--- a/renovate.json
+++ b/renovate.json
@@ -1,15 +1,5 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "osvVulnerabilityAlerts": true,
-  "dependencyDashboard": true,
-  "schedule": ["before 6am on monday"],
-  "vulnerabilityAlerts": {
-    "labels": ["security", "P1-high"]
-  },
-  "lockFileMaintenance": {
-    "enabled": true,
-    "schedule": ["before 6am on monday"]
-  },
  "packageRules": [
    {
      "description": "bucket4j-core is manually pinned outside the Spring BOM — track patch auto-merge, minor/major as PRs.",
@@ -19,13 +9,13 @@
      "matchUpdateTypes": ["patch"]
    },
    {
-      "matchPackageNames": ["/^@tiptap/"],
+      "matchPackagePatterns": ["^@tiptap/"],
      "groupName": "tiptap",
      "automerge": false
    },
    {
      "description": "Digest bumps for images used in privileged CI steps (--privileged --pid=host) must be reviewed manually — a compromised image has root-equivalent host access. Covers .gitea/actions/** too: the reload-caddy alpine digest now lives in a composite action (#603).",
-      "matchFileNames": [".gitea/workflows/**", ".gitea/actions/**"],
+      "matchPaths": [".gitea/workflows/**", ".gitea/actions/**"],
      "matchUpdateTypes": ["digest"],
      "automerge": false,
      "reviewersFromCodeOwners": false
Author	SHA1	Message	Date
Marcel	bed99ff3fe	test(timeline): allow timeline package in entity-location ArchRule Some checks failed CI / Unit & Component Tests (pull_request) Failing after 39s Details CI / OCR Service Tests (pull_request) Successful in 25s Details CI / Backend Unit Tests (pull_request) Successful in 5m45s Details CI / fail2ban Regex (pull_request) Successful in 47s Details CI / Semgrep Security Scan (pull_request) Successful in 24s Details CI / Compose Bucket Idempotency (pull_request) Successful in 1m8s Details The entities_reside_in_domain_packages ArchUnit rule has a hardcoded allow-list of domain packages; add ..timeline.. so TimelineEvent passes. CI caught this — the new domain package was not yet whitelisted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 23:26:27 +02:00
Marcel	27bfa7acbd	docs(timeline): register timeline domain in package tables and diagrams Some checks failed CI / Unit & Component Tests (pull_request) Failing after 47s Details CI / OCR Service Tests (pull_request) Successful in 25s Details CI / Backend Unit Tests (pull_request) Failing after 5m29s Details CI / fail2ban Regex (pull_request) Successful in 47s Details CI / Semgrep Security Scan (pull_request) Successful in 26s Details CI / Compose Bucket Idempotency (pull_request) Successful in 1m7s Details Add timeline/ to the root and backend package tables, TimelineEvent to the domain-model entity tables, TimelineEvent/EventType/Zeitstrahl to the glossary, a new l3-backend-timeline C4 component diagram, and the timeline_events table + two join tables (with their CHECKs and cascade FKs) to the db-orm and db-relationships ER diagrams. Bumps the db-orm snapshot to V77. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 23:11:08 +02:00
Marcel	2d9047a56b	docs(adr): add ADR-040 timeline domain data model Records the architectural commitment for the timeline domain: views-not- entities for issue 3 (ADR-036 rationale), DatePrecision import coupling (ADR-025), the UNKNOWN-forbidden / SEASON-APPROX-legal precision contract, the strict biconditional RANGE CHECK as a deliberate divergence from Document, the @Version + NOT NULL audit-trail decisions, the optimistic- lock-to-conflict translation contract (CWE-209), the server-populated-only createdBy/updatedBy forgery guard (CWE-639), and the EventType stable frontend styling contract. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 23:10:26 +02:00
Marcel	8bc21d8680	test(timeline): cover persistence, constraints, and FK cascade @DataJpaTest against real Postgres (never H2): required-field round-trip, YEAR default, linked persons/documents, eventDateEnd null/range round-trip, TEXT description with no length cap, both RANGE-invariant rejections, the UNKNOWN-precision rejection (NOT_SUPPORTED so the constraint violation does not poison the test transaction), version null-before-persist/0-after-save, and a parameterized accept-side proving DAY/MONTH/SEASON/YEAR/APPROX all persist. makeEvent() defaults createdBy/updatedBy to random UUIDs so every red is red for the intended reason. @SpringBootTest cascade guard: deleting a linked Person/Document via the domain service drops the join row (verified by direct COUNT) and leaves the event intact. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 23:05:04 +02:00
Marcel	23e53bf30b	feat(timeline): add V77 migration for timeline_events table Creates timeline_events plus the timeline_event_persons and timeline_event_documents join tables, all FK columns ON DELETE CASCADE (a person/document delete drops the join row, the event survives — V71-class hardening). Two CHECK constraints push integrity to Postgres: chk_timeline_event_range enforces event_date_end non-null IFF RANGE (a strict biconditional, intentionally tighter than Document's open-ended ranges), and chk_timeline_event_precision forbids exactly UNKNOWN while keeping SEASON/APPROX legal. FK and query-column indexes added up-front to avoid the V62 retrofit debt. Forward-only, additive DDL. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 23:04:02 +02:00
Marcel	cec4ee4415	feat(timeline): add TimelineEvent entity and repository Curated timeline event mirroring Document's date block (eventDate / precision / eventDateEnd) so events and letters share one rendering path. Audit footprint deliberately diverges from Document: @Version optimistic lock plus NOT NULL createdBy/updatedBy for the multi-curator edit flow. precision reuses document.DatePrecision (imported, not duplicated) and defaults to YEAR. ManyToMany persons/documents with explicit @JoinTable + @BatchSize, matching Document's join conventions. Repository is empty for now with a TODO marker for the issue-5 per-person filter query. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 23:02:59 +02:00
Marcel	50b6f807fc	feat(timeline): add EventType enum PERSONAL/HISTORICAL classify a curated timeline event. The string value names are a stable frontend styling contract (family vs. muted world accent) — no mapping layer; renaming requires a coordinated frontend change. First piece of the new timeline domain (Zeitstrahl, issue #774). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 23:01:37 +02:00