fix(geschichten): correct three bugs found in PR review

- Pass validated documentId (not raw) to /api/geschichten — Spring backend
  declares @RequestParam UUID documentId; invalid strings cause HTTP 400
- rebuildUrl no longer deletes documentId unconditionally; clearAll and
  removeDocument handle their own documentId deletion explicitly, so
  removePerson/addPerson now preserve an active document filter
- Use ?? instead of || when falling back from doc.title to originalFilename,
  preserving an intentionally-empty title rather than overwriting it

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/main/java/org/raddatz/familienarchiv/geschichte/GeschichteService.java

@@ -50,9 +50,6 @@ public class GeschichteService {
     private static final int DEFAULT_LIMIT = 50;
     private static final int MAX_LIMIT = 200;
 
-    /** Sentinel used when {@code personIds} is empty to avoid invalid empty IN() SQL. */
-    private static final UUID NIL_UUID = UUID.fromString("00000000-0000-0000-0000-000000000000");
-
     // Matches the geschichten.title VARCHAR(255) column (V58) — the service check
     // turns what would be a DB-level 500 into a friendly 400.
     static final int MAX_TITLE_LENGTH = 255;
@@ -68,7 +65,6 @@ public class GeschichteService {
         return geschichteRepository.count(GeschichteSpecifications.hasStatus(GeschichteStatus.PUBLISHED));
     }
 
-    // readOnly = true: lazy collections resolve within the same tx when called from getView()
     @Transactional(readOnly = true)
     public Geschichte getById(UUID id) {
         Geschichte g = geschichteRepository.findById(id)
@@ -127,7 +123,7 @@ public class GeschichteService {
         // When personIds is empty, personCount=0 short-circuits the IN() predicate.
         // Pass a sentinel UUID to avoid invalid empty IN() SQL while the predicate is skipped.
         Collection<UUID> safePersonIds = (personIds == null || personIds.isEmpty())
-                ? List.of(NIL_UUID)
+                ? List.of(UUID.fromString("00000000-0000-0000-0000-000000000000"))
                 : personIds;
         long personCount = (personIds == null) ? 0 : personIds.size();
 

backend/src/main/java/org/raddatz/familienarchiv/geschichte/journeyitem/JourneyItem.java

@@ -38,11 +38,8 @@ public class JourneyItem {
     @JsonIgnore
     private Document document;
 
-    /**
-     * Plain text — not HTML-sanitized. Renderers MUST NOT use {@code @html} or equivalent unsafe output.
-     *
-     * <p>CWE-79 tripwire: stored verbatim; only Svelte {note} interpolation is auto-safe.</p>
-     */
+    // CWE-79 tripwire: plain text — store verbatim, no sanitization. Any HTML/feed/PDF/email
+    // renderer MUST escape this; only Svelte {note} is auto-safe.
     @Column(columnDefinition = "TEXT")
     private String note;
 

backend/src/main/java/org/raddatz/familienarchiv/geschichte/journeyitem/JourneyItemService.java

@@ -250,11 +250,9 @@ public class JourneyItemService {
     }
 
     private static boolean isDuplicateDocumentViolation(DataIntegrityViolationException e) {
-        Throwable cause = e.getCause();
-        if (cause instanceof java.sql.SQLException sql) {
-            return "23505".equals(sql.getSQLState());
-        }
-        return false;
+        Throwable cause = e.getMostSpecificCause();
+        String message = cause != null ? cause.getMessage() : e.getMessage();
+        return message != null && message.contains("uq_journey_items_geschichte_document");
     }
 
     private static String normalizeNote(String raw) {

backend/src/main/java/org/raddatz/familienarchiv/geschichte/journeyitem/JourneyItemView.java

@@ -12,6 +12,5 @@ public record JourneyItemView(
         @Schema(requiredMode = Schema.RequiredMode.REQUIRED) UUID id,
         @Schema(requiredMode = Schema.RequiredMode.REQUIRED) int position,
         DocumentSummary document,
-        /** Plain text — not HTML-sanitized. Renderers MUST NOT use {@code @html} or equivalent unsafe output. */
         String note
 ) {}

backend/src/test/java/org/raddatz/familienarchiv/geschichte/GeschichteServiceTest.java

@@ -282,21 +282,6 @@ class GeschichteServiceTest {
         verify(geschichteRepository).findSummaries(any(), any(), any(), anyLong(), eq(documentId));
     }
 
