Merge commit '213a889c8f0a475abfdb06082065320379d9bc7a' into work/reports-ui

docs/tests/integration/projects-completed-history.md

@@ -0,0 +1,77 @@
+# Test Evidence: Completed Project member and Task history
+
+- **Test type:** Integration
+- **Requirement IDs:** `AUTH-006`, `PRJ-014`
+- **Scenario IDs:** `AC-AUTH-007`
+- **Test class/method:** `com.lab.labtimesheet.feature.project.service.ProjectServiceIntegrationTest#completedProjectQueriesReturnHistoricalMembersWithoutRequiringACurrentLeader`
+- **Implementation commit:** `3d954dd`
+
+## Protected behavior
+
+After Project completion closes every membership and leadership interval, a historical member can still retrieve read-only Task context and member history. The Task context reports no current Leader and no active members, and every historical member row reports `currentLeader=false`.
+
+## Test method
+
+The Spring Boot integration test creates a Project and second member through public Project services, then uses direct SQL only as a fixture to reproduce the Iteration 2 completion result: all leadership and membership intervals are closed and the Project is marked `COMPLETED`. After clearing the persistence context, it calls the public Project query APIs as the former member and checks the DTOs.
+
+## Hand-derived expected result
+
+A completed Project cannot have a current Leader or active member. Therefore `ProjectTaskContext.currentLeaderMembershipId` is `null`, `activeMembers` is empty, both membership-history rows remain visible, both have leave timestamps, and neither is marked as current Leader.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=ProjectServiceIntegrationTest#completedProjectQueriesReturnHistoricalMembersWithoutRequiringACurrentLeader test
+```
+
+**Observed result**
+
+```text
+[ERROR] ProjectRuleViolationException: Project has no current Leader
+    at com.lab.labtimesheet.feature.project.model.entity.ProjectEntity.currentLeader(ProjectEntity.java:232)
+    at com.lab.labtimesheet.feature.project.service.ProjectQueryService.taskContext(ProjectQueryService.java:113)
+[ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0
+[INFO] BUILD FAILURE
+```
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=ProjectServiceIntegrationTest#completedProjectQueriesReturnHistoricalMembersWithoutRequiringACurrentLeader test
+```
+
+**Observed result**
+
+```text
+[INFO] Running com.lab.labtimesheet.feature.project.service.ProjectServiceIntegrationTest
+[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest='Project*Test' test
+
+[INFO] Tests run: 21, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## External-test boundaries
+
+This regression proves completed-state DTO behavior against PostgreSQL 18.4. It does not implement or test the future Project-completion mutation itself, browser rendering, or Task-owned authorization and presentation; direct SQL is confined to constructing the completed aggregate fixture.

docs/tests/integration/projects-workflows.md

@@ -0,0 +1,75 @@
+# Test Evidence: Atomic Project workflows
+
+- **Test type:** Integration
+- **Requirement IDs:** `PRJ-001`–`PRJ-007`, `PRJ-017`, `AUTH-001`–`AUTH-004`, `DB-003`, `DB-007`
+- **Scenario IDs:** `AC-PRJ-001`–`AC-PRJ-003`, `AC-PRJ-009`
+- **Test class/method:** `com.lab.labtimesheet.feature.project.service.ProjectServiceIntegrationTest`
+- **Implementation commit:** `25a855e`
+
+## Protected behavior
+
+PostgreSQL transactions persist a planned Project with its initial membership and leadership term, reject unauthorized or duplicate direct additions, change exactly one Leader without moving Task assignments, and enforce role/membership visibility without ID disclosure.
+
+## Test method
+
+A Spring Boot integration test uses the platform-owned PostgreSQL 18.4 Testcontainer and Flyway V1 schema. It calls the public Project service and verifies committed-shape rows and negative-case non-mutation with independent SQL.
+
+## Hand-derived expected result
+
+Creation yields one Project, one active membership, and one current leadership term. Direct addition yields one membership per Project/Intern pair while allowing the same Intern in a second Project. Leader change yields one closed and one current term while the Task assignee ID remains unchanged. Admin, owner, and historical member visibility is allowed; unrelated IDs are denied uniformly.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=ProjectServiceIntegrationTest test
+```
+
+**Observed result**
+
+```text
+[ERROR] cannot find symbol: class CreateProjectCommand
+[ERROR] cannot find symbol: class ProjectService
+[INFO] BUILD FAILURE
+```
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=ProjectServiceIntegrationTest test
+```
+
+**Observed result**
+
+```text
+[INFO] Running com.lab.labtimesheet.feature.project.service.ProjectServiceIntegrationTest
+[INFO] Tests run: 4, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw test
+
+[INFO] Tests run: 25, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## External-test boundaries
+
+This test does not prove MockMvc authorization, Thymeleaf rendering, browser accessibility, real concurrent transaction races, Iteration 2 invitations/removals/completion, or Task-module business rules beyond preserving stored assignment IDs. `I1-PRJ-04` remains `IN_PROGRESS`: the activation Task-assignee guard will be implemented only after the Task feature exposes its concrete query service.

docs/tests/integration/task-workflow.md

@@ -0,0 +1,101 @@
+# Test Evidence: Iteration 1 Task persistence and authorization
+
+- **Test type:** Integration
+- **Requirement IDs:** `AUTH-001`, `AUTH-002`, `AUTH-005`–`AUTH-009`, `AUTH-011`, `PRJ-013`, `PRJ-015`, `PRJ-016`, `TSK-001`–`TSK-005`, `TSK-007`, `TSK-008`, `TSK-011`, `TSK-012`, `TSK-018`
+- **Scenario IDs:** `I1-TSK-01`–`I1-TSK-05`, `AC-AUTH-001`, `AC-AUTH-003`–`AC-AUTH-007`, `AC-AUTH-010`, `AC-PRJ-008`, `AC-TSK-002`, `AC-TSK-003`, `AC-TSK-006`, `AC-TSK-010`
+- **Test class/method:** `com.lab.labtimesheet.feature.task.service.TaskCreationIntegrationTest`
+- **Implementation commit:** `511ee81a91a79a61cc6afb00097e1b38577c1968`
+
+## Protected behavior
+
+PostgreSQL-backed Task operations preserve generic same-Project membership actors, limit ordinary members to self-Task creation, allow current Leaders to assign active same-Project members, validate due dates, restrict status changes to the active current assignee, append authorized comments, exclude deleted Tasks from current reads/progress, render assignee names and empty progress, deny guessed/cross-Project identifiers without writes, give former members read-only access only after completion, and execute the Project-activation and dashboard Task queries.
+
+## Test method
+
+Thirteen transactional Spring integration tests create real users, Intern profiles, Projects, memberships, leadership terms, calendar events, Tasks, and comments against the approved PostgreSQL 18.4 V1 schema. Assertions inspect returned behavior and persisted rows; there are no mocked domain or database operations.
+
+## Hand-derived expected result
+
+A self-Task stores one membership in creator, assigner, and assignee fields. A Leader-created Task retains the Leader membership as creator/assigner and the selected member as assignee. Project start/end due dates are valid; dates before, after, or on a current global day off are invalid. Only an active Project's current assignee can traverse an allowed status edge. Authorized member/Mentor comments append two rows. Four current Tasks with one in each status produce 25% and four unit counts; a deleted fifth Task is absent; zero Tasks has no percentage.
+
+A former member cannot read Task data while the Project remains planned or active, but can read the completed Project history. List/detail views resolve the assignee display name from the Project service boundary, and their capability flags match current membership, assignment, role, and Project lifecycle.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=TaskCreationIntegrationTest test
+```
+
+**Observed result**
+
+```text
+[ERROR] TaskCreationIntegrationTest.java:[6,34] cannot find symbol
+  symbol:   class CreateTaskCommand
+[ERROR] TaskCreationIntegrationTest.java:[8,34] cannot find symbol
+  symbol:   class TaskService
+[INFO] BUILD FAILURE
+```
+
+After creation reached GREEN, the next cohesive workflow increment was separately observed RED:
+
+```text
+[ERROR] TaskCreationIntegrationTest.java:[7,34] cannot find symbol
+  symbol:   class TaskCommentView
+[ERROR] TaskCreationIntegrationTest.java:[8,34] cannot find symbol
+  symbol:   class TaskDetails
+[ERROR] TaskCreationIntegrationTest.java:[9,34] cannot find symbol
+  symbol:   class TaskListView
+[INFO] BUILD FAILURE
+```
+
+The review-hardening increment was also observed RED before its implementation. The former-member PostgreSQL regression reached the old list behavior instead of throwing, and the view-contract tests could not compile because `assigneeName`, `canCreate`, `canChangeStatus`, and `canComment` did not exist.
+
+The second review then made the completed-history fixture production-shaped by closing the current leadership term and all memberships. That focused test was observed RED because the Project read boundary still required `currentLeader()` for a completed Project:
+
+```text
+[ERROR] TaskCreationIntegrationTest.formerMemberReadsOnlyCompletedProjectTaskHistory
+  » TaskNotFound Task or Project was not found
+[INFO] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0
+[INFO] BUILD FAILURE
+```
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=TaskCreationIntegrationTest test
+```
+
+**Observed result**
+
+```text
+[INFO] Tests run: 13, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw test
+
+[INFO] Tests run: 107, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## External-test boundaries
+
+This evidence does not prove browser behavior, shared-shell integration, notification delivery, Iteration 2 work logs/reassignment/edit/deletion, or Iteration 3 concurrency/index plans. The status edge matrix is separately protected by unit evidence. HTTP form, CSRF, template, and direct-route behavior require the companion web evidence.

docs/tests/unit/project-task-mutation-context.md

@@ -0,0 +1,75 @@
+# Test Evidence: Locked Project context for Task mutations
+
+- **Test type:** Unit
+- **Requirement IDs:** `AUTH-001`, `AUTH-011`, `PRJ-012`
+- **Scenario IDs:** `AC-AUTH-001`, `AC-AUTH-010`, `AC-PRJ-006`
+- **Test class/method:** `com.lab.labtimesheet.feature.project.service.ProjectTaskMutationContextTest#loadsTheProjectForUpdateBeforeBuildingTheTaskMutationContext`
+- **Implementation commit:** `19a3518`
+
+## Protected behavior
+
+Task mutations obtain their Project authorization and current lifecycle, Leader, owning-Mentor, and active-member facts from a DTO-only Project service boundary after the Project row has been locked for update. Missing and unauthorized Projects retain the same non-disclosing denial behavior.
+
+## Test method
+
+The isolated service test invokes `ProjectService.taskMutationContext(actorUserId, projectId)`, verifies that `ProjectRepository.findLockedById` is used and the ordinary `findById` path is not used, and verifies that only the locked entity is passed to the existing Project-owned authorization and DTO mapper. The PostgreSQL integration test additionally exercises the public API with authorized, unauthorized, current-member, and former-member data.
+
+## Hand-derived expected result
+
+Exactly one pessimistic Project lookup occurs before context evaluation. The returned `ProjectTaskContext` exposes scalar/DTO facts only; no Project repository or entity crosses the feature boundary. When called from Task's active transaction, Spring's default `REQUIRED` propagation keeps the row lock in that transaction through its commit or rollback.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=ProjectTaskMutationContextTest test
+```
+
+**Observed result**
+
+```text
+[ERROR] constructor ProjectService ... cannot be applied to given types
+[ERROR] incompatible types: ProjectEntity cannot be converted to long
+[INFO] BUILD FAILURE
+```
+
+The test failed to compile because Project had no mutation-context API and its context mapper accepted only an unlocked Project ID lookup.
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=ProjectTaskMutationContextTest test
+```
+
+**Observed result**
+
+```text
+[INFO] Running com.lab.labtimesheet.feature.project.service.ProjectTaskMutationContextTest
+[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest='Project*Test' test
+
+[INFO] Tests run: 20, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## External-test boundaries
+
+The unit test proves the locked repository path and DTO-only handoff, while the integration coverage proves current Project authorization/member mapping against PostgreSQL 18.4. It does not orchestrate two concurrent database transactions; the lock-retention guarantee relies on the public method's `@Transactional` default `REQUIRED` propagation and the Task caller retaining its outer transaction.

docs/tests/unit/projects-domain.md

@@ -3,8 +3,8 @@
 - **Test type:** Unit
 - **Requirement IDs:** `PRJ-001`–`PRJ-007`, `PRJ-012`, `PRJ-017`, `AUTH-001`–`AUTH-004`
 - **Scenario IDs:** `AC-PRJ-001`, `AC-PRJ-003`, `AC-PRJ-006`, `AC-PRJ-009`
-- **Test class/method:** `com.lab.labtimesheet.projects.domain.ProjectTest`
+- **Test class/method:** `com.lab.labtimesheet.feature.project.model.entity.ProjectEntityTest`
-- **Implementation commit:** `3483347`
+- **Implementation commit:** `25a855e`
 
 ## Protected behavior
 
@@ -43,13 +43,13 @@ export PATH="$JAVA_HOME/bin:$PATH"
 ```text
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
-./mvnw -Dtest=ProjectTest test
+./mvnw -Dtest=ProjectEntityTest test
 ```
 
 **Observed result**
 
 ```text
-[INFO] Running com.lab.labtimesheet.projects.domain.ProjectTest
+[INFO] Running com.lab.labtimesheet.feature.project.model.entity.ProjectEntityTest
 [INFO] Tests run: 6, Failures: 0, Errors: 0, Skipped: 0
 [INFO] BUILD SUCCESS
 ```
@@ -61,7 +61,7 @@ export PATH="$JAVA_HOME/bin:$PATH"
 ```text
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
-./mvnw -Dtest=ProjectTest test
+./mvnw -Dtest=ProjectEntityTest test
 
 [INFO] Tests run: 6, Failures: 0, Errors: 0, Skipped: 0
 [INFO] BUILD SUCCESS

docs/tests/unit/projects-layer-structure.md

@@ -0,0 +1,75 @@
+# Test Evidence: Project layer and JPA structure
+
+- **Test type:** Unit
+- **Requirement IDs:** `ARC-002`, `ARC-005`–`ARC-007`, `OPS-018`–`OPS-020`, `TST-001`–`TST-010`
+- **Scenario IDs:** `I1-PRJ-01`–`I1-PRJ-05`
+- **Test class/method:** `com.lab.labtimesheet.feature.project.repository.ProjectPersistenceStructureTest#projectPersistenceUsesTheRequiredLayerPackagesAndSpringDataJpa`
+- **Implementation commit:** `25a855e`
+
+## Protected behavior
+
+Project-owned production code follows the authoritative feature-first package layout, persists aggregate entities through Spring Data JPA, keeps JDBC operations out of Project business services, and does not shadow Account or Task persistence.
+
+## Test method
+
+Plain JUnit inspects the public Project entity, repository, and service types. It verifies their exact feature/layer packages, the entity's JPA mapping, the repository's `JpaRepository` contract, the absence of JDBC service dependencies, and the absence of foreign-table Account/Task shadow entities.
+
+## Hand-derived expected result
+
+The Project aggregate is under `feature.project.model.entity`, persistence under `feature.project.repository`, business logic under `feature.project.service`, the service has zero JDBC collaborators, and Account/Task persistence remains owned by those features.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=ProjectPersistenceStructureTest test
+```
+
+**Observed result**
+
+```text
+[ERROR] cannot find symbol: class ProjectUserRepository
+[ERROR] cannot find symbol: class ProjectInternProfileRepository
+[ERROR] cannot find symbol: class ProjectTaskRepository
+[INFO] BUILD FAILURE
+```
+
+The RED was observed after removing Project-owned shadow mappings of Account and Task tables. It proves the service still required cross-feature dependencies and could not be made green by retaining forbidden repositories.
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=ProjectPersistenceStructureTest test
+```
+
+**Observed result**
+
+```text
+[INFO] Running com.lab.labtimesheet.feature.project.repository.ProjectPersistenceStructureTest
+[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=LayerStructureTest,ProjectPersistenceStructureTest,ProjectEntityTest test
+
+[INFO] Tests run: 8, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## External-test boundaries
+
+This check does not prove database mappings, transaction behavior, MVC routing, or runtime authorization; those remain covered by PostgreSQL and MockMvc tests.

docs/tests/unit/task-dashboard-query.md

@@ -0,0 +1,74 @@
+# Test Evidence: Role-correct Task dashboard query
+
+- **Test type:** Unit
+- **Requirement IDs:** `AUTH-003`–`AUTH-005`, `AUTH-009`, `TSK-001`, `TSK-002`, `TSK-004`, `PRJ-016`
+- **Scenario IDs:** `I1-UI-03`
+- **Test class/method:** `com.lab.labtimesheet.feature.task.service.TaskDashboardServiceTest`
+- **Implementation commit:** `511ee81a91a79a61cc6afb00097e1b38577c1968`
+
+## Protected behavior
+
+The public Task dashboard service reports blocked Tasks only for a Mentor's active owned Projects. For an Intern, it excludes former/completed memberships, counts current assigned Tasks, and returns at most five priority Tasks ordered by due date with null dates last and Task ID as the stable tie-breaker.
+
+## Test method
+
+Two focused Mockito tests provide Project service DTOs and verify the Task service result. The repository remains mocked so the test isolates role/project/member filtering and the Task-owned dashboard DTO boundary; PostgreSQL query ordering is verified by the affected integration suite.
+
+## Hand-derived expected result
+
+A Mentor with one active and one planned Project receives the active Project's four blocked Tasks only. An Intern with one current active membership, one former membership, and one completed Project receives six assigned Tasks and the due-first Task from the current Project.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=TaskDashboardServiceTest test
+```
+
+**Observed result**
+
+```text
+[ERROR] TaskDashboardServiceTest.java:[34,13] cannot find symbol
+  symbol: class TaskDashboardService
+[INFO] BUILD FAILURE
+```
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=TaskDashboardServiceTest test
+```
+
+Run with approved sandbox escalation for Mockito Java 25 self-attach.
