docs: add assisted exit transfer and history design documents

docs: add comprehensive technology stack reference
docs(test): pin registry workflow evidence
2026-08-20 17:22:28 +07:00 · 2026-08-16 00:33:55 +07:00 · 2026-08-16 00:28:46 +07:00 · 2026-08-16 00:28:15 +07:00 · 2026-08-15 23:55:52 +07:00 · 2026-08-15 23:21:23 +07:00
75 changed files with 4914 additions and 165 deletions
@@ -0,0 +1,417 @@
 # Lab Timesheet — Three-Iteration Delivery Plan
 **Artifact purpose:** Local agent coordination and progress tracking  
 **Implementation branches:** `work/platform`, `work/projects`, `work/tasks`, `work/attendance`, `work/reports-ui`  
 **Requirements authority:** `labtimesheet-docs-hub/requirements-specification.md`  
 **SRS:** `labtimesheet-docs-hub/software-requirements-specification.md`  
 **Initial status:** Planning complete; implementation remains subject to requirements approval
 This file divides the approved product scope across three iterations and five persistent work branches. It is a coordination artifact, not an alternative requirements source. When this plan and a numbered requirement disagree, the numbered requirement wins.
 ## 1. Progress rules
 Use these exact status values:
 | Status | Meaning |
 |---|---|
 | `TODO` | No implementation work has started. |
 | `IN_PROGRESS` | One named owner is actively working on the item. |
 | `BLOCKED` | Work cannot continue; the tracker must name the evidence and required decision/dependency. |
 | `DONE` | Required RED/GREEN evidence exists, affected tests pass, and the integrated behavior satisfies the requirement. |
 Before editing production code, an agent shall:
 1. Read the applicable numbered requirements and acceptance scenarios.
 2. Claim one bounded tracker item by setting its status to `IN_PROGRESS` and recording owner/date.
 3. Identify the test level and evidence file that will protect the behavior.
 4. Write and run the failing test before production code.
 5. Confirm the test fails because the required behavior is missing, not because the test or environment is broken.
 When completing an item, the agent shall record:
 - the exact RED command and expected failure;
 - the exact GREEN and affected-suite commands;
 - the evidence Markdown path under `docs/tests/`;
 - the implementation commit or final local commit SHA;
 - any remaining limitation that is explicitly allowed by the requirements.
 No item becomes `DONE` based only on compilation, an isolated happy path, screenshots, or a verbal claim.
 ## 2. Branch ownership and conflict boundaries
 | Branch | Sole or primary ownership |
 |---|---|
 | `work/platform` | Maven/application baseline, feature-package foundation, Flyway migration files, account/security/bootstrap, internship lifecycle, integration credential lifecycle, notification delivery infrastructure, Docker, and CI. |
 | `work/projects` | Projects, membership intervals, invitations, membership-exit requests/readiness, leadership terms, Project lifecycle, Project-history authorization, transfer orchestration, and Project completion. |
 | `work/tasks` | Tasks, generic creator/assignment actors, pending-exit assignment exclusion, member self-Task rules, comments, work logs, fixed status transitions, batch reassignment/direct-removal transfer operations, Task soft deletion, and Project Task-progress/history queries. |
 | `work/attendance` | Attendance-policy versions/history, configured workdays, global calendar/history, HolidayAPI import interpretation, attendance, corrections, leave, deadline schedulers, and attendance/compliance metrics. |
 | `work/reports-ui` | Shared Thymeleaf shell/fragments, Tailwind tokens/assets, dashboards, invitation/exit/transfer screens, Project and Admin-setting History tabs, shared report datasets, Chart.js presentation, XLSX/PDF exports, and cross-product UI/accessibility consistency. |
 Conflict-prevention rules:
 - `LabtimesheetApplication` shall remain in `com.lab.labtimesheet`, shared wiring in `config`, and business code in `feature.account`, `feature.integration`, `feature.project`, `feature.task`, `feature.attendance`, `feature.notification`, or `feature.reporting`. Each feature repeats only the controller/model/model.dto/model.entity/repository/service/exception layers it needs, and tests mirror that feature/layer shape.
 - Cross-feature code may call another feature's service contract and DTOs but shall not import that feature's repository or JPA entity. Do not create empty `utils`, `common`, or `core` packages.
 - Business persistence shall use Spring Data JPA repositories. Direct SQL is limited to Flyway migrations and schema/catalog verification; services shall not use `JdbcTemplate` or embed SQL.
 - `work/platform` owns `src/main/resources/db/migration/**`, Maven/dependency configuration, Compose, container build files, and CI workflow files. Other branches request schema changes instead of independently allocating migration versions.
 - `work/reports-ui` owns shared templates/fragments, shared design tokens, and general UI assets. Each domain branch owns its module-specific controllers and pages while consuming those shared fragments.
 - A targeted repair shall use a clean, isolated `work/fix/<feature>/<what-fix>` branch and worktree from the taskmaster-verified current `main`. Do not use `work/<feature>/fix/<what-fix>`: the persistent `work/<feature>` ref already occupies that Git ref prefix.
 - `work/tasks` exposes focused Task eligibility, batch-transfer, unfinished-count, and retained-history operations required by Project workflows. `work/projects` owns pending-exit readiness/approval, direct-removal orchestration, and Project completion transactions.
 - `work/platform` owns HolidayAPI credential storage and the tested HTTP client. `work/attendance` owns preview interpretation, selection, deduplication, import, and day-off effects.
 - Attendance time and Task work time remain separate. No branch may make one mutate or prove the other.
 - Do not introduce a generic workflow engine, generic event-sourcing layer, multi-assignee Task model, Project-level day-off model, or speculative cross-module abstraction.
 ## 3. Iteration overview
 | Iteration | Theme | Required demonstration | Status | Integration commit |
 |---|---|---|---|---|
 | 1 | Working vertical slice | Bootstrap users, create/activate Project, assign/change a Task, and check in/out with role-correct UI. | `DONE` | `b9b150ff8ca9333e3b46d77537ec91875a970d57` |
 | 2 | Complete business workflows | Policy/calendar changes, leave/corrections, leadership/member transfer, work logs, notifications, and full HTML workflows. | `TODO` | — |
 | 3 | Hardening and delivery | Historical/concurrency proof, production security, HTML/XLSX/PDF parity, accessibility, containers, and CI publication boundary. | `TODO` | — |
 ## 4. Iteration 1 — Working vertical slice
 ### 4.1 `work/platform`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I1-PLAT-01 | Establish the Maven/Spring Boot modular baseline and root/config/feature package boundaries. | Context/load test; root-package and package-by-feature/layer check; no cross-feature repository/entity access or direct-SQL business services. | `DONE` | platform_agent / 2026-08-15 | Approved Platform head `692b23e9b9891d360882671d8247965b44920b2f`; integrated architecture/full-suite gates passed. |
 | I1-PLAT-02 | Promote the reviewed 23-table/56-foreign-key PostgreSQL baseline into the platform-owned initial Flyway migration after explicit approval. | Fresh PostgreSQL 18.4 migration replay, catalog assertions, and invitation/exit same-Project constraints. | `DONE` | platform_agent / 2026-08-15 | Fresh local replay produced exactly 23 application tables and 56 foreign keys at the integrated head. |
 | I1-PLAT-03 | Configure PostgreSQL Testcontainers and shared test-only encryption/clock facilities. | Affected integration tests require no developer database or SMTP. | `DONE` | platform_agent / 2026-08-15 | Taskmaster full PostgreSQL 18.4 Testcontainers suite passed 197/197. |
 | I1-PLAT-04 | Implement atomic first-Admin bootstrap and permanent bootstrap closure. | Concurrent submissions create exactly one first Admin; restart keeps bootstrap closed. | `DONE` | platform_agent / 2026-08-15 | Bootstrap/restart/concurrency evidence approved at `692b23e9b9891d360882671d8247965b44920b2f`; fresh local bootstrap passed. |
 | I1-PLAT-05 | Implement initial SMTP draft/test/active path sufficient for Mailpit onboarding. | Failed test cannot activate; tested revision supports delivery. | `DONE` | platform_agent / 2026-08-15 | Real local Mailpit draft, test delivery, activation, active-state, and health checks passed at the integrated head. |
 | I1-PLAT-06 | Create Mentor/Intern accounts, deliver activation, set first password, and authenticate/logout. | SMTP gate, single-use token, expiry, normalized email, role/state access. | `DONE` | platform_agent / 2026-08-15 | Activation/authentication evidence and independent review approved at `692b23e9b9891d360882671d8247965b44920b2f`. |
 | I1-PLAT-07 | Provide development Compose with PostgreSQL and Mailpit plus initial Gitea verification workflow. | Fresh developer start and branch/main verification. | `DEFERRED` | taskmaster / 2026-08-15 | Explicitly excluded from this exit gate; application containerization, Compose, and CI remain future work. |
 ### 4.2 `work/projects`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I1-PRJ-01 | Atomically create a Mentor-owned `PLANNED` Project, eligible initial Leader membership, and first leadership term. | No committed Project is empty or leaderless; non-owner, ineligible Leader, and guessed-ID access are denied. | `DONE` | projects_agent / 2026-08-15 | Approved Project head `baa0695c60153bc997ebf8b11adcfbdd2cbc1962`; Project suite and review passed. |
 | I1-PRJ-02 | Directly add eligible Interns through owning-Mentor-controlled interval memberships. | Multiple concurrent Projects per Intern; duplicate active membership rejected; no acceptance step for direct add. | `DONE` | projects_agent / 2026-08-15 | Membership/eligibility/IDOR evidence approved at `baa0695c60153bc997ebf8b11adcfbdd2cbc1962`. |
 | I1-PRJ-03 | Appoint and change one current Leader from active same-Project members. | One current Leader; non-member/ineligible selection rejected. | `DONE` | projects_agent / 2026-08-15 | Leadership-term invariants and completed-history behavior approved at `baa0695c60153bc997ebf8b11adcfbdd2cbc1962`. |
 | I1-PRJ-04 | Activate a Project when initial member, Leader, date, and assignee guards pass. | Missing Leader/member or invalid assignee blocks activation. | `DONE` | projects_agent / 2026-08-15 | Task-bound activation guard approved at `baa0695c60153bc997ebf8b11adcfbdd2cbc1962`. |
 | I1-PRJ-05 | Provide Project list/detail/member/leadership pages with owning-Mentor and member visibility. | MockMvc authorization plus direct-ID denial. | `DONE` | projects_agent / 2026-08-15 | Authorized pages, retained errors, and former-member history approved at `baa0695c60153bc997ebf8b11adcfbdd2cbc1962`. |
 ### 4.3 `work/attendance`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I1-ATT-01 | Resolve the seeded attendance policy, timezone, configured workdays, schedule, and separate check-in/checkout grace boundaries. | Both grace defaults are 30; values are 0–720; checkout cutoff must stay before local midnight. | `DONE` | attendance_agent / 2026-08-15 | Approved Attendance head `01b8095e9459417e2cf5bd1079c796d4f01ec549`; fresh seed verified both grace values at 30. |
 | I1-ATT-02 | Manage manual future global calendar events and day-off decisions. | Admin-only mutation; past-event immutability; workday/day-off distinction. | `DONE` | attendance_agent / 2026-08-15 | Calendar authorization and day-off evidence approved at `01b8095e9459417e2cf5bd1079c796d4f01ec549`. |
 | I1-ATT-03 | Check in once on an eligible day using server time and the effective policy. | Off-day, approved-leave, duplicate, lifecycle rejection, and inclusive 09:00 check-in-grace boundary. | `DONE` | attendance_agent / 2026-08-15 | Boundary, eligibility, leave-day, and real duplicate-race evidence approved at `01b8095e9459417e2cf5bd1079c796d4f01ec549`. |
 | I1-ATT-04 | Check out once through the attached-policy checkout cutoff and derive basic daily classification. | Default 16:00 succeeds; first later instant and zero-grace late attempt fail; no checkout becomes only `MISSING_CHECKOUT` with raw checkout unchanged. | `DONE` | attendance_agent / 2026-08-15 | Historical-policy cutoff, eligibility recheck, and missing-checkout-only evidence approved at `01b8095e9459417e2cf5bd1079c796d4f01ec549`. |
 | I1-ATT-05 | Provide own-attendance history and authorized Mentor/Admin inspection. | Own/global-view authorization and historical applied-policy display. | `DONE` | attendance_agent / 2026-08-15 | Policy-local history, all violations, and role authorization approved at `01b8095e9459417e2cf5bd1079c796d4f01ec549`. |
 ### 4.4 `work/tasks`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I1-TSK-01 | Create one-assignee Tasks in `PLANNED` or `ACTIVE`: any active member for self, current Leader for any active same-Project member. Store generic creator/assigner/assignee actors. | Self-Task actor equality, other-assignee denial for members, Leader allowance, and cross-Project actor rejection. | `DONE` | tasks_agent / 2026-08-15 | Approved Task head `e38e2cdea912160b183c65398c4e8d5682c1b00e`; actor/assignee/IDOR evidence passed review. |
 | I1-TSK-02 | Validate optional due dates against Project dates and current global days off. | Boundary dates accepted; outside/day-off dates rejected. | `DONE` | tasks_agent / 2026-08-15 | Due-date/calendar validation and retained field-error behavior approved at `e38e2cdea912160b183c65398c4e8d5682c1b00e`. |
 | I1-TSK-03 | Enforce the complete fixed Task status graph through current-assignee authorization. | Parameterized allowed/forbidden transition matrix and ID denial. | `DONE` | tasks_agent / 2026-08-15 | Server graph and legal UI choices approved at `e38e2cdea912160b183c65398c4e8d5682c1b00e`. |
 | I1-TSK-04 | Add append-only Task comments for active members, current Leader, and owning Mentor. | Unauthorized/non-member and completed-Project mutation denial. | `DONE` | tasks_agent / 2026-08-15 | Comment authorization, lock order, and completed-history behavior approved at `e38e2cdea912160b183c65398c4e8d5682c1b00e`. |
 | I1-TSK-05 | Show Task list/detail and initial DONE/non-deleted progress/status counts. | Empty Project renders `N/A`; soft/deleted data not yet exposed as current. | `DONE` | tasks_agent / 2026-08-15 | Progress/N/A, assignee display, visibility, and dashboard ordering approved at `e38e2cdea912160b183c65398c4e8d5682c1b00e`. |
 ### 4.5 `work/reports-ui`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I1-UI-01 | Establish Tailwind tokens and reusable Thymeleaf shell/fragments. | Fragment rendering, local assets, no unauthorized navigation items. | `DONE` | reports_ui_agent / 2026-08-15 | Shared local-asset shell and persistent SMTP restriction contract verified at `039fe25c7c2622a015c8962892dd99ff58be321d`. |
 | I1-UI-02 | Implement the supported desktop sidebar/header, forms, tables, badges, alerts, confirmations, empty/error states, and theme bootstrap. | Keyboard labels/focus, no desktop page-level overflow, pre-paint theme application. | `DONE` | reports_ui_agent / 2026-08-15 | Edge/Chromium 1365x900 focus, collapse tooltip, theme pre-paint, and overflow gates verified at `039fe25c7c2622a015c8962892dd99ff58be321d`. |
 | I1-UI-03 | Build basic Admin, Mentor, and Intern dashboards from real queries. | Role-correct metrics/actions; illustrative data never leaks into production paths. | `DONE` | reports_ui_agent / 2026-08-15 | Public service/DTO dashboards and role-correct navigation verified at `039fe25c7c2622a015c8962892dd99ff58be321d`. |
 | I1-UI-04 | Integrate bootstrap, authentication, Project, Task, and attendance pages into the shared shell. | Critical MockMvc web flows and server-side authorization. | `DONE` | reports_ui_agent / 2026-08-15 | Integrated shell, SMTP five-step journey, forms, history, errors, and authorization verified at `039fe25c7c2622a015c8962892dd99ff58be321d`. |
 ### 4.6 Iteration 1 integration gate
 Integration order:
 1. `work/platform`
 2. `work/projects`
 3. `work/attendance`
 4. `work/tasks`
 5. `work/reports-ui`
 Exit demonstration:
 - First Admin bootstraps the installation.
 - SMTP is tested through Mailpit.
 - Admin creates and activates Mentor and Intern accounts.
 - Mentor atomically creates a Project with its first Leader, directly adds another member, and activates it.
 - Ordinary member creates a self-assigned Task; Leader creates and assigns another Task.
 - Assignee changes Task status and comments.
 - Intern checks in and checks out.
 - Every role sees only authorized navigation, actions, and records.
 - Full integrated tests pass at the iteration integration commit.
 Taskmaster exit result (2026-08-15): `DONE` at main integration commit `b9b150ff8ca9333e3b46d77537ec91875a970d57`, incorporating reviewed candidate `039fe25c7c2622a015c8962892dd99ff58be321d` and the verified development configuration/documentation follow-up. The final merged-main PostgreSQL 18.4 suite passed 197/197; Flyway produced 23 application tables and 56 foreign keys; Node 24/Tailwind assets built successfully; compile and full Javadoc/doclint passed on the reviewed candidate. A real local Java 25 process completed fresh bootstrap, login, five-step SMTP deferral, persistent restriction recovery, and a separate real Mailpit draft/test/activate flow with aggregate health `UP`. Temporary exit databases and Mailpit were removed; the existing development PostgreSQL service remained intact. Project/Task/Attendance role flows are protected by the approved branch suites and real desktop E2E evidence. Application containerization, Compose, CI, and production liveness/readiness hardening remain deferred as recorded above.
 ## 5. Iteration 2 — Complete business workflows
 Iteration 2 starts only after every continuing branch incorporates the integrated Iteration 1 `main`.