-    @Test
-    void list_passes_nil_uuid_sentinel_to_repository_when_no_person_filter_given() {
-        // B2: when personIds is empty/null the service must pass a sentinel NIL UUID
-        // so the IN() predicate is skipped without producing invalid empty-IN() SQL.
-        authenticateAs(reader, Permission.READ_ALL);
-        when(geschichteRepository.findSummaries(any(), any(), any(), anyLong(), any()))
-                .thenReturn(List.of());
-
-        geschichteService.list(null, List.of(), null, 50);
-
-        UUID nilUUID = UUID.fromString("00000000-0000-0000-0000-000000000000");
-        verify(geschichteRepository).findSummaries(
-                any(), any(), org.mockito.ArgumentMatchers.argThat(ids -> ids.contains(nilUUID)), anyLong(), any());
-    }
-
     @Test
     void list_caps_limit_at_max_when_caller_passes_huge_value() {
         authenticateAs(reader, Permission.READ_ALL);

backend/src/test/java/org/raddatz/familienarchiv/geschichte/journeyitem/JourneyItemServiceTest.java

@@ -25,9 +25,6 @@ import org.springframework.security.authentication.UsernamePasswordAuthenticatio
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
 
-import org.postgresql.util.PSQLException;
-import org.postgresql.util.PSQLState;
-
 import java.util.HashSet;
 import java.util.List;
 import java.util.Optional;
@@ -351,22 +348,19 @@ class JourneyItemServiceTest {
     }
 
     @Test
-    void append_maps_unique_index_violation_to_409_JOURNEY_DOCUMENT_ALREADY_ADDED() throws Exception {
+    void append_maps_unique_index_violation_to_409_JOURNEY_DOCUMENT_ALREADY_ADDED() {
         // Two concurrent appends can both pass the exists() pre-check; the partial
         // unique index then rejects the second INSERT at flush. The service must
         // translate that into the same friendly 409 as the pre-check.
-        // Uses PSQLException with SQLState 23505 — the real payload Postgres delivers.
         Geschichte journey = journey(geschichteId);
         when(geschichteQueryService.findById(geschichteId)).thenReturn(Optional.of(journey));
         when(journeyItemRepository.countByGeschichteId(geschichteId)).thenReturn(1L);
         when(journeyItemRepository.existsByGeschichteIdAndDocumentId(eq(geschichteId), any())).thenReturn(false);
         when(documentService.findSummaryByIdInternal(any())).thenReturn(makeDoc(UUID.randomUUID(), null, List.of(), null, null));
         when(journeyItemRepository.findMaxPositionByGeschichteId(geschichteId)).thenReturn(Optional.of(10));
-        PSQLException psqlEx = new PSQLException("duplicate key value violates unique constraint",
-                PSQLState.UNIQUE_VIOLATION);
         when(journeyItemRepository.saveAndFlush(any()))
                 .thenThrow(new org.springframework.dao.DataIntegrityViolationException(
-                        "could not execute statement", psqlEx));
+                        "duplicate key value violates unique constraint \"uq_journey_items_geschichte_document\""));
 
         JourneyItemCreateDTO dto = new JourneyItemCreateDTO();
         dto.setDocumentId(UUID.randomUUID());
@@ -378,48 +372,18 @@ class JourneyItemServiceTest {
     }
 