+
+**Observed result**
+
+```text
+[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=TaskPersistenceStructureTest,TaskDomainRulesTest,TaskControllerTest,TaskQueryServiceTest,TaskDashboardServiceTest,TaskMutationBoundaryTest,TaskCreationIntegrationTest test
+
+[INFO] Tests run: 51, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## External-test boundaries
+
+This test does not prove the shared dashboard controller/template, which belongs to `work/reports-ui`. PostgreSQL ordering, soft-delete filtering, and repository query syntax remain integration-test concerns.

docs/tests/unit/task-mutation-boundary.md

@@ -0,0 +1,77 @@
+# Test Evidence: Task mutation authorization and locking boundary
+
+- **Test type:** Unit
+- **Requirement IDs:** `AUTH-011`, `TSK-003`, `TSK-007`, `TSK-012`, `TSK-018`
+- **Scenario IDs:** `I1-TSK-01`, `I1-TSK-03`, `I1-TSK-04`, `AC-AUTH-010`, `AC-TSK-003`, `AC-TSK-006`, `AC-TSK-010`
+- **Test class/method:** `com.lab.labtimesheet.feature.task.service.TaskMutationBoundaryTest`
+- **Implementation commit:** `511ee81a91a79a61cc6afb00097e1b38577c1968`
+
+## Protected behavior
+
+Every Task create/status/comment mutation first asks the concrete Project service for a current authorization context while holding the Project row lock. Status and comment mutations then load the Task with `PESSIMISTIC_WRITE` before checking or changing Task state.
+
+## Test method
+
+Three focused Mockito tests verify call order for create, status, and comment. They prove the Project mutation context precedes the Task write, the unlocked Project query is not used for create, and status/comment use the locked Task lookup before mutation. `TaskPersistenceStructureTest` separately inspects the real repository method's lock annotation, while the PostgreSQL workflow suite executes the query.
+
+## Hand-derived expected result
+
+Create calls `ProjectService.taskMutationContext(5, 10)` before saving. Status and comment call that same Project boundary, then `TaskRepository.findLockedByIdAndProjectIdAndDeletedAtIsNull(25, 10)`, before changing status or appending the comment. The Project service joins the outer Task transaction, so both locks remain through commit or rollback.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=TaskMutationBoundaryTest test
+```
+
+**Observed result**
+
+```text
+[ERROR] constructor TaskService ... cannot be applied to given types
+  required: TaskRepository,TaskCommentRepository,ProjectQueryService,CalendarApplicationService,Clock
+  found:    TaskRepository,TaskCommentRepository,ProjectQueryService,ProjectService,CalendarApplicationService,Clock
+[ERROR] cannot find symbol
+  symbol: method findLockedByIdAndProjectIdAndDeletedAtIsNull(long,long)
+[INFO] BUILD FAILURE
+```
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=TaskMutationBoundaryTest test
+```
+
+Run with approved sandbox escalation for Mockito Java 25 self-attach.
+
+**Observed result**
+
+```text
+[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=TaskPersistenceStructureTest,TaskDomainRulesTest,TaskControllerTest,TaskQueryServiceTest,TaskDashboardServiceTest,TaskMutationBoundaryTest,TaskCreationIntegrationTest test
+
+[INFO] Tests run: 51, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## External-test boundaries
+
+These unit tests establish service call order and repository lock metadata; they do not simulate two concurrent database transactions. PostgreSQL execution of the locked Task lookup is covered by `TaskCreationIntegrationTest`, and the producing Project feature separately proves its locked DTO boundary. Broader concurrency stress remains the explicit Iteration 3 hardening scope.

docs/tests/unit/task-persistence-structure.md

@@ -0,0 +1,88 @@
+# Test Evidence: Task feature persistence structure
+
+- **Test type:** Unit
+- **Requirement IDs:** `TSK-001`–`TSK-005`, `TSK-007`, `TSK-011`, `TSK-012`
+- **Scenario IDs:** `I1-TSK-01`–`I1-TSK-04`
+- **Test class/method:** `com.lab.labtimesheet.feature.task.repository.TaskPersistenceStructureTest#taskPersistenceUsesJpaEntitiesAndSpringDataRepositories`
+- **Implementation commit:** `511ee81a91a79a61cc6afb00097e1b38577c1968`
+
+## Protected behavior
+
+Task persistence uses JPA entities in `feature.task.model.entity` and Spring Data repositories in `feature.task.repository`. Status/comment mutation lookup is protected by `PESSIMISTIC_WRITE`. This prevents a regression to business-level JDBC access, unlocked mutation reads, or a global layer package.
+
+## Test method
+
+Four focused tests load the production `Task` and `TaskComment` classes, verify their `@Entity` annotations, verify that both production repository interfaces extend `JpaRepository`, reject direct JDBC imports in Task business code, and inspect the locked lookup's `@Lock(PESSIMISTIC_WRITE)` annotation.
+
+## Hand-derived expected result
+
+Exactly two Task-owned persisted aggregates are required for Iteration 1: `Task` and append-only `TaskComment`. Each must be a JPA entity, and each repository must be a Spring Data JPA repository under the Task feature package.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=TaskPersistenceStructureTest test
+```
+
+**Observed result**
+
+```text
+[ERROR] TaskPersistenceStructureTest.java:[5,54] package com.lab.labtimesheet.feature.task.model.entity does not exist
+[ERROR] TaskPersistenceStructureTest.java:[6,54] package com.lab.labtimesheet.feature.task.model.entity does not exist
+[INFO] BUILD FAILURE
+```
+
+The final feature-first package contract did not yet exist.
+
+After that package move reached GREEN, the business-persistence boundary was tightened with a second test and separately observed RED:
+
+```text
+[ERROR] Tests run: 3, Failures: 2, Errors: 0, Skipped: 0
+Expecting [org.springframework.jdbc.core.simple.JdbcClient]
+to contain [TaskRepository, TaskCommentRepository]
+Expecting empty but was: [src/main/java/com/lab/labtimesheet/feature/task/service/TaskService.java]
+[INFO] BUILD FAILURE
+```
+
+The second failure proves that `TaskService` still depended on direct JDBC instead of the two Task-owned Spring Data repositories.
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=TaskPersistenceStructureTest test
+```
+
+**Observed result**
+
+```text
+[INFO] Tests run: 4, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=TaskPersistenceStructureTest,TaskDomainRulesTest,TaskControllerTest,TaskQueryServiceTest,TaskDashboardServiceTest,TaskMutationBoundaryTest,TaskCreationIntegrationTest test
+
+[INFO] Tests run: 51, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+The suite ran with approved escalation for PostgreSQL 18.4 Testcontainers and Mockito Java 25 self-attach.
+
+## External-test boundaries
+
+This structure test does not prove persistence mappings against PostgreSQL, transactional authorization, cross-feature service contracts, or rendered behavior. Those remain protected by the Task integration and web evidence after the dependency foundations are merged.

docs/tests/unit/task-project-activation-query.md

@@ -0,0 +1,74 @@
+# Test Evidence: Project activation Task-assignment query
+
+- **Test type:** Unit
+- **Requirement IDs:** `PRJ-012`
+- **Scenario IDs:** `I1-PRJ-04`, `AC-PRJ-006`
+- **Test class/method:** `com.lab.labtimesheet.feature.task.service.TaskQueryServiceTest`
+- **Implementation commit:** `511ee81a91a79a61cc6afb00097e1b38577c1968`
+
+## Protected behavior
+
+The Project feature can ask the public Task service whether any current non-deleted Task is assigned outside the Project's active membership set, without accessing Task repositories or entities.
+
+## Test method
+
+Two focused Mockito tests exercise the concrete public service. An empty active-membership set counts every current Task without issuing an invalid `NOT IN ()` query. A non-empty set delegates to the filtered Spring Data repository query.
+
+## Hand-derived expected result
+
+With no active memberships, all three current Tasks are invalid assignments. With active memberships 7 and 9, the repository-derived count of assignments outside that set is two.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=TaskQueryServiceTest test
+```
+
+**Observed result**
+
+```text
+[ERROR] TaskQueryServiceTest.java:[22,13] cannot find symbol
+  symbol: class TaskQueryService
+[INFO] BUILD FAILURE
+```
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=TaskQueryServiceTest test
+```
+
+Run with approved sandbox escalation for Mockito Java 25 self-attach.
+
+**Observed result**
+
+```text
+[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=TaskPersistenceStructureTest,TaskDomainRulesTest,TaskControllerTest,TaskQueryServiceTest,TaskDashboardServiceTest,TaskMutationBoundaryTest,TaskCreationIntegrationTest test
+
+[INFO] Tests run: 51, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## External-test boundaries
+
+This unit test does not prove the JPQL query against PostgreSQL or Project activation integration. The Task PostgreSQL suite and the Project feature's own integration tests cover those boundaries after dependency merge.

docs/tests/unit/task-status-progress.md

@@ -0,0 +1,75 @@
+# Test Evidence: Fixed Task status graph and initial Project progress
+
+- **Test type:** Unit
+- **Requirement IDs:** `TSK-007`, `TSK-008`, `PRJ-015`, `PRJ-016`
+- **Scenario IDs:** `I1-TSK-03`, `I1-TSK-05`, `AC-TSK-003`, `AC-PRJ-008`
+- **Test class/method:** `com.lab.labtimesheet.feature.task.model.TaskDomainRulesTest`
+- **Implementation commit:** `17a3c5d`
+
+## Protected behavior
+
+The Task status graph accepts exactly the seven specified directed edges. Initial Project progress counts each current Task status and represents a Project without current Tasks as no percentage rather than zero percent.
+
+## Test method
+
+One parameterized test checks all 16 source/target status pairs against a hand-written allowed-edge table. Two focused tests check empty progress and a four-Task example with two `DONE` Tasks.
+
+## Hand-derived expected result
+
+Allowed edges are `TODO` to `IN_PROGRESS` or `BLOCKED`; `IN_PROGRESS` to `DONE` or `BLOCKED`; `BLOCKED` to `TODO` or `IN_PROGRESS`; and `DONE` to `IN_PROGRESS`. All other pairs are forbidden. Zero Tasks has no percentage. Two `DONE` among four Tasks is 50%, with counts 1 `TODO`, 1 `IN_PROGRESS`, 0 `BLOCKED`, and 2 `DONE`.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=TaskDomainRulesTest test
+```
+
+**Observed result**
+
+```text
+[ERROR] COMPILATION ERROR :
+TaskDomainRulesTest.java:[16,30] cannot find symbol
+  symbol:   class TaskStatus
+[INFO] BUILD FAILURE
+```
+
+The test could not compile because the required Task status and progress domain types did not exist.
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=TaskDomainRulesTest test
+```
+
+**Observed result**
+
+```text
+[INFO] Tests run: 18, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw test
+
+[INFO] Tests run: 107, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## External-test boundaries
+
+This unit evidence does not prove current-assignee authorization, Project lifecycle enforcement, PostgreSQL persistence/query filtering, non-deleted selection, HTTP authorization, or rendered `N/A`. Those require the platform/Project foundation and PostgreSQL/web tests.

docs/tests/web/projects-pages.md

@@ -0,0 +1,85 @@
+# Test Evidence: Authorized Project pages
+
+- **Test type:** Web
+- **Requirement IDs:** `AUTH-001`, `AUTH-002`, `AUTH-006`, `PRJ-001`, `PRJ-004`–`PRJ-006`, `SEC-001`, `ERR-001`
+- **Scenario IDs:** `AC-AUTH-001`, `AC-AUTH-002`, `AC-AUTH-007`, `I1-PRJ-05`
+- **Test class/method:** `com.lab.labtimesheet.feature.project.controller.ProjectControllerTest`
+- **Implementation commits:** `25a855e`, `a9ee99a`
+
+## Protected behavior
+
+Authenticated users receive only authorized Project routes; guessed IDs return a non-disclosing not-found response; valid Mentor create requests use the authenticated identity; invalid forms do not mutate; state changes require CSRF.
+
+## Test method
+
+MockMvc exercises the real controller, binding, Bean Validation, exception mapping, view selection, redirect, Spring Security authentication, and CSRF filter. Only application/query services are mocked.
+
+## Hand-derived expected result
+
+An authorized list request renders `projects/list`. An unauthorized direct ID returns 404. Member and leadership routes authorize through actor plus Project ID. A valid create redirects to the created detail ID; a blank name and zero Leader ID render field errors and make no service call. POST without CSRF returns 403.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=ProjectControllerTest test
+```
+
+**Observed result**
+
+```text
+[ERROR] cannot find symbol: class ProjectController
+[ERROR] cannot find symbol: class ProjectPageService
+[INFO] BUILD FAILURE
+```
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=ProjectControllerTest test
+```
+
+**Observed result**
+
+```text
+[INFO] Running com.lab.labtimesheet.feature.project.controller.ProjectControllerTest
+[INFO] Tests run: 6, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw test
+
+[INFO] Tests run: 25, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Mentor-only control regression
+
+**RED:** the focused MockMvc run reported two expected failures: `GET /projects/new` returned `200` for an Intern instead of non-disclosing `404`, and the member page rendered the `Add member` form for a non-owner.
+
+**GREEN:** rerunning `./mvnw -Dtest=ProjectControllerTest test` after the controller/DTO/template correction passed 7 tests with zero failures, errors, or skips.
+
+## Role-aware Project-list action regression
+
+**RED:** the focused MockMvc run reported two expected failures after adding the list-action regression: the controller still resolved only a user ID, so the Mentor fixture was queried as user `0`, and an Intern-facing Project list rendered the `Create Project` link.
+
+**GREEN:** rerunning `./mvnw -Dtest=ProjectControllerTest test` after resolving the public actor view and conditionally rendering the link passed 8 tests with zero failures, errors, or skips.
+
+## External-test boundaries
+
+This slice does not prove PostgreSQL query correctness, a real login flow, shared-shell navigation, browser accessibility, or Iteration 2 invitation/exit/completion pages. The activation route remains deferred with `I1-PRJ-04` until the Task feature query dependency is available.

docs/tests/web/task-pages.md

@@ -0,0 +1,82 @@
+# Test Evidence: Task pages and server-side request boundaries
+
+- **Test type:** Web
+- **Requirement IDs:** `AUTH-001`, `AUTH-002`, `AUTH-005`, `AUTH-009`, `AUTH-011`, `PRJ-015`, `TSK-003`, `TSK-007`, `TSK-011`, `TSK-012`
+- **Scenario IDs:** `I1-TSK-01`, `I1-TSK-03`–`I1-TSK-05`, `AC-AUTH-001`, `AC-AUTH-006`, `AC-AUTH-010`, `AC-PRJ-008`, `AC-TSK-003`, `AC-TSK-006`, `AC-TSK-010`
+- **Test class/method:** `com.lab.labtimesheet.feature.task.controller.TaskControllerTest`
+- **Implementation commit:** `511ee81a91a79a61cc6afb00097e1b38577c1968`
+
+## Protected behavior
+
+Task list/detail/create/status/comment routes require authentication, obtain actor identity from Spring Security rather than request IDs, retain CSRF protection, convert guessed-record denial to HTTP 404, validate create input, render the actual Thymeleaf pages, show `N/A` for an empty Project, display assignees, and expose create/status/comment controls only when the service-provided capability permits them.
+
+## Test method
+
+Nine `@WebMvcTest` MockMvc tests render the real Task templates and exercise the real controller, Spring Security filter chain, CSRF filter, Bean Validation binding, redirect contracts, exception-to-status mapping, assignee output, and capability-controlled actions. Only the PostgreSQL-backed Task service is replaced at the controller boundary.
+
+## Hand-derived expected result
+
+Unauthenticated list access returns 401 under the current platform security baseline. An authorized empty list returns 200 and contains `N/A`. A denied guessed Task returns 404. A valid create request passes Project 10, assignee membership 7, the supplied fields, and the authenticated email to the service, then redirects to Task 25. Blank title stays on the form with a field error and no write. Valid status/comment posts redirect to Task 25.
+
+When `canCreate`, `canChangeStatus`, or `canComment` is false, the corresponding control is absent. When true, it is rendered. Both list and detail output the assignee display name.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=TaskControllerTest test
+```
+
+**Observed result**
+
+```text
+[ERROR] TaskControllerTest.java:[28,13] cannot find symbol
+  symbol: class TaskController
+[INFO] BUILD FAILURE
+```
+
+The first sandboxed GREEN attempt then exposed an environment boundary, not an application failure: Mockito could not use Java 25 self-attach inside the restricted sandbox. The exact same command was rerun with approved escalation; one test expectation was corrected from a login redirect to the platform baseline's observed 401 response before the final GREEN run.
+
+The later view-capability increment was observed RED at test compilation because the Task DTOs did not yet provide the required capability and assignee fields.
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+./mvnw -Dtest=TaskControllerTest test
+```
+
+Run with approved sandbox escalation for Mockito Java 25 self-attach.
+
+**Observed result**
+
+```text
+[INFO] Tests run: 9, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw test
+
+[INFO] Tests run: 107, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+The suite ran with approved escalation for OrbStack and Mockito self-attach.
+
+## External-test boundaries
+
+This slice test does not prove PostgreSQL state changes; those are covered by `TaskCreationIntegrationTest`. Shared shell styling/navigation remains owned by `work/reports-ui`. Browser journeys, notifications, Iteration 2 workflows, and narrow-screen behavior are outside this Iteration 1 Task evidence.