 ### 5.1 `work/platform`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I2-PLAT-01 | Complete account lock/unlock/deactivation and session invalidation. | State graph, authentication denial, retained attribution. | `TODO` | — | — |
 | I2-PLAT-02 | Implement activation failure/resend and forgot/reset-password workflows. | Failed token invalidation, single-use/expiry, generic enumeration-safe responses. | `TODO` | — | — |
 | I2-PLAT-03 | Implement internship start activation, completion, and withdrawal guards. | Scheduler plus request-time activation; Leader/unfinished-Task terminal guards. | `TODO` | — | — |
 | I2-PLAT-04 | Complete encrypted SMTP and HolidayAPI draft/test/active revision lifecycles. | AES-GCM round trip, wrong-key failure, one active revision, no browser secret disclosure. | `TODO` | — | — |
 | I2-PLAT-05 | Expose the tested VN HolidayAPI client to the attendance module. | Valid preview, invalid key/rate limit/unavailable responses without local-data outage. | `TODO` | — | — |
 | I2-PLAT-06 | Persist in-app notifications and initial ordinary-email delivery states, including Project invitation and membership-exit created/resolved types. | Recipient deduplication, domain commit independent of SMTP, self-Task silence, and `UNAVAILABLE`/sent/failed behavior. | `TODO` | — | — |
 ### 5.2 `work/tasks`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I2-TSK-01 | Add dated 1–1440-minute Task work logs and author corrections. | Membership/date boundaries and author-only editing. | `TODO` | — | — |
 | I2-TSK-02 | Enforce the combined 1440-minute daily total across all Projects. | PostgreSQL integration and concurrent over-allocation proof. | `TODO` | — | — |
 | I2-TSK-03 | Reassign unfinished Tasks while preserving creator, state, comments, work logs, lifecycle timestamps, and assignment actor/time; exclude pending exit targets from new/self-assignment. | DONE requires assignee reopen; prior attribution remains; pending target keeps existing assignee rights but receives no new work. | `TODO` | — | — |
 | I2-TSK-04 | Implement Task edit/soft deletion and authorized historical inspection for Leader/self-Task creator plus Project History projection. | Eligible creator controls only while current assignee; deleted/completed Tasks expose retained attribution without invented previous-assignee or edit/status timelines. | `TODO` | — | — |
 | I2-TSK-05 | Provide repeatable multi-Task/one-recipient transfer batches, unfinished-count, direct-removal transfer, and completion-query operations to Projects. | Each batch is atomic; recipient/pending state rechecked; direct removal transfers all unfinished Tasks atomically; non-deleted/DONE counts remain correct. | `TODO` | — | — |
 | I2-TSK-06 | Complete Project status counts, percentage, total minutes, and per-member work queries. | Empty `N/A`, authorization scopes, hand-checkable totals. | `TODO` | — | — |
 ### 5.3 `work/projects`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I2-PRJ-01 | Issue and revoke non-expiring Leader invitations while retaining the issuing leadership term. | Eligibility, one pending Project/Intern pair, Leader-own versus Mentor-any revocation, ordinary notification behavior. | `TODO` | — | — |
 | I2-PRJ-02 | Let only the intended authenticated Intern accept or decline; support Mentor direct-add supersession. | Email is not a bearer join token; exactly one membership; terminal status/code and provenance retained. | `TODO` | — | — |
 | I2-PRJ-03 | Create/cancel Leader-removal and member-leave requests, expose persistent readiness warnings, and keep existing rights while excluding the target from new/self-assignment. | Nonblank reason, same-Project/type shape, one pending request per target, requester-only cancellation, replacement/remaining/ready state for every authorized viewer. | `TODO` | — | — |
 | I2-PRJ-04 | Let only the owning Mentor approve/reject exits after Leader-managed redistribution; preserve the direct-removal automatic-transfer shortcut. | Leader exit requires replacement first; repeated batches persist; cancel/reject keeps them and restores eligibility; approval waits for non-Leader/zero unfinished Tasks; closure/request resolution commit together. | `TODO` | — | — |
 | I2-PRJ-05 | Retain leadership history, change Leader without moving assignments, and complete only when every non-deleted Task is `DONE`. | Exactly one current Leader in PLANNED/ACTIVE; completion closes intervals, revokes invitations, and supersedes exits. | `TODO` | — | — |
 | I2-PRJ-06 | Provide one authorized Project History view for membership, leadership, invitation, exit decision, completed/soft-deleted Task, comment, work-log, and retained attribution data. | Admin all read-only; owning Mentor/current member on open Project; removed member denied until completion; no fabricated previous-assignee/status/edit timeline. | `TODO` | — | — |
 ### 5.4 `work/attendance`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I2-ATT-01 | Schedule future-month attendance-policy versions, including separate grace values, preserve effective history, and expose Admin-only Policy History. | First-of-future-month rule; effective immutability; old cutoff/report stability; safe version/actor/effective metadata only. | `TODO` | — | — |
 | I2-ATT-02 | Preview/import VN HolidayAPI candidates with Admin selection, override, provenance, deduplication, and Admin-only Calendar History. | Public suggestion not authority; manual fallback; repeated import safety; past/current event metadata remains read-only and non-secret. | `TODO` | — | — |
 | I2-ATT-03 | Materialize frozen full-day leave allocations and monthly/cross-month quota reservations. | Workday/day-off classification, policy snapshot, quota per month. | `TODO` | — | — |
 | I2-ATT-04 | Implement leave submit/approve/reject/cancel and overlap protection. | Same-day boundary, pending/approved reservations, concurrent overlap/quota. | `TODO` | — | — |
 | I2-ATT-05 | Implement missed-checkout correction submission and effective-checkout derivation. | Reject before/at checkout cutoff; accept afterward through scheduled end +24 hours; raw checkout remains null. | `TODO` | — | — |
 | I2-ATT-06 | Implement Mentor approve/reject/revert and separate decision-window locking. | Valid state graph, concurrent decision, expired pending auto-rejection. | `TODO` | — | — |
 | I2-ATT-07 | Add idempotent schedulers and equivalent request-time deadline guards. | Late/multiple scheduler invocation cannot duplicate transitions/notifications. | `TODO` | — | — |
 ### 5.5 `work/reports-ui`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I2-UI-01 | Complete Admin/Mentor/Intern/Leader dashboards and notification UI. | Authorization-correct actions and deadline/state summaries. | `TODO` | — | — |
 | I2-UI-02 | Complete account, integration, Project, invitation, membership-exit/transfer, Task, policy/calendar, attendance, correction, leave, and History desktop workflows using shared fragments. | Persistent warning; Leader-only multi-Task/one-recipient drawer; Mentor readiness decision; Project History; Admin-only Policy/Calendar/SMTP/HolidayAPI History; keyboard operation, redaction, and clear conflicts. | `TODO` | — | — |
 | I2-UI-03 | Build one authorized attendance/compliance HTML report dataset. | Date filters, detailed versus own scope, formulas and `N/A`. | `TODO` | — | — |
 | I2-UI-04 | Build one authorized Project/Task HTML report dataset. | Project/member/status/date filters and per-member visibility rules. | `TODO` | — | — |
 | I2-UI-05 | Add only meaningful Chart.js trends with adjacent text/table alternatives. | Accessible label, equivalent data, theme tokens, reduced motion. | `TODO` | — | — |
 ### 5.6 Iteration 2 integration gate
 Integration order:
 1. `work/platform`
 2. `work/tasks`
 3. `work/projects`
 4. `work/attendance`
 5. `work/reports-ui`
 Exit demonstration:
 - Admin schedules a future policy without changing historical output.
 - Admin previews/imports holidays and overrides a suggested day-off decision.
 - Intern submits cross-month leave and Mentor decides it.
 - Intern submits a missed-checkout correction; Mentor decides and may revert it inside the window.
 - Leader reassigns an unfinished Task while preserving creator, comments, work logs, and current assignment attribution.
 - Leader invites an eligible Intern; the signed-in Intern accepts or declines; Mentor direct-add safely supersedes a pending invite.
 - Mentor changes Leader without moving the former Leader's Tasks.
 - Member requests to leave and Leader requests removal; all authorized viewers see readiness, replacement is appointed first when needed, Leader redistributes unfinished Tasks in repeated batches, cancellation/rejection keeps completed batches, and approval waits for zero unfinished Tasks.
 - Mentor directly removes an ordinary member and a Leader in separate cases; automatic transfer remains atomic and completed Tasks keep the removed Intern's displayed name.
 - Admin, owning Mentor, current member, and removed member before/after completion receive the exact Project History visibility defined by AUTH-006.
 - Admin opens read-only Attendance Policy, Calendar, SMTP, and HolidayAPI History tabs; non-Admins are denied and no secret/internal retry data appears.
 - Mentor completes a Project after all non-deleted Tasks are done.
 - Ordinary domain actions retain in-app notifications when SMTP is unavailable.
 - Full integrated tests pass at the iteration integration commit.
 ## 6. Iteration 3 — Hardening, reports, and delivery readiness
 Iteration 3 starts only after every continuing branch incorporates the integrated Iteration 2 `main`.
 ### 6.1 `work/platform`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I3-PLAT-01 | Add normalized-email-plus-source-IP login throttling. | Five-in-15 and 15-minute throttle boundaries; successful-login clearing. | `TODO` | — | — |
 | I3-PLAT-02 | Finish ordinary email retry schedule and terminal failure handling. | Exact 1m/5m/30m/2h/12h attempts; idempotent bounded worker. | `TODO` | — | — |
 | I3-PLAT-03 | Add token cleanup and production-safe operational/status views. | Expired token behavior, no secret/stack/SQL disclosure. | `TODO` | — | — |
 | I3-PLAT-04 | Enforce production HTTPS/origin/proxy/header/cookie/master-key readiness. | Prod fails unsafe configuration; dev/test relax only transport/origin controls. | `TODO` | — | — |
 | I3-PLAT-05 | Produce the non-root application image and bundled/external PostgreSQL deployment modes. | Same immutable image becomes healthy in both configurations. | `TODO` | — | — |
 | I3-PLAT-06 | Finalize Gitea verification, main-only OCI publication, and disabled SSH deployment/rollback template. | Work branches never publish; disabled deploy receives no secrets; exact-SHA flow is testable when enabled. | `TODO` | — | — |
 ### 6.2 `work/projects`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I3-PRJ-01 | Harden concurrent membership, invitation acceptance/direct-add, exit approval, and leadership operations. | One valid winner; locks/rechecks cover invitation, Project, membership, leadership, request, and unfinished Tasks; stale requests produce explicit conflict without partial history. | `TODO` | — | — |
 | I3-PRJ-02 | Complete the global-role/context/ownership authorization matrix for direct membership, invitations, exits, and leadership. | Direct-ID, stale Leader, wrong invitee, cross-Mentor/member, requester, target, and decision-maker negative cases. | `TODO` | — | — |
 | I3-PRJ-03 | Prove completed/historical read-only behavior and terminal Intern guards. | No mutation through UI or direct request after lifecycle closure. | `TODO` | — | — |
 | I3-PRJ-04 | Verify Project list/progress query indexes and bounded performance. | Explain plan/catalog evidence for actual report paths. | `TODO` | — | — |
 ### 6.3 `work/tasks`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I3-TSK-01 | Harden concurrent status, reassignment, deletion, and daily-minute operations. | Optimistic conflicts and serialized daily total. | `TODO` | — | — |
 | I3-TSK-02 | Complete due-date impact behavior for later-created global days off. | Existing due date retained and disclosed; new/changed due date rejected. | `TODO` | — | — |
 | I3-TSK-03 | Complete former-assignee work-log correction and historical-deletion boundaries. | Author/member/Project lifecycle matrix. | `TODO` | — | — |
 | I3-TSK-04 | Complete Task authorization/ID-guessing matrix and progress query verification. | Admin/Mentor/Leader/member/creator/current-assignee distinctions, creator-right loss after reassignment, generic same-Project actors, and real query indexes. | `TODO` | — | — |
 ### 6.4 `work/attendance`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I3-ATT-01 | Finalize attendance-rate and compliance formulas plus `N/A` denominators. | Hand-derived expected values across absence, leave, days off, and violations. | `TODO` | — | — |
 | I3-ATT-02 | Prove historical stability after workday, schedule, check-in/checkout grace, quota, penalty, and calendar changes. | Before/after report equality plus unchanged cutoff for an older attendance row. | `TODO` | — | — |
 | I3-ATT-03 | Harden concurrent leave quota/overlap and correction-decision races. | PostgreSQL exclusion plus transactional locking/optimistic conflicts. | `TODO` | — | — |
 | I3-ATT-04 | Prove request-time and scheduler equivalence at checkout/correction boundaries and both expiry windows. | Pre-cutoff correction rejection; inclusive submission deadline; delayed/repeated scheduler produces one final transition. | `TODO` | — | — |
 | I3-ATT-05 | Complete terminal-Intern and date-classification edge cases. | Terminal date with/without attendance, approved leave, and global day off. | `TODO` | — | — |
 ### 6.5 `work/reports-ui`
 | ID | Deliverable | Test/evidence emphasis | Status | Owner/date | Result/commit |
 |---|---|---|---|---|---|
 | I3-UI-01 | Export attendance/compliance and Project/Task datasets to XLSX. | Parse workbook and compare filters, rows, totals, and `N/A` with HTML. | `TODO` | — | — |
 | I3-UI-02 | Export the same datasets to PDF through a print-safe template and embedded Unicode font. | Vietnamese sample text and HTML/XLSX/PDF total parity. | `TODO` | — | — |
 | I3-UI-03 | Complete desktop light/dark themes and all required desktop screens/states. | Theme before paint, system override, contrast, error/empty/stale/unavailable states. | `TODO` | — | — |
 | I3-UI-04 | Complete WCAG-focused keyboard, focus, labels, icon names, and chart alternatives. | Web/accessibility evidence for representative critical pages. | `TODO` | — | — |
 | I3-UI-05 | Add critical end-to-end flows across the integrated application. | Bootstrap/onboarding, Project/Task, attendance/correction/leave, and reports. | `TODO` | — | — |
 | I3-UI-06 | Perform best-effort narrow-screen smoke checks only. | Prevent catastrophic corruption where practical; no mobile parity or mobile mockup gate. | `TODO` | — | — |
 ### 6.6 Iteration 3 integration gate
 Integration order:
 1. `work/platform`
 2. `work/projects`, `work/tasks`, and `work/attendance` after their platform dependencies are available
 3. `work/reports-ui`
 Exit demonstration:
 - Historical results and checkout cutoffs remain stable after later policy/calendar changes.
 - Concurrent bootstrap, invitation/direct-add, membership exit/transfer, leadership, Task, leave, and correction operations fail safely.
 - HTML, XLSX, and PDF expose identical authorized totals.
 - Production refuses unsafe origin, proxy, datasource, or master-key configuration.
 - The same non-root image works with bundled and external PostgreSQL.
 - Work branches verify without publishing; only `main` publishes immutable SHA and convenience tags.
 - SSH deployment remains dormant without secrets or an explicit enable variable.
 - Desktop light/dark and accessibility acceptance passes; mobile/tablet remains best-effort only.
 - Full integrated tests pass at the final integration commit.
 ## 7. Mandatory TDD workflow
 Every feature follows this sequence:
 1. Select a requirement and acceptance scenario.
 2. Write the smallest behavioral test.
 3. Run it and confirm the intended RED failure.
 4. Record the RED command/result in the appropriate evidence file.
 5. Write the minimum production code required for GREEN and add its meaningful Javadoc in the same implementation milestone.
 6. Run the focused test.
 7. Run the affected module/integration/web suite.
 8. Refactor without weakening assertions.
 9. Run the affected suite again.
 10. Record final commands/results and commit SHA.
 Recommended history:
 ```text
 test(attendance): prove 09:00 check-in grace boundary [RED]
 feat(attendance): enforce inclusive check-in grace boundary [GREEN]
 ```
 The RED and GREEN commits may be pushed together after the branch head is green. The failing historical commit proves test-first order without leaving the remote branch intentionally broken.
 Required evidence locations:
 | Test level | Evidence directory |
 |---|---|
 | Unit/state/calculation | `docs/tests/unit/` |
 | PostgreSQL/module integration | `docs/tests/integration/` |
 | MockMvc/Thymeleaf/security web behavior | `docs/tests/web/` |
 | Cross-module/browser journey | `docs/tests/e2e/` |
 Every evidence Markdown record must include:
 - requirement and scenario IDs;
 - protected behavior and why it matters;
 - test method and hand-derived expected result;
 - exact RED command and relevant failure;
 - exact GREEN and affected-suite commands/results;
 - external dependency or environment boundaries;
 - final commit SHA when available.
 Javadoc is part of production implementation, not a later documentation phase. Every new or materially changed production type and every declared public/protected method shall document its business contract, including non-obvious authorization, transaction/locking, lifecycle/history, unit, timezone, or deadline semantics. Do not add prose that merely repeats names. Iteration 1 alone may retrofit Javadocs after feature implementation is complete; those branch-owned retrofit commits still require affected verification and independent scoped re-review. Every later iteration and turn shall add/update Javadocs during the implementation milestone.
 ## 8. Branch-level test emphasis
 | Branch | Non-negotiable evidence |
 |---|---|
 | `work/platform` | Bootstrap concurrency, token lifecycle, account/security authorization, encryption, SMTP failure, session invalidation, production-profile failure. |
 | `work/projects` | Lifecycle graphs, ownership, membership/invitation/exit/leadership intervals, transfer transactions, optimistic locking, guessed-ID denial. |
 | `work/tasks` | Parameterized status graph, Leader/member creator/assignee distinction, self-Task and same-Project generic actors, daily-minute concurrency, progress totals. |
 | `work/attendance` | Injected-Clock boundaries, PostgreSQL overlap/uniqueness, policy history, quota concurrency, schedulers and request-time guards. |
 | `work/reports-ui` | MockMvc forms/authorization, accessible rendering, report query totals, XLSX/PDF parsing/parity, critical browser journeys. |
 ## 9. Iteration handoff protocol
 At each iteration boundary:
 1. Each branch owner updates every claimed item to `DONE`, `BLOCKED`, or returns it to `TODO`.
 2. The owner provides commit SHA, evidence paths, exact verification commands, and remaining risk.
 3. Integrate branches in the iteration's declared order.
 4. Resolve cross-module conflicts through the owning branch rather than duplicating code in the integrator.
 5. Run the full affected integrated suite.
 6. Record the integration commit in Section 3.
 7. Bring the integrated `main` into all five persistent work branches before the next iteration begins.
 Handoff template:
 ```markdown
 ### <tracker ID> — <short title>
 - Status: DONE | BLOCKED | TODO
 - Owner:
 - Requirements/scenarios:
 - RED evidence:
 - GREEN evidence:
 - Focused verification:
 - Affected-suite verification:
 - Commit SHA:
 - Remaining risk/blocker:
 - Required next owner/action:
 ```
 ## 10. Global definition of done
 A tracker item is complete only when:
 - the numbered requirement and acceptance behavior are satisfied;
 - the test existed and failed for the intended reason before production code;
 - focused and affected suites pass;
 - authorization and negative cases are covered where applicable;
 - PostgreSQL-specific rules are tested against PostgreSQL, not H2;
 - concurrency/deadline/history behavior has proportionate evidence;
 - UI behavior uses server-side authorization and shared fragments;
 - documentation/evidence paths are recorded in this tracker;
 - new or changed production types and public/protected methods have accurate Javadoc created during implementation (Iteration 1 retrofit exception only);
 - no unrelated files or another branch's ownership area were changed without coordination;
 - the final branch head is green;
 - integration does not alter totals, state graphs, or historical meaning.
 ## 11. Progress log
 Append material coordination events only. Do not duplicate every commit.
 | Date/time | Agent/person | Event | Tracker IDs | Evidence/commit | Next action |
 |---|---|---|---|---|---|
 | — | — | Plan initialized; no implementation item claimed. | — | — | Obtain requirements approval and begin Iteration 1. |
 | 2026-08-15 | Taskmaster + five feature owners | Retrofitted targeted Lombok boilerplate after every owner fast-forwarded to the latest `main`; all five exact heads passed independent review and the combined merge passed 201 PostgreSQL 18.4 tests, compile, Javadoc/doclint, deterministic assets, and final integration review. | Iteration 1 maintenance | Platform `c9499732`; Project `58712710`; Task `469d7e27`; Attendance `5ddbd75f`; Reporting `8500cb6e`; integrated `b764707716f54ad164547b087f658c277cf46e0f`; `docs/tests/unit/lombok-*-boilerplate.md` | Push reviewed `main`, then fast-forward all five persistent work branches before Iteration 2 work. |
@@ -0,0 +1,215 @@
 ---
 name: orchestrate-labtimesheet-iteration
 description: Use when initiating, resuming, integrating, or completing a multi-branch Lab Timesheet iteration defined by .agents/PROJECT_PLAN.md.
 ---
 # Orchestrate a Lab Timesheet Iteration
 Run the iteration continuously from repository audit through an evidence-backed local exit demonstration. Preserve the five long-lived work branches and keep business features isolated behind public services and DTOs.
 ## Load authority and preserve state
 1. Read the repository `AGENTS.md`, `.agents/PROJECT_PLAN.md`, `PRODUCT.md`, `DEVELOPMENT.md`, `TESTING.md`, and the applicable numbered requirements in `labtimesheet-docs-hub/requirements-specification.md`.
 2. Apply authority in this order: current user decisions, numbered requirements, approved plan, tests/code, then inference.
 3. Inspect every worktree and the root `git status` before mutation. Record and preserve unrelated dirty or untracked files.
 4. Confirm the actual Maven, Spring Boot, Java, Node, PostgreSQL, Flyway, and Testcontainers versions. Use the documented project baseline even if a newer JDK is installed.