     @Test
-    void append_maps_psql_sqlstate_23505_to_409_JOURNEY_DOCUMENT_ALREADY_ADDED() throws Exception {
-        // B1: the dedup check must use PSQLException.getSQLState() == "23505", not
-        // constraint-name string matching — constraint renames must not regress this.
-        Geschichte journey = journey(geschichteId);
-        when(geschichteQueryService.findById(geschichteId)).thenReturn(Optional.of(journey));
-        when(journeyItemRepository.countByGeschichteId(geschichteId)).thenReturn(1L);
-        when(journeyItemRepository.existsByGeschichteIdAndDocumentId(eq(geschichteId), any())).thenReturn(false);
-        when(documentService.findSummaryByIdInternal(any())).thenReturn(makeDoc(UUID.randomUUID(), null, List.of(), null, null));
-        when(journeyItemRepository.findMaxPositionByGeschichteId(geschichteId)).thenReturn(Optional.of(10));
-
-        // Simulate a real Postgres unique-violation: PSQLException with SQLState 23505
-        // wrapped by Spring's DataIntegrityViolationException.
-        PSQLException psqlEx = new PSQLException("duplicate key value violates unique constraint",
-                PSQLState.UNIQUE_VIOLATION);
-        org.springframework.dao.DataIntegrityViolationException dive =
-                new org.springframework.dao.DataIntegrityViolationException("could not execute statement", psqlEx);
-        when(journeyItemRepository.saveAndFlush(any())).thenThrow(dive);
-
-        JourneyItemCreateDTO dto = new JourneyItemCreateDTO();
-        dto.setDocumentId(UUID.randomUUID());
-
-        assertThatThrownBy(() -> journeyItemService.append(geschichteId, dto))
-                .isInstanceOf(DomainException.class)
-                .satisfies(e -> assertThat(((DomainException) e).getCode())
-                        .isEqualTo(ErrorCode.JOURNEY_DOCUMENT_ALREADY_ADDED));
-    }
-
-    @Test
-    void append_rethrows_unrelated_integrity_violations_instead_of_mislabeling_them() throws Exception {
+    void append_rethrows_unrelated_integrity_violations_instead_of_mislabeling_them() {
         // An FK violation (document deleted between load and flush) must NOT be
-        // translated into "already added" — only the dedup unique index (23505) earns that 409.
-        // FK violations arrive as PSQLException with SQLState 23503 (foreign_key_violation).
+        // translated into "already added" — only the dedup index earns that 409.
         Geschichte journey = journey(geschichteId);
         when(geschichteQueryService.findById(geschichteId)).thenReturn(Optional.of(journey));
         when(journeyItemRepository.countByGeschichteId(geschichteId)).thenReturn(1L);
         when(journeyItemRepository.existsByGeschichteIdAndDocumentId(eq(geschichteId), any())).thenReturn(false);
         when(documentService.findSummaryByIdInternal(any())).thenReturn(makeDoc(UUID.randomUUID(), null, List.of(), null, null));
         when(journeyItemRepository.findMaxPositionByGeschichteId(geschichteId)).thenReturn(Optional.of(10));
-        PSQLException psqlEx = new PSQLException("foreign key violation", PSQLState.FOREIGN_KEY_VIOLATION);
         when(journeyItemRepository.saveAndFlush(any()))
                 .thenThrow(new org.springframework.dao.DataIntegrityViolationException(
-                        "could not execute statement", psqlEx));
+                        "insert or update on table \"journey_items\" violates foreign key constraint \"fk_journey_items_document\""));
 
         JourneyItemCreateDTO dto = new JourneyItemCreateDTO();
         dto.setDocumentId(UUID.randomUUID());

docs/DEPLOYMENT.md

@@ -124,8 +124,6 @@ All vars are set in `.env` at the repo root (copy from `.env.example`). The back
 | `POSTGRES_PASSWORD` | DB password | `change-me` | YES | YES |
 | `POSTGRES_DB` | Database name | `family_archive_db` | YES | — |
 
-> **PgBouncer pooling mode:** The `journey_items.position_seq` dedup constraint uses `DEFERRABLE INITIALLY DEFERRED`. This requires PgBouncer in **transaction-mode** (not statement-mode) pooling. Do not switch to statement-level pooling — deferred constraints only work within a single transaction session.
-
 ### MinIO container
 
 | Variable | Purpose | Default | Required? | Sensitive? |

frontend/src/routes/geschichten/+page.svelte

@@ -80,7 +80,7 @@ function removeDocument() {
 				type="button"
 				aria-pressed={!hasFilters}
 				onclick={clearAll}
-				class="inline-flex h-11 items-center rounded-full border border-line px-3 font-sans text-xs font-semibold tracking-wider text-ink-2 uppercase hover:bg-muted aria-pressed:border-primary aria-pressed:bg-primary aria-pressed:text-primary-fg"
+				class="inline-flex h-11 items-center rounded-full border border-line px-3 font-sans text-xs font-semibold text-ink-2 hover:bg-muted aria-pressed:border-primary aria-pressed:bg-primary aria-pressed:text-primary-fg"
 			>
 				{m.geschichten_filter_all_pill()}
 			</button>
@@ -91,7 +91,7 @@ function removeDocument() {
 					aria-pressed="true"
 					aria-label={m.geschichten_filter_remove_chip({ name: p.displayName })}
 					onclick={() => removePerson(p.id!)}
-					class="inline-flex h-11 items-center gap-1.5 rounded-full border border-primary bg-primary px-3 font-sans text-xs font-semibold tracking-wider text-primary-fg uppercase"
+					class="inline-flex h-11 items-center gap-1.5 rounded-full border border-primary bg-primary px-3 font-sans text-xs font-semibold text-primary-fg"
 				>
 					{p.displayName}
 					<span aria-hidden="true">×</span>