src/main/java/com/lab/labtimesheet/feature/project/controller/ProjectController.java

@@ -1,5 +1,6 @@
 package com.lab.labtimesheet.feature.project.controller;
 
+import com.lab.labtimesheet.feature.project.exception.ProjectAccessDeniedException;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectCreateForm;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectMemberForm;
 import com.lab.labtimesheet.feature.project.service.ProjectQueryService;
@@ -29,12 +30,17 @@ public class ProjectController {
 
     @GetMapping
     public String list(Principal principal, Model model) {
-        model.addAttribute("projects", pages.listVisible(actorId(principal)));
+        var actor = pages.authenticatedActor(principal.getName());
+        model.addAttribute("projects", pages.listVisible(actor.userId()));
+        model.addAttribute("canCreateProject", "MENTOR".equals(actor.role()));
         return "projects/list";
     }
 
     @GetMapping("/new")
-    public String createForm(Model model) {
+    public String createForm(Principal principal, Model model) {
+        if (!"MENTOR".equals(pages.authenticatedActor(principal.getName()).role())) {
+            throw new ProjectAccessDeniedException();
+        }
         model.addAttribute("projectForm", new ProjectCreateForm());
         return "projects/form";
     }

src/main/java/com/lab/labtimesheet/feature/project/model/dto/ProjectDetail.java

@@ -10,5 +10,6 @@ public record ProjectDetail(
         LocalDate startDate,
         LocalDate endDate,
         String mentorName,
-        String leaderName) {
+        String leaderName,
+        boolean canManage) {
 }

src/main/java/com/lab/labtimesheet/feature/project/service/ProjectQueryService.java

@@ -64,13 +64,16 @@ public class ProjectQueryService {
                 project.startDate(),
                 project.endDate(),
                 displayName(project.mentorUserId()),
-                displayName(project.currentLeader().internUserId()));
+                displayName(project.currentLeader().internUserId()),
+                project.mentorUserId() == actorUserId);
     }
 
     @Transactional(readOnly = true)
     public List<ProjectMemberView> members(long actorUserId, long projectId) {
         var project = visibleProject(actorUserId, projectId);
-        var leaderUserId = project.currentLeader().internUserId();
+        Long leaderUserId = project.status() == ProjectStatus.COMPLETED
+                ? null
+                : project.currentLeader().internUserId();
         return project.memberships().stream()
                 .map(membership -> new ProjectMemberView(
                         membership.id(),
@@ -78,7 +81,9 @@ public class ProjectQueryService {
                         displayName(membership.internUserId()),
                         membership.joinedAt(),
                         membership.leftAt(),
-                        membership.isCurrent() && membership.internUserId() == leaderUserId))
+                        membership.isCurrent()
+                                && leaderUserId != null
+                                && membership.internUserId() == leaderUserId))
                 .toList();
     }
 
@@ -96,7 +101,22 @@ public class ProjectQueryService {
 
     @Transactional(readOnly = true)
     public ProjectTaskContext taskContext(long actorUserId, long projectId) {
-        var project = visibleProject(actorUserId, projectId);
+        var project = projects.findById(projectId).orElseThrow(ProjectAccessDeniedException::new);
+        return taskContext(actorUserId, project);
+    }
+
+    ProjectTaskContext taskContext(long actorUserId, ProjectEntity project) {
+        requireVisibleProject(actorUserId, project);
+        if (project.status() == ProjectStatus.COMPLETED) {
+            return new ProjectTaskContext(
+                    project.id(),
+                    project.mentorUserId(),
+                    project.status().name(),
+                    project.startDate(),
+                    project.endDate(),
+                    null,
+                    List.of());
+        }
         var activeMembers = project.memberships().stream()
                 .filter(membership -> membership.isCurrent() && isEligibleIntern(membership.internUserId()))
                 .map(membership -> new ProjectTaskMemberView(
@@ -141,15 +161,19 @@ public class ProjectQueryService {
     }
 
     private ProjectEntity visibleProject(long actorUserId, long projectId) {
-        var actor = activeActor(actorUserId);
         var project = projects.findById(projectId).orElseThrow(ProjectAccessDeniedException::new);
+        requireVisibleProject(actorUserId, project);
+        return project;
+    }
+
+    private void requireVisibleProject(long actorUserId, ProjectEntity project) {
+        var actor = activeActor(actorUserId);
         var visible = "ADMIN".equals(actor.role().name())
                 || ("MENTOR".equals(actor.role().name()) && project.mentorUserId() == actorUserId)
                 || ("INTERN".equals(actor.role().name()) && project.hasEverHadMember(actorUserId));
         if (!visible) {
             throw new ProjectAccessDeniedException();
         }
-        return project;
     }
 
     private List<ProjectEntity> visibleProjects(AccountIdentity actor, long actorUserId) {

src/main/java/com/lab/labtimesheet/feature/project/service/ProjectService.java

@@ -4,6 +4,7 @@ import com.lab.labtimesheet.feature.project.exception.ProjectAccessDeniedExcepti
 import com.lab.labtimesheet.feature.account.service.AccountService;
 import com.lab.labtimesheet.feature.project.model.ProjectInternEligibility;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectCreateCommand;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectTaskContext;
 import com.lab.labtimesheet.feature.project.model.entity.ProjectEntity;
 import com.lab.labtimesheet.feature.project.repository.ProjectRepository;
 import java.time.Clock;
@@ -15,14 +16,17 @@ public class ProjectService {
 
     private final ProjectRepository projects;
     private final AccountService accounts;
+    private final ProjectQueryService queries;
     private final Clock clock;
 
     public ProjectService(
             ProjectRepository projects,
             AccountService accounts,
+            ProjectQueryService queries,
             Clock clock) {
         this.projects = projects;
         this.accounts = accounts;
+        this.queries = queries;
         this.clock = clock;
     }
 
@@ -61,6 +65,11 @@ public class ProjectService {
         projects.flush();
     }
 
+    @Transactional
+    public ProjectTaskContext taskMutationContext(long actorUserId, long projectId) {
+        return queries.taskContext(actorUserId, lockedProject(projectId));
+    }
+
     private ProjectEntity lockedProject(long projectId) {
         return projects.findLockedById(projectId).orElseThrow(ProjectAccessDeniedException::new);
     }

src/main/java/com/lab/labtimesheet/feature/task/controller/TaskController.java

@@ -0,0 +1,115 @@
+package com.lab.labtimesheet.feature.task.controller;
+
+import com.lab.labtimesheet.feature.task.model.TaskProgress;
+import com.lab.labtimesheet.feature.task.model.TaskStatus;
+import com.lab.labtimesheet.feature.task.model.dto.CreateTaskCommand;
+import com.lab.labtimesheet.feature.task.model.dto.TaskCreateForm;
+import com.lab.labtimesheet.feature.task.model.dto.TaskListView;
+import com.lab.labtimesheet.feature.task.model.dto.TaskView;
+import com.lab.labtimesheet.feature.task.service.TaskService;
+import jakarta.validation.Valid;
+import java.util.Locale;
+import org.springframework.security.core.Authentication;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.validation.BindingResult;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.ModelAttribute;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+
+@Controller
+public class TaskController {
+
+    private final TaskService taskService;
+
+    public TaskController(TaskService taskService) {
+        this.taskService = taskService;
+    }
+
+    @GetMapping("/projects/{projectId}/tasks")
+    String list(Authentication authentication, @PathVariable long projectId, Model model) {
+        TaskListView taskList = taskService.list(authentication.getName(), projectId);
+        model.addAttribute("projectId", projectId);
+        model.addAttribute("taskList", taskList);
+        model.addAttribute("progressLabel", progressLabel(taskList.progress()));
+        return "tasks/list";
+    }
+
+    @GetMapping("/projects/{projectId}/tasks/new")
+    String createForm(Authentication authentication, @PathVariable long projectId, Model model) {
+        model.addAttribute("taskForm", new TaskCreateForm("", "", null, null));
+        populateForm(authentication.getName(), projectId, model);
+        return "tasks/form";
+    }
+
+    @PostMapping("/projects/{projectId}/tasks")
+    String create(
+            Authentication authentication,
+            @PathVariable long projectId,
+            @Valid @ModelAttribute("taskForm") TaskCreateForm form,
+            BindingResult bindingResult,
+            Model model) {
+        if (bindingResult.hasErrors()) {
+            populateForm(authentication.getName(), projectId, model);
+            return "tasks/form";
+        }
+        TaskView task = taskService.create(
+                authentication.getName(),
+                new CreateTaskCommand(
+                        projectId,
+                        form.assigneeMembershipId(),
+                        form.title(),
+                        form.description(),
+                        form.dueDate()));
+        return "redirect:/projects/%d/tasks/%d".formatted(projectId, task.id());
+    }
+
+    @GetMapping("/projects/{projectId}/tasks/{taskId}")
+    String details(
+            Authentication authentication,
+            @PathVariable long projectId,
+            @PathVariable long taskId,
+            Model model) {
+        model.addAttribute("projectId", projectId);
+        model.addAttribute("details", taskService.details(authentication.getName(), projectId, taskId));
+        model.addAttribute("statuses", TaskStatus.values());
+        return "tasks/detail";
+    }
+
+    @PostMapping("/projects/{projectId}/tasks/{taskId}/status")
+    String changeStatus(
+            Authentication authentication,
+            @PathVariable long projectId,
+            @PathVariable long taskId,
+            @RequestParam TaskStatus status) {
+        taskService.changeStatus(authentication.getName(), projectId, taskId, status);
+        return detailsRedirect(projectId, taskId);
+    }
+
+    @PostMapping("/projects/{projectId}/tasks/{taskId}/comments")
+    String addComment(
+            Authentication authentication,
+            @PathVariable long projectId,
+            @PathVariable long taskId,
+            @RequestParam String body) {
+        taskService.addComment(authentication.getName(), projectId, taskId, body);
+        return detailsRedirect(projectId, taskId);
+    }
+
+    private void populateForm(String actorEmail, long projectId, Model model) {
+        model.addAttribute("projectId", projectId);
+        model.addAttribute("assignees", taskService.assignmentChoices(actorEmail, projectId));
+    }
+
+    private static String detailsRedirect(long projectId, long taskId) {
+        return "redirect:/projects/%d/tasks/%d".formatted(projectId, taskId);
+    }
+
+    private static String progressLabel(TaskProgress progress) {
+        return progress.completionPercentage().isEmpty()
+                ? "N/A"
+                : String.format(Locale.ROOT, "%.1f%%", progress.completionPercentage().getAsDouble());
+    }
+}

src/main/java/com/lab/labtimesheet/feature/task/exception/TaskNotFoundException.java

@@ -0,0 +1,12 @@
+package com.lab.labtimesheet.feature.task.exception;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.web.bind.annotation.ResponseStatus;
+
+@ResponseStatus(HttpStatus.NOT_FOUND)
+public final class TaskNotFoundException extends RuntimeException {
+
+    public TaskNotFoundException() {
+        super("Task or Project was not found");
+    }
+}

src/main/java/com/lab/labtimesheet/feature/task/exception/TaskValidationException.java

@@ -0,0 +1,12 @@
+package com.lab.labtimesheet.feature.task.exception;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.web.bind.annotation.ResponseStatus;
+
+@ResponseStatus(HttpStatus.BAD_REQUEST)
+public final class TaskValidationException extends RuntimeException {
+
+    public TaskValidationException(String message) {
+        super(message);
+    }
+}

src/main/java/com/lab/labtimesheet/feature/task/model/TaskProgress.java

@@ -0,0 +1,40 @@
+package com.lab.labtimesheet.feature.task.model;
+
+import java.util.Collection;
+import java.util.OptionalDouble;
+
+public record TaskProgress(int todo, int inProgress, int blocked, int done) {
+
+    public static TaskProgress from(Collection<TaskStatus> statuses) {
+        int todo = 0;
+        int inProgress = 0;
+        int blocked = 0;
+        int done = 0;
+        for (TaskStatus status : statuses) {
+            switch (status) {
+                case TODO -> todo++;
+                case IN_PROGRESS -> inProgress++;
+                case BLOCKED -> blocked++;
+                case DONE -> done++;
+            }
+        }
+        return new TaskProgress(todo, inProgress, blocked, done);
+    }
+
+    public int total() {
+        return todo + inProgress + blocked + done;
+    }
+
+    public int count(TaskStatus status) {
+        return switch (status) {
+            case TODO -> todo;
+            case IN_PROGRESS -> inProgress;
+            case BLOCKED -> blocked;
+            case DONE -> done;
+        };
+    }
+
+    public OptionalDouble completionPercentage() {
+        return total() == 0 ? OptionalDouble.empty() : OptionalDouble.of(done * 100.0 / total());
+    }
+}

src/main/java/com/lab/labtimesheet/feature/task/model/TaskStatus.java

@@ -0,0 +1,17 @@
+package com.lab.labtimesheet.feature.task.model;
+
+public enum TaskStatus {
+    TODO,
+    IN_PROGRESS,
+    BLOCKED,
+    DONE;
+
+    public boolean canTransitionTo(TaskStatus target) {
+        return switch (this) {
+            case TODO -> target == IN_PROGRESS || target == BLOCKED;
+            case IN_PROGRESS -> target == DONE || target == BLOCKED;
+            case BLOCKED -> target == TODO || target == IN_PROGRESS;
+            case DONE -> target == IN_PROGRESS;
+        };
+    }
+}

src/main/java/com/lab/labtimesheet/feature/task/model/dto/CreateTaskCommand.java

@@ -0,0 +1,10 @@
+package com.lab.labtimesheet.feature.task.model.dto;
+
+import java.time.LocalDate;
+
+public record CreateTaskCommand(
+        long projectId,
+        long assigneeMembershipId,
+        String title,
+        String description,
+        LocalDate dueDate) {}

src/main/java/com/lab/labtimesheet/feature/task/model/dto/TaskAssigneeChoice.java

@@ -0,0 +1,3 @@
+package com.lab.labtimesheet.feature.task.model.dto;
+
+public record TaskAssigneeChoice(long membershipId, String displayName) {}

src/main/java/com/lab/labtimesheet/feature/task/model/dto/TaskCommentView.java

@@ -0,0 +1,5 @@
+package com.lab.labtimesheet.feature.task.model.dto;
+
+import java.time.Instant;
+
+public record TaskCommentView(long id, long taskId, long authorUserId, String body, Instant createdAt) {}

src/main/java/com/lab/labtimesheet/feature/task/model/dto/TaskCreateForm.java

@@ -0,0 +1,13 @@
+package com.lab.labtimesheet.feature.task.model.dto;
+
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Size;
+import java.time.LocalDate;
+import org.springframework.format.annotation.DateTimeFormat;
+
+public record TaskCreateForm(
+        @NotBlank @Size(max = 200) String title,
+        String description,
+        @NotNull Long assigneeMembershipId,
+        @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate dueDate) {}

src/main/java/com/lab/labtimesheet/feature/task/model/dto/TaskDashboardView.java

@@ -0,0 +1,13 @@
+package com.lab.labtimesheet.feature.task.model.dto;
+
+import java.util.List;
+
+public record TaskDashboardView(
+        long blockedTaskCount,
+        long assignedTaskCount,
+        List<TaskPriorityView> priorityTasks) {
+
+    public TaskDashboardView {
+        priorityTasks = List.copyOf(priorityTasks);
+    }
+}

src/main/java/com/lab/labtimesheet/feature/task/model/dto/TaskDetails.java

@@ -0,0 +1,14 @@
+package com.lab.labtimesheet.feature.task.model.dto;
+
+import java.util.List;
+
+public record TaskDetails(
+        TaskView task,
+        List<TaskCommentView> comments,
+        boolean canChangeStatus,
+        boolean canComment) {
+
+    public TaskDetails {
+        comments = List.copyOf(comments);
+    }
+}

src/main/java/com/lab/labtimesheet/feature/task/model/dto/TaskListView.java

@@ -0,0 +1,11 @@
+package com.lab.labtimesheet.feature.task.model.dto;
+
+import com.lab.labtimesheet.feature.task.model.TaskProgress;
+import java.util.List;
+
+public record TaskListView(List<TaskView> tasks, TaskProgress progress, boolean canCreate) {
+
+    public TaskListView {
+        tasks = List.copyOf(tasks);
+    }
+}

src/main/java/com/lab/labtimesheet/feature/task/model/dto/TaskPriorityView.java

@@ -0,0 +1,10 @@
+package com.lab.labtimesheet.feature.task.model.dto;
+
+import com.lab.labtimesheet.feature.task.model.TaskStatus;
+import java.time.LocalDate;
+
+public record TaskPriorityView(
+        String title,
+        String projectName,
+        TaskStatus status,
+        LocalDate dueDate) {}

src/main/java/com/lab/labtimesheet/feature/task/model/dto/TaskView.java

@@ -0,0 +1,19 @@
+package com.lab.labtimesheet.feature.task.model.dto;
+
+import com.lab.labtimesheet.feature.task.model.TaskStatus;
+import java.time.Instant;
+import java.time.LocalDate;
+
+public record TaskView(
+        long id,
+        long projectId,
+        long assigneeMembershipId,
+        String assigneeName,
+        String title,
+        String description,
+        TaskStatus status,
+        LocalDate dueDate,
+        long creatorMembershipId,
+        long assignerMembershipId,
+        Instant assignedAt,
+        Instant createdAt) {}

src/main/java/com/lab/labtimesheet/feature/task/model/entity/Task.java

@@ -0,0 +1,145 @@
+package com.lab.labtimesheet.feature.task.model.entity;
+
+import com.lab.labtimesheet.feature.task.model.TaskStatus;
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.EnumType;
+import jakarta.persistence.Enumerated;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import jakarta.persistence.Version;
+import java.time.Instant;
+import java.time.LocalDate;
+
+@Entity
+@Table(name = "tasks")
+public class Task {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "project_id", nullable = false)
+    private long projectId;
+
+    @Column(name = "assignee_membership_id", nullable = false)
+    private long assigneeMembershipId;
+
+    @Column(nullable = false, length = 200)
+    private String title;
+
+    @Column(columnDefinition = "text")
+    private String description;
+
+    @Enumerated(EnumType.STRING)
+    @Column(nullable = false, length = 24)
+    private TaskStatus status;
+
+    @Column(name = "due_date")
+    private LocalDate dueDate;
+
+    @Column(name = "assigned_at", nullable = false)