 5. Create or update the active goal and plan only when the user requests goal-mode execution.
 ## Enforce the project structure
 Keep `LabtimesheetApplication` in `com.lab.labtimesheet`, shared wiring in `config`, and business code under:
 ```text
 feature.account
 feature.integration
 feature.project
 feature.task
 feature.attendance
 feature.notification
 feature.reporting
 ```
 Repeat only the layers a feature needs: `controller`, `model`, `model.dto`, `model.entity`, `repository`, `service`, and `exception`. Mirror these packages in tests.
 - Call another feature only through its concrete public service methods and DTOs.
 - Never import another feature's repository or JPA entity.
 - Use Spring Data JPA for business persistence.
 - Limit direct SQL to Flyway and schema/catalog verification.
 - Do not add empty `common`, `core`, `utils`, or boundary-placeholder packages.
 - Do not add one-implementation interfaces, shadow mappings of foreign tables, or speculative abstractions.
 Use the installed Lombok processor as the default for safe Java boilerplate:
 - `@RequiredArgsConstructor` for injection-only constructors with required final dependencies;
 - targeted `@Getter`, `@Setter`, and protected `@NoArgsConstructor` instead of blanket `@Data`;
 - no generated JPA entity `equals`, `hashCode`, or `toString` over mutable state, associations, or secrets;
 - records remain records for immutable DTOs and commands;
 - explicit constructors and methods remain when they validate, normalize, enforce invariants, preserve history, define identity, or select qualified dependencies.
 Require each owner to audit its production package, record a source-contract RED for eligible handwritten boilerplate, make the smallest behavior-preserving Lombok conversion, and prove compile/Javadoc, Spring injection, JPA mapping, template property access, and affected behavior remain green. Do not add annotations that generate unused API.
 ## Establish the shared baseline first
 Before dispatching feature work:
 1. Verify the Maven wrapper, application profile, Flyway baseline, PostgreSQL connectivity, test-only clock/encryption, and frontend asset toolchain.
 2. Run a clean baseline test and capture any pre-existing failure separately.
 3. Run the application locally against a disposable or dedicated PostgreSQL service. A PostgreSQL or Mailpit test container is acceptable; do not containerize the application when the exit gate says local process.
 4. Commit the shared platform foundation before dependent branches use it.
 5. Hand off only full immutable commit SHAs from clean worktrees.
 ## Own five branches and worktrees
 Use exactly these persistent branches unless the user changes the plan:
 | Branch | Ownership |
 |---|---|
 | `work/platform` | Baseline, migration, accounts, security, bootstrap, integrations, notification plumbing |
 | `work/projects` | Projects, membership, leadership, lifecycle, project authorization |
 | `work/tasks` | Tasks, comments, work logs, status, task progress |
 | `work/attendance` | Policy, calendar, attendance, corrections, leave, metrics |
 | `work/reports-ui` | Shared Thymeleaf UI, dashboards, reports, exports |
 For a targeted repair outside the next iteration, create a clean isolated
 `work/fix/<feature>/<what-fix>` worktree from the taskmaster-verified current
 `main`. Do not use `work/<feature>/fix/<what-fix>`: the persistent
 `work/<feature>` ref already occupies that Git ref prefix.
 Create one isolated worktree per branch. Give each implementation agent explicit ownership, tell it other agents share the repository, forbid reverting others' work, require medium-milestone local commits, and forbid push unless separately authorized.
 Before any owner edits its module, require it to:
 1. verify its worktree has no uncommitted changes;
 2. confirm the taskmaster's exact latest `main` SHA;
 3. fast-forward its persistent work branch to that SHA with `git merge --ff-only main`;
 4. prove `git rev-parse HEAD` equals the supplied main SHA;
 5. stop rather than resolving unexpected divergence or overwriting user work.
 Store durable coordination under `.superpowers/sdd/PROJECT_PLAN/`:
 - `progress.md` with exact SHAs, dependency pins, tests, blockers, and review rounds;
 - one task report per branch;
 - review packages and reviewer reports.
 Trust this ledger and Git history after context compaction. Never redispatch a completed milestone.
 ## Require RED, GREEN, Javadoc, and companion evidence
 For every behavior:
 1. Read its requirement and acceptance scenario IDs.
 2. Write the narrowest production-shaped test first.
 3. Run it and record RED for the expected missing behavior, not an environment or test defect.
 4. Implement the minimum coherent change and its meaningful Javadoc in the same milestone. Document every new or materially changed production type and declared public/protected method, emphasizing business contracts, authorization, transactions/locking, state/history semantics, units, and time boundaries rather than restating names.
 5. Run focused GREEN, affected-suite verification, then the branch-wide suite.
 6. Refactor only while tests remain green.
 7. Commit when a medium milestone is complete.
 Use PostgreSQL 18.4 Testcontainers for persistence semantics; do not substitute H2. Keep time and randomness controllable. Test public outcomes, persisted state, authorization denial, and boundary cases.
 Create a Markdown evidence record under the matching directory:
 ```text
 docs/tests/unit/
 docs/tests/integration/
 docs/tests/web/
 docs/tests/e2e/
 ```
 Start from that directory's `_TEMPLATE.md`. Every record must include requirement/scenario IDs, protected behavior, test method, hand-derived expected result, exact RED command/result, exact GREEN and affected-suite commands/results, implementation milestone, and external-test boundaries. Never replace executable evidence with a verbal claim.
 Iteration 1 is the only retrofit exception: after all feature tasks finish, return each branch to its original owner to add missing Javadocs before integration, rerun affected verification, commit, and undergo scoped re-review. In every later iteration or turn, reject delayed Javadoc cleanup; it belongs in the implementation milestone.
 ## Merge dependencies by immutable pin
 Derive the dependency graph from the current iteration plan. For Iteration 1, use:
 ```text
 platform foundation
  -> projects base
  -> attendance
  -> tasks (projects + attendance public APIs)
  -> projects activation guard (final Task query API)
  -> reports-ui (final public dashboard APIs)
 ```
 - A producer reports a clean full SHA and public API before a consumer merges it.
 - Never merge a moving branch or a short ambiguous SHA.
 - Preserve dirty consumer work during the merge and immediately rerun its structure test.
 - If a consumer needs data, add the smallest producer-owned public query DTO/service method; never map or query the producer's tables locally.
 - Keep final integration order from `.agents/PROJECT_PLAN.md` even when development dependencies require a temporary producer/base round trip.
 - Reuse the last reviewed consumer branch as the integrated candidate when it already contains every approved producer pin in order. An extra integration branch adds no safety by itself.
 - After a Platform merge, run the architecture test and every `@WebMvcTest` controller slice. Global advice and shared beans can invalidate otherwise unrelated slice fixtures; fix only the test fixture, never production security to accommodate a slice.
 ## Coordinate agents without losing control
 Let the five owners work in parallel where dependencies permit. Resolve normal in-scope questions without pausing the run. Stop only for a genuine blocker, consequential ambiguity, destructive action, or sensitive external effect requiring user approval.
 For a sensitive action, state the exact effect and obtain approval in the root task. If a child cannot inherit that approval, the root may apply only the isolated approved patch; return the worktree to its owner for tests, evidence, self-review, and commit.
 Do not accept an agent's completion claim alone. Require:
 - exact branch and full SHA;
 - clean worktree;
 - focused, affected, and full test counts;
 - confirmation that new/changed production APIs carry accurate Javadoc;
 - a list of Lombok conversions and explicit boilerplate deliberately retained with its business reason;
 - evidence/report path;
 - public API handoff;
 - blockers and unverified boundaries;
 - confirmation of no push.
 ## Review only after all five owners finish
 After every implementation owner reports `DONE`, dispatch independent code-review assignments, one branch per assignment. Give each reviewer the plan/requirements paths, branch report, ledger, merge base, full diff package, and exact structure/TDD constraints.
 Each review must return both spec-compliance and code-quality verdicts with file/line evidence. For Critical or Important findings:
 1. Send the complete finding list back to that branch's original owner.
 2. Require a focused regression test, RED when applicable, GREEN, affected suite, evidence update, and a fix commit.
 3. Dispatch an independent scoped re-review of only the fix range.
 4. Repeat up to five rounds; use a fresh stronger fixer for rounds four and five.
 5. At the cap, record a reasoned ruling for non-load-bearing findings or stop on a load-bearing blocker.
 Do not merge a branch with unresolved load-bearing findings.
 ## Prove the iteration exit gate
 Integrate only reviewed immutable branch SHAs in the plan's order. Then verify from the integrated tree:
 1. `git diff --check` and package/JPA architecture tests.
 2. Flyway replay against fresh PostgreSQL and the required table/foreign-key catalogue checks.
 3. Full Maven tests on the documented Java version and PostgreSQL engine.
 4. Frontend asset build on the pinned Node version.
 5. A local application process connected to the configured PostgreSQL service.
 6. Health/readiness and the iteration's real role-correct web workflow.
 7. No application containerization when explicitly deferred.
 8. Root dirty-state preservation, clean reviewed worktrees, and no unauthorized push.
 Keep environment authority explicit:
 - real `.env` files are local and ignored;
 - `.env.example` contains placeholders only;
 - the development Spring profile maps every required runtime value from the environment;
 - Admin-console SMTP and HolidayAPI secrets never move into `.env`;
 - configuration-only work uses a shell/configuration RED and real application smoke test instead of an artificial Java unit test.
 If SMTP participates in health, exercise both states deliberately: application startup with SMTP deferred, and aggregate health with a real temporary Mailpit connection. Report the distinction instead of calling one state universally healthy.
 Store cross-module browser journeys in `docs/tests/e2e/`. Before completion, update every Iteration row and the durable progress ledger; stale `IN_PROGRESS` rows are an incomplete gate even when tests pass.
 Review source Javadocs against behavior as part of the branch and integration diff; stale or content-free Javadoc does not satisfy the gate.
 ## Merge reviewed Iteration work to main
 Only enter this phase with explicit user authority.
 1. Add any final environment example, profile configuration, implementation-status README, development guide, and testing/TDD guide to the integrated candidate under RED/GREEN evidence.
 2. Run the complete PostgreSQL suite and a real local-process smoke test on that exact candidate.
 3. Fetch the remote base. Stop on unexpected divergence; never force-push to hide it.
 4. Preserve unrelated dirty root files. Commit only separately authorized tracked root guidance before merging if the incoming branch also changes that file.
 5. Merge the exact candidate into `main` without squashing or rewriting the reviewed branch history.
 6. Rerun the full suite on merged `main`, inspect the diff, and verify `.env` is ignored and absent from the index.
 7. Push `main` normally, verify the remote ref equals local `HEAD`, and keep host-managed worktrees unless cleanup was explicitly requested.
 Record the integration SHA, commands, outputs, limitations, and deferred next-iteration scope. Mark the goal complete only after every stated exit condition has fresh evidence.
@@ -0,0 +1,4 @@
 interface:
  display_name: "Orchestrate Lab Timesheet Iteration"
  short_description: "Run five-branch TDD and Javadoc delivery"
  default_prompt: "Use $orchestrate-labtimesheet-iteration to execute the current iteration across the five work branches with TDD, Javadoc, and review gates."
@@ -0,0 +1,16 @@
 .git
 .gitea
 .idea
 .agents
 .superpowers
 .env
 .env.*
 !.env.compose.example
 labtimesheet-docs-hub
 node_modules
 target
 docs
 src/test
 *.log
 *.7z
 .DS_Store
@@ -0,0 +1,20 @@
 # Production Compose example only. Store the real file outside the repository with mode 0600.
 # Use an immutable sha-<full-commit> tag. The moving main tag is for convenience, not rollback.
 LAB_IMAGE=git.sechmachine.io.vn/sechmachine/labtimesheet:sha-replace-with-full-commit
 # The app is intended to sit behind an HTTPS reverse proxy on the same host.
 LAB_HTTP_BIND=127.0.0.1
 LAB_HTTP_PORT=8080
 LAB_PUBLIC_ORIGIN=https://timesheet.example.edu
 LAB_FORWARD_HEADERS_STRATEGY=framework
 LAB_SECURITY_MASTER_KEY=replace-with-base64-encoded-32-byte-key
 # Bundled mode uses the Compose service name. For external mode, replace this URL and credentials.
 LAB_DB_URL=jdbc:postgresql://postgres:5432/labtimesheet
 LAB_DB_USERNAME=labtimesheet
 LAB_DB_PASSWORD=replace-with-database-password
 # Used only when the bundled-db profile is enabled.
 POSTGRES_DB=labtimesheet
 POSTGRES_USER=labtimesheet
 POSTGRES_PASSWORD=replace-with-the-same-database-password
@@ -1,4 +1,4 @@
-# Copy to .env, replace every placeholder, then load it into the IDE or shell.
+# Copy to .env and replace every placeholder. The dev profile imports it from the repository root.
 SPRING_PROFILES_ACTIVE=dev
 LAB_SERVER_PORT=8080
 LAB_FORWARD_HEADERS_STRATEGY=NONE
@@ -0,0 +1,207 @@
 name: Container
 'on':
  workflow_dispatch:
  push:
    branches:
      - main
 permissions:
  contents: read
 concurrency:
  group: container-${{ gitea.workflow }}-${{ gitea.ref }}
  cancel-in-progress: true
 env:
  REGISTRY: git.sechmachine.io.vn
  IMAGE_NAME: sechmachine/labtimesheet
 jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      TESTCONTAINERS_HOST_OVERRIDE: host.docker.internal
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Java 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: '25'
          cache: maven
      - name: Set up Node 24
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: npm
      - name: Verify Docker for PostgreSQL tests
        run: docker info
      - name: Install frontend dependencies
        run: npm ci
      - name: Run frontend tests
        run: npm run test:ui
      - name: Build frontend assets
        run: npm run build
      - name: Verify generated assets are committed
        run: git diff --exit-code -- src/main/resources/static/assets/app.css src/main/resources/static/assets/icons.svg
      - name: Run Maven tests
        run: ./mvnw -B test
      - name: Verify Javadoc
        run: ./mvnw -B -DskipTests -Ddoclint=all javadoc:javadoc
      - name: Verify whitespace
        run: git diff --check
  amd64:
    needs: verify
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Select image tags
        id: image
        env:
          EVENT_NAME: ${{ gitea.event_name }}
          GITEA_REF: ${{ gitea.ref }}
          GITEA_SHA: ${{ gitea.sha }}
        run: |
          publish=false
          image="$REGISTRY/$IMAGE_NAME"
          if [ "$EVENT_NAME" = "push" ] && [ "$GITEA_REF" = "refs/heads/main" ]; then
            publish=true
          fi
          {
            echo "publish=$publish"
            echo "image=$image"
            echo "tags<<EOF"
            echo "$image:sha-${GITEA_SHA}-amd64"
            if [ "$publish" = "true" ]; then
              echo "$image:sha-${GITEA_SHA}"
              echo "$image:main"
            fi
            echo "EOF"
          } >> "$GITHUB_OUTPUT"
      - name: Log in to registry
        if: steps.image.outputs.publish == 'true'
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}
      - name: Build AMD64 image and publish main
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64
          push: ${{ steps.image.outputs.publish }}
          tags: ${{ steps.image.outputs.tags }}
          build-args: |
            VCS_REF=${{ gitea.sha }}
  arm64:
    # Gitea cannot schedule a probe on a missing label. Enable this repository variable only
    # while a trusted ubuntu-latest-arm runner is registered and online.
    if: vars.ARM64_RUNNER_AVAILABLE == 'true'
    needs: verify
    runs-on: ubuntu-latest-arm
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Select image tag
        id: image
        env:
          EVENT_NAME: ${{ gitea.event_name }}
          GITEA_REF: ${{ gitea.ref }}
          GITEA_SHA: ${{ gitea.sha }}
        run: |
          publish=false
          image="$REGISTRY/$IMAGE_NAME"
          if [ "$EVENT_NAME" = "push" ] && [ "$GITEA_REF" = "refs/heads/main" ]; then
            publish=true
          fi
          echo "publish=$publish" >> "$GITHUB_OUTPUT"
          echo "tag=$image:sha-${GITEA_SHA}-arm64" >> "$GITHUB_OUTPUT"
      - name: Log in to registry
        if: steps.image.outputs.publish == 'true'
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}
      - name: Build native ARM64 image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/arm64
          push: ${{ steps.image.outputs.publish }}
          tags: ${{ steps.image.outputs.tag }}
          build-args: |
            VCS_REF=${{ gitea.sha }}
  manifest:
    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main' && vars.ARM64_RUNNER_AVAILABLE == 'true'
    needs: [amd64, arm64]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      packages: write
    steps:
      - name: Set up Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Log in to registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.actor }}
          password: ${{ secrets.REGISTRY_TOKEN }}
      - name: Publish combined manifest
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          GITEA_SHA: ${{ gitea.sha }}
        run: |
          docker buildx imagetools create \
            --tag "$IMAGE:sha-${GITEA_SHA}" \
            --tag "$IMAGE:main" \
            "$IMAGE:sha-${GITEA_SHA}-amd64" \
            "$IMAGE:sha-${GITEA_SHA}-arm64"
@@ -0,0 +1,61 @@
 name: Verify
 'on':
  pull_request:
  push:
 permissions:
  contents: read
 concurrency:
  group: verify-${{ gitea.workflow }}-${{ gitea.ref }}
  cancel-in-progress: true
 jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      TESTCONTAINERS_HOST_OVERRIDE: host.docker.internal
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Java 25
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: '25'
          cache: maven
      - name: Set up Node 24
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: npm
      - name: Verify Docker for PostgreSQL tests
        run: docker info
      - name: Install frontend dependencies
        run: npm ci
      - name: Run frontend tests
        run: npm run test:ui
      - name: Build frontend assets
        run: npm run build
      - name: Verify generated assets are committed
        run: git diff --exit-code -- src/main/resources/static/assets/app.css src/main/resources/static/assets/icons.svg
      - name: Run Maven tests
        run: ./mvnw -B test
      - name: Verify Javadoc
        run: ./mvnw -B -DskipTests -Ddoclint=all javadoc:javadoc
      - name: Verify whitespace
        run: git diff --check
@@ -3,6 +3,7 @@ target/
 .mvn/wrapper/maven-wrapper.jar
 !**/src/main/**/target/
 !**/src/test/**/target/
 .DS_Store
 ### STS ###
 .apt_generated
@@ -34,15 +35,5 @@ node_modules/
 ### VS Code ###
 .vscode/
 ### Agentic ###
 .agents/
 .agent/
 AGENTS.md
 # Local requirements review artifacts
 /labtimesheet-docs-hub/
 # Local Impeccable product context
 /PRODUCT.md
 /DESIGN.md
 /.impeccable/
@@ -0,0 +1,18 @@
 {
  "northStar": "The Calm Operations Ledger",
  "rules": [
    "Neutral structure carries the interface; semantic color is rare.",
    "Use border and tone before shadow.",
    "Put one role-correct task and action in the first viewport.",
    "Desktop is supported; mobile and tablet are best-effort."
  ],
  "shadows": {
    "panel": "0 10px 28px rgba(20,25,35,.06)",
    "active": "0 1px 2px rgba(0,0,0,.06)"
  },
  "breakpoints": {
    "supportedDesktop": "1365px",
    "bestEffortNarrow": "900px"
  },
  "source": "labtimesheet-docs-hub/ui-mockups/mockup.css"
 }
@@ -0,0 +1,175 @@
 # Lab Timesheet Engineering Instructions
 ## Authority and required reading
 This repository implements the **Lab Timesheet & Project Management System**, a server-rendered university internship/laboratory application covering accounts, Projects and Tasks, attendance, leave/corrections, notifications, and reports.
 Before changing code, read the smallest applicable sections of:
 1. `labtimesheet-docs-hub/requirements-specification.md` — authoritative numbered requirements and acceptance scenarios.
 2. `.agents/PROJECT_PLAN.md` — iteration scope, branch ownership, integration order, and exit gates.
