TimelineController exposes GET /api/timeline with @RequirePermission(READ_ALL) and @Validated so @Min(0) on generation fires a 400. Delegates to TimelineService.assemble(TimelineFilter). DomainException 404/400 propagate via GlobalExceptionHandler (no extra mapping needed). Refs #777 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>