+    private Instant assignedAt;
+
+    @Column(name = "created_by_membership_id", nullable = false)
+    private long creatorMembershipId;
+
+    @Column(name = "assigned_by_membership_id", nullable = false)
+    private long assignerMembershipId;
+
+    @Column(name = "deleted_at")
+    private Instant deletedAt;
+
+    @Column(name = "deleted_by_membership_id")
+    private Long deletedByMembershipId;
+
+    @Column(name = "created_at", nullable = false)
+    private Instant createdAt;
+
+    @Column(name = "updated_at", nullable = false)
+    private Instant updatedAt;
+
+    @Version
+    private long version;
+
+    protected Task() {}
+
+    public Task(
+            long projectId,
+            long assigneeMembershipId,
+            String title,
+            String description,
+            LocalDate dueDate,
+            long actorMembershipId,
+            Instant now) {
+        this.projectId = projectId;
+        this.assigneeMembershipId = assigneeMembershipId;
+        this.title = title;
+        this.description = description;
+        this.status = TaskStatus.TODO;
+        this.dueDate = dueDate;
+        this.assignedAt = now;
+        this.creatorMembershipId = actorMembershipId;
+        this.assignerMembershipId = actorMembershipId;
+        this.createdAt = now;
+        this.updatedAt = now;
+    }
+
+    public void changeStatus(TaskStatus target, Instant now) {
+        if (!status.canTransitionTo(target)) {
+            throw new IllegalArgumentException("Task status transition is not allowed");
+        }
+        status = target;
+        updatedAt = now;
+    }
+
+    public Long getId() {
+        return id;
+    }
+
+    public long getProjectId() {
+        return projectId;
+    }
+
+    public long getAssigneeMembershipId() {
+        return assigneeMembershipId;
+    }
+
+    public String getTitle() {
+        return title;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public TaskStatus getStatus() {
+        return status;
+    }
+
+    public LocalDate getDueDate() {
+        return dueDate;
+    }
+
+    public Instant getAssignedAt() {
+        return assignedAt;
+    }
+
+    public long getCreatorMembershipId() {
+        return creatorMembershipId;
+    }
+
+    public long getAssignerMembershipId() {
+        return assignerMembershipId;
+    }
+
+    public Instant getDeletedAt() {
+        return deletedAt;
+    }
+
+    public Instant getCreatedAt() {
+        return createdAt;
+    }
+}

src/main/java/com/lab/labtimesheet/feature/task/model/entity/TaskComment.java

@@ -0,0 +1,59 @@
+package com.lab.labtimesheet.feature.task.model.entity;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import java.time.Instant;
+
+@Entity
+@Table(name = "task_comments")
+public class TaskComment {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "task_id", nullable = false)
+    private long taskId;
+
+    @Column(name = "author_user_id", nullable = false)
+    private long authorUserId;
+
+    @Column(nullable = false, columnDefinition = "text")
+    private String body;
+
+    @Column(name = "created_at", nullable = false)
+    private Instant createdAt;
+
+    protected TaskComment() {}
+
+    public TaskComment(long taskId, long authorUserId, String body, Instant createdAt) {
+        this.taskId = taskId;
+        this.authorUserId = authorUserId;
+        this.body = body;
+        this.createdAt = createdAt;
+    }
+
+    public Long getId() {
+        return id;
+    }
+
+    public long getTaskId() {
+        return taskId;
+    }
+
+    public long getAuthorUserId() {
+        return authorUserId;
+    }
+
+    public String getBody() {
+        return body;
+    }
+
+    public Instant getCreatedAt() {
+        return createdAt;
+    }
+}

src/main/java/com/lab/labtimesheet/feature/task/repository/TaskCommentRepository.java

@@ -0,0 +1,10 @@
+package com.lab.labtimesheet.feature.task.repository;
+
+import com.lab.labtimesheet.feature.task.model.entity.TaskComment;
+import java.util.List;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface TaskCommentRepository extends JpaRepository<TaskComment, Long> {
+
+    List<TaskComment> findAllByTaskIdOrderByCreatedAtAscIdAsc(long taskId);
+}

src/main/java/com/lab/labtimesheet/feature/task/repository/TaskRepository.java

@@ -0,0 +1,56 @@
+package com.lab.labtimesheet.feature.task.repository;
+
+import com.lab.labtimesheet.feature.task.model.TaskStatus;
+import com.lab.labtimesheet.feature.task.model.entity.Task;
+import jakarta.persistence.LockModeType;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+import org.springframework.data.domain.Pageable;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Lock;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+
+public interface TaskRepository extends JpaRepository<Task, Long> {
+
+    Optional<Task> findByIdAndProjectIdAndDeletedAtIsNull(long id, long projectId);
+
+    @Lock(LockModeType.PESSIMISTIC_WRITE)
+    Optional<Task> findLockedByIdAndProjectIdAndDeletedAtIsNull(long id, long projectId);
+
+    List<Task> findAllByProjectIdAndDeletedAtIsNullOrderById(long projectId);
+
+    long countByProjectIdAndDeletedAtIsNull(long projectId);
+
+    long countByProjectIdInAndStatusAndDeletedAtIsNull(List<Long> projectIds, TaskStatus status);
+
+    long countByProjectIdInAndAssigneeMembershipIdInAndDeletedAtIsNull(
+            List<Long> projectIds, List<Long> assigneeMembershipIds);
+
+    @Query("""
+            select task
+            from Task task
+            where task.projectId in :projectIds
+              and task.assigneeMembershipId in :assigneeMembershipIds
+              and task.deletedAt is null
+            order by case when task.dueDate is null then 1 else 0 end,
+                     task.dueDate,
+                     task.id
+            """)
+    List<Task> findPriorityTasks(
+            @Param("projectIds") List<Long> projectIds,
+            @Param("assigneeMembershipIds") List<Long> assigneeMembershipIds,
+            Pageable pageable);
+
+    @Query("""
+            select count(task)
+            from Task task
+            where task.projectId = :projectId
+              and task.deletedAt is null
+              and task.assigneeMembershipId not in :activeMembershipIds
+            """)
+    long countCurrentTasksAssignedOutside(
+            @Param("projectId") long projectId,
+            @Param("activeMembershipIds") Set<Long> activeMembershipIds);
+}

src/main/java/com/lab/labtimesheet/feature/task/service/TaskDashboardService.java

@@ -0,0 +1,86 @@
+package com.lab.labtimesheet.feature.task.service;
+
+import com.lab.labtimesheet.feature.project.model.dto.ProjectSummary;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectTaskMemberView;
+import com.lab.labtimesheet.feature.project.service.ProjectQueryService;
+import com.lab.labtimesheet.feature.task.model.TaskStatus;
+import com.lab.labtimesheet.feature.task.model.dto.TaskDashboardView;
+import com.lab.labtimesheet.feature.task.model.dto.TaskPriorityView;
+import com.lab.labtimesheet.feature.task.model.entity.Task;
+import com.lab.labtimesheet.feature.task.repository.TaskRepository;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import org.springframework.data.domain.PageRequest;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+public class TaskDashboardService {
+
+    private static final TaskDashboardView EMPTY_DASHBOARD = new TaskDashboardView(0, 0, List.of());
+
+    private final TaskRepository tasks;
+    private final ProjectQueryService projects;
+
+    public TaskDashboardService(TaskRepository tasks, ProjectQueryService projects) {
+        this.tasks = tasks;
+        this.projects = projects;
+    }
+
+    @Transactional(readOnly = true)
+    public TaskDashboardView dashboard(String actorEmail) {
+        var actor = projects.authenticatedActor(actorEmail);
+        List<ProjectSummary> activeProjects = projects.listVisible(actor.userId()).stream()
+                .filter(project -> "ACTIVE".equals(project.status()))
+                .toList();
+        if ("MENTOR".equals(actor.role())) {
+            return mentorDashboard(activeProjects);
+        }
+        if ("INTERN".equals(actor.role())) {
+            return internDashboard(actor.userId(), activeProjects);
+        }
+        return EMPTY_DASHBOARD;
+    }
+
+    private TaskDashboardView mentorDashboard(List<ProjectSummary> activeProjects) {
+        List<Long> projectIds = activeProjects.stream().map(ProjectSummary::id).toList();
+        long blocked = projectIds.isEmpty()
+                ? 0
+                : tasks.countByProjectIdInAndStatusAndDeletedAtIsNull(projectIds, TaskStatus.BLOCKED);
+        return new TaskDashboardView(blocked, 0, List.of());
+    }
+
+    private TaskDashboardView internDashboard(long actorUserId, List<ProjectSummary> activeProjects) {
+        Map<Long, ProjectSummary> currentProjects = new LinkedHashMap<>();
+        Map<Long, Long> currentMemberships = new LinkedHashMap<>();
+        for (ProjectSummary project : activeProjects) {
+            projects.taskContext(actorUserId, project.id()).activeMembers().stream()
+                    .filter(member -> member.userId() == actorUserId)
+                    .map(ProjectTaskMemberView::membershipId)
+                    .findFirst()
+                    .ifPresent(membershipId -> {
+                        currentProjects.put(project.id(), project);
+                        currentMemberships.put(project.id(), membershipId);
+                    });
+        }
+        List<Long> projectIds = List.copyOf(currentProjects.keySet());
+        List<Long> membershipIds = List.copyOf(currentMemberships.values());
+        if (projectIds.isEmpty()) {
+            return EMPTY_DASHBOARD;
+        }
+
+        long assigned = tasks.countByProjectIdInAndAssigneeMembershipIdInAndDeletedAtIsNull(
+                projectIds, membershipIds);
+        List<TaskPriorityView> priority = tasks.findPriorityTasks(
+                        projectIds, membershipIds, PageRequest.of(0, 5))
+                .stream()
+                .map(task -> priorityView(task, currentProjects.get(task.getProjectId()).name()))
+                .toList();
+        return new TaskDashboardView(0, assigned, priority);
+    }
+
+    private static TaskPriorityView priorityView(Task task, String projectName) {
+        return new TaskPriorityView(task.getTitle(), projectName, task.getStatus(), task.getDueDate());
+    }
+}

src/main/java/com/lab/labtimesheet/feature/task/service/TaskQueryService.java

@@ -0,0 +1,24 @@
+package com.lab.labtimesheet.feature.task.service;
+
+import com.lab.labtimesheet.feature.task.repository.TaskRepository;
+import java.util.Set;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+public class TaskQueryService {
+
+    private final TaskRepository tasks;
+
+    public TaskQueryService(TaskRepository tasks) {
+        this.tasks = tasks;
+    }
+
+    @Transactional(readOnly = true)
+    public long countCurrentTasksAssignedOutside(long projectId, Set<Long> activeMembershipIds) {
+        if (activeMembershipIds.isEmpty()) {
+            return tasks.countByProjectIdAndDeletedAtIsNull(projectId);
+        }
+        return tasks.countCurrentTasksAssignedOutside(projectId, Set.copyOf(activeMembershipIds));
+    }
+}

src/main/java/com/lab/labtimesheet/feature/task/service/TaskService.java

@@ -0,0 +1,323 @@
+package com.lab.labtimesheet.feature.task.service;
+
+import com.lab.labtimesheet.feature.attendance.service.CalendarApplicationService;
+import com.lab.labtimesheet.feature.project.exception.ProjectAccessDeniedException;
+import com.lab.labtimesheet.feature.project.exception.ProjectRuleViolationException;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectActorView;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectMemberView;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectTaskContext;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectTaskMemberView;
+import com.lab.labtimesheet.feature.project.service.ProjectQueryService;
+import com.lab.labtimesheet.feature.project.service.ProjectService;
+import com.lab.labtimesheet.feature.task.exception.TaskNotFoundException;
+import com.lab.labtimesheet.feature.task.exception.TaskValidationException;
+import com.lab.labtimesheet.feature.task.model.TaskProgress;
+import com.lab.labtimesheet.feature.task.model.TaskStatus;
+import com.lab.labtimesheet.feature.task.model.dto.CreateTaskCommand;
+import com.lab.labtimesheet.feature.task.model.dto.TaskAssigneeChoice;
+import com.lab.labtimesheet.feature.task.model.dto.TaskCommentView;
+import com.lab.labtimesheet.feature.task.model.dto.TaskDetails;
+import com.lab.labtimesheet.feature.task.model.dto.TaskListView;
+import com.lab.labtimesheet.feature.task.model.dto.TaskView;
+import com.lab.labtimesheet.feature.task.model.entity.Task;
+import com.lab.labtimesheet.feature.task.model.entity.TaskComment;
+import com.lab.labtimesheet.feature.task.repository.TaskCommentRepository;
+import com.lab.labtimesheet.feature.task.repository.TaskRepository;
+import java.time.Clock;
+import java.time.LocalDate;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+public class TaskService {
+
+    private final TaskRepository tasks;
+    private final TaskCommentRepository comments;
+    private final ProjectQueryService projects;
+    private final ProjectService projectMutations;
+    private final CalendarApplicationService calendar;
+    private final Clock clock;
+
+    public TaskService(
+            TaskRepository tasks,
+            TaskCommentRepository comments,
+            ProjectQueryService projects,
+            ProjectService projectMutations,
+            CalendarApplicationService calendar,
+            Clock clock) {
+        this.tasks = tasks;
+        this.comments = comments;
+        this.projects = projects;
+        this.projectMutations = projectMutations;
+        this.calendar = calendar;
+        this.clock = clock;
+    }
+
+    @Transactional
+    public TaskView create(String actorEmail, CreateTaskCommand command) {
+        String title = requireTitle(command.title());
+        TaskAccess access = requireMutationAccess(actorEmail, command.projectId());
+        requireOpenProject(access.project());
+        ProjectTaskMemberView actorMembership = requireActorMembership(
+                access.project(), access.actor().userId());
+        ProjectTaskMemberView assignee = requireAssigneeMembership(
+                access.project(), command.assigneeMembershipId());
+        if (actorMembership.membershipId() != assignee.membershipId()
+                && !Objects.equals(access.project().currentLeaderMembershipId(), actorMembership.membershipId())) {
+            throw new TaskNotFoundException();
+        }
+        validateDueDate(access.project(), command.dueDate());
+
+        Task task = new Task(
+                access.project().projectId(),
+                assignee.membershipId(),
+                title,
+                trimToNull(command.description()),
+                command.dueDate(),
+                actorMembership.membershipId(),
+                clock.instant());
+        return view(tasks.saveAndFlush(task), assignee.displayName());
+    }
+
+    @Transactional
+    public TaskView changeStatus(String actorEmail, long projectId, long taskId, TaskStatus target) {
+        TaskAccess access = requireMutationAccess(actorEmail, projectId);
+        if (!"ACTIVE".equals(access.project().status())) {
+            throw new TaskNotFoundException();
+        }
+        ProjectTaskMemberView actorMembership = requireActorMembership(
+                access.project(), access.actor().userId());
+        Task task = requireLockedTask(projectId, taskId);
+        if (task.getAssigneeMembershipId() != actorMembership.membershipId()) {
+            throw new TaskNotFoundException();
+        }
+        if (!task.getStatus().canTransitionTo(target)) {
+            throw new TaskValidationException("Task status transition is not allowed");
+        }
+        task.changeStatus(target, clock.instant());
+        return view(tasks.saveAndFlush(task), actorMembership.displayName());
+    }
+
+    @Transactional
+    public TaskCommentView addComment(String actorEmail, long projectId, long taskId, String body) {
+        String normalizedBody = requireCommentBody(body);
+        TaskAccess access = requireMutationAccess(actorEmail, projectId);
+        if ("COMPLETED".equals(access.project().status())) {
+            throw new TaskNotFoundException();
+        }
+        boolean owningMentor = access.actor().userId() == access.project().mentorUserId();
+        boolean activeMember = access.project().activeMembers().stream()
+                .anyMatch(member -> member.userId() == access.actor().userId());
+        if (!owningMentor && !activeMember) {
+            throw new TaskNotFoundException();
+        }
+        requireLockedTask(projectId, taskId);
+
+        TaskComment comment = new TaskComment(
+                taskId, access.actor().userId(), normalizedBody, clock.instant());
+        return view(comments.saveAndFlush(comment));
+    }
+
+    @Transactional(readOnly = true)
+    public TaskListView list(String actorEmail, long projectId) {
+        TaskAccess access = requireReadableProject(actorEmail, projectId);
+        Map<Long, ProjectMemberView> members = projectMembers(access);
+        List<TaskView> projectTasks = tasks.findAllByProjectIdAndDeletedAtIsNullOrderById(projectId)
+                .stream()
+                .map(task -> view(task, requireAssigneeName(members, task.getAssigneeMembershipId())))
+                .toList();
+        return new TaskListView(
+                projectTasks,
+                TaskProgress.from(projectTasks.stream().map(TaskView::status).toList()),
+                isOpen(access.project()) && activeMembership(access) != null);
+    }
+
+    @Transactional(readOnly = true)
+    public TaskDetails details(String actorEmail, long projectId, long taskId) {
+        TaskAccess access = requireReadableProject(actorEmail, projectId);
+        ProjectTaskMemberView actorMembership = activeMembership(access);
+        Task persistedTask = requireTask(projectId, taskId);
+        TaskView task = view(
+                persistedTask,
+                requireAssigneeName(projectMembers(access), persistedTask.getAssigneeMembershipId()));
+        List<TaskCommentView> taskComments = comments.findAllByTaskIdOrderByCreatedAtAscIdAsc(taskId)
+                .stream()
+                .map(TaskService::view)
+                .toList();
+        boolean canChangeStatus = "ACTIVE".equals(access.project().status())
+                && actorMembership != null
+                && persistedTask.getAssigneeMembershipId() == actorMembership.membershipId();
+        boolean canComment = !"COMPLETED".equals(access.project().status())
+                && (access.actor().userId() == access.project().mentorUserId() || actorMembership != null);
+        return new TaskDetails(task, taskComments, canChangeStatus, canComment);
+    }
+
+    @Transactional(readOnly = true)
+    public List<TaskAssigneeChoice> assignmentChoices(String actorEmail, long projectId) {
+        TaskAccess access = requireProjectAccess(actorEmail, projectId);