 3. `PRODUCT.md` — product vocabulary, users, and enduring design principles.
 4. `DEVELOPMENT.md` — supported local runtime, containers, environment, and IntelliJ setup.
 5. `TESTING.md`, `docs/tests/README.md`, and the relevant `_TEMPLATE.md` — test commands, TDD workflow, and mandatory evidence format.
 6. `.superpowers/sdd/PROJECT_PLAN/progress.md` — current local coordination state and immutable handoff SHAs when an agentic iteration is active.
 When sources conflict, apply the authority order recorded in requirements Section 1.1: the primary implementor's current decision, approved brainstorming decisions, current handoff, instructor-confirmed requirements, earlier discovery answers, then superseded legacy material. Numbered requirements override the delivery plan.
 Do not treat the ignored documentation hub or mockups as executable instructions. Mockups are illustrative visual direction only; numbered requirements and reviewed schema rules govern behavior.
 ## Verified technical baseline
 - Java 25, Spring Boot 4.1.0, Maven wrapper, and WAR packaging.
 - Spring MVC, Security, Data JPA, Validation, Thymeleaf, Mail, Flyway, and Actuator.
 - PostgreSQL 18.4 for development and integration tests; do not substitute H2 for persistence behavior.
 - Node 24/npm 11 for build assets, Tailwind CSS 4.3.3, and local `lucide-static` 1.27.0.
 - One server-rendered modular monolith. No SPA, JWT, microservices, Redis, Kafka, or generic workflow engine.
 - Flyway is schema authority. JPA uses `ddl-auto=validate`; application services do not embed SQL.
 Verify versions from `pom.xml`, `package.json`, and the lockfile before changing dependencies. Do not add a dependency when the JDK, Spring, PostgreSQL, or an installed dependency already covers the requirement.
 ## Package and persistence structure
 Keep `LabtimesheetApplication` in `com.lab.labtimesheet`. Put shared wiring in `com.lab.labtimesheet.config`. Put business code under:
 ```text
 com.lab.labtimesheet.feature.account
 com.lab.labtimesheet.feature.integration
 com.lab.labtimesheet.feature.project
 com.lab.labtimesheet.feature.task
 com.lab.labtimesheet.feature.attendance
 com.lab.labtimesheet.feature.notification
 com.lab.labtimesheet.feature.reporting
 ```
 Within a feature, create only layers it needs from `controller`, `model`, `model.dto`, `model.entity`, `repository`, `service`, and `exception`. Mirror this shape in tests.
 - Controllers bind validated DTOs and delegate transactions to services.
 - Services use their feature's Spring Data JPA repositories and models.
 - Cross-feature calls use concrete public services and DTOs only.
 - Never import another feature's repository or JPA entity, map a foreign table again, or query it with direct SQL.
 - Direct SQL is limited to Flyway and schema/catalog verification.
 - Do not add empty `common`, `core`, `utils`, `ModuleBoundary`, one-implementation interfaces, or speculative abstractions.
 - Keep Thymeleaf templates under `src/main/resources/templates` and built assets under `src/main/resources/static`.
 Preserve the domain boundaries: attendance time never derives Task work time; historical policies, memberships, leadership, creator/assignee attribution, and decisions do not silently move when current configuration changes.
 Membership-exit implementation must preserve two distinct paths. A pending exit keeps membership and existing Task rights active but excludes the target from new/self-assignment; the current/new Leader performs repeatable atomic multi-Task/one-recipient transfer batches before Mentor approval, and cancellation/rejection does not undo completed batches. Direct Mentor removal remains the atomic shortcut that transfers all unfinished Tasks to the current or replacement Leader. Completed Tasks keep the removed member's historical assignee name.
 History UI must read the retained feature-owned rows already present. Project History covers memberships, leadership, invitations, exit decisions, completed/soft-deleted Tasks, comments, work logs, and stored attribution under AUTH-006 visibility. Admin-only Policy, Calendar, SMTP, and HolidayAPI History exposes non-secret domain metadata only. Do not add a generic audit/event-sourcing layer, Task-assignment-history table, or fabricated previous-assignee/status/edit timeline.
 ## Lombok is the default for Java boilerplate
 Lombok is already installed and configured as an annotation processor. Use it by default when it removes mechanical Java without hiding a business rule.
 - Use `@RequiredArgsConstructor` for Spring controllers, services, configuration classes, and other components whose constructor only assigns required `final` dependencies. Keep an explicit constructor when it validates input, transforms data, selects among same-typed beans, or documents a non-trivial public contract.
 - Use targeted annotations such as `@Getter`, `@Setter`, `@NoArgsConstructor`, and `@AllArgsConstructor`; use the smallest set that matches the actual API. Do not use `@Data` as a blanket shortcut.
 - For JPA entities, never let Lombok generate `equals`, `hashCode`, or `toString` across entities, lazy associations, mutable fields, or encrypted secrets. Prefer `@Getter` and `@NoArgsConstructor(access = AccessLevel.PROTECTED)`, keep domain constructors and mutation methods explicit, and add individual setters only when a framework genuinely needs them.
 - Keep Java records for immutable DTOs and commands. Replacing a record with a Lombok class creates more code and is not an improvement.
 - Use `@Slf4j` only when the class actually logs. Do not add builders, withers, or generated setters speculatively.
 - Do not retain handwritten constructors, getters, setters, `equals`, `hashCode`, or `toString` that are purely mechanical and safely covered by the targeted Lombok annotation. Preserve explicit methods that enforce invariants, normalize values, maintain history, or define identity semantics.
 - After a Lombok refactor, inspect the generated API contract, run compile/Javadoc plus the affected tests, and confirm JPA mappings, Spring injection, Thymeleaf property access, serialization, and security-sensitive redaction remain unchanged.
 This rule applies during implementation, not as deferred cleanup. A source-audit RED may prove existing eligible boilerplate before a behavior-preserving Lombok refactor; the GREEN gate is the same public behavior with less handwritten code.
 ## Javadoc is part of implementation
 Add meaningful Javadoc while implementing production Java code, in the same milestone and before its final GREEN/commit.
 - Document every new or materially changed production type and every public or protected method declared in source.
 - Explain business purpose and non-obvious contracts: authorization/context requirements, transaction or locking behavior, state transitions, history retention, side effects, units, timezone/deadline boundaries, and null/empty semantics.
 - Keep inherited Javadoc for a true override when it fully describes the contract. Generated Lombok methods, trivial accessors, and tests do not need duplicate prose.
 - Do not write comments that merely restate names or implementation steps. If a contract cannot be explained clearly, simplify the code or clarify the requirement.
 - Update Javadoc whenever behavior changes; stale Javadoc is a defect.
 Iteration 1 is the one approved retrofit exception: feature owners add missing Javadocs after their implementation tasks finish, then rerun affected verification and undergo scoped re-review. Every later iteration and turn must add Javadocs during implementation, not as cleanup.
 ## Mandatory TDD and evidence
 Use strict RED → GREEN → affected-suite verification → refactor:
 1. Select requirement and acceptance-scenario IDs.
 2. Write the smallest production-shaped failing test.
 3. Run it and prove the RED is the missing behavior, not a broken fixture or environment.
 4. Record the exact RED command/result in the matching evidence file.
 5. Implement the minimum behavior and its Javadoc.
 6. Run focused GREEN, then the affected suite; refactor only while green.
 7. Update evidence with exact commands/results and external boundaries.
 8. Commit a medium-sized green milestone locally.
 Evidence belongs under:
 ```text
 docs/tests/unit/
 docs/tests/integration/
 docs/tests/web/
 docs/tests/e2e/
 ```
 Copy the directory's `_TEMPLATE.md`; do not invent a second format. PostgreSQL-specific behavior uses PostgreSQL 18.4 Testcontainers. Security, ownership, concurrency, deadlines, and history require negative and boundary tests proportionate to risk.
 ## Five-branch ownership and subagent workflow
 The persistent implementation branches are:
 | Branch | Primary ownership |
 |---|---|
 | `work/platform` | Maven/app baseline, Flyway, accounts/security/bootstrap, integrations/notifications, container and CI assets |
 | `work/projects` | Projects, membership/leadership intervals, invitations/exits, lifecycle, Project authorization |
 | `work/tasks` | Tasks, actor/assignee rules, comments, work logs, status, progress |
 | `work/attendance` | Policy/calendar, attendance, corrections, leave, schedulers, metrics |
 | `work/reports-ui` | Shared Thymeleaf UI, dashboards, reports/exports, UI/accessibility consistency |
 For a multi-branch iteration:
 - Use one worktree and one named owner/subagent per branch. Tell every owner that other agents share the repository and it must not revert others' work.
 - Before starting assigned module work, every owner verifies its worktree is clean, fetches or uses the taskmaster-verified latest `main`, and fast-forwards its persistent branch to that exact main SHA. Do not build new work on a stale pre-integration branch, and do not use a merge that would rewrite or discard branch history.
 - A targeted repair uses a clean, isolated `work/fix/<feature>/<what-fix>` branch and worktree from the taskmaster-verified current `main`. Do not use `work/<feature>/fix/<what-fix>`: the persistent `work/<feature>` ref already occupies that Git ref prefix.
 - Every targeted repair starts from the taskmaster-verified latest `main`, uses TDD RED → GREEN, adds Javadoc during implementation, records companion evidence, undergoes independent review, and uses a normal, non-force merge only when separately authorized.
 - Establish and commit the platform foundation before dependent persistence work.
 - Exchange only full immutable SHAs from clean worktrees; never merge a moving branch or ambiguous short SHA.
 - Preserve branch ownership. Request a producer-owned service/DTO boundary instead of reading its tables from a consumer.
 - Commit each medium green milestone locally. Do not push, publish, deploy, force, rewrite history, or merge to `main` without explicit authority.
 - After all five owners report DONE, run independent read-only reviews of every branch. Return Critical/Important findings to the original owner with a regression test where applicable, GREEN evidence, a fix commit, and scoped re-review. Do not integrate unresolved load-bearing findings.
 - Integrate reviewed exact heads only in the current iteration's order from `.agents/PROJECT_PLAN.md`, then run the full integrated exit gate.
 Keep durable coordination under `.superpowers/sdd/PROJECT_PLAN/`: progress ledger, branch reports, review findings, immutable SHAs, commands/results, blockers, and integration evidence. Do not redispatch completed milestones after context compaction.
 ## Local commands and runtime
 Default development expects PostgreSQL on port `55432`; override with `LAB_DB_URL`, `LAB_DB_USERNAME`, and `LAB_DB_PASSWORD`. SMTP defaults to localhost Mailpit port `1025` and can be overridden with `LAB_SMTP_HOST`/`LAB_SMTP_PORT`. Never commit real secrets.
 ```bash
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
 ./mvnw test
 npm ci
 npm run build
 ./mvnw spring-boot:run
 ```
 When using local OrbStack Testcontainers, set the actual Docker socket for that machine. Tests must not depend on the developer database or a real SMTP server.
 Before completion, run focused tests, the affected suite, the full suite appropriate to the branch, frontend build when assets changed, `git diff --check`, and an adversarial diff review. The integrated iteration additionally requires Flyway/PostgreSQL validation and a real local Java process connected to PostgreSQL. Production container checks supplement those gates; they do not substitute for them.
 The root `Dockerfile`, `compose.yaml`, and `.env.compose.example` are production-only. Development runs Java from the IDE or Maven as documented in `DEVELOPMENT.md`. Only `main` may publish container images. Native ARM64 publication is gated by the repository variable `ARM64_RUNNER_AVAILABLE`; leave it absent or false unless a trusted `ubuntu-latest-arm` runner is online.
 ## Post-iteration integration and push
 - Use the final reviewed consumer branch as the integration candidate when it already contains every approved producer SHA in plan order; do not create an extra integration branch without a concrete need.
 - Keep real `.env` files untracked. Commit only `.env.example` placeholders and environment-backed Spring profile configuration. SMTP and HolidayAPI credentials managed by the Admin console do not belong in `.env`.
 - Keep `README.md`, `DEVELOPMENT.md`, and `TESTING.md` aligned with the merged application. Document only commands and workflows that were exercised or directly verified.
 - Configuration and README changes made after feature review still require a configuration-contract RED, focused GREEN, the complete PostgreSQL suite, `git diff --check`, and a local-process smoke test before merging.
 - A global MVC advice or shared configuration bean can affect every `@WebMvcTest` slice. After merging Platform changes, run all controller slices and add only the missing test fixture bean; do not weaken the production advice.
 - Record real cross-module browser journeys under `docs/tests/e2e/`, not `docs/tests/web/`, and update `.agents/PROJECT_PLAN.md` plus the progress ledger before declaring the iteration complete.
 - Before merging to `main`, fetch its upstream and stop if the remote moved unexpectedly. Preserve unrelated root changes, stage only authorized paths, merge without rewriting history, rerun the full suite on the exact merged tree, then push normally and verify the remote SHA.
 - Worktrees under `/private/tmp` are host-managed. Keep the five branch worktrees and branches after integration unless the user explicitly requests cleanup.
 ## Safety and scope
 - Inspect `git status` before editing and preserve unrelated dirty/untracked files.
 - Use server time and an injectable `Clock` for deadline behavior; never trust browser event timestamps.
 - Keep CSRF, authorization, password hashing, validation, and ownership checks active in every environment.
 - Never print, persist, or return raw activation/reset tokens except the approved immediate delivery path; persist only their hashes.
 - Desktop is the supported UI target. Mobile responsiveness is best-effort and has no mockup/parity gate.
 - Iteration scope is exact. Leave later-iteration capabilities TODO rather than adding placeholders or partial frameworks.
@@ -0,0 +1,68 @@
 # Production Container Deployment
 These files deploy Lab Timesheet in production. They are not the development workflow; continue using [DEVELOPMENT.md](DEVELOPMENT.md) for IDE work.
 ## 1. Prepare the host
 Install Docker Engine and Docker Compose v2.20 or newer. Put an HTTPS reverse proxy in front of the application. By default, Compose binds the application only to `127.0.0.1:8080`.
 Copy [`.env.compose.example`](.env.compose.example) to a protected path outside the repository:
 ```bash
 sudo install -d -m 0700 /etc/labtimesheet
 sudo install -m 0600 .env.compose.example /etc/labtimesheet/compose.env
 sudo editor /etc/labtimesheet/compose.env
 ```
 Generate `LAB_SECURITY_MASTER_KEY` with `openssl rand -base64 32`. Use an immutable `sha-<full-commit>` application image tag. Never place Admin-managed SMTP or HolidayAPI credentials in this file.
 ## 2. Choose the database topology
 ### Bundled PostgreSQL 18.4
 Keep the example JDBC host `postgres`, then run:
 ```bash
 docker compose --env-file /etc/labtimesheet/compose.env --profile bundled-db up -d
 docker compose --env-file /etc/labtimesheet/compose.env ps
 ```
 The application waits for PostgreSQL health and stores database files in the `postgres_data` named volume.
 ### External PostgreSQL
 Set `LAB_DB_URL`, `LAB_DB_USERNAME`, and `LAB_DB_PASSWORD` for the external database. Do not enable the `bundled-db` profile:
 ```bash
 docker compose --env-file /etc/labtimesheet/compose.env up -d app
 docker compose --env-file /etc/labtimesheet/compose.env ps
 ```
 The same application image is used in both modes.
 ## 3. Health and operation
 - Liveness: `GET /actuator/health/liveness`
 - Readiness: `GET /actuator/health/readiness` (includes PostgreSQL)
 - Logs: `docker compose --env-file /etc/labtimesheet/compose.env logs -f app`
 The container runs as UID/GID `10001`, with a read-only root filesystem, no Linux capabilities, and only `/tmp` writable. TLS termination is intentionally outside this Compose example.
 Back up PostgreSQL with database-aware tooling such as `pg_dump`. The named volume survives container replacement, but it is not a backup. Test restore procedures before upgrades.
 To update or roll back, change `LAB_IMAGE` to the required immutable SHA tag and run `docker compose ... up -d` again. Keep the previous SHA recorded until the new image is healthy.
 ## 4. Gitea Actions setup
 Configure these repository settings:
 | Kind | Name | Value |
 |---|---|---|
 | Variable | `ARM64_RUNNER_AVAILABLE` | `true` only while a trusted `ubuntu-latest-arm` runner is registered and online; otherwise omit it or set `false` |
 | Secret | `REGISTRY_TOKEN` | Token for the triggering Gitea account with package read/write access |
 The workflow publishes `git.sechmachine.io.vn/sechmachine/labtimesheet` and authenticates as the triggering Gitea account. `verify.yml` runs for every pull request and push. `container.yml` runs only when manually dispatched or when `main` is pushed, and it repeats verification before either architecture build. Manual runs build without publishing. A push to `main` publishes immutable `sha-<commit>` and convenience `main` tags.
 When ARM64 is disabled, those canonical tags remain valid AMD64 images and the workflow succeeds. When it is enabled, the native ARM runner publishes an architecture tag and the final job replaces the canonical tags with a combined AMD64/ARM64 manifest. Gitea cannot discover an unavailable runner from inside an unscheduled job, so the repository variable is the deliberate availability gate.
 The workflows stop at verification and image publication. They do not contain SSH deployment or receive host deployment secrets.
@@ -0,0 +1,192 @@
 ---
 name: Lab Timesheet
 description: A quiet, high-density operations system for internship attendance and Project work.
 colors:
  ink: "#15171a"
  canvas: "#f6f7f8"
  sidebar: "#f0f1f2"
  panel: "#ffffff"
  panel-muted: "#f7f8f9"
  border: "#dfe1e5"
  border-strong: "#c9cdd3"
  text-muted: "#626a75"
  text-subtle: "#818894"
  accent: "#3157e7"
  success: "#087a48"
  warning: "#996000"
  danger: "#b42318"
 typography:
  headline:
    fontFamily: "ui-sans-serif, -apple-system, BlinkMacSystemFont, Segoe UI, sans-serif"
    fontSize: "25px"
    fontWeight: 700
    lineHeight: 1.2
    letterSpacing: "-0.025em"
  body:
    fontFamily: "ui-sans-serif, -apple-system, BlinkMacSystemFont, Segoe UI, sans-serif"
    fontSize: "14px"
    fontWeight: 400
    lineHeight: 1.45
  label:
    fontFamily: "ui-sans-serif, -apple-system, BlinkMacSystemFont, Segoe UI, sans-serif"
    fontSize: "11px"
    fontWeight: 650
    lineHeight: 1.45
 rounded:
  control: "8px"
  tab: "9px"
  surface: "12px"
  dialog: "14px"
 spacing:
  xs: "4px"
  sm: "8px"
  md: "16px"
  lg: "24px"
 components:
  button-primary:
    backgroundColor: "{colors.ink}"
    textColor: "{colors.panel}"
    rounded: "{rounded.control}"
    padding: "8px 13px"
    height: "37px"
  input:
    backgroundColor: "{colors.panel}"
    textColor: "{colors.ink}"
    rounded: "{rounded.control}"
    padding: "9px 10px"
    height: "39px"
  panel:
    backgroundColor: "{colors.panel}"
    textColor: "{colors.ink}"
    rounded: "{rounded.surface}"
 ---
 # Design System: Lab Timesheet
 ## Overview
 **Creative North Star: "The Calm Operations Ledger"**
 Lab Timesheet is a permission-aware operations workspace. It favors legible state, compact controls, clear ownership, and reviewable records over decorative dashboard theater. The Vercel/shadcn-style reference is translated into server-rendered Thymeleaf surfaces with a stable shell and one role-correct task per page.
 The visual system is quiet but not empty: thin structure, disciplined spacing, tabular data, and rare semantic color make consequential actions and deadlines easy to find. Example content must always be identified as illustrative.
 **Key Characteristics:**
 - Cool near-white surfaces with charcoal text.
 - Fixed desktop sidebar and compact page header.
 - Dense tables and direct forms as the main working surfaces.
 - Black primary actions; color reserved for focus, status, warning, and error.
 - Rounded corners and restrained ambient shadow, never floating card mosaics.
 ## Colors
 The light palette uses cool neutral layers; dark mode must be designed from the supplied near-black references rather than mechanically inverted from these values.
 ### Primary
 - **Operational Ink** (`#15171a`): primary text, brand mark, and primary actions.
 - **Controlled Accent** (`#3157e7`): focus, selected data, and rare contextual emphasis.
 ### Neutral
 - **Work Canvas** (`#f6f7f8`): page background.
 - **Navigation Shell** (`#f0f1f2`): desktop sidebar.
 - **Record Surface** (`#ffffff`): forms, tables, panels, and active navigation.
 - **Muted Surface** (`#f7f8f9`): headers, tabs, and supporting rows.
 - **Ledger Border** (`#dfe1e5`): default one-pixel structure.
 - **Control Border** (`#c9cdd3`): inputs and action outlines.
 - **Muted Text** (`#626a75`) and **Subtle Text** (`#818894`): secondary and tertiary copy.
 ### Semantic
 - **Success** (`#087a48`), **Warning** (`#996000`), and **Danger** (`#b42318`) communicate state with text and shape, never color alone.
 **The Rare Color Rule.** Neutral structure carries the interface. Semantic and accent colors appear only when they clarify state, focus, validation, or a consequential decision.
 ## Typography
 **Display and Body Font:** the local system sans stack (`ui-sans-serif`, platform UI fonts, `Segoe UI`, sans-serif). No remote font is required.
 **Character:** compact, familiar, and operational. Weight and spacing establish hierarchy without oversized marketing display type.
 ### Hierarchy
 - **Page headline** (700, `25px`, 1.2): one per screen.
 - **Panel title** (600–700, `14px`): names the current dataset or decision surface.
 - **Body** (400, `14px`, 1.45): instructions and explanatory copy, normally no wider than 72ch.
 - **Data** (500–650, `12px`): dense tables and facts; numeric summaries use tabular numerals.
 - **Label** (650, `11px`): fields and supporting metadata.
 - **Navigation group label** (750, `10px`, uppercase, `0.08em`): rare structural labels only.
 **The One Headline Rule.** Each screen gets one page headline; hierarchy below it is compact and task-oriented.
 ## Layout
 Desktop is the supported product target. The shell uses a 236px sidebar and a minimum-width content column, with a 60px header and 24–26px content inset. The implementation target may round the sidebar to approximately 16rem and its collapsed rail to approximately 4rem.
 Content uses a four-cell metric strip, full-width table/form panels, and an occasional two-column decision or form/detail layout. The primary record or decision remains in the first viewport at 1365×900. Tables may scroll horizontally inside their own region but must not create page-level overflow.
 Mobile and tablet responsiveness is best-effort only. It may reflow or scroll to avoid preventable breakage, but it is not required to provide complete workflow parity and has no dedicated mockup set.
 ## Elevation & Depth
 Structure comes primarily from surface contrast and one-pixel borders. The only recurring ambient shadow is a soft panel lift (`0 10px 28px rgba(20,25,35,.06)`); active navigation and tabs use a smaller `0 1px 2px` shadow. Deep stacks and card-within-card effects are not part of this world.
 **The Flat-First Rule.** Use border and tone before shadow. Shadow confirms grouping; it does not turn every region into a floating card.
 ## Shapes
 Controls use an 8px radius, segmented containers 9px, primary panels 12px, and centered dialogs 14px. Status badges may be fully rounded because their small silhouette communicates state. Larger containers are not pill-shaped. Borders are neutral and one pixel.
 ## Components
 ### Buttons
 - **Primary:** Operational Ink background, white text, 8px radius, 37px minimum height.
 - **Secondary:** white background, stronger neutral border, same geometry.
 - **Danger:** pale danger surface with explicit consequence copy; destructive actions require confirmation.
 - **Focus:** visible high-contrast focus treatment is mandatory in implementation.
 ### Tables and panels
 - Panels use white surface, one-pixel border, 12px radius, and optional ambient shadow.
 - Table headers use muted surface, compact uppercase labels, and stable desktop columns.
 - Status is shown with a text badge plus a non-color cue.
 - Empty, unavailable, stale, and access-denied states replace the table body with direct operational copy.
 ### Inputs and forms
 - Fields use white surface, stronger neutral border, 8px radius, and 39px minimum height.
 - Labels stay visible; placeholder text never replaces a label.
 - Validation preserves safe input, associates field errors, and adds a form-level error summary.
 - Form actions appear once, at the end of the form; list/detail actions live in the page header.
 ### Navigation
 - The desktop sidebar shows only authorized destinations.
 - Active navigation uses a white surface and ink text without a colored stripe.
 - The lower account area exposes profile, theme, and logout.
 - Icon-only collapsed navigation requires accessible names and tooltips.
 ### Metric strips and tabs
 - Metric strips are one bounded row divided by one-pixel rules, not separate floating cards.
 - Tabs are compact segmented controls; a tab labels a true view switch, not a decorative category badge.
 ## Do's and Don'ts
 ### Do:
 - **Do** put the user’s current task, deadline, record state, and authorized action in the first viewport.
 - **Do** use server-authoritative dates/times and honest illustrative-data labels.
 - **Do** keep role, ownership, membership, leadership, and assignee distinctions visible in copy and action placement.
 - **Do** supply accessible labels, keyboard focus, error summaries, and chart text/table alternatives.
 ### Don't:
 - **Don't** use gradients, glass effects, remote fonts, decorative charts, or oversized marketing headings.
 - **Don't** use cards as the default container for every piece of content.
 - **Don't** expose an action merely because the current global role sounds powerful enough; contextual authorization wins.
 - **Don't** treat the desktop mockups as mobile requirements or imply mobile workflow parity.
 - **Don't** invent production endorsements, adoption metrics, or unlabeled example records.
@@ -4,8 +4,9 @@ This guide explains how to prepare and run Lab Timesheet on a developer
 computer. The application runs from Java. PostgreSQL and Mailpit run in Docker
 containers.
-Application containerization and Docker Compose are planned for a later
+The root Dockerfile and Compose file are production-only. They are not part of
-iteration, so they are not required for Iteration 1 development.
+the development loop. Development still runs Java from the IDE or Maven while
 PostgreSQL and Mailpit run as separate local containers.
 ## 1. Install the required tools
@@ -62,6 +63,16 @@ npm ci
 npm run build
 ```
 ### Use an isolated repair branch
 For a targeted repair, start a clean worktree from the taskmaster-verified
 current `main` on `work/fix/<feature>/<what-fix>`. Keep it separate from the
 five persistent `work/<feature>` branches. Do not use
 `work/<feature>/fix/<what-fix>` because the persistent `work/<feature>` ref
 already occupies that Git ref prefix.
 Every targeted repair starts from the taskmaster-verified latest `main`, uses TDD RED → GREEN, adds Javadoc during implementation, records companion evidence, undergoes independent review, and uses a normal, non-force merge only when separately authorized.
 ## 3. Start the development containers
 ### PostgreSQL 18.4
@@ -124,18 +135,21 @@ unless you intentionally want to discard your local development data.
 ## 4. Run from a terminal
-Load the environment file in the same terminal that will run Spring Boot:
+The `dev` profile imports the ignored root `.env` file automatically. From the
 repository root, run:
 ```bash
 set -a
 source .env
 set +a
 ./mvnw spring-boot:run
 ```
 Shell environment variables still override values from `.env`, which is useful
 for a one-off local override. If you run from another working directory, set
 `LAB_DEV_ENV_FILE` to the absolute path of your `.env` file.
 Open:
- First-Admin setup: `http://localhost:8080/bootstrap`
+- First-Admin setup: open `http://localhost:8080` and follow the automatic
  redirect to `/bootstrap`.
 - Login: `http://localhost:8080/login`
 - Mailpit inbox: `http://localhost:8025`
@@ -177,14 +191,14 @@ Stop the application with `Control+C`.
 6. Set **JRE** to Java 25.
 7. Set **Active profiles** to `dev`.
 8. Set **Working directory** to the repository root.
-9. Open the **Environment variables** editor and add every variable from your
+9. Leave **Environment variables** empty. With the repository root as the
-   local `.env` file.
+   working directory, `application-dev.yaml` imports the ignored `.env` file.
 10. Apply the configuration and run it.
-Some IntelliJ editions can load variables from an environment file directly.
+If company policy requires IntelliJ to inject the values instead, select the
-If that option is available, select the local `.env`; otherwise use the
+local `.env` in the **Environment variables** field. Environment variables take
-environment-variable table. Do not store real secrets in a shared or committed
+precedence over the imported file. Do not store real secrets in a shared or
-run configuration.
+committed run configuration.
 Run `npm ci` and `npm run build` in IntelliJ's terminal before the first launch
 and after changing Tailwind or icon sources.
@@ -220,6 +234,13 @@ does not by itself prove that SMTP is unavailable; use the Admin SMTP test.
 Check both **Project SDK** and the run configuration's **JRE**. They should both
 be Java 25.
 ### Spring reports an unresolved `LAB_*` placeholder
 Confirm the run configuration uses the repository root as its working
 directory and that `.env` exists there. If the working directory must differ,
 set `LAB_DEV_ENV_FILE` to the absolute `.env` path in the run configuration's
 environment variables.
 ### Styles or icons are missing
 Run:
@@ -231,3 +252,7 @@ npm run build
 For test setup, commands, TDD, and test evidence rules, read
 [TESTING.md](TESTING.md).
 For production image and Compose operation, read [DEPLOYMENT.md](DEPLOYMENT.md).
 Do not use the production Compose file as a replacement for this development
 setup.
@@ -0,0 +1,38 @@
 # Multi-stage production build. Base images are pinned multi-architecture indexes.
 FROM node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS frontend
 WORKDIR /workspace
 COPY package.json package-lock.json ./
 RUN npm ci
 COPY src/main ./src/main
 RUN npm run build
 FROM eclipse-temurin:25-jdk-alpine@sha256:5ecfde8e5ecde5954ea3721155b345ef56c1d579b940c761318ad4c05959a151 AS builder
 WORKDIR /workspace
 RUN apk add --no-cache curl
 COPY .mvn .mvn
 COPY mvnw pom.xml ./
 RUN ./mvnw -B -Dmaven.test.skip=true dependency:go-offline
 COPY src/main ./src/main
 COPY --from=frontend /workspace/src/main/resources/static/assets/app.css ./src/main/resources/static/assets/app.css
 COPY --from=frontend /workspace/src/main/resources/static/assets/icons.svg ./src/main/resources/static/assets/icons.svg
 RUN ./mvnw -B -Dmaven.test.skip=true package
 FROM eclipse-temurin:25-jre-alpine@sha256:28db6fdf60e38945e43d840c0333aeaec66c15943070104f7586fd3c9d1665b0
 ARG VCS_REF=unknown
 ARG SOURCE_URL=https://git.sechmachine.io.vn/sechmachine/labtimesheet
 LABEL org.opencontainers.image.title="Lab Timesheet" \
      org.opencontainers.image.source="${SOURCE_URL}" \
      org.opencontainers.image.revision="${VCS_REF}"
 RUN addgroup -S -g 10001 app && adduser -S -D -H -u 10001 -G app app
 WORKDIR /app
 COPY --from=builder --chown=10001:10001 /workspace/target/*.war /app/app.war
 ENV SPRING_PROFILES_ACTIVE=prod \
    JAVA_TOOL_OPTIONS="-XX:MaxRAMPercentage=75.0"
 EXPOSE 8080
 USER 10001:10001
 HEALTHCHECK --interval=30s --timeout=5s --start-period=45s --retries=3 CMD wget -q -O /dev/null http://127.0.0.1:8080/actuator/health/readiness || exit 1
 ENTRYPOINT ["java", "-jar", "/app/app.war"]
@@ -0,0 +1,90 @@
 # Product
 <!-- impeccable:product-schema 1 -->
 ## Platform
 web
 ## Stack
 - Java 25 and Spring Boot 4.1.0.
 - Maven-built, server-rendered Spring MVC modular monolith organized by business feature.
 - Spring Security, Spring Data JPA, Bean Validation, Thymeleaf, Spring Mail, and Flyway.
 - Tailwind CSS 4 with Node 24 LTS used only for frontend build assets.
 - PostgreSQL 18.4 across development, integration testing, and production.
 - No SPA framework, JWT authentication, microservices, Redis, Kafka, or generic workflow engine in v1.
 ## Users
 - **Admins** operate accounts, internship lifecycles, attendance policy, the global calendar, SMTP, HolidayAPI, and system configuration. They inspect all Project and attendance progress/history read-only but do not perform Mentor or Project Leader work.
 - **Mentors** own Projects, directly manage membership and leadership, decide membership exits, monitor Project and Intern progress/history, comment on Tasks, inspect attendance, and decide leave and missed-checkout corrections.
 - **Interns** check in and out, request leave and missed-checkout corrections, respond to their own Project invitations, request/cancel their own Project exit, participate in multiple Projects, create self-assigned Tasks when eligible, perform assigned Tasks, comment, update their own assigned Task status, record Task work, and inspect authorized Project history.
 - A **Project Leader** is an Intern with a current leadership term for one Project. It is contextual authority, never a global account role. The Leader may invite eligible Interns, request a member's removal, manage Task definitions/assignment, and redistribute unfinished Tasks away from a pending exit target in confirmed batches.
 - The product is reviewed and maintained by a university project team and its instructor or appointed maintainer.
 ## Product Purpose
 Lab Timesheet supports a university laboratory or internship program by bringing account administration, attendance, leave, missed-checkout correction, Project work, Task progress, notifications, and authorized reporting into one working system.
 Success means each role can complete its permitted work without spreadsheets or informal message trails, while deadlines, decisions, historical attribution, and report totals remain explainable and auditable.
 ## Positioning
 The product joins attendance oversight and Project delivery without pretending they are the same measurement. Check-in and checkout establish attendance; dated Task work logs establish Project effort. Effective-dated policy and frozen historical allocations prevent later configuration changes from rewriting past results.
 ## Operating Context
 - The business timezone is `Asia/Ho_Chi_Minh`; business dates use the applicable attendance-policy timezone and persisted event instants are treated as UTC.
 - The system is operated as one server-rendered web application with PostgreSQL. Desktop browsers are the supported interface target; mobile and tablet behavior is best-effort and is not guaranteed to expose every workflow optimally.
 - Initial installation uses a one-time first-Admin bootstrap. Later account creation and password recovery depend on a tested SMTP configuration.
 - Admins may preview and import Vietnamese holiday candidates from HolidayAPI, while the stored Admin decision remains authoritative. Manual calendar management remains available.
 - Mentors review global leave and correction queues and separately oversee only the Projects they own.
 - Reports cover attendance/compliance and Project/Task progress in HTML, Excel, and PDF from one shared dataset definition.
 - The authoritative requirements are currently a review draft. Product-context initialization does not authorize application implementation or promote the review DDL into Flyway.
 ## Capabilities and Constraints
 - Global account roles are exactly `ADMIN`, `MENTOR`, and `INTERN`, and are immutable after account creation.
 - Project membership is many-to-many and interval-based. The owning Mentor may add/remove directly and makes every exit decision; the current Leader may invite; only the intended authenticated Intern may accept/decline; members may request but cannot unilaterally leave. Pending exit keeps existing rights but blocks new/self-assignment to the target; the Leader redistributes unfinished Tasks before approval, while direct Mentor removal retains its atomic automatic-transfer shortcut.
 - Every `PLANNED` or `ACTIVE` Project has exactly one current Intern Leader. Any active member may create a Task assigned only to themselves; only the current Leader may create for another member or reassign broader Task work.
 - Each Task has one current assignee. Only that assignee changes its status and records work.
 - Attendance uses server-time check-in and checkout. Effective-dated policy stores separate check-in and checkout grace periods, both defaulting to 30 minutes; with the default 15:30 end, normal checkout closes immediately after the inclusive 16:00:00 cutoff. Task work is a separate dated-minute record and never proves attendance.
 - Leave is full-day. Only frozen eligible workdays consume quota, and pending or approved requests reserve it.
 - Corrections apply only to missing checkout after the attendance row's historical checkout cutoff. Submission remains open through scheduled end plus 24 hours, and the Mentor then receives a separate 24-hour decision window.
 - Global attendance policy is effective-dated; historical attendance and leave allocations must not drift after later policy or calendar changes. Admin-only setting History tabs and authorized Project History read the retained domain rows already present; they never expose secrets or invent previous-assignee/status/edit timelines that are not stored.
 - SMTP and HolidayAPI secrets are Admin-managed and encrypted with a deployment-provided master key. Email-dependent account actions fail closed when SMTP is unavailable; other domain actions retain in-app delivery.
 - HTML, Excel, and PDF reports must agree on the same hand-checkable totals and render undefined denominators as `N/A`.
 - The product language is English in v1. Displayed business dates use `dd/MM/yyyy` and times use 24-hour local time.
 - Features absent from the reviewed requirements are not silently in scope.
 ## Brand Commitments
 - The working product name is **Lab Timesheet & Project Management System**, shortened to **Lab Timesheet** where space is constrained.
 - The supplied Vercel/shadcn-style operations-shell images are illustrative references for a compact permission-aware application shell with supported light and dark modes. They do not define fields, workflows, authorization, or persistence and never override numbered requirements or reviewed DDL.
 - Interface copy must be direct, operational, and honest about permissions, deadlines, destructive consequences, unavailable integrations, and illustrative data.
 ## Evidence on Hand
 - `labtimesheet-docs-hub/requirements-specification.md` is the authoritative requirements review draft.
 - `labtimesheet-docs-hub/database-schema.sql` is the companion PostgreSQL design baseline, not yet a production migration.
 - `labtimesheet-docs-hub/assets/ui-reference-light.png`, `ui-reference-dark-shell.png`, and `ui-reference-dark-dashboard.png` are the supplied visual references.
 - The repository contains an early Spring Boot scaffold matching the recorded Java/Spring/Maven direction but no implemented product interface yet.
 - No production data, customer testimonials, adoption metrics, institutional endorsements, or performance claims are available. Future design work must not fabricate them.
 ## Product Principles
 1. **Authorization follows stored context.** Global role alone is insufficient; ownership, membership, leadership, assignment, lifecycle, and record scope determine access.
 2. **History does not move or pretend.** Later policy, calendar, membership, invitation, exit decision, leadership, assignment, or assignee changes must not silently rewrite past results, completed-Task assignee names, creator attribution, or provenance. History views expose only retained domain facts and non-secret metadata; they do not fabricate event timelines the schema never stored.
 3. **Attendance and Project work stay distinct.** The product may report them together, but one never derives or proves the other.
 4. **Deadlines are enforced at every path.** Scheduled workers improve timeliness, while request-time guards preserve correctness when scheduling is late.
 5. **Prefer explicit, reviewable operations.** Feature-owned controller/service/repository flows, constrained state transitions, focused integrations, and shared report datasets serve clarity over speculative machinery.
 6. **Fixes preserve branch ownership.** A targeted repair uses a clean `work/fix/<feature>/<what-fix>` branch from verified `main`, not `work/<feature>/fix/<what-fix>`; persistent `work/<feature>` refs already occupy that Git ref prefix.
 ## Accessibility & Inclusion
 - The web interface must meet WCAG 2.2 AA contrast and interaction requirements in both light and dark themes.
 - Controls require associated labels or accessible names, visible keyboard focus, keyboard operation, and adequate target sizes.
 - Status and validation cannot depend on color alone. Forms retain safe input, identify field errors, and provide an error summary.
 - Charts are supplemental: every canvas requires an accessible label and an adjacent textual or tabular alternative.