+        requireOpenProject(access.project());
+        ProjectTaskMemberView actorMembership = requireActorMembership(
+                access.project(), access.actor().userId());
+        if (Objects.equals(access.project().currentLeaderMembershipId(), actorMembership.membershipId())) {
+            return access.project().activeMembers().stream()
+                    .map(member -> new TaskAssigneeChoice(member.membershipId(), member.displayName()))
+                    .toList();
+        }
+        return List.of(new TaskAssigneeChoice(
+                actorMembership.membershipId(), actorMembership.displayName()));
+    }
+
+    private TaskAccess requireProjectAccess(String actorEmail, long projectId) {
+        try {
+            ProjectActorView actor = projects.authenticatedActor(actorEmail);
+            return new TaskAccess(actor, projects.taskContext(actor.userId(), projectId));
+        } catch (ProjectAccessDeniedException | ProjectRuleViolationException exception) {
+            throw new TaskNotFoundException();
+        }
+    }
+
+    private TaskAccess requireMutationAccess(String actorEmail, long projectId) {
+        try {
+            ProjectActorView actor = projects.authenticatedActor(actorEmail);
+            return new TaskAccess(actor, projectMutations.taskMutationContext(actor.userId(), projectId));
+        } catch (ProjectAccessDeniedException | ProjectRuleViolationException exception) {
+            throw new TaskNotFoundException();
+        }
+    }
+
+    private TaskAccess requireReadableProject(String actorEmail, long projectId) {
+        TaskAccess access = requireProjectAccess(actorEmail, projectId);
+        boolean historicalIntern = "INTERN".equals(access.actor().role())
+                && access.project().activeMembers().stream()
+                        .noneMatch(member -> member.userId() == access.actor().userId());
+        if (historicalIntern && !"COMPLETED".equals(access.project().status())) {
+            throw new TaskNotFoundException();
+        }
+        return access;
+    }
+
+    private Map<Long, ProjectMemberView> projectMembers(TaskAccess access) {
+        try {
+            return projects.members(access.actor().userId(), access.project().projectId()).stream()
+                    .collect(Collectors.toUnmodifiableMap(ProjectMemberView::membershipId, Function.identity()));
+        } catch (ProjectAccessDeniedException | ProjectRuleViolationException exception) {
+            throw new TaskNotFoundException();
+        }
+    }
+
+    private static String requireAssigneeName(Map<Long, ProjectMemberView> members, long membershipId) {
+        ProjectMemberView member = members.get(membershipId);
+        if (member == null) {
+            throw new TaskNotFoundException();
+        }
+        return member.displayName();
+    }
+
+    private static ProjectTaskMemberView activeMembership(TaskAccess access) {
+        return access.project().activeMembers().stream()
+                .filter(member -> member.userId() == access.actor().userId())
+                .findFirst()
+                .orElse(null);
+    }
+
+    private Task requireTask(long projectId, long taskId) {
+        return tasks.findByIdAndProjectIdAndDeletedAtIsNull(taskId, projectId)
+                .orElseThrow(TaskNotFoundException::new);
+    }
+
+    private Task requireLockedTask(long projectId, long taskId) {
+        return tasks.findLockedByIdAndProjectIdAndDeletedAtIsNull(taskId, projectId)
+                .orElseThrow(TaskNotFoundException::new);
+    }
+
+    private static void requireOpenProject(ProjectTaskContext project) {
+        if (!isOpen(project)) {
+            throw new TaskNotFoundException();
+        }
+    }
+
+    private static boolean isOpen(ProjectTaskContext project) {
+        return "PLANNED".equals(project.status()) || "ACTIVE".equals(project.status());
+    }
+
+    private static ProjectTaskMemberView requireActorMembership(ProjectTaskContext project, long userId) {
+        return project.activeMembers().stream()
+                .filter(member -> member.userId() == userId)
+                .findFirst()
+                .orElseThrow(TaskNotFoundException::new);
+    }
+
+    private static ProjectTaskMemberView requireAssigneeMembership(ProjectTaskContext project, long membershipId) {
+        return project.activeMembers().stream()
+                .filter(member -> member.membershipId() == membershipId)
+                .findFirst()
+                .orElseThrow(TaskNotFoundException::new);
+    }
+
+    private void validateDueDate(ProjectTaskContext project, LocalDate dueDate) {
+        if (dueDate == null) {
+            return;
+        }
+        if (dueDate.isBefore(project.startDate()) || dueDate.isAfter(project.endDate())) {
+            throw new TaskValidationException("Due date must be within Project dates");
+        }
+        if (calendar.isGlobalDayOff(dueDate)) {
+            throw new TaskValidationException("Due date cannot be a current global day off");
+        }
+    }
+
+    private static TaskView view(Task task, String assigneeName) {
+        return new TaskView(
+                task.getId(),
+                task.getProjectId(),
+                task.getAssigneeMembershipId(),
+                assigneeName,
+                task.getTitle(),
+                task.getDescription(),
+                task.getStatus(),
+                task.getDueDate(),
+                task.getCreatorMembershipId(),
+                task.getAssignerMembershipId(),
+                task.getAssignedAt(),
+                task.getCreatedAt());
+    }
+
+    private static TaskCommentView view(TaskComment comment) {
+        return new TaskCommentView(
+                comment.getId(),
+                comment.getTaskId(),
+                comment.getAuthorUserId(),
+                comment.getBody(),
+                comment.getCreatedAt());
+    }
+
+    private static String requireTitle(String title) {
+        String trimmed = trimToNull(title);
+        if (trimmed == null || trimmed.length() > 200) {
+            throw new TaskValidationException("Title is required and must not exceed 200 characters");
+        }
+        return trimmed;
+    }
+
+    private static String requireCommentBody(String body) {
+        String trimmed = trimToNull(body);
+        if (trimmed == null) {
+            throw new TaskValidationException("Comment body is required");
+        }
+        return trimmed;
+    }
+
+    private static String trimToNull(String value) {
+        if (value == null || value.isBlank()) {
+            return null;
+        }
+        return value.trim();
+    }
+
+    private record TaskAccess(ProjectActorView actor, ProjectTaskContext project) {}
+}

src/main/resources/templates/projects/leadership.html

@@ -7,7 +7,7 @@
   <table><caption>Leadership history</caption><thead><tr><th scope="col">Leader</th><th scope="col">Started</th><th scope="col">Ended</th></tr></thead>
     <tbody><tr th:each="term : ${leadership}"><td th:text="${term.leaderName}"></td><td th:text="${term.startedAt}"></td><td th:text="${term.endedAt}"></td></tr></tbody>
   </table>
-  <form method="post" th:action="@{/projects/{id}/leadership(id=${project.id})}"><label for="leader">New Leader user ID</label><input id="leader" name="internUserId" type="number" min="1" required><button type="submit">Change Leader</button></form>
+  <form th:if="${project.canManage}" method="post" th:action="@{/projects/{id}/leadership(id=${project.id})}"><label for="leader">New Leader user ID</label><input id="leader" name="internUserId" type="number" min="1" required><button type="submit">Change Leader</button></form>
 </main>
 </body>
 </html>

src/main/resources/templates/projects/list.html

@@ -4,7 +4,7 @@
 <body>
 <main>
   <h1>Projects</h1>
-  <a href="/projects/new">Create Project</a>
+  <a th:if="${canCreateProject}" href="/projects/new">Create Project</a>
   <p th:if="${#lists.isEmpty(projects)}">No authorized Projects.</p>
   <table th:unless="${#lists.isEmpty(projects)}">
     <caption>Authorized Projects</caption>

src/main/resources/templates/projects/members.html

@@ -7,7 +7,7 @@
   <table><caption>Membership history</caption><thead><tr><th scope="col">Intern</th><th scope="col">Joined</th><th scope="col">Left</th><th scope="col">Role</th></tr></thead>
     <tbody><tr th:each="member : ${members}"><td th:text="${member.displayName}"></td><td th:text="${member.joinedAt}"></td><td th:text="${member.leftAt}"></td><td th:text="${member.currentLeader} ? 'Leader' : 'Member'"></td></tr></tbody>
   </table>
-  <form method="post" th:action="@{/projects/{id}/members(id=${project.id})}"><label for="intern">Intern user ID</label><input id="intern" name="internUserId" type="number" min="1" required><button type="submit">Add member</button></form>
+  <form th:if="${project.canManage}" method="post" th:action="@{/projects/{id}/members(id=${project.id})}"><label for="intern">Intern user ID</label><input id="intern" name="internUserId" type="number" min="1" required><button type="submit">Add member</button></form>
 </main>
 </body>
 </html>

src/main/resources/templates/tasks/detail.html

@@ -0,0 +1,37 @@
+<!doctype html>
+<html lang="en" xmlns:th="http://www.thymeleaf.org">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title th:text="${details.task.title}">Task</title>
+</head>
+<body>
+<main>
+    <h1 th:text="${details.task.title}">Task</h1>
+    <p th:text="${details.task.description ?: 'No description'}">No description</p>
+    <p>Assignee: <strong th:text="${details.task.assigneeName}">Assignee</strong></p>
+    <p>Status: <strong th:text="${details.task.status}">TODO</strong></p>
+    <p>Due date: <span th:text="${details.task.dueDate ?: '—'}">—</span></p>
+
+    <form th:if="${details.canChangeStatus}" method="post" th:action="@{/projects/{projectId}/tasks/{taskId}/status(projectId=${projectId},taskId=${details.task.id})}">
+        <label for="status">New status</label>
+        <select id="status" name="status" required>
+            <option th:each="status : ${statuses}" th:value="${status}" th:text="${status}">TODO</option>
+        </select>
+        <button type="submit">Change status</button>
+    </form>
+
+    <section aria-labelledby="comments-heading">
+        <h2 id="comments-heading">Comments</h2>
+        <ol>
+            <li th:each="comment : ${details.comments}" th:text="${comment.body}">Comment</li>
+        </ol>
+        <form th:if="${details.canComment}" method="post" th:action="@{/projects/{projectId}/tasks/{taskId}/comments(projectId=${projectId},taskId=${details.task.id})}">
+            <label for="body">Comment</label>
+            <textarea id="body" name="body" required></textarea>
+            <button type="submit">Add comment</button>
+        </form>
+    </section>
+</main>
+</body>
+</html>

src/main/resources/templates/tasks/form.html

@@ -0,0 +1,37 @@
+<!doctype html>
+<html lang="en" xmlns:th="http://www.thymeleaf.org">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Create Task</title>
+</head>
+<body>
+<main>
+    <h1>Create Task</h1>
+    <form method="post" th:action="@{/projects/{projectId}/tasks(projectId=${projectId})}" th:object="${taskForm}">
+        <div>
+            <label for="title">Title</label>
+            <input id="title" type="text" maxlength="200" required th:field="*{title}">
+            <p role="alert" th:if="${#fields.hasErrors('title')}" th:errors="*{title}">Title error</p>
+        </div>
+        <div>
+            <label for="description">Description</label>
+            <textarea id="description" th:field="*{description}"></textarea>
+        </div>
+        <div>
+            <label for="assigneeMembershipId">Assignee</label>
+            <select id="assigneeMembershipId" required th:field="*{assigneeMembershipId}">
+                <option value="">Select an assignee</option>
+                <option th:each="assignee : ${assignees}" th:value="${assignee.membershipId}" th:text="${assignee.displayName}">Member</option>
+            </select>
+            <p role="alert" th:if="${#fields.hasErrors('assigneeMembershipId')}" th:errors="*{assigneeMembershipId}">Assignee error</p>
+        </div>
+        <div>
+            <label for="dueDate">Due date</label>
+            <input id="dueDate" type="date" th:field="*{dueDate}">
+        </div>
+        <button type="submit">Create Task</button>
+    </form>
+</main>
+</body>
+</html>

src/main/resources/templates/tasks/list.html

@@ -0,0 +1,33 @@
+<!doctype html>
+<html lang="en" xmlns:th="http://www.thymeleaf.org">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Project tasks</title>
+</head>
+<body>
+<main>
+    <h1>Project tasks</h1>
+    <p>Progress: <strong th:text="${progressLabel}">N/A</strong></p>
+    <dl>
+        <dt>TODO</dt><dd th:text="${taskList.progress.todo}">0</dd>
+        <dt>IN_PROGRESS</dt><dd th:text="${taskList.progress.inProgress}">0</dd>
+        <dt>BLOCKED</dt><dd th:text="${taskList.progress.blocked}">0</dd>
+        <dt>DONE</dt><dd th:text="${taskList.progress.done}">0</dd>
+    </dl>
+    <p th:if="${taskList.canCreate}"><a th:href="@{/projects/{projectId}/tasks/new(projectId=${projectId})}">Create Task</a></p>
+    <table>
+        <caption>Current non-deleted Tasks</caption>
+        <thead><tr><th scope="col">Title</th><th scope="col">Assignee</th><th scope="col">Status</th><th scope="col">Due date</th></tr></thead>
+        <tbody>
+        <tr th:each="task : ${taskList.tasks}">
+            <td><a th:href="@{/projects/{projectId}/tasks/{taskId}(projectId=${projectId},taskId=${task.id})}" th:text="${task.title}">Task</a></td>
+            <td th:text="${task.assigneeName}">Assignee</td>
+            <td th:text="${task.status}">TODO</td>
+            <td th:text="${task.dueDate ?: '—'}">—</td>
+        </tr>
+        </tbody>
+    </table>
+</main>
+</body>
+</html>

src/test/java/com/lab/labtimesheet/feature/project/controller/ProjectControllerTest.java

@@ -3,6 +3,8 @@ package com.lab.labtimesheet.feature.project.controller;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.not;
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
@@ -13,6 +15,7 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
 
 import com.lab.labtimesheet.feature.project.exception.ProjectAccessDeniedException;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectCreateCommand;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectActorView;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectDetail;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectSummary;
 import com.lab.labtimesheet.feature.project.service.ProjectQueryService;
@@ -41,7 +44,8 @@ class ProjectControllerTest {
     @Test
     @WithMockUser(username = "mentor@example.test")
     void listsOnlyTheAuthenticatedUsersAuthorizedProjects() throws Exception {
-        when(pages.authenticatedUserId("mentor@example.test")).thenReturn(10L);
+        when(pages.authenticatedActor("mentor@example.test"))
+                .thenReturn(new ProjectActorView(10L, "MENTOR"));
         when(pages.listVisible(10L)).thenReturn(List.of(new ProjectSummary(
                 30L,
                 "Intern Portal Refresh",
@@ -52,11 +56,26 @@ class ProjectControllerTest {
         mvc.perform(get("/projects"))
                 .andExpect(status().isOk())
                 .andExpect(view().name("projects/list"))
-                .andExpect(model().attributeExists("projects"));
+                .andExpect(model().attributeExists("projects"))
+                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
+                        .string(containsString("Create Project")));
 
         verify(pages).listVisible(10L);
     }
 
+    @Test
+    @WithMockUser(username = "member@example.test")
+    void nonMentorProjectListOmitsTheCreateLink() throws Exception {
+        when(pages.authenticatedActor("member@example.test"))
+                .thenReturn(new ProjectActorView(20L, "INTERN"));
+        when(pages.listVisible(20L)).thenReturn(List.of());
+
+        mvc.perform(get("/projects"))
+                .andExpect(status().isOk())
+                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
+                        .string(not(containsString("Create Project"))));
+    }
+
     @Test
     @WithMockUser(username = "member@example.test")
     void guessedProjectIdReturnsTheSameNotFoundResponseAsAMissingProject() throws Exception {
@@ -79,16 +98,31 @@ class ProjectControllerTest {
                 LocalDate.of(2026, 8, 15),
                 LocalDate.of(2026, 9, 30),
                 "Mentor",
-                "Leader"));
+                "Leader",
+                false));
         when(pages.members(20L, 30L)).thenReturn(List.of());
         when(pages.leadership(20L, 30L)).thenReturn(List.of());
 
         mvc.perform(get("/projects/30/members"))
                 .andExpect(status().isOk())
-                .andExpect(view().name("projects/members"));
+                .andExpect(view().name("projects/members"))
+                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
+                        .string(not(containsString("Add member"))));
         mvc.perform(get("/projects/30/leadership"))
                 .andExpect(status().isOk())
-                .andExpect(view().name("projects/leadership"));
+                .andExpect(view().name("projects/leadership"))
+                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
+                        .string(not(containsString("Change Leader"))));
+    }
+
+    @Test
+    @WithMockUser(username = "member@example.test")
+    void nonMentorCannotOpenProjectCreationForm() throws Exception {
+        when(pages.authenticatedActor("member@example.test"))
+                .thenReturn(new ProjectActorView(20L, "INTERN"));
+
+        mvc.perform(get("/projects/new"))
+                .andExpect(status().isNotFound());
     }
 
     @Test

src/test/java/com/lab/labtimesheet/feature/project/service/ProjectServiceIntegrationTest.java

@@ -1,6 +1,7 @@
 package com.lab.labtimesheet.feature.project.service;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
@@ -144,11 +145,14 @@ class ProjectServiceIntegrationTest {
         assertEquals(List.of(), projectPages.listVisible(unrelatedId));
         assertEquals(projectId, projectPages.detail(memberId, projectId).id());
         assertEquals("INTERN", projectPages.authenticatedActor("member-view@example.test").role());
-        var taskContext = projectPages.taskContext(memberId, projectId);
+        var taskContext = projectService.taskMutationContext(memberId, projectId);
         assertEquals(mentorId, taskContext.mentorUserId());
         assertEquals("PLANNED", taskContext.status());
         assertEquals(2, taskContext.activeMembers().size());
         assertEquals(membershipId(projectId, leaderId), taskContext.currentLeaderMembershipId());
+        assertEquals(taskContext, projectPages.taskContext(memberId, projectId));
+        assertThrows(ProjectAccessDeniedException.class,
+                () -> projectService.taskMutationContext(otherMentorId, projectId));
         jdbc.update("""
                 update projects set status = 'ACTIVE', activated_at = ?, updated_at = ? where id = ?