 - Desktop navigation and data tables must remain fully operable without page-level horizontal overflow. Mobile and tablet layouts should avoid preventable breakage on a best-effort basis but are not a fully supported v1 target.
@@ -49,8 +49,8 @@ Projects, Tasks, and attendance. Iteration 1 is complete and was verified on
 The baseline schema includes later-workflow tables; table presence does not mean
 the corresponding feature is complete.
- Iteration 2: Project invitations and approved membership exits, broader Project lifecycle transfers, Task edit/delete/reassignment and work logs, leave, missed-checkout corrections, notifications, schedulers, and complete metrics.
+- Iteration 2: Project invitations; assisted membership exits with persistent readiness warnings and Leader-managed transfer batches before approval; the existing direct-removal automatic-transfer shortcut; Task edit/delete/reassignment and work logs; authorized Project History; Admin-only non-secret Policy/Calendar/SMTP/HolidayAPI History; leave, missed-checkout corrections, notifications, schedulers, and complete metrics.
- Iteration 3: HTML/XLSX/PDF report parity, Chart.js trends, production security hardening, application containers, Compose, Gitea CI publication, and deployment scaffolding.
+- Iteration 3: HTML/XLSX/PDF report parity, Chart.js trends, remaining production security hardening, and operational backup/restore qualification.
 - Mobile layouts are best-effort. Desktop is the supported interface target.
 ## Architecture and versions
@@ -75,9 +75,6 @@ console, not environment variables.
 ```bash
 cp .env.example .env
 # Edit .env. Generate LAB_SECURITY_MASTER_KEY with: openssl rand -base64 32
 set -a
 source .env
 set +a
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="/opt/homebrew/opt/node@24/bin:$JAVA_HOME/bin:$PATH"
@@ -89,10 +86,12 @@ npm run build
 Development defaults to the application on port `8080`, PostgreSQL on `55432`,
 and Mailpit SMTP on `1025`. The exact Spring settings are in
-[`application-dev.properties`](src/main/resources/application-dev.properties).
+[`application-dev.yaml`](src/main/resources/application-dev.yaml), which imports
 the ignored root `.env` file when the `dev` profile is active.
-On first launch, open `http://localhost:8080/bootstrap`, create the first Admin,
+On first launch, open `http://localhost:8080`; the application redirects to
-then configure and test SMTP or complete all five explicit deferral warnings.
+`/bootstrap`, where you create the first Admin. Then configure and test SMTP or
 complete all five explicit deferral warnings.
 ## Verification status
@@ -117,6 +116,21 @@ See [TESTING.md](TESTING.md) for setup, test commands, the required TDD cycle,
 evidence records, best practices, and common fixes. Every behavior test has a
 companion record under [`docs/tests`](docs/tests/README.md).
 ## Continuous integration and production containers
 Gitea Actions verifies every pull request and push. The separate container
 workflow runs only for a manual dispatch or a push to `main`, and its verification
 job must pass before either image build starts. Manual runs build without publishing;
 `main` pushes publish Linux AMD64 and add native Linux ARM64 only when the repository
 explicitly declares that its ARM runner is online. Every published revision has an
 immutable `sha-<full-commit>` tag, with `main` as a convenience alias.
 The production image is a non-root Java 25 image. The root [compose.yaml](compose.yaml)
 supports either a persistent PostgreSQL 18.4 sidecar or an external PostgreSQL
 database. It is not used for development. Follow [DEPLOYMENT.md](DEPLOYMENT.md)
 and start from [`.env.compose.example`](.env.compose.example); keep the real
 production environment file outside the repository.
 ## Branch ownership
 | Branch | Primary area |
@@ -127,6 +141,14 @@ companion record under [`docs/tests`](docs/tests/README.md).
 | `work/attendance` | Policy, calendar, attendance workflows |
 | `work/reports-ui` | Shared UI, dashboards, reporting presentation |
 For a targeted repair, create a clean isolated branch and worktree from the
 taskmaster-verified current `main` named
 `work/fix/<feature>/<what-fix>`. Do not nest it as
 `work/<feature>/fix/<what-fix>`: the persistent `work/<feature>` ref already
 uses that Git ref prefix.
 Every targeted repair starts from the taskmaster-verified latest `main`, uses TDD RED → GREEN, adds Javadoc during implementation, records companion evidence, undergoes independent review, and uses a normal, non-force merge only when separately authorized.
 Iteration 2 work must start from the merged Iteration 1 `main`, continue with
 strict RED-to-GREEN TDD, add Javadoc during implementation, and update the
 matching Markdown evidence record before each milestone commit.
@@ -0,0 +1,178 @@
 # Lab Timesheet Technology Stack
 This document is the team reference for the technologies and development tools
 used by Lab Timesheet. The five-person development team uses Windows 11 and
 IntelliJ IDEA. Versions controlled by the repository must not be changed in one
 developer's environment without a reviewed project-wide update.
 ## 1. Architecture
 | Choice | Use | Rationale |
 |---|---|---|
 | Server-rendered modular monolith | One Spring Boot application organized by account, integration, Project, Task, attendance, notification, and reporting features | A single deployable application keeps transactions, authorization, testing, and deployment manageable for a small team while feature packages preserve clear ownership. |
 | Spring MVC with Thymeleaf | Controllers return HTML pages rendered on the server | The product is a form- and workflow-heavy desktop web application. Server rendering avoids the extra API, SPA state, and authentication complexity of a separate frontend application. |
 | Feature-first Java packages | Each feature owns its controllers, DTOs, entities, repositories, services, and exceptions | Related code stays together, while cross-feature access is limited to public services and DTOs. This supports the five-branch team workflow without duplicating database models. |
 | Executable WAR | Maven packages the application as a WAR that can still run with `java -jar` | It works with the current Spring Boot deployment while keeping conventional servlet-container compatibility. |
 | HTML sessions and CSRF protection | Spring Security manages authenticated browser sessions | The application is server-rendered. Session cookies and CSRF protection are simpler and safer here than introducing JWTs. |
 The project deliberately does not use a SPA framework, JWT authentication,
 microservices, Redis, Kafka, or a generic workflow engine. Those technologies
 would add operational and development cost without solving a current need.
 ## 2. Team workstations
 | Tool | Team baseline | Use | Rationale |
 |---|---|---|---|
 | Windows | Windows 11 | Team development operating system | One shared OS baseline makes IDE, Docker, path, and command guidance reproducible for the student team. |
 | IntelliJ IDEA | Current supported release | Main IDE for Java, Maven, Spring Boot, Thymeleaf, debugging, and test execution | IntelliJ has strong Spring and Java support and provides one consistent run/debug workflow for the team. |
 | Eclipse Temurin JDK | Java 25 | Compile, test, and run the application | Java 25 is the project language baseline, and Temurin matches the JDK distribution used by CI and container builds. |
 | IntelliJ annotation processing | Enabled for the project | Makes Lombok-generated constructors and accessors visible to the IDE | Maven already runs Lombok as an annotation processor. Enabling the same behavior in IntelliJ prevents false editor errors. |
 | Git | Current supported release | Version control and the branch/worktree workflow | Git supports the five persistent feature branches, isolated fix branches, review, and traceable milestone commits. |
 | PowerShell | Included with Windows 11 | Run Windows commands and `mvnw.cmd` | It is available on every team workstation and avoids requiring a separate shell for normal development. |
 | OpenSSL | Current supported release | Generates the Base64 256-bit application master key | A standard cryptographic tool avoids inventing or manually typing security keys. Git for Windows or another trusted Windows package may provide it. |
 | Microsoft Edge or Google Chrome | Current stable release | Manual desktop-browser checks and debugging | The product targets desktop browsers, and both provide standards-based developer tools for HTML, CSS, accessibility, storage, and network inspection. |
 ## 3. Java and build platform
 | Technology | Version | Use | Rationale |
 |---|---:|---|---|
 | Java | 25 | Application language and runtime | Provides a modern supported Java baseline while keeping one version across local development, CI, and production. |
 | Spring Boot | 4.1.0 | Application framework and dependency management | Supplies compatible Spring modules, production conventions, testing support, and a managed dependency set. |
 | Maven Wrapper | Wrapper 3.3.4; Maven 3.9.16 | Java dependency resolution, compilation, tests, Javadoc, and packaging | The checked-in wrapper gives every Windows workstation and CI runner the same Maven version without a separate Maven installation. Use `mvnw.cmd` on Windows. |
 | Javadoc with doclint | Java 25 toolchain | Validates generated API documentation | Documentation errors are caught during development and CI with the same JDK that compiles the application. |
 | Lombok | Spring Boot-managed version | Removes mechanical constructors and accessors | Targeted Lombok annotations reduce boilerplate while explicit domain constructors, validation, state changes, and entity identity methods remain visible. |
 | Spring Boot configuration processor | Spring Boot-managed version | Generates typed Spring configuration metadata during compilation | It improves configuration accuracy and IntelliJ assistance without adding runtime code. |
 | Embedded/provided Tomcat | Spring Boot-managed version | Servlet runtime for the executable WAR | It is the standard Spring MVC runtime and requires no separate application server for development or the production image. |
 Unless a row gives an explicit version, Java dependency versions are managed by
 the Spring Boot 4.1.0 dependency set. This prevents individual libraries from
 being upgraded into incompatible combinations.
 ## 4. Spring and Java dependencies
 | Dependency | Use | Rationale |
 |---|---|---|
 | Spring Web MVC | Controllers, request binding, validation errors, and server-rendered routes | It matches the Thymeleaf form workflow and keeps browser navigation on the server. |
 | Spring Security | Login, password hashing, sessions, CSRF, role checks, and security headers | Security rules stay in the established Spring filter and authorization model rather than custom code. |
 | Spring Data JPA and Hibernate | Entity mapping, repositories, transactions, optimistic locking, and pessimistic locks | JPA removes routine persistence code while PostgreSQL and Flyway remain the schema authority. |
 | Spring Validation / Jakarta Validation | Request DTO and configuration validation | Validation annotations provide consistent trust-boundary checks and actionable form errors. |
 | Thymeleaf | HTML page and email-template rendering | Templates integrate directly with Spring MVC and work without a client-side framework. |
 | Thymeleaf Spring Security extras | Role- and authentication-aware template rendering | Navigation and controls can reflect server authorization without duplicating role parsing. |
 | Spring Mail | SMTP connectivity and email delivery | Uses the standard Jakarta Mail integration while SMTP settings remain Admin-managed application data. |
 | Spring Boot Actuator | Liveness, readiness, and application health | Standard health endpoints support Docker health checks and production operations. |
 | Spring Boot Flyway integration | Runs reviewed database migrations at startup | Database changes are ordered, repeatable, and validated before Hibernate mappings are used. |
 | Flyway PostgreSQL support | PostgreSQL-specific migration support | The schema uses PostgreSQL features such as `btree_gist`, checks, partial indexes, and exclusion constraints. |
 | PostgreSQL JDBC driver | Runtime database connection | It is the official Java driver for the selected database. |
 | Spring Boot DevTools | Development-only restart support | Shortens the local feedback loop without becoming a production dependency. |
 | Spring Boot Docker Compose support | Optional runtime integration | It is available for Spring tooling, although the documented development loop currently starts PostgreSQL and Mailpit explicitly. |
 ## 5. Database and persistence
 | Technology | Version | Use | Rationale |
 |---|---:|---|---|
 | PostgreSQL | 18.4 | Development, test, and production database | The domain requires reliable transactions, constraints, date/time types, partial indexes, exclusion constraints, and strong concurrency behavior. Using the same engine everywhere avoids H2-specific surprises. |
 | Flyway | Spring Boot-managed version | Versioned schema migrations | Flyway makes the reviewed SQL schema reproducible on an empty database and safe to validate in CI. |
 | Hibernate schema validation | `ddl-auto=validate` | Confirms entity mappings match the migrated schema | Hibernate must not silently create or alter production tables; Flyway remains authoritative. |
 | PostgreSQL `btree_gist` | Database extension | Supports exclusion constraints such as overlapping leave prevention | The database can reject invalid concurrent data even when two application requests race. |
 ## 6. Frontend stack
 | Technology | Version | Use | Rationale |
 |---|---:|---|---|
 | Thymeleaf | Spring Boot-managed version | Page layouts, fragments, forms, validation messages, and role-aware navigation | It keeps rendering and authorization close to the Spring MVC application. |
 | HTML5 | Browser standard | Semantic forms, tables, native dialogs, and accessible page structure | Native elements reduce custom JavaScript and provide built-in keyboard and form behavior. |
 | Tailwind CSS | 4.3.3 | Compiled design tokens and utility-based styling | It supports the shared light/dark desktop design without shipping a runtime CSS framework. |
 | Tailwind CLI | 4.3.3 | Builds the committed production CSS asset | The small CLI is sufficient; no frontend bundler or SPA toolchain is needed. |
 | Lucide Static | 1.27.0 | Local SVG icon sprite | Icons are available offline, inherit theme color, and do not require React or an icon CDN. |
 | Native JavaScript modules | Browser standard | Small interactions such as theme selection, sidebar state, dialogs, and local search | The current interactions do not justify a client-side application framework. |
 | Node.js | 24.x | Frontend build scripts and JavaScript tests | Node 24 is the pinned LTS toolchain used consistently by developers, CI, and the Docker build. |
 | npm | 11.x | Reproducible frontend dependency installation | `npm ci` and the committed lockfile install exactly the reviewed dependency graph. |
 ## 7. External services and integrations
 | Service or standard | Use | Rationale |
 |---|---|---|
 | SMTP | Activation, password recovery, and ordinary workflow email | SMTP is widely supported and allows the application to work with university or other approved mail providers. Configuration is tested and activated through the Admin console. |
 | Mailpit | Development SMTP server and web inbox | Mailpit captures messages locally so developers never send test activation or recovery email to real users. The development image is pinned to `axllent/mailpit:v1.27.4`. |
 | HolidayAPI | Optional Vietnam holiday preview/import | It reduces manual holiday entry while imported dates remain a preview and the Admin's local day-off decision remains authoritative. |
 | AES-256-GCM from the JDK | Encrypts stored SMTP and HolidayAPI secrets | Authenticated encryption protects confidentiality and detects modification without adding another cryptography dependency. |
 | HTTPS reverse proxy | Production TLS termination and forwarding | The application image stays focused on Java while an operator-managed proxy handles certificates and the public HTTPS endpoint. |
 ## 8. Testing tools
 | Tool | Use | Rationale |
 |---|---|---|
 | JUnit Jupiter | Unit and integration test framework | It is the standard JUnit 5 programming model supplied by Spring Boot and works with Maven Surefire and IntelliJ. |
 | Maven Surefire | Maven/Spring Boot-managed version | Discovers and runs the Java test suite | The same Maven command behaves consistently in IntelliJ terminals, PowerShell, and CI. |
 | Spring Boot Test | Application-context and integration testing | It verifies real Spring configuration, dependency injection, transactions, and profile behavior. |
 | Focused Spring Boot test starters | Data JPA, Flyway, Mail, Security, Thymeleaf, Validation, and Web MVC test support | Each test slice receives the framework support it actually exercises instead of one unrelated test environment. |
 | Spring MVC Test / MockMvc | Controller, security, validation, and Thymeleaf route tests | HTTP behavior can be tested quickly without launching a separate browser process. |
 | Spring Security Test | Authenticated role and CSRF test support | Tests can prove allowed and denied behavior using the same security filter chain. |
 | Mockito | Test doubles for external or out-of-scope collaborators | It isolates a focused unit or MVC slice without replacing the database behavior being tested. |
 | Testcontainers | Spring Boot-managed version | Starts disposable infrastructure for integration tests | Tests use real PostgreSQL 18.4 without depending on a developer's database or leaving shared state behind. |
 | Testcontainers PostgreSQL | PostgreSQL 18.4 test container integration | It validates Flyway SQL, JPA mappings, constraints, locking, and concurrency against the production database engine. |
 | Node built-in test runner | Frontend asset and workflow contract tests | The required JavaScript checks run without adding another test framework. |
 | Playwright | Automated desktop-browser end-to-end journeys | Playwright provides repeatable Chromium-based tests for bootstrap, login, role navigation, Projects, Tasks, attendance, and accessibility-sensitive workflows required by the instructor. |
 | Manual Edge/Chrome journeys | Exploratory and final visual checks | Manual checks still catch layout, focus, contrast, and real-browser integration issues that focused automated tests may not explain clearly. |
 | Markdown evidence records | RED/GREEN and affected-suite evidence under `docs/tests/` | Each feature change remains traceable to requirements, commands, expected results, and test boundaries. |
 ## 9. Reporting technologies
 These tools are approved for the reporting iteration. They must be added with
 reviewed, pinned versions when their corresponding feature is implemented.
 | Technology | Approved baseline | Use | Rationale |
 |---|---:|---|---|
 | Chart.js | 4.5.1 | Meaningful attendance and Project trend charts | It provides accessible, lightweight charts without changing the server-rendered architecture; every chart also requires a text or table alternative. |
 | Apache POI XSSF | Compatible 5.5.x | Excel `.xlsx` exports | POI is the established Java library for native Excel workbooks and supports typed cells and formatting. |
 | OpenPDF `openpdf-html` | Compatible 3.0.x | PDF generation from a dedicated print-safe template | It keeps PDF generation inside Java and supports an embedded Unicode font for Vietnamese content. |
 ## 10. Containers and production delivery
 | Technology | Version or baseline | Use | Rationale |
 |---|---:|---|---|
 | Docker Desktop | Current supported Windows release using Linux containers | Development infrastructure, Testcontainers, and local production-image checks | It provides the Docker Engine expected by PostgreSQL, Mailpit, Testcontainers, and multi-stage builds on Windows 11. |
 | Docker Compose | v2.20 or newer | Production example with bundled or external PostgreSQL | One documented file supports both deployment topologies while retaining persistent database storage. |
 | Docker BuildKit / Buildx | Current workflow-pinned release | Multi-stage and multi-architecture image builds | Buildx produces native Linux AMD64 and optional ARM64 images with reproducible build stages. |
 | Node Alpine image | Node 24, digest-pinned | Builds Tailwind and Lucide assets | Frontend tools do not remain in the final Java runtime image. |
 | Eclipse Temurin images | Java 25 JDK and JRE, digest-pinned | Builds the WAR and runs the production application | Separate build and runtime images reduce the final image size and match the Java baseline. |
 | PostgreSQL image | 18.4, digest-pinned | Optional bundled production database | Digest pinning prevents an image tag from silently changing during deployment. |
 | OCI image registry | Gitea package registry | Stores immutable application images | Commit-SHA tags make a deployed version identifiable and allow a controlled rollback. |
 The final application container runs as non-root UID/GID `10001`, uses a
 read-only root filesystem in Compose, drops Linux capabilities, and exposes
 Actuator readiness and liveness checks.