                 """, dbTime(NOW.plusSeconds(30)), dbTime(NOW.plusSeconds(30)), projectId);
@@ -169,12 +173,48 @@ class ProjectServiceIntegrationTest {
         entityManager.clear();
 
         assertEquals(projectId, projectPages.detail(memberId, projectId).id());
-        assertTrue(projectPages.taskContext(memberId, projectId).activeMembers().stream()
+        assertTrue(projectService.taskMutationContext(memberId, projectId).activeMembers().stream()
                 .noneMatch(member -> member.userId() == memberId));
         assertEquals(0, projectPages.dashboardSummary(memberId).activeProjectCount());
         assertEquals(1, projectPages.dashboardSummary(mentorId).distinctActiveMemberCount());
     }
 
+    @Test
+    void completedProjectQueriesReturnHistoricalMembersWithoutRequiringACurrentLeader() {
+        long mentorId = user("mentor-history@example.test", "MENTOR");
+        long leaderId = intern("leader-history@example.test", "I012");
+        long memberId = intern("member-history@example.test", "I013");
+        long projectId = createProject(mentorId, leaderId, "Completed history");
+        projectService.addMember(mentorId, projectId, memberId);
+        var activatedAt = dbTime(NOW.plusSeconds(30));
+        var completedAt = dbTime(NOW.plusSeconds(60));
+        jdbc.update("""
+                update project_leadership_terms
+                set ended_at = ?, ended_by_mentor_user_id = ?
+                where project_id = ? and ended_at is null
+                """, completedAt, mentorId, projectId);
+        jdbc.update("""
+                update project_memberships
+                set left_at = ?, removed_by_mentor_user_id = ?, updated_at = ?
+                where project_id = ? and left_at is null
+                """, completedAt, mentorId, completedAt, projectId);
+        jdbc.update("""
+                update projects
+                set status = 'COMPLETED', activated_at = ?, completed_at = ?, updated_at = ?
+                where id = ?
+                """, activatedAt, completedAt, completedAt, projectId);
+        entityManager.clear();
+
+        var taskContext = projectPages.taskContext(memberId, projectId);
+        assertEquals("COMPLETED", taskContext.status());
+        assertNull(taskContext.currentLeaderMembershipId());
+        assertEquals(List.of(), taskContext.activeMembers());
+        var members = projectPages.members(memberId, projectId);
+        assertEquals(2, members.size());
+        assertTrue(members.stream().allMatch(member -> member.leftAt() != null));
+        assertTrue(members.stream().noneMatch(member -> member.currentLeader()));
+    }
+
     private long createProject(long mentorId, long leaderId, String name) {
         return projectService.create(
                 mentorId,

src/test/java/com/lab/labtimesheet/feature/project/service/ProjectTaskMutationContextTest.java

@@ -0,0 +1,59 @@
+package com.lab.labtimesheet.feature.project.service;
+
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import com.lab.labtimesheet.feature.account.service.AccountService;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectTaskContext;
+import com.lab.labtimesheet.feature.project.model.entity.ProjectEntity;
+import com.lab.labtimesheet.feature.project.repository.ProjectRepository;
+import java.time.Clock;
+import java.time.LocalDate;
+import java.util.List;
+import java.util.Optional;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+@ExtendWith(MockitoExtension.class)
+class ProjectTaskMutationContextTest {
+
+    @Mock
+    private ProjectRepository projects;
+
+    @Mock
+    private AccountService accounts;
+
+    @Mock
+    private ProjectQueryService queries;
+
+    @Mock
+    private ProjectEntity project;
+
+    @Test
+    void loadsTheProjectForUpdateBeforeBuildingTheTaskMutationContext() {
+        long actorUserId = 20L;
+        long projectId = 30L;
+        var expected = new ProjectTaskContext(
+                projectId,
+                10L,
+                "ACTIVE",
+                LocalDate.of(2026, 8, 15),
+                LocalDate.of(2026, 9, 30),
+                40L,
+                List.of());
+        var service = new ProjectService(projects, accounts, queries, Clock.systemUTC());
+        when(projects.findLockedById(projectId)).thenReturn(Optional.of(project));
+        when(queries.taskContext(actorUserId, project)).thenReturn(expected);
+
+        var actual = service.taskMutationContext(actorUserId, projectId);
+
+        assertSame(expected, actual);
+        verify(projects).findLockedById(projectId);
+        verify(projects, never()).findById(projectId);
+        verify(queries).taskContext(actorUserId, project);
+    }
+}

src/test/java/com/lab/labtimesheet/feature/task/controller/TaskControllerTest.java

@@ -0,0 +1,180 @@
+package com.lab.labtimesheet.feature.task.controller;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
+import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.model;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.view;
+
+import com.lab.labtimesheet.feature.task.exception.TaskNotFoundException;
+import com.lab.labtimesheet.feature.task.model.TaskProgress;
+import com.lab.labtimesheet.feature.task.model.TaskStatus;
+import com.lab.labtimesheet.feature.task.model.dto.CreateTaskCommand;
+import com.lab.labtimesheet.feature.task.model.dto.TaskAssigneeChoice;
+import com.lab.labtimesheet.feature.task.model.dto.TaskCommentView;
+import com.lab.labtimesheet.feature.task.model.dto.TaskDetails;
+import com.lab.labtimesheet.feature.task.model.dto.TaskListView;
+import com.lab.labtimesheet.feature.task.model.dto.TaskView;
+import com.lab.labtimesheet.feature.task.service.TaskService;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.util.List;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
+import org.springframework.test.context.bean.override.mockito.MockitoBean;
+import org.springframework.test.web.servlet.MockMvc;
+
+@WebMvcTest(TaskController.class)
+class TaskControllerTest {
+
+    private static final String ACTOR_EMAIL = "member@example.test";
+
+    @Autowired
+    private MockMvc mockMvc;
+
+    @MockitoBean
+    private TaskService taskService;
+
+    @Test
+    void taskListRequiresAuthentication() throws Exception {
+        mockMvc.perform(get("/projects/10/tasks"))
+                .andExpect(status().isUnauthorized());
+
+        verifyNoInteractions(taskService);
+    }
+
+    @Test
+    void emptyTaskListRendersNotApplicableProgress() throws Exception {
+        given(taskService.list(ACTOR_EMAIL, 10L))
+                .willReturn(new TaskListView(List.of(), TaskProgress.from(List.of()), false));
+
+        mockMvc.perform(get("/projects/10/tasks").with(user(ACTOR_EMAIL)))
+                .andExpect(status().isOk())
+                .andExpect(view().name("tasks/list"))
+                .andExpect(content().string(org.hamcrest.Matchers.containsString("N/A")))
+                .andExpect(content().string(org.hamcrest.Matchers.not(
+                        org.hamcrest.Matchers.containsString("Create Task"))));
+    }
+
+    @Test
+    void taskListShowsAssigneeAndCreateActionOnlyWhenAllowed() throws Exception {
+        given(taskService.list(ACTOR_EMAIL, 10L)).willReturn(new TaskListView(
+                List.of(task(25L)), TaskProgress.from(List.of(TaskStatus.TODO)), true));
+
+        mockMvc.perform(get("/projects/10/tasks").with(user(ACTOR_EMAIL)))
+                .andExpect(status().isOk())
+                .andExpect(content().string(org.hamcrest.Matchers.containsString("Member Name")))
+                .andExpect(content().string(org.hamcrest.Matchers.containsString("Create Task")));
+    }
+
+    @Test
+    void guessedTaskIdentifierReturnsNotFoundWithoutRenderingDetails() throws Exception {
+        given(taskService.details(ACTOR_EMAIL, 10L, 999L)).willThrow(new TaskNotFoundException());
+
+        mockMvc.perform(get("/projects/10/tasks/999").with(user(ACTOR_EMAIL)))
+                .andExpect(status().isNotFound());
+    }
+
+    @Test
+    void validCreateFormUsesAuthenticatedIdentityAndRedirectsToCreatedTask() throws Exception {
+        given(taskService.create(org.mockito.ArgumentMatchers.eq(ACTOR_EMAIL), any(CreateTaskCommand.class)))
+                .willReturn(task(25L));
+
+        mockMvc.perform(post("/projects/10/tasks")
+                        .with(user(ACTOR_EMAIL))
+                        .with(csrf())
+                        .param("title", "Draft")
+                        .param("description", "Notes")
+                        .param("assigneeMembershipId", "7")
+                        .param("dueDate", "2026-08-20"))
+                .andExpect(status().is3xxRedirection())
+                .andExpect(redirectedUrl("/projects/10/tasks/25"));
+
+        ArgumentCaptor<CreateTaskCommand> command = ArgumentCaptor.forClass(CreateTaskCommand.class);
+        verify(taskService).create(org.mockito.ArgumentMatchers.eq(ACTOR_EMAIL), command.capture());
+        assertThat(command.getValue()).isEqualTo(new CreateTaskCommand(
+                10L, 7L, "Draft", "Notes", LocalDate.of(2026, 8, 20)));
+    }
+
+    @Test
+    void blankCreateFormRendersValidationErrorWithoutWriting() throws Exception {
+        given(taskService.assignmentChoices(ACTOR_EMAIL, 10L))
+                .willReturn(List.of(new TaskAssigneeChoice(7L, "Member")));
+
+        mockMvc.perform(post("/projects/10/tasks")
+                        .with(user(ACTOR_EMAIL))
+                        .with(csrf())
+                        .param("title", "  ")
+                        .param("assigneeMembershipId", "7"))
+                .andExpect(status().isOk())
+                .andExpect(view().name("tasks/form"))
+                .andExpect(model().attributeHasFieldErrors("taskForm", "title"));
+
+        verify(taskService, org.mockito.Mockito.never())
+                .create(org.mockito.ArgumentMatchers.eq(ACTOR_EMAIL), any(CreateTaskCommand.class));
+    }
+
+    @Test
+    void statusAndCommentPostsUseAuthenticatedIdentityAndCsrf() throws Exception {
+        given(taskService.changeStatus(ACTOR_EMAIL, 10L, 25L, TaskStatus.IN_PROGRESS))
+                .willReturn(task(25L));
+        given(taskService.addComment(ACTOR_EMAIL, 10L, 25L, "Update"))
+                .willReturn(new TaskCommentView(3L, 25L, 5L, "Update", Instant.parse("2026-08-14T10:00:00Z")));
+
+        mockMvc.perform(post("/projects/10/tasks/25/status")
+                        .with(user(ACTOR_EMAIL))
+                        .with(csrf())
+                        .param("status", "IN_PROGRESS"))
+                .andExpect(status().is3xxRedirection())
+                .andExpect(redirectedUrl("/projects/10/tasks/25"));
+        mockMvc.perform(post("/projects/10/tasks/25/comments")
+                        .with(user(ACTOR_EMAIL))
+                        .with(csrf())
+                        .param("body", "Update"))
+                .andExpect(status().is3xxRedirection())
+                .andExpect(redirectedUrl("/projects/10/tasks/25"));
+    }
+
+    @Test
+    void taskDetailsHideUnavailableActionsAndShowAssignee() throws Exception {
+        given(taskService.details(ACTOR_EMAIL, 10L, 25L))
+                .willReturn(new TaskDetails(task(25L), List.of(), false, false));
+
+        mockMvc.perform(get("/projects/10/tasks/25").with(user(ACTOR_EMAIL)))
+                .andExpect(status().isOk())
+                .andExpect(content().string(org.hamcrest.Matchers.containsString("Member Name")))
+                .andExpect(content().string(org.hamcrest.Matchers.not(
+                        org.hamcrest.Matchers.containsString("Change status"))))
+                .andExpect(content().string(org.hamcrest.Matchers.not(
+                        org.hamcrest.Matchers.containsString("Add comment"))));
+    }
+
+    @Test
+    void taskDetailsRenderAvailableActions() throws Exception {
+        given(taskService.details(ACTOR_EMAIL, 10L, 25L))
+                .willReturn(new TaskDetails(task(25L), List.of(), true, true));
+
+        mockMvc.perform(get("/projects/10/tasks/25").with(user(ACTOR_EMAIL)))
+                .andExpect(status().isOk())
+                .andExpect(content().string(org.hamcrest.Matchers.containsString("Change status")))
+                .andExpect(content().string(org.hamcrest.Matchers.containsString("Add comment")));
+    }
+
+    private static TaskView task(long id) {
+        Instant instant = Instant.parse("2026-08-14T10:00:00Z");
+        return new TaskView(
+                id, 10L, 7L, "Member Name", "Draft", "Notes", TaskStatus.TODO,
+                LocalDate.of(2026, 8, 20), 7L, 7L, instant, instant);
+    }
+}

src/test/java/com/lab/labtimesheet/feature/task/model/TaskDomainRulesTest.java

@@ -0,0 +1,61 @@
+package com.lab.labtimesheet.feature.task.model;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Stream;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+
+class TaskDomainRulesTest {
+
+    private static final Map<TaskStatus, Set<TaskStatus>> ALLOWED_TRANSITIONS = Map.of(
+            TaskStatus.TODO, Set.of(TaskStatus.IN_PROGRESS, TaskStatus.BLOCKED),
+            TaskStatus.IN_PROGRESS, Set.of(TaskStatus.DONE, TaskStatus.BLOCKED),
+            TaskStatus.BLOCKED, Set.of(TaskStatus.TODO, TaskStatus.IN_PROGRESS),
+            TaskStatus.DONE, Set.of(TaskStatus.IN_PROGRESS));
+
+    @ParameterizedTest
+    @MethodSource("allStatusTransitions")
+    void acceptsOnlyTheFixedStatusGraph(TaskStatus current, TaskStatus target, boolean expected) {
+        assertThat(current.canTransitionTo(target)).isEqualTo(expected);
+    }
+
+    @Test
+    void reportsNoPercentageForAProjectWithoutTasks() {
+        TaskProgress progress = TaskProgress.from(List.of());
+
+        assertThat(progress.completionPercentage()).isEmpty();
+        assertThat(progress.total()).isZero();
+        assertThat(progress.count(TaskStatus.DONE)).isZero();
+    }
+
+    @Test
+    void countsStatusesAndDonePercentageFromCurrentTasks() {
+        TaskProgress progress = TaskProgress.from(List.of(
+                TaskStatus.TODO,
+                TaskStatus.IN_PROGRESS,
+                TaskStatus.DONE,
+                TaskStatus.DONE));
+
+        assertThat(progress.completionPercentage()).hasValue(50);
+        assertThat(progress.total()).isEqualTo(4);
+        assertThat(progress.count(TaskStatus.TODO)).isEqualTo(1);
+        assertThat(progress.count(TaskStatus.IN_PROGRESS)).isEqualTo(1);
+        assertThat(progress.count(TaskStatus.BLOCKED)).isZero();
+        assertThat(progress.count(TaskStatus.DONE)).isEqualTo(2);
+    }
+
+    private static Stream<Arguments> allStatusTransitions() {
+        return Stream.of(TaskStatus.values())
+                .flatMap(current -> Stream.of(TaskStatus.values())
+                        .map(target -> Arguments.of(
+                                current,
+                                target,
+                                ALLOWED_TRANSITIONS.get(current).contains(target))));
+    }
+}

src/test/java/com/lab/labtimesheet/feature/task/repository/TaskPersistenceStructureTest.java

@@ -0,0 +1,70 @@
+package com.lab.labtimesheet.feature.task.repository;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import com.lab.labtimesheet.feature.task.model.entity.Task;
+import com.lab.labtimesheet.feature.task.model.entity.TaskComment;
+import com.lab.labtimesheet.feature.task.service.TaskService;
+import jakarta.persistence.Entity;
+import jakarta.persistence.LockModeType;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Arrays;
+import org.junit.jupiter.api.Test;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Lock;
+import org.springframework.jdbc.core.simple.JdbcClient;
+
+class TaskPersistenceStructureTest {
+
+    @Test
+    void taskPersistenceUsesJpaEntitiesAndSpringDataRepositories() {
+        assertThat(Task.class).hasAnnotation(Entity.class);
+        assertThat(TaskComment.class).hasAnnotation(Entity.class);
+        assertThat(JpaRepository.class).isAssignableFrom(TaskRepository.class);
+        assertThat(JpaRepository.class).isAssignableFrom(TaskCommentRepository.class);
+    }
+
+    @Test
+    void taskServiceUsesTaskRepositoriesInsteadOfDirectJdbcAccess() {
+        var constructorTypes = Arrays.stream(TaskService.class.getDeclaredConstructors())
+                .flatMap(constructor -> Arrays.stream(constructor.getParameterTypes()))
+                .toList();
+
+        assertThat(constructorTypes)
+                .contains(TaskRepository.class, TaskCommentRepository.class)
+                .doesNotContain(JdbcClient.class);
+    }
+
+    @Test
+    void taskMutationLookupUsesAPessimisticWriteLock() throws NoSuchMethodException {
+        var method = TaskRepository.class.getMethod(
+                "findLockedByIdAndProjectIdAndDeletedAtIsNull", long.class, long.class);
+
+        Lock lock = method.getAnnotation(Lock.class);
+        assertThat(lock).isNotNull();
+        assertThat(lock.value()).isEqualTo(LockModeType.PESSIMISTIC_WRITE);
+    }
+
+    @Test
+    void taskBusinessCodeContainsNoDirectJdbcOrSqlImports() throws IOException {
+        Path taskSource = Path.of("src/main/java/com/lab/labtimesheet/feature/task");
+        try (var sources = Files.walk(taskSource)) {
+            var directSqlSources = sources
+                    .filter(path -> path.toString().endsWith(".java"))
+                    .filter(path -> {
+                        try {
+                            String source = Files.readString(path);
+                            return source.contains("import org.springframework.jdbc")
+                                    || source.contains("import java.sql");
+                        } catch (IOException exception) {
+                            throw new IllegalStateException("Cannot inspect " + path, exception);
+                        }
+                    })
+                    .toList();
+
+            assertThat(directSqlSources).isEmpty();
+        }
+    }
+}

src/test/java/com/lab/labtimesheet/feature/task/service/TaskCreationIntegrationTest.java

@@ -0,0 +1,563 @@
+package com.lab.labtimesheet.feature.task.service;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import com.lab.labtimesheet.config.TestcontainersConfiguration;
+import com.lab.labtimesheet.feature.task.exception.TaskNotFoundException;
+import com.lab.labtimesheet.feature.task.exception.TaskValidationException;