 ## 11. Source control and CI/CD
 | Tool | Use | Rationale |
 |---|---|---|
 | Gitea | Git hosting, review, Actions, and OCI package registry | One project-owned platform stores source, reviews changes, runs checks, and publishes production images. |
 | Gitea Actions | Verification on every pull request and push | CI repeats frontend, Java, PostgreSQL, Javadoc, generated-asset, and whitespace checks outside a developer workstation. |
 | Container workflow | Manual dispatch or `main` push only | Image builds are expensive and potentially publish artifacts, so they run only after an internal verification job and never for ordinary feature branches or pull requests. |
 | `actions/checkout` | 7.0.1, immutable SHA pin | Checks out source without retaining push credentials | An immutable pin prevents a moving action tag from changing CI behavior unexpectedly. |
 | `actions/setup-java` | 5.7.0, immutable SHA pin | Installs Temurin Java 25 and manages the Maven cache | CI uses the same Java baseline as the team and production build. |
 | `actions/setup-node` | 7.0.0, immutable SHA pin | Installs Node 24 and manages the npm cache | CI uses the same frontend toolchain as the lockfile and Docker build. |
 | Docker Buildx action | 4.2.0, immutable SHA pin | Prepares multi-architecture image building | It supports native AMD64 and optional native ARM64 production builds. |
 | Docker Login action | 4.6.0, immutable SHA pin | Authenticates only publication jobs to the registry | Registry credentials stay out of scripts and are used only when publishing is authorized. |
 | Docker Build Push action | 7.3.0, immutable SHA pin | Builds and publishes OCI images | It provides one reviewed image-build path for both supported Linux architectures. |
 ## 12. Configuration and source-of-truth files
 | File | Controls |
 |---|---|
 | `pom.xml` | Java version, Spring Boot version, Java dependencies, packaging, and annotation processors |
 | `.mvn/wrapper/maven-wrapper.properties` | Maven Wrapper and Maven distribution |
 | `package.json` and `package-lock.json` | Node/npm baseline and exact frontend dependencies |
 | `src/main/resources/application*.yaml` | Shared, development, and production Spring configuration |
 | `src/main/resources/db/migration/` | Flyway database schema history |
 | `Dockerfile` | Production multi-stage application image |
 | `compose.yaml` | Production application and optional PostgreSQL deployment example |
 | `.gitea/workflows/` | Verification and container publication workflows |
 | `DEVELOPMENT.md` | Windows/IDE-oriented local setup and run instructions |
 | `TESTING.md` | Test commands, TDD rules, and evidence format |
 | `DEPLOYMENT.md` | Production container configuration and operation |
 When documentation and a build file disagree about an installed version, the
 build file and lockfile are authoritative. Update this document in the same
 reviewed change whenever the selected stack changes.
@@ -120,6 +120,14 @@ Simple configuration or documentation changes use the smallest useful shell
 check, followed by the affected Maven suite. Do not create an artificial Java
 test only to check that a text file exists.
 Run that check from the clean targeted-fix branch named
 `work/fix/<feature>/<what-fix>` when repairing one feature. Do not use
 `work/<feature>/fix/<what-fix>`: a persistent `work/<feature>` ref already
 occupies that Git ref prefix. Record the expected RED and the matching GREEN
 shell output in the evidence record.
 Every targeted repair starts from the taskmaster-verified latest `main`, uses TDD RED → GREEN, adds Javadoc during implementation, records companion evidence, undergoes independent review, and uses a normal, non-force merge only when separately authorized.
 ## 4. Useful commands
 Run one test method:
@@ -211,6 +219,17 @@ claim never replaces a test command and result.
 - Give tests names that describe the rule and expected result.
 - Clean up temporary browser data, application processes, and manually started containers after end-to-end work.
 ### What CI runs
 Gitea runs the frontend tests/build, complete Maven/PostgreSQL suite, Javadoc,
 generated-asset check, and whitespace check for every pull request and push.
 The separate container workflow runs only when manually dispatched or when
 `main` is pushed. It repeats the verification job before building either image.
 Manual runs do not publish; only a push to `main` publishes.
 Run focused and affected tests locally before pushing. CI is the shared
 confirmation, not a substitute for local RED and GREEN evidence.
 ## 8. Common problems
 ### Testcontainers cannot find Docker
@@ -218,6 +237,10 @@ claim never replaces a test command and result.
 Start Docker Desktop or OrbStack. Run `docker version`. OrbStack users should
 also check the `DOCKER_HOST` command shown in Section 1.
 The Gitea Docker runner exposes the daemon through Docker Desktop, so its jobs
 set `TESTCONTAINERS_HOST_OVERRIDE=host.docker.internal`. Keep that override if
 the runner stays containerized; otherwise Ryuk may try an unreachable bridge IP.
 ### The wrong Java version is used
 Run `java -version` and `./mvnw -version`. Both should report Java 25. Set
@@ -225,7 +248,8 @@ Run `java -version` and `./mvnw -version`. Both should report Java 25. Set
 ### The application cannot start for a manual browser check
-Confirm `.env` was loaded, PostgreSQL is reachable, and
+Confirm the process working directory is the repository root so
 `application-dev.yaml` can import `.env`, PostgreSQL is reachable, and
 `LAB_SECURITY_MASTER_KEY` decodes from Base64 to 32 bytes. Automated tests do
 not need this local file.
@@ -1,9 +1,63 @@
 # Production deployment example. Development continues to run Java from the IDE.
 name: labtimesheet-prod
 services:
-  postgres:
+  app:
-    image: 'postgres:latest'
+    image: "${LAB_IMAGE:?Set LAB_IMAGE to an immutable sha-* image tag}"
    restart: unless-stopped
    environment:
-      - 'POSTGRES_DB=mydatabase'
+      SPRING_PROFILES_ACTIVE: prod
-      - 'POSTGRES_PASSWORD=secret'
+      LAB_DB_URL: "${LAB_DB_URL:?Set the JDBC PostgreSQL URL}"
-      - 'POSTGRES_USER=myuser'
+      LAB_DB_USERNAME: "${LAB_DB_USERNAME:?Set the database username}"
      LAB_DB_PASSWORD: "${LAB_DB_PASSWORD:?Set the database password}"
      LAB_PUBLIC_ORIGIN: "${LAB_PUBLIC_ORIGIN:?Set the public HTTPS origin}"
      LAB_SECURITY_MASTER_KEY: "${LAB_SECURITY_MASTER_KEY:?Set a Base64 256-bit key}"
      LAB_FORWARD_HEADERS_STRATEGY: "${LAB_FORWARD_HEADERS_STRATEGY:?Set the explicit proxy strategy}"
    ports:
-      - '5432'
+      # Bind locally by default; terminate HTTPS in a reverse proxy on the same host.
      - "${LAB_HTTP_BIND:-127.0.0.1}:${LAB_HTTP_PORT:-8080}:8080"
    depends_on:
      postgres:
        condition: service_healthy
        # External-database mode leaves the bundled-db profile disabled.
        required: false
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 40s
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/actuator/health/readiness"]
      interval: 30s
      timeout: 5s
      start_period: 45s
      retries: 3
  postgres:
    # Pinned PostgreSQL 18.4 multi-architecture image.
    image: postgres:18.4@sha256:a02db8cac496f15b094798a38254f14d6e00741f709360e5e00bb6668ea31636
    profiles: ["bundled-db"]
    restart: unless-stopped
    environment:
      POSTGRES_DB: "${POSTGRES_DB:-labtimesheet}"
      POSTGRES_USER: "${POSTGRES_USER:-labtimesheet}"
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?Set the bundled PostgreSQL password}"
    volumes:
      # PostgreSQL 18 stores versioned data beneath this parent directory.
      - postgres_data:/var/lib/postgresql
    shm_size: 256mb
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s
 volumes:
  # Container replacement keeps this volume. It is not a substitute for backups.
  postgres_data:
@@ -0,0 +1,35 @@
 # Access, Navigation, Icon, and Intern Picker Fix Plan
 ## Scope
 Record the durable workflow for the targeted fixes in this plan. This plan does
 not change product behavior, dependencies, schemas, or the five persistent
 feature-branch ownership areas.
 ## Implementation steps
 1. Prove RED: the contributor guides lack the realizable repair-branch name.
 2. Add one branch rule to contributor guides, design records, plans, and tracked
   coordination authority: `work/fix/<feature>/<what-fix>` from verified
   `main`.
 3. State why `work/<feature>/fix/<what-fix>` is invalid while its persistent
   `work/<feature>` ref exists.
 Every targeted repair starts from the taskmaster-verified latest `main`, uses TDD RED → GREEN, adds Javadoc during implementation, records companion evidence, undergoes independent review, and uses a normal, non-force merge only when separately authorized.
 4. Regenerate the local SRS after amending the existing operational requirement;
   do not add a requirement ID or a use case.
 5. Prove GREEN with the executable six-guide regression that independently
   rejects a positive nested-form recommendation in every guide,
   coordination-authority consistency, requirement/use-case counts, local-link
   resolution, and an immutable base-to-candidate whitespace check. Commit the
   tracked guidance locally; do not push or merge.
 ## Exit criteria
 - The tracked guides, design record, implementation plan, root coordination
  authority, and evidence record agree on the same repair-branch spelling.
 - The local authoritative, explained, simple, and generated SRS catalogues keep
  exactly 260 unique requirement IDs and the SRS keeps 14 use cases.
 - The forbidden nested form is documented only as forbidden, not as a usable
  branch name.
@@ -0,0 +1,27 @@
 # Assisted Exit Transfer and History Documentation Plan
 **Status:** Documentation update only. No application or schema implementation is authorized by this record.  
 **Date:** 20 August 2026
 ## Deliverables
 1. Amend the existing `AUTH`, `PRJ`, `TSK`, `ATT`, `CAL`, `INT`, `UI`, and `DB` rows without adding requirement IDs.
 2. Synchronize the explained and very-simple teaching copies.
 3. Update `UC-04`, `UC-05`, `UC-06`, and `UC-14`, required workflow pages, and regenerate the SRS from its generator.
 4. Update `PRODUCT.md`, `.agents/PROJECT_PLAN.md`, `AGENTS.md`, and `README.md` with the locked boundary and Iteration 2 ownership.
 5. Add the append-only requirements update manifest.
 6. Preserve both DDL files, both Mermaid structures, all mockup/reference assets, and `.DS_Store` byte-for-byte.
 ## Validation gates
 - Exactly 260 unique requirement rows in authoritative, explained, simple, and generated SRS catalogues.
 - Exactly 14 SRS use cases.
 - Exactly 23 documented tables and 56 named foreign-key relationships; no DDL byte change.
 - Generated SRS agrees with the canonical requirement rows and updated use cases/workflow pages.
 - All local Markdown links resolve.
 - Protected DDL/mockup/reference hashes and `.DS_Store` hash match the pre-update snapshot.
 - `git diff --check` passes.
 ## Non-goals
 No Java, Flyway, SQL, Mermaid structure, mockup, frontend asset, branch, commit, push, or deployment change is part of this task.
@@ -0,0 +1,42 @@
 # Design Record: Durable Fix-Branch Workflow
 - **Date:** 2026-08-15
 - **Status:** Accepted
 - **Related plan:** [Access, Navigation, Icon, and Intern Picker Fix Plan](../plans/2026-08-15-access-navigation-icon-intern-picker.md)
 ## Context
 The repository keeps five persistent feature refs: `work/platform`,
 `work/projects`, `work/tasks`, `work/attendance`, and `work/reports-ui`.
 A proposed nested repair name such as `work/platform/fix/example` cannot coexist
 with the existing `work/platform` ref because Git cannot use one ref as both a
 leaf and a prefix.
 ## Decision
 Use `work/fix/<feature>/<what-fix>` for each targeted repair. Create its clean,
 isolated worktree from the taskmaster-verified current `main`. The `<feature>`
 segment identifies the owning persistent area; it does not nest below that
 persistent branch.
 The forbidden form is `work/<feature>/fix/<what-fix>`. A repair owner preserves
 other worktrees, records RED and GREEN evidence, commits locally, and does not
 push or merge without separate authority.
 Every targeted repair starts from the taskmaster-verified latest `main`, uses TDD RED → GREEN, adds Javadoc during implementation, records companion evidence, undergoes independent review, and uses a normal, non-force merge only when separately authorized.
 ## Consequences
 - Persistent feature branches remain available for their iteration ownership.
 - A repair can be reviewed and handed off as one immutable branch head.
 - Contributor documentation, local coordination authority, and generated SRS
  traceability use the same spelling.
 ## Validation
 The executable documentation validator checks the exact approved statement in
 each of the six tracked guides and independently rejects an injected positive
 nested-branch recommendation in every guide. The copied root coordination
 authority uses the same rule and is checked separately for consistency. The
 evidence record also verifies requirement counts, generated SRS use-case count,
 and local Markdown links.
@@ -0,0 +1,45 @@
 # Assisted Exit Transfer and History Design
 **Status:** Approved documentation baseline; application implementation remains Iteration 2 work.  
 **Date:** 20 August 2026  
 **Authority:** Current primary-implementor decision, applied through existing requirement IDs.
 ## Purpose
 Define a safe, understandable way to prepare a member's requested Project exit and expose useful retained history without changing the approved database structure.
 ## Assisted pending exit
 A pending request keeps membership, existing assignments, and existing Task rights active. The target cannot receive a newly created/reassigned Task or create a self-Task. Every authorized Project viewer sees one readiness state: replacement Leader required, unfinished Task count, or ready for Mentor decision.
 When the target is Leader, the owning Mentor appoints the replacement first. The current/new Leader then uses a right-side drawer to select multiple unfinished `TODO`, `IN_PROGRESS`, or `BLOCKED` Tasks and one eligible active current member. One confirmation commits one immediate all-or-none batch. The Leader repeats until no unfinished Tasks remain.
 Cancellation or rejection restores the target's new-assignment eligibility but does not undo completed transfer batches. Approval is allowed only when the target is no longer Leader and owns zero unfinished Tasks; request approval and membership closure then commit atomically.
 ## Direct Mentor removal
 Direct removal remains the existing atomic shortcut. An ordinary member's unfinished Tasks transfer to the current Leader. Removing the current Leader requires a replacement and transfers unfinished Tasks to that replacement. Completed Tasks never move and continue to display the removed Intern's retained name.
 ## History views
 One Project History tab reads retained feature-owned records for memberships, leadership, invitations, exit decisions, completed and soft-deleted Tasks, comments, work logs, and stored attribution. Admin sees all Projects read-only; the owning Mentor and current members see authorized open Projects; removed members regain read-only Project history only after completion.
 Task history shows creator, current/final assignee, status/dates, comment/work-log authors, and deletion attribution. It does not claim previous-assignee or edit/status-event timelines that the schema does not store.
 Admin-only read-only History tabs cover Attendance Policy, Calendar, SMTP, and HolidayAPI. They show user-meaningful non-secret metadata and never expose tokens, ciphertext/nonces, passwords, API keys, master-key material, bootstrap state, or internal retry records.
 ## Persistence boundary
 No table, foreign key, DDL statement, or Mermaid entity changes. The existing 23 tables and 56 foreign keys already retain the required domain records. `GOV-009` remains authoritative: no generic audit/event-sourcing or Task-assignment-history table.
 ## Iteration ownership
 - `work/tasks`: pending-target assignment exclusion, atomic batch transfer, direct-removal transfer helper, unfinished count, and retained Task projection.
 - `work/projects`: exit readiness, Leader replacement order, approval guard/closure, direct-removal orchestration, and Project-history authorization.
 - `work/attendance`: policy/calendar retained-history queries.
 - `work/platform`: non-secret SMTP/HolidayAPI revision-history queries.
 - `work/reports-ui`: persistent warning, transfer drawer, Project History, and Admin-setting History tabs.
 ## Acceptance focus
 Tests must cover replacement-before-transfer, a newly joined eligible recipient, pending-target exclusion, repeatable batches, cancel/reject without rollback, zero-unfinished approval guard, direct-removal atomic transfer, completed-name retention, every history role boundary, and secret redaction.
@@ -0,0 +1,83 @@
 # Test Evidence: development-profile attendance policy time hydration
 - **Test type:** Integration
 - **Requirement IDs:** `ATT-002`, `ATT-003`, `I1-ATT-01`
 - **Scenario IDs:** `AC-ATT-001`
 - **Test class/method:** `com.lab.labtimesheet.feature.attendance.controller.CalendarDevelopmentProfileWebIntegrationTest#v1SeededPolicyLetsFormAuthenticatedAdminOpenCalendarInAsiaHoChiMinhDevelopmentProfile`
 - **Implementation commit:** pending
 ## Protected behavior
 The unmodified V1 attendance policy must hydrate its `time` schedule as the configured local wall-clock values when the development profile runs in `Asia/Ho_Chi_Minh`. A form-authenticated Admin can therefore open the calendar without weakening the policy rule that requires the checkout cutoff to be before local midnight.
 ## Test method
 The test starts the application with the real `dev` profile plus isolated test configuration, forces the JVM default zone to `Asia/Ho_Chi_Minh` before JPA starts, and uses PostgreSQL 18.4 Testcontainers with Flyway V1. It bootstraps an Admin through the form, logs in through the form, and requests `/attendance/calendar`, which resolves the current policy through `AttendanceApplicationService.currentBusinessDate`.
 ## Hand-derived expected result
 V1 explicitly stores `scheduled_start = 08:30`, `scheduled_end = 15:30`, and `checkout_grace_minutes = 30`. The checkout cutoff is therefore `16:00`, which is strictly before local midnight, so the calendar request returns HTTP 200.
 ## RED
 **Command**
 ```text
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw '-Dtest=CalendarDevelopmentProfileWebIntegrationTest' test
 ```
 **Observed result**
 ```text
 PostgreSQL 18.4 Testcontainers applied Flyway V1, then the form-authenticated GET /attendance/calendar failed.
 BUILD FAILURE: CalendarDevelopmentProfileWebIntegrationTest ... ServletException caused by
 IllegalArgumentException: checkout cutoff must be before local midnight
 at AttendancePolicy.java:58 via AttendancePolicyEntity.toDomain and AttendanceApplicationService.currentBusinessDate.
 ```
 ## GREEN
 **Command**
 ```text
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw '-Dtest=CalendarDevelopmentProfileWebIntegrationTest' test
 ```
 **Observed result**
 ```text
 PostgreSQL 18.4 Testcontainers applied Flyway V1.
 Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 ```
 ## Affected suite
 **Command and result**
 ```text
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw '-Dtest=CalendarAuthorizationWebIntegrationTest,CalendarDevelopmentProfileWebIntegrationTest,RoleDashboardWebIntegrationTest,AttendancePersistenceIntegrationTest,AttendancePolicyTest' test
 Tests run: 13, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw '-Dtest=*Attendance*Test,*Calendar*Test,Dashboard*Test,RoleDashboardWebIntegrationTest,AdminDashboardWebTest' test
 Tests run: 60, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 ```
 ## Java 26 smoke
 **Command and result**
 ```text
 env JAVA_HOME=/Users/sechmachine/Library/Java/JavaVirtualMachines/corretto-26.0.2/Contents/Home PATH=/Users/sechmachine/Library/Java/JavaVirtualMachines/corretto-26.0.2/Contents/Home/bin:/opt/homebrew/bin:/usr/bin:/bin ./mvnw clean compile -DskipTests
 Amazon Corretto 26.0.2 compiled 129 source files with release 25.
 BUILD SUCCESS
 ```
 ## External-test boundaries
 This integration test proves the fresh Flyway/JPA/real-login calendar path under the development profile and Vietnam JVM zone. It does not operate the already-running browser-gate application or exercise the Intern dashboard UI itself; both paths resolve the same policy timeline.
@@ -0,0 +1,106 @@
 # Test Evidence: Gitea Testcontainers and container workflow gates
 - **Test type:** Integration
 - **Requirement IDs:** `OPS-011`, `OPS-012`, `TST-001`, `TST-005`, `TST-009`
 - **Scenario IDs:** `AC-OPS-002`, `AC-OPS-004`
 - **Test class/method:** `src/test/js/delivery-contract.test.mjs`
 - **Implementation commit:** `d13443e338770dec0ca9822600f9a9d8405dfdbb`
 ## Protected behavior
 Gitea verification must reach Docker Desktop-published Testcontainers ports from
 inside its job container. Container builds may start only after an equivalent
 verification job succeeds, and the container workflow may run only by manual
 dispatch or by a push to `main`. Every third-party workflow action is pinned to
 the reviewed latest release commit rather than a moving tag.
 ## Test method
 The dependency-free delivery contract reads both workflow files and checks the
 Testcontainers host override, event filters, verify-to-build dependencies, and
 the complete allowlist of immutable action SHAs. The remote failure log supplies
 the production-shaped network reproduction because it ran inside the real Gitea
 Docker runner.