+import com.lab.labtimesheet.feature.task.model.TaskStatus;
+import com.lab.labtimesheet.feature.task.model.dto.CreateTaskCommand;
+import com.lab.labtimesheet.feature.task.model.dto.TaskAssigneeChoice;
+import com.lab.labtimesheet.feature.task.model.dto.TaskCommentView;
+import com.lab.labtimesheet.feature.task.model.dto.TaskDetails;
+import com.lab.labtimesheet.feature.task.model.dto.TaskListView;
+import com.lab.labtimesheet.feature.task.model.dto.TaskView;
+import jakarta.persistence.EntityManager;
+import java.time.LocalDate;
+import java.util.Set;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.context.annotation.Import;
+import org.springframework.jdbc.core.simple.JdbcClient;
+import org.springframework.test.context.ActiveProfiles;
+import org.springframework.transaction.annotation.Transactional;
+
+@Import(TestcontainersConfiguration.class)
+@SpringBootTest
+@ActiveProfiles("test")
+@Transactional
+class TaskCreationIntegrationTest {
+
+    private static final LocalDate PROJECT_START = LocalDate.of(2026, 8, 1);
+    private static final LocalDate PROJECT_END = LocalDate.of(2026, 8, 31);
+
+    @Autowired
+    private JdbcClient jdbc;
+
+    @Autowired
+    private EntityManager entityManager;
+
+    @Autowired
+    private TaskService taskService;
+
+    @Autowired
+    private TaskQueryService taskQueries;
+
+    @Autowired
+    private TaskDashboardService taskDashboard;
+
+    private long projectId;
+    private long leaderMembershipId;
+    private long memberMembershipId;
+
+    @BeforeEach
+    void setUpProject() {
+        long mentorId = insertUser("mentor@example.test", "MENTOR");
+        long leaderId = insertIntern("leader@example.test");
+        long memberId = insertIntern("member@example.test");
+        projectId = insertProject(mentorId, "PLANNED");
+        leaderMembershipId = insertMembership(projectId, leaderId, mentorId);
+        memberMembershipId = insertMembership(projectId, memberId, mentorId);
+        jdbc.sql("""
+                        insert into project_leadership_terms
+                            (project_id, membership_id, appointed_by_mentor_user_id)
+                        values (:projectId, :membershipId, :mentorId)
+                        """)
+                .param("projectId", projectId)
+                .param("membershipId", leaderMembershipId)
+                .param("mentorId", mentorId)
+                .update();
+    }
+
+    @Test
+    void activeMemberCreatesOnlyASelfAssignedTaskWithEqualActors() {
+        TaskView task = taskService.create(
+                "member@example.test",
+                new CreateTaskCommand(projectId, memberMembershipId, "  Draft results  ", "  notes  ", PROJECT_START));
+
+        assertThat(task.status()).isEqualTo(TaskStatus.TODO);
+        assertThat(task.title()).isEqualTo("Draft results");
+        assertThat(task.description()).isEqualTo("notes");
+        assertThat(task.creatorMembershipId()).isEqualTo(memberMembershipId);
+        assertThat(task.assignerMembershipId()).isEqualTo(memberMembershipId);
+        assertThat(task.assigneeMembershipId()).isEqualTo(memberMembershipId);
+        assertThat(task.assigneeName()).isEqualTo("member@example.test");
+
+        assertThatThrownBy(() -> taskService.create(
+                        "member@example.test",
+                        new CreateTaskCommand(projectId, leaderMembershipId, "Forbidden", null, null)))
+                .isInstanceOf(TaskNotFoundException.class);
+        assertThat(taskCount()).isEqualTo(1);
+    }
+
+    @Test
+    void currentLeaderCreatesForAnotherActiveSameProjectMember() {
+        TaskView task = taskService.create(
+                "leader@example.test",
+                new CreateTaskCommand(projectId, memberMembershipId, "Review results", null, PROJECT_END));
+
+        assertThat(task.creatorMembershipId()).isEqualTo(leaderMembershipId);
+        assertThat(task.assignerMembershipId()).isEqualTo(leaderMembershipId);
+        assertThat(task.assigneeMembershipId()).isEqualTo(memberMembershipId);
+    }
+
+    @Test
+    void rejectsCrossProjectAndInactiveAssigneesWithoutWriting() {
+        long mentorId = userId("mentor@example.test");
+        long outsiderId = insertIntern("outsider@example.test");
+        long otherProjectId = insertProject(mentorId, "PLANNED");
+        long otherMembershipId = insertMembership(otherProjectId, outsiderId, mentorId);
+        jdbc.sql("update project_memberships set left_at = joined_at + interval '1 second', removed_by_mentor_user_id = :mentorId where id = :id")
+                .param("mentorId", mentorId)
+                .param("id", memberMembershipId)
+                .update();
+
+        assertThatThrownBy(() -> taskService.create(
+                        "leader@example.test",
+                        new CreateTaskCommand(projectId, otherMembershipId, "Cross project", null, null)))
+                .isInstanceOf(TaskNotFoundException.class);
+        assertThatThrownBy(() -> taskService.create(
+                        "leader@example.test",
+                        new CreateTaskCommand(projectId, memberMembershipId, "Inactive", null, null)))
+                .isInstanceOf(TaskNotFoundException.class);
+        assertThat(taskCount()).isZero();
+    }
+
+    @Test
+    void acceptsProjectBoundaryDueDatesAndRejectsOutsideOrCurrentDayOff() {
+        taskService.create(
+                "leader@example.test",
+                new CreateTaskCommand(projectId, memberMembershipId, "Start boundary", null, PROJECT_START));
+        taskService.create(
+                "leader@example.test",
+                new CreateTaskCommand(projectId, memberMembershipId, "End boundary", null, PROJECT_END));
+        insertDayOff(LocalDate.of(2026, 8, 15));
+
+        assertThatThrownBy(() -> taskService.create(
+                        "leader@example.test",
+                        new CreateTaskCommand(projectId, memberMembershipId, "Before", null, PROJECT_START.minusDays(1))))
+                .isInstanceOf(TaskValidationException.class);
+        assertThatThrownBy(() -> taskService.create(
+                        "leader@example.test",
+                        new CreateTaskCommand(projectId, memberMembershipId, "After", null, PROJECT_END.plusDays(1))))
+                .isInstanceOf(TaskValidationException.class);
+        assertThatThrownBy(() -> taskService.create(
+                        "leader@example.test",
+                        new CreateTaskCommand(projectId, memberMembershipId, "Day off", null, LocalDate.of(2026, 8, 15))))
+                .isInstanceOf(TaskValidationException.class);
+        assertThat(taskCount()).isEqualTo(2);
+    }
+
+    @Test
+    void onlyCurrentAssigneeChangesStatusOnAnActiveProject() {
+        TaskView task = taskService.create(
+                "member@example.test",
+                new CreateTaskCommand(projectId, memberMembershipId, "Run experiment", null, null));
+
+        assertThatThrownBy(() -> taskService.changeStatus(
+                        "member@example.test", projectId, task.id(), TaskStatus.IN_PROGRESS))
+                .isInstanceOf(TaskNotFoundException.class);
+        activateProject();
+        assertThatThrownBy(() -> taskService.changeStatus(
+                        "leader@example.test", projectId, task.id(), TaskStatus.IN_PROGRESS))
+                .isInstanceOf(TaskNotFoundException.class);
+
+        TaskView inProgress = taskService.changeStatus(
+                "member@example.test", projectId, task.id(), TaskStatus.IN_PROGRESS);
+
+        assertThat(inProgress.status()).isEqualTo(TaskStatus.IN_PROGRESS);
+        assertThatThrownBy(() -> taskService.changeStatus(
+                        "member@example.test", projectId, task.id(), TaskStatus.TODO))
+                .isInstanceOf(TaskValidationException.class);
+    }
+
+    @Test
+    void activeMemberAndOwningMentorAppendCommentsUntilProjectCompletion() {
+        TaskView task = taskService.create(
+                "member@example.test",
+                new CreateTaskCommand(projectId, memberMembershipId, "Discuss results", null, null));
+        insertIntern("outsider@example.test");
+
+        TaskCommentView memberComment = taskService.addComment(
+                "member@example.test", projectId, task.id(), "  First note  ");
+        TaskCommentView mentorComment = taskService.addComment(
+                "mentor@example.test", projectId, task.id(), "Mentor note");
+
+        assertThat(memberComment.body()).isEqualTo("First note");
+        assertThat(mentorComment.authorUserId()).isEqualTo(userId("mentor@example.test"));
+        assertThatThrownBy(() -> taskService.addComment(
+                        "outsider@example.test", projectId, task.id(), "Forbidden"))
+                .isInstanceOf(TaskNotFoundException.class);
+        assertThatThrownBy(() -> taskService.addComment(
+                        "member@example.test", projectId, task.id(), "  "))
+                .isInstanceOf(TaskValidationException.class);
+
+        completeProject();
+        assertThatThrownBy(() -> taskService.addComment(
+                        "mentor@example.test", projectId, task.id(), "Too late"))
+                .isInstanceOf(TaskNotFoundException.class);
+        assertThat(commentCount()).isEqualTo(2);
+    }
+
+    @Test
+    void authorizedListsAndDetailsExcludeDeletedTasksAndReportEmptyAsNotApplicable() {
+        TaskView todo = createMemberTask("Todo");
+        TaskView active = createMemberTask("Active");
+        TaskView blocked = createMemberTask("Blocked");
+        TaskView done = createMemberTask("Done");
+        TaskView deleted = createMemberTask("Deleted");
+        setStatus(active.id(), TaskStatus.IN_PROGRESS);
+        setStatus(blocked.id(), TaskStatus.BLOCKED);
+        setStatus(done.id(), TaskStatus.DONE);
+        softDelete(deleted.id());
+        taskService.addComment("member@example.test", projectId, todo.id(), "Visible comment");
+
+        TaskListView list = taskService.list("member@example.test", projectId);
+        TaskDetails details = taskService.details("mentor@example.test", projectId, todo.id());
+
+        assertThat(list.tasks()).extracting(TaskView::title)
+                .containsExactly("Todo", "Active", "Blocked", "Done");
+        assertThat(list.tasks()).extracting(TaskView::assigneeName)
+                .containsOnly("member@example.test");
+        assertThat(list.canCreate()).isTrue();
+        assertThat(list.progress().total()).isEqualTo(4);
+        assertThat(list.progress().count(TaskStatus.TODO)).isEqualTo(1);
+        assertThat(list.progress().count(TaskStatus.IN_PROGRESS)).isEqualTo(1);
+        assertThat(list.progress().count(TaskStatus.BLOCKED)).isEqualTo(1);
+        assertThat(list.progress().count(TaskStatus.DONE)).isEqualTo(1);
+        assertThat(list.progress().completionPercentage()).hasValue(25.0);
+        assertThat(details.comments()).extracting(TaskCommentView::body).containsExactly("Visible comment");
+        assertThat(details.task().assigneeName()).isEqualTo("member@example.test");
+        assertThat(details.canChangeStatus()).isFalse();
+        assertThat(details.canComment()).isTrue();
+
+        long emptyProjectId = insertProject(userId("mentor@example.test"), "PLANNED");
+        long emptyLeaderMembershipId = insertMembership(
+                emptyProjectId,
+                userId("leader@example.test"),
+                userId("mentor@example.test"));
+        jdbc.sql("""
+                        insert into project_leadership_terms
+                            (project_id, membership_id, appointed_by_mentor_user_id)
+                        values (:projectId, :membershipId, :mentorId)
+                        """)
+                .param("projectId", emptyProjectId)
+                .param("membershipId", emptyLeaderMembershipId)
+                .param("mentorId", userId("mentor@example.test"))
+                .update();
+        assertThat(taskService.list("mentor@example.test", emptyProjectId).progress().completionPercentage())
+                .isEmpty();
+    }
+
+    @Test
+    void directAndCrossProjectTaskIdentifiersDoNotDiscloseRecords() {
+        TaskView task = createMemberTask("Private task");
+        long otherProjectId = insertProject(userId("mentor@example.test"), "PLANNED");
+
+        assertThatThrownBy(() -> taskService.details(
+                        "mentor@example.test", otherProjectId, task.id()))
+                .isInstanceOf(TaskNotFoundException.class);
+        assertThatThrownBy(() -> taskService.details(
+                        "outsider@example.test", projectId, task.id()))
+                .isInstanceOf(TaskNotFoundException.class);
+    }
+
+    @Test
+    void formerMemberReadsOnlyCompletedProjectTaskHistory() {
+        TaskView task = createMemberTask("Historical task");
+        closeMembership(memberMembershipId);
+
+        assertThatThrownBy(() -> taskService.list("member@example.test", projectId))
+                .isInstanceOf(TaskNotFoundException.class);
+        assertThatThrownBy(() -> taskService.details("member@example.test", projectId, task.id()))
+                .isInstanceOf(TaskNotFoundException.class);
+
+        completeProject();
+
+        assertThat(currentLeadershipCount()).isZero();
+        assertThat(currentMembershipCount()).isZero();
+
+        assertThat(taskService.list("member@example.test", projectId).tasks())
+                .extracting(TaskView::title)
+                .containsExactly("Historical task");
+        assertThat(taskService.details("member@example.test", projectId, task.id()).task().title())
+                .isEqualTo("Historical task");
+    }
+
+    @Test
+    void viewCapabilitiesFollowCurrentMembershipAssignmentAndProjectLifecycle() {
+        TaskView task = createMemberTask("Capability task");
+
+        assertThat(taskService.list("member@example.test", projectId).canCreate()).isTrue();
+        assertThat(taskService.list("mentor@example.test", projectId).canCreate()).isFalse();
+        assertThat(taskService.details("member@example.test", projectId, task.id()))
+                .satisfies(details -> {
+                    assertThat(details.canChangeStatus()).isFalse();
+                    assertThat(details.canComment()).isTrue();
+                });
+
+        activateProject();
+
+        assertThat(taskService.details("member@example.test", projectId, task.id()))
+                .satisfies(details -> {
+                    assertThat(details.canChangeStatus()).isTrue();
+                    assertThat(details.canComment()).isTrue();
+                });
+        assertThat(taskService.details("leader@example.test", projectId, task.id()).canChangeStatus())
+                .isFalse();
+
+        completeProject();
+
+        assertThat(taskService.list("member@example.test", projectId).canCreate()).isFalse();
+        assertThat(taskService.details("member@example.test", projectId, task.id()))
+                .satisfies(details -> {
+                    assertThat(details.canChangeStatus()).isFalse();
+                    assertThat(details.canComment()).isFalse();
+                });
+    }
+
+    @Test
+    void createFormChoicesAreSelfOnlyForMembersAndAllActiveMembersForLeader() {
+        assertThat(taskService.assignmentChoices("member@example.test", projectId))
+                .extracting(TaskAssigneeChoice::membershipId)
+                .containsExactly(memberMembershipId);
+        assertThat(taskService.assignmentChoices("leader@example.test", projectId))
+                .extracting(TaskAssigneeChoice::membershipId)
+                .containsExactly(leaderMembershipId, memberMembershipId);
+    }
+
+    @Test
+    void projectActivationQueryCountsOnlyCurrentTasksOutsideActiveMemberships() {
+        createMemberTask("Member task");
+        TaskView leaderTask = taskService.create(
+                "leader@example.test",
+                new CreateTaskCommand(projectId, leaderMembershipId, "Leader task", null, null));
+
+        assertThat(taskQueries.countCurrentTasksAssignedOutside(projectId, Set.of(memberMembershipId)))
+                .isEqualTo(1L);
+
+        softDelete(leaderTask.id());
+        assertThat(taskQueries.countCurrentTasksAssignedOutside(projectId, Set.of(memberMembershipId)))
+                .isZero();
+    }
+
+    @Test
+    void internDashboardCountsAssignmentsAndOrdersFivePriorityTasks() {
+        createMemberTask("Late");
+        taskService.create("member@example.test", new CreateTaskCommand(
+                projectId, memberMembershipId, "No due date", null, null));
+        taskService.create("member@example.test", new CreateTaskCommand(
+                projectId, memberMembershipId, "Earliest A", null, LocalDate.of(2026, 8, 10)));
+        taskService.create("member@example.test", new CreateTaskCommand(
+                projectId, memberMembershipId, "Earliest B", null, LocalDate.of(2026, 8, 10)));
+        taskService.create("member@example.test", new CreateTaskCommand(
+                projectId, memberMembershipId, "Middle", null, LocalDate.of(2026, 8, 11)));
+        taskService.create("member@example.test", new CreateTaskCommand(
+                projectId, memberMembershipId, "Next", null, LocalDate.of(2026, 8, 13)));
+        setDueDateForTitle("Late", LocalDate.of(2026, 8, 12));
+        activateProject();
+
+        var dashboard = taskDashboard.dashboard("member@example.test");
+
+        assertThat(dashboard.assignedTaskCount()).isEqualTo(6L);
+        assertThat(dashboard.priorityTasks())
+                .extracting(task -> task.title())
+                .containsExactly("Earliest A", "Earliest B", "Middle", "Late", "Next");
+    }
+
+    private long insertUser(String email, String role) {
+        return jdbc.sql("""
+                        insert into app_users
+                            (email, display_name, password_hash, global_role, account_status, activated_at)
+                        values (:email, :email, 'hash', :role, 'ACTIVE', current_timestamp)
+                        returning id
+                        """)
+                .param("email", email)
+                .param("role", role)
+                .query(Long.class)
+                .single();
+    }
+
+    private long insertIntern(String email) {
+        long userId = insertUser(email, "INTERN");
+        jdbc.sql("""
+                        insert into intern_profiles
+                            (user_id, student_code, internship_start_date, internship_end_date,
+                             internship_status, activated_at)
+                        values (:userId, :studentCode, date '2026-01-01', date '2026-12-31',
+                                'ACTIVE', current_timestamp)
+                        """)
+                .param("userId", userId)
+                .param("studentCode", "S" + userId)
+                .update();
+        return userId;
+    }
+
+    private long insertProject(long mentorId, String status) {
+        return jdbc.sql("""
+                        insert into projects
+                            (mentor_user_id, name, status, start_date, end_date, activated_at)
+                        values (:mentorId, 'Project', :status, :startDate, :endDate,
+                                case when :status = 'ACTIVE' then current_timestamp else null end)
+                        returning id
+                        """)
+                .param("mentorId", mentorId)
+                .param("status", status)
+                .param("startDate", PROJECT_START)
+                .param("endDate", PROJECT_END)
+                .query(Long.class)
+                .single();
+    }
+
+    private long insertMembership(long targetProjectId, long internId, long mentorId) {
+        return jdbc.sql("""
+                        insert into project_memberships (project_id, intern_user_id, added_by_user_id)
+                        values (:projectId, :internId, :mentorId)
+                        returning id
+                        """)
+                .param("projectId", targetProjectId)
+                .param("internId", internId)
+                .param("mentorId", mentorId)
+                .query(Long.class)
+                .single();
+    }
+
+    private void insertDayOff(LocalDate date) {
+        long mentorId = userId("mentor@example.test");
+        jdbc.sql("""
+                        insert into global_calendar_events
+                            (calendar_date, name, source, is_day_off, created_by_user_id, updated_by_user_id)
+                        values (:date, 'Day off', 'CUSTOM', true, :userId, :userId)
+                        """)
+                .param("date", date)
+                .param("userId", mentorId)
+                .update();
+    }
+
+    private long userId(String email) {
+        return jdbc.sql("select id from app_users where email = :email")
+                .param("email", email)
+                .query(Long.class)
+                .single();
+    }
+
+    private long taskCount() {
+        return jdbc.sql("select count(*) from tasks").query(Long.class).single();
+    }
+
+    private long commentCount() {
+        return jdbc.sql("select count(*) from task_comments").query(Long.class).single();
+    }
+
+    private long currentLeadershipCount() {
+        return jdbc.sql("""
+                        select count(*) from project_leadership_terms
+                        where project_id = :projectId and ended_at is null
+                        """)
+                .param("projectId", projectId)
+                .query(Long.class)
+                .single();
+    }
+
+    private long currentMembershipCount() {
+        return jdbc.sql("""
+                        select count(*) from project_memberships
+                        where project_id = :projectId and left_at is null
+                        """)
+                .param("projectId", projectId)
+                .query(Long.class)
+                .single();
+    }
+
+    private TaskView createMemberTask(String title) {
+        return taskService.create(
+                "member@example.test",
+                new CreateTaskCommand(projectId, memberMembershipId, title, null, null));
+    }
+
+    private void activateProject() {
+        jdbc.sql("update projects set status = 'ACTIVE', activated_at = current_timestamp where id = :id")
+                .param("id", projectId)
+                .update();
+        entityManager.clear();
+    }
+
+    private void completeProject() {
+        long mentorId = userId("mentor@example.test");
+        jdbc.sql("""
+                        update tasks
+                        set status = 'DONE'
+                        where project_id = :id and deleted_at is null
+                        """)
+                .param("id", projectId)
+                .update();
+        jdbc.sql("""
+                        update project_leadership_terms
+                        set ended_at = started_at + interval '1 second', ended_by_mentor_user_id = :mentorId
+                        where project_id = :id and ended_at is null
+                        """)
+                .param("id", projectId)
+                .param("mentorId", mentorId)
+                .update();
+        jdbc.sql("""
+                        update project_memberships
+                        set left_at = joined_at + interval '1 second', removed_by_mentor_user_id = :mentorId
+                        where project_id = :id and left_at is null
+                        """)
+                .param("id", projectId)
+                .param("mentorId", mentorId)
+                .update();
+        jdbc.sql("""
+                        update projects
+                        set status = 'COMPLETED', activated_at = current_timestamp,
+                            completed_at = current_timestamp
+                        where id = :id
+                        """)
+                .param("id", projectId)
+                .update();
+        entityManager.clear();
+    }
+
+    private void setStatus(long taskId, TaskStatus status) {
+        jdbc.sql("update tasks set status = :status where id = :id")
+                .param("status", status.name())
+                .param("id", taskId)
+                .update();
+        entityManager.clear();
+    }
+
+    private void softDelete(long taskId) {
+        jdbc.sql("""
+                        update tasks
+                        set deleted_at = current_timestamp, deleted_by_membership_id = :membershipId
+                        where id = :id
+                        """)
+                .param("membershipId", memberMembershipId)
+                .param("id", taskId)
+                .update();
+        entityManager.clear();
+    }
+
+    private void closeMembership(long membershipId) {
+        jdbc.sql("""
+                        update project_memberships
+                        set left_at = joined_at + interval '1 second', removed_by_mentor_user_id = :mentorId
+                        where id = :id
+                        """)
+                .param("mentorId", userId("mentor@example.test"))
+                .param("id", membershipId)
+                .update();
+        entityManager.clear();
+    }
+
+    private void setDueDateForTitle(String title, LocalDate dueDate) {
+        jdbc.sql("update tasks set due_date = :dueDate where title = :title")
+                .param("dueDate", dueDate)
+                .param("title", title)
+                .update();
+        entityManager.clear();
+    }
+}

src/test/java/com/lab/labtimesheet/feature/task/service/TaskDashboardServiceTest.java

@@ -0,0 +1,108 @@
+package com.lab.labtimesheet.feature.task.service;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.BDDMockito.given;
+
+import com.lab.labtimesheet.feature.project.model.dto.ProjectActorView;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectSummary;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectTaskContext;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectTaskMemberView;
+import com.lab.labtimesheet.feature.project.service.ProjectQueryService;
+import com.lab.labtimesheet.feature.task.model.TaskStatus;
+import com.lab.labtimesheet.feature.task.model.entity.Task;
+import com.lab.labtimesheet.feature.task.repository.TaskRepository;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.util.List;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.data.domain.Pageable;
+
+@ExtendWith(MockitoExtension.class)
+class TaskDashboardServiceTest {
+
+    @Mock
+    private TaskRepository tasks;
+
+    @Mock
+    private ProjectQueryService projects;
+
+    @InjectMocks
+    private TaskDashboardService dashboardService;
+
+    @Test
+    void mentorDashboardCountsBlockedTasksOnlyInOwnedActiveProjects() {
+        given(projects.authenticatedActor("mentor@example.test"))
+                .willReturn(new ProjectActorView(3L, "MENTOR"));
+        given(projects.listVisible(3L)).willReturn(List.of(
+                summary(10L, "Active", "ACTIVE"),
+                summary(11L, "Planned", "PLANNED")));
+        given(tasks.countByProjectIdInAndStatusAndDeletedAtIsNull(List.of(10L), TaskStatus.BLOCKED))
+                .willReturn(4L);
+
+        var dashboard = dashboardService.dashboard("mentor@example.test");
+
+        assertThat(dashboard.blockedTaskCount()).isEqualTo(4L);
+        assertThat(dashboard.assignedTaskCount()).isZero();
+        assertThat(dashboard.priorityTasks()).isEmpty();
+    }
+
+    @Test
+    void internDashboardExcludesFormerMembershipsAndReturnsFiveDueDatePriorities() {
+        given(projects.authenticatedActor("intern@example.test"))
+                .willReturn(new ProjectActorView(5L, "INTERN"));
+        given(projects.listVisible(5L)).willReturn(List.of(
+                summary(10L, "Current", "ACTIVE"),
+                summary(11L, "Former", "ACTIVE"),
+                summary(12L, "Completed", "COMPLETED")));
+        given(projects.taskContext(5L, 10L)).willReturn(context(
+                10L, List.of(new ProjectTaskMemberView(70L, 5L, "Intern"))));
+        given(projects.taskContext(5L, 11L)).willReturn(context(11L, List.of()));
+        given(tasks.countByProjectIdInAndAssigneeMembershipIdInAndDeletedAtIsNull(
+                        List.of(10L), List.of(70L)))
+                .willReturn(6L);
+        var priority = new Task(
+                10L,
+                70L,
+                "Due first",
+                null,
+                LocalDate.of(2026, 8, 16),
+                70L,
+                Instant.parse("2026-08-15T00:00:00Z"));
+        given(tasks.findPriorityTasks(
+                        org.mockito.ArgumentMatchers.eq(List.of(10L)),
+                        org.mockito.ArgumentMatchers.eq(List.of(70L)),
+                        org.mockito.ArgumentMatchers.any(Pageable.class)))
+                .willReturn(List.of(priority));
+
+        var dashboard = dashboardService.dashboard("intern@example.test");
+
+        assertThat(dashboard.blockedTaskCount()).isZero();
+        assertThat(dashboard.assignedTaskCount()).isEqualTo(6L);
+        assertThat(dashboard.priorityTasks()).singleElement().satisfies(task -> {
+            assertThat(task.title()).isEqualTo("Due first");
+            assertThat(task.projectName()).isEqualTo("Current");
+            assertThat(task.status()).isEqualTo(TaskStatus.TODO);
+            assertThat(task.dueDate()).isEqualTo(LocalDate.of(2026, 8, 16));
+        });
+    }
+
+    private static ProjectSummary summary(long id, String name, String status) {
+        return new ProjectSummary(
+                id, name, status, LocalDate.of(2026, 8, 1), LocalDate.of(2026, 8, 31));
+    }
+
+    private static ProjectTaskContext context(long id, List<ProjectTaskMemberView> members) {
+        return new ProjectTaskContext(
+                id,
+                3L,
+                "ACTIVE",
+                LocalDate.of(2026, 8, 1),
+                LocalDate.of(2026, 8, 31),
+                null,
+                members);
+    }
+}

src/test/java/com/lab/labtimesheet/feature/task/service/TaskMutationBoundaryTest.java

@@ -0,0 +1,135 @@
+package com.lab.labtimesheet.feature.task.service;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.inOrder;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import com.lab.labtimesheet.feature.attendance.service.CalendarApplicationService;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectActorView;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectTaskContext;
+import com.lab.labtimesheet.feature.project.model.dto.ProjectTaskMemberView;
+import com.lab.labtimesheet.feature.project.service.ProjectQueryService;
+import com.lab.labtimesheet.feature.project.service.ProjectService;
+import com.lab.labtimesheet.feature.task.model.TaskStatus;
+import com.lab.labtimesheet.feature.task.model.dto.CreateTaskCommand;
+import com.lab.labtimesheet.feature.task.model.entity.Task;
+import com.lab.labtimesheet.feature.task.model.entity.TaskComment;
+import com.lab.labtimesheet.feature.task.repository.TaskCommentRepository;
+import com.lab.labtimesheet.feature.task.repository.TaskRepository;
+import java.time.Clock;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneOffset;
+import java.util.List;
+import java.util.Optional;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InOrder;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+@ExtendWith(MockitoExtension.class)
+class TaskMutationBoundaryTest {
+
+    private static final Instant NOW = Instant.parse("2026-08-15T00:00:00Z");
+
+    @Mock private TaskRepository tasks;
+    @Mock private TaskCommentRepository comments;
+    @Mock private ProjectQueryService projectQueries;
+    @Mock private ProjectService projectMutations;
+    @Mock private CalendarApplicationService calendar;
+
+    private TaskService service;
+    private ProjectTaskContext context;
+
+    @BeforeEach
+    void setUp() {
+        service = new TaskService(
+                tasks,
+                comments,
+                projectQueries,
+                projectMutations,
+                calendar,
+                Clock.fixed(NOW, ZoneOffset.UTC));
+        context = new ProjectTaskContext(
+                10L,
+                3L,
+                "ACTIVE",
+                LocalDate.of(2026, 8, 1),
+                LocalDate.of(2026, 8, 31),
+                70L,
+                List.of(new ProjectTaskMemberView(70L, 5L, "Member")));
+        when(projectQueries.authenticatedActor("member@example.test"))
+                .thenReturn(new ProjectActorView(5L, "INTERN"));
+        when(projectMutations.taskMutationContext(5L, 10L)).thenReturn(context);
+    }
+
+    @Test
+    void createLocksAndRechecksProjectBeforeWriting() {
+        Task saved = taskForView(TaskStatus.TODO);
+        when(tasks.saveAndFlush(any(Task.class))).thenReturn(saved);
+
+        service.create(
+                "member@example.test",
+                new CreateTaskCommand(10L, 70L, "Task", null, null));
+
+        InOrder order = inOrder(projectMutations, tasks);
+        order.verify(projectMutations).taskMutationContext(5L, 10L);
+        order.verify(tasks).saveAndFlush(any(Task.class));
+        verify(projectQueries, never()).taskContext(5L, 10L);
+    }
+
+    @Test
+    void statusChangeLocksProjectThenTaskBeforeMutation() {
+        Task task = taskForView(TaskStatus.TODO);
+        when(tasks.findLockedByIdAndProjectIdAndDeletedAtIsNull(25L, 10L))
+                .thenReturn(Optional.of(task));
+        when(tasks.saveAndFlush(task)).thenReturn(task);
+
+        service.changeStatus("member@example.test", 10L, 25L, TaskStatus.IN_PROGRESS);
+
+        InOrder order = inOrder(projectMutations, tasks, task);
+        order.verify(projectMutations).taskMutationContext(5L, 10L);
+        order.verify(tasks).findLockedByIdAndProjectIdAndDeletedAtIsNull(25L, 10L);
+        order.verify(task).changeStatus(TaskStatus.IN_PROGRESS, NOW);
+    }
+
+    @Test
+    void commentLocksProjectThenTaskBeforeWriting() {
+        Task task = mock(Task.class);
+        TaskComment saved = mock(TaskComment.class);
+        when(tasks.findLockedByIdAndProjectIdAndDeletedAtIsNull(25L, 10L))
+                .thenReturn(Optional.of(task));
+        when(comments.saveAndFlush(any(TaskComment.class))).thenReturn(saved);
+        when(saved.getId()).thenReturn(4L);
+        when(saved.getTaskId()).thenReturn(25L);
+        when(saved.getAuthorUserId()).thenReturn(5L);
+        when(saved.getBody()).thenReturn("Comment");
+        when(saved.getCreatedAt()).thenReturn(NOW);
+
+        service.addComment("member@example.test", 10L, 25L, "Comment");
+
+        InOrder order = inOrder(projectMutations, tasks, comments);
+        order.verify(projectMutations).taskMutationContext(5L, 10L);
+        order.verify(tasks).findLockedByIdAndProjectIdAndDeletedAtIsNull(25L, 10L);
+        order.verify(comments).saveAndFlush(any(TaskComment.class));
+    }
+
+    private static Task taskForView(TaskStatus status) {
+        Task task = mock(Task.class);
+        when(task.getId()).thenReturn(25L);
+        when(task.getProjectId()).thenReturn(10L);
+        when(task.getAssigneeMembershipId()).thenReturn(70L);
+        when(task.getTitle()).thenReturn("Task");
+        when(task.getStatus()).thenReturn(status);
+        when(task.getCreatorMembershipId()).thenReturn(70L);
+        when(task.getAssignerMembershipId()).thenReturn(70L);
+        when(task.getAssignedAt()).thenReturn(NOW);
+        when(task.getCreatedAt()).thenReturn(NOW);
+        return task;
+    }
+}

src/test/java/com/lab/labtimesheet/feature/task/service/TaskQueryServiceTest.java

@@ -0,0 +1,41 @@
+package com.lab.labtimesheet.feature.task.service;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.verify;
+
+import com.lab.labtimesheet.feature.task.repository.TaskRepository;
+import java.util.Set;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+@ExtendWith(MockitoExtension.class)
+class TaskQueryServiceTest {
+
+    @Mock
+    private TaskRepository tasks;
+
+    @InjectMocks
+    private TaskQueryService taskQueries;
+
+    @Test
+    void countsEveryCurrentTaskWhenProjectHasNoActiveMemberships() {
+        given(tasks.countByProjectIdAndDeletedAtIsNull(42L)).willReturn(3L);
+
+        assertThat(taskQueries.countCurrentTasksAssignedOutside(42L, Set.of())).isEqualTo(3L);
+
+        verify(tasks).countByProjectIdAndDeletedAtIsNull(42L);
+    }
+
+    @Test
+    void countsCurrentTasksWhoseAssigneeIsOutsideActiveMemberships() {
+        given(tasks.countCurrentTasksAssignedOutside(42L, Set.of(7L, 9L))).willReturn(2L);
+
+        assertThat(taskQueries.countCurrentTasksAssignedOutside(42L, Set.of(7L, 9L))).isEqualTo(2L);
+
+        verify(tasks).countCurrentTasksAssignedOutside(42L, Set.of(7L, 9L));
+    }
+}