 ## Hand-derived expected result
 The runner already resolves `host.docker.internal` to its Docker host. Therefore
 Testcontainers must use that host instead of the job-network gateway
 `172.17.0.1`. Pull requests and non-main branch pushes must never schedule the
 container workflow. Manual dispatches build but do not publish, while main pushes
 publish only after verification succeeds.
 ## RED
 **Command**
 ```text
 env PATH=/opt/homebrew/opt/node@24/bin:/usr/bin:/bin \
  node --test src/test/js/delivery-contract.test.mjs
 tea actions runs logs 174 --repo sechmachine/labtimesheet \
  --login sechmachine-git
 ```
 **Observed result**
 ```text
 Delivery contract: 4 tests, 1 passed, 3 failed. The workflows lacked the
 Testcontainers host override, container event/dependency gates, and current
 action pins.
 Gitea run 174 found Docker at unix:///var/run/docker.sock but selected host
 172.17.0.1. Ryuk started, then repeated connections to 172.17.0.1:57499 were
 refused. Maven ended with 217 tests, 64 errors.
 ```
 ## GREEN
 **Command**
 ```text
 env PATH=/opt/homebrew/opt/node@24/bin:/usr/bin:/bin \
  node --test src/test/js/delivery-contract.test.mjs
 ```
 **Observed result**
 ```text
 Delivery contract: 4 tests, 4 passed.
 ```
 ## Affected suite
 **Command and result**
 ```text
 env PATH=/opt/homebrew/opt/node@24/bin:/usr/bin:/bin npm run test:ui
 Result: 5 tests passed.
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 \
  PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin \
  DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock \
  ./mvnw -B test
 Result: 205 tests passed across 44 suites; 0 failures, errors, or skips.
 npm ci && npm run build
 Result: Tailwind and Lucide assets built successfully; tracked assets remained unchanged.
 ./mvnw -B -DskipTests -Ddoclint=all javadoc:javadoc
 Result: BUILD SUCCESS with 83 existing missing-comment warnings and no production Java change.
 Ruby YAML parsing and git diff --check
 Result: both workflow files parsed and the diff check passed.
 Gitea Actions run 177 on `work/fix/platform/ci-testcontainers-actions`
 Result: Verify completed successfully in 8 minutes on the real Docker-mode runner.
 The non-main branch push scheduled `verify.yml` only; `container.yml` did not run.
 ```
 ## External-test boundaries
 The local contract cannot prove action-runner compatibility, registry credentials,
 or availability of the optional ARM runner. Those are checked by the actual Gitea
 branch verification and main container runs. Release freshness was checked against
 the official upstream release APIs on 2026-08-15; the immutable pins remain stable,
 but a later release requires an intentional reviewed update.
@@ -0,0 +1,63 @@
 # Test Evidence: Gitea container registry authentication
 - **Test type:** Integration
 - **Requirement IDs:** `OPS-012`, `OPS-016`, `OPS-017`
 - **Scenario IDs:** `AC-OPS-004`
 - **Test class/method:** `src/test/js/delivery-contract.test.mjs` — `container workflow runs only manually or on main and verifies before either image build`
 - **Implementation commit:** `4dd9f96a231316ce2c14755157a380a2123c2f0b`
 ## Protected behavior
 A push to `main` publishes `git.sechmachine.io.vn/sechmachine/labtimesheet` by authenticating the triggering Gitea account with the repository `REGISTRY_TOKEN`. Publication does not depend on separately configured image-name or username settings.
 ## Test method
 The dependency-free Node contract reads the committed workflow and checks its fixed registry/image coordinates, actor-based username, token secret, and absence of the obsolete `CONTAINER_IMAGE` and `REGISTRY_USERNAME` settings. Ruby's YAML parser separately checks workflow syntax.
 ## Hand-derived expected result
 The repository and package location are stable project facts. Therefore the workflow needs one credential only: a token belonging to the triggering actor with package read/write permission. Manual dispatch still builds without publishing; only a `main` push logs in and publishes.
 ## RED
 **Command**
 ```text
 env PATH=/opt/homebrew/opt/node@24/bin:/usr/bin:/bin node --test src/test/js/delivery-contract.test.mjs
 ```
 **Observed result**
 ```text
 4 tests ran: 3 passed, 1 failed. The container contract could not find the fixed registry/image or actor-based login. Real Gitea Container run 179 independently failed before registry login with "Repository variable CONTAINER_IMAGE is required", so REGISTRY_TOKEN was never used.
 ```
 ## GREEN
 **Command**
 ```text
 env PATH=/opt/homebrew/opt/node@24/bin:/usr/bin:/bin node --test src/test/js/delivery-contract.test.mjs
 ruby -e 'require "yaml"; YAML.safe_load(File.read(".gitea/workflows/container.yml"), aliases: true); puts "container workflow YAML: OK"'
 ```
 **Observed result**
 ```text
 Delivery contract: 4 tests, 4 passed. Container workflow YAML: OK.
 ```
 ## Affected suite
 **Command and result**
 ```text
 git diff --check
 ! rg -n 'CONTAINER_IMAGE|REGISTRY_USERNAME' .gitea/workflows/container.yml DEPLOYMENT.md
 Both checks passed. Application tests were deliberately not repeated because the change is limited to workflow metadata, its contract test, and deployment guidance; the container workflow retains its mandatory verify job before building.
 ```
 ## External-test boundaries
 Local checks do not authenticate to the private registry. The first `main` push containing this change is the production-shaped check of `REGISTRY_TOKEN`, package permissions, and registry publication.
@@ -3,36 +3,47 @@
 - **Test type:** Integration
 - **Requirement IDs:** `OPS-001`, `OPS-004`, `SEC-013`
 - **Scenario IDs:** `AC-OPS-001`, `AC-SEC-005`
- **Test class/method:** Shell configuration contract plus the full Spring Boot Maven suite
+- **Test class/method:** Shell configuration contract, an unsourced dev-profile startup probe, and the full Spring Boot Maven suite
- **Implementation commit:** `4212e9cbc2791e0c733929af62503df26097431e`
+- **Implementation commit:** `531c6078521341b156d69cb1013e54f65c092311`
 ## Protected behavior
-Development starts from environment-backed datasource, encryption, public-origin, server, proxy, and local Mailpit settings without committing a real `.env` or weakening application security controls.
+Development starts from datasource, encryption, public-origin, server, proxy,
 and local Mailpit values in the ignored root `.env` file without requiring an
 IDE-specific environment-variable copy, committing secrets, or weakening
 application security controls.
 ## Test method
-A shell contract verifies that the committed placeholder and development properties exist, the superseded YAML is absent, the real `.env` is ignored, every required environment key is represented, and every application placeholder resolves after loading the local file. The full Maven suite then exercises Spring configuration binding, Flyway, JPA validation, security, and PostgreSQL behavior.
+A shell contract verifies that the committed placeholder and development YAML
 exist, the superseded properties file is absent, the YAML explicitly imports
 the ignored root `.env`, and every required placeholder remains represented. A
 real dev-profile process is launched without sourcing `.env` to prove Spring
 loads it. The full Maven suite then exercises Spring configuration binding,
 Flyway, JPA validation, security, and PostgreSQL behavior.
 ## Hand-derived expected result
-The committed tree contains `.env.example` and `application-dev.properties`, never tracks `.env`, and exposes exactly the environment inputs needed by the current application. Loading the local file gives Spring a `dev` profile, PostgreSQL connection, 32-byte Base64 encryption key, public origin, local Mailpit endpoint, server port, and explicit no-forwarded-header policy.
+The committed tree contains `.env.example` and `application-dev.yaml`, never
 tracks `.env`, and exposes exactly the inputs needed by the current
 application. Starting the `dev` profile from the repository root, without
 exporting the file, gives Spring the PostgreSQL connection, 32-byte Base64
 encryption key, public origin, local Mailpit endpoint, server port, and explicit
 forwarded-header policy.
 ## RED
 **Command**
 ```text
-required_files=(.env.example src/main/resources/application-dev.properties); failed=0; for file in $required_files; do if [ ! -f "$file" ]; then echo "MISSING $file"; failed=1; fi; done; if [ -f src/main/resources/application-dev.yaml ]; then echo 'STALE src/main/resources/application-dev.yaml'; failed=1; fi; if ! grep -qx '/.env' .gitignore; then echo 'MISSING /.env ignore rule'; failed=1; fi; exit "$failed"
+/bin/zsh -lc 'config_check_failed=0; if test -e src/main/resources/application-dev.properties; then echo "STALE application-dev.properties"; config_check_failed=1; fi; if ! test -f src/main/resources/application-dev.yaml; then echo "MISSING application-dev.yaml"; config_check_failed=1; fi; if test -f src/main/resources/application-dev.yaml && ! grep -Fq "optional:file:\${LAB_DEV_ENV_FILE:.env}[.properties]" src/main/resources/application-dev.yaml; then echo "MISSING .env import"; config_check_failed=1; fi; exit "$config_check_failed"'
 ```
 **Observed result**
 ```text
-MISSING .env.example
+STALE application-dev.properties
-MISSING src/main/resources/application-dev.properties
+MISSING application-dev.yaml
 STALE src/main/resources/application-dev.yaml
 MISSING /.env ignore rule
 exit 1
 ```
@@ -41,15 +52,28 @@ exit 1
 **Command**
 ```text
-required_files=(.env.example src/main/resources/application-dev.properties); required_env=(SPRING_PROFILES_ACTIVE LAB_SERVER_PORT LAB_FORWARD_HEADERS_STRATEGY LAB_DB_URL LAB_DB_USERNAME LAB_DB_PASSWORD LAB_SMTP_HOST LAB_SMTP_PORT LAB_PUBLIC_ORIGIN LAB_SECURITY_MASTER_KEY); required_props=(server.port server.forward-headers-strategy spring.datasource.url spring.datasource.username spring.datasource.password spring.jpa.hibernate.ddl-auto spring.jpa.open-in-view spring.flyway.enabled spring.mail.host spring.mail.port lab.public-origin lab.security.master-key); failed=0; for file in $required_files; do if [ ! -f "$file" ]; then echo "MISSING $file"; failed=1; fi; done; if [ -f src/main/resources/application-dev.yaml ]; then echo 'STALE src/main/resources/application-dev.yaml'; failed=1; fi; if ! grep -qx '/.env' .gitignore; then echo 'MISSING /.env ignore rule'; failed=1; fi; for key in $required_env; do if ! grep -q "^${key}=" .env.example; then echo "MISSING example $key"; failed=1; fi; if ! grep -q "^${key}=" .env; then echo "MISSING local $key"; failed=1; fi; done; for property in $required_props; do if ! grep -q "^${property}=" src/main/resources/application-dev.properties; then echo "MISSING property $property"; failed=1; fi; done; set -a; source .env; set +a; decoded_bytes=$(printf '%s' "$LAB_SECURITY_MASTER_KEY" | base64 -d | wc -c | tr -d ' '); if [ "$decoded_bytes" != 32 ]; then echo "INVALID master key bytes=$decoded_bytes"; failed=1; fi; if ! git check-ignore -q .env; then echo 'LOCAL .env is not ignored'; failed=1; fi; if git ls-files --error-unmatch .env >/dev/null 2>&1; then echo 'LOCAL .env is tracked'; failed=1; fi; if [ "$failed" -eq 0 ]; then echo 'development configuration contract: PASS'; fi; exit "$failed"
+/bin/zsh -lc 'dev_contract_failed=0; dev_required_files=(.env.example src/main/resources/application-dev.yaml); dev_required_env=(SPRING_PROFILES_ACTIVE LAB_SERVER_PORT LAB_FORWARD_HEADERS_STRATEGY LAB_DB_URL LAB_DB_USERNAME LAB_DB_PASSWORD LAB_SMTP_HOST LAB_SMTP_PORT LAB_PUBLIC_ORIGIN LAB_SECURITY_MASTER_KEY); dev_required_placeholders=(LAB_SERVER_PORT LAB_FORWARD_HEADERS_STRATEGY LAB_DB_URL LAB_DB_USERNAME LAB_DB_PASSWORD LAB_SMTP_HOST LAB_SMTP_PORT LAB_PUBLIC_ORIGIN LAB_SECURITY_MASTER_KEY); for dev_file in $dev_required_files; do if ! test -f "$dev_file"; then echo "MISSING $dev_file"; dev_contract_failed=1; fi; done; if test -e src/main/resources/application-dev.properties; then echo "STALE application-dev.properties"; dev_contract_failed=1; fi; if ! grep -Fq "optional:file:\${LAB_DEV_ENV_FILE:.env}[.properties]" src/main/resources/application-dev.yaml; then echo "MISSING .env import"; dev_contract_failed=1; fi; if ! grep -qx "/.env" .gitignore; then echo "MISSING /.env ignore rule"; dev_contract_failed=1; fi; for dev_key in $dev_required_env; do if ! grep -q "^${dev_key}=" .env.example; then echo "MISSING example $dev_key"; dev_contract_failed=1; fi; if ! grep -q "^${dev_key}=" .env; then echo "MISSING local $dev_key"; dev_contract_failed=1; fi; done; for dev_key in $dev_required_placeholders; do dev_placeholder="\${${dev_key}}"; if ! grep -Fq "$dev_placeholder" src/main/resources/application-dev.yaml; then echo "MISSING YAML placeholder $dev_key"; dev_contract_failed=1; fi; done; set -a; source .env; set +a; dev_decoded_key_bytes=$(printf "%s" "$LAB_SECURITY_MASTER_KEY" | base64 -d | wc -c | tr -d " "); if test "$dev_decoded_key_bytes" != 32; then echo "INVALID master key bytes=$dev_decoded_key_bytes"; dev_contract_failed=1; fi; if ! git check-ignore -q .env; then echo "LOCAL .env is not ignored"; dev_contract_failed=1; fi; if git ls-files --error-unmatch .env >/dev/null 2>&1; then echo "LOCAL .env is tracked"; dev_contract_failed=1; fi; if test "$dev_contract_failed" -eq 0; then echo "development configuration contract: PASS"; fi; exit "$dev_contract_failed"'
 ```
 **Observed result**
 ```text
 development configuration contract: PASS
 ```
-A real Java 25 process loaded `.env` and `application-dev.properties`, connected to PostgreSQL 18.4, validated Flyway/JPA, and started on the environment-overridden port 18081. With temporary Mailpit on the configured SMTP port, `/actuator/health` returned HTTP 200 with `UP`, and `/login` returned HTTP 200. The process shut down and the temporary Mailpit container was removed.
+An additional Java 25 process was started with all `LAB_*` and
 `SPRING_PROFILES_ACTIVE` environment variables removed. It loaded the root
 `.env` through `application-dev.yaml`, connected to PostgreSQL 18.4, validated
 Flyway/JPA, and started successfully. The process was then stopped cleanly.
 ```text
 env -u SPRING_PROFILES_ACTIVE -u LAB_SERVER_PORT -u LAB_FORWARD_HEADERS_STRATEGY -u LAB_DB_URL -u LAB_DB_USERNAME -u LAB_DB_PASSWORD -u LAB_SMTP_HOST -u LAB_SMTP_PORT -u LAB_PUBLIC_ORIGIN -u LAB_SECURITY_MASTER_KEY -u LAB_DEV_ENV_FILE /bin/zsh -lc 'export JAVA_HOME=/opt/homebrew/opt/openjdk@25; export PATH="$JAVA_HOME/bin:$PATH"; ./mvnw -DskipTests spring-boot:run'
 No active profile set, falling back to 1 default profile: "dev"
 Database: jdbc:postgresql://localhost:55432/labtimesheet (PostgreSQL 18.4)
 Started LabtimesheetApplication in 4.068 seconds
 Graceful shutdown complete
 BUILD SUCCESS
 ```
 ## Affected suite
@@ -57,12 +81,14 @@ A real Java 25 process loaded `.env` and `application-dev.properties`, connected
 **Command and result**
 ```text
-env -u SPRING_PROFILES_ACTIVE -u LAB_SERVER_PORT -u LAB_FORWARD_HEADERS_STRATEGY -u LAB_DB_URL -u LAB_DB_USERNAME -u LAB_DB_PASSWORD -u LAB_SMTP_HOST -u LAB_SMTP_PORT -u LAB_PUBLIC_ORIGIN -u LAB_SECURITY_MASTER_KEY /bin/zsh -lc 'export JAVA_HOME=/opt/homebrew/opt/openjdk@25; export PATH=/opt/homebrew/opt/node@24/bin:$JAVA_HOME/bin:$PATH; export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock; ./mvnw test'
+env -u SPRING_PROFILES_ACTIVE -u LAB_SERVER_PORT -u LAB_FORWARD_HEADERS_STRATEGY -u LAB_DB_URL -u LAB_DB_USERNAME -u LAB_DB_PASSWORD -u LAB_SMTP_HOST -u LAB_SMTP_PORT -u LAB_PUBLIC_ORIGIN -u LAB_SECURITY_MASTER_KEY -u LAB_DEV_ENV_FILE /bin/zsh -lc 'export JAVA_HOME=/opt/homebrew/opt/openjdk@25; export PATH=/opt/homebrew/opt/node@24/bin:$JAVA_HOME/bin:$PATH; export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock; ./mvnw test'
-Tests run: 197, Failures: 0, Errors: 0, Skipped: 0
+Tests run: 201, Failures: 0, Errors: 0, Skipped: 0
-BUILD SUCCESS in 01:33 using PostgreSQL 18.4 Testcontainers. No development environment value was present.
+BUILD SUCCESS in 01:29 using PostgreSQL 18.4 Testcontainers.
 ```
 ## External-test boundaries
-The committed example cannot prove another developer's local credentials. Product SMTP and HolidayAPI revisions remain Admin-console configuration and are intentionally absent from `.env`.
+The committed example cannot prove another developer's local credentials or
 an IDE working directory. Product SMTP and HolidayAPI revisions remain
 Admin-console configuration and are intentionally absent from `.env`.
@@ -0,0 +1,161 @@
 # Test Evidence: Eligible Intern picker query
 - **Test type:** Integration
 - **Requirement IDs:** ACC-014, ACC-019–ACC-021, AUTH-001, PRJ-017, TST-001–TST-010
 - **Scenario IDs:** AC-ACC-009, AC-ACC-010, AC-PRJ-010 (selection-eligibility support)
 - **Test class/method:** com.lab.labtimesheet.feature.account.service.EligibleInternOptionIntegrationTest#listsOnlyActiveInternsWithActiveInclusiveInternshipsInPickerOrder; #rejectsMissingBusinessDate
 - **Implementation commit:** e70159a81b6445825f6d5f912ecf3c4aa3c1aa85
 ## Protected behavior
 Pending, locked, deactivated, non-Intern, not-started, completed, and date-expired records must not appear in the
 Account-owned Intern picker. An option is selectable only when both account and internship are ACTIVE and the
 explicit business date lies within the inclusive internship range. The returned numeric user ID is the internal
 submission identity, and options sort by display name then student code.
 The public query rejects a missing business date with the documented actionable message instead of issuing an
 ambiguous null-bound database query.
 ## Test method
 The PostgreSQL 18.4 integration test persists valid account/profile combinations through the account feature's JPA
 entities and repositories. It uses SQL only as a test fixture for future lock, deactivation, and completion states
 whose production transitions are outside this change. It calls the public Account service query and compares the
 complete immutable DTO sequence, including both inclusive date boundaries and unique user IDs.
 Its separate null-date regression calls the same public service method and asserts the exact
 <code>IllegalArgumentException</code> message documented by that method.
 ## Hand-derived expected result
 For business date 2026-08-14, profiles starting on that date and ending on that date remain eligible. The only
 expected options are Alpha / STU-100, Alpha / STU-200, and Zeta / STU-300, in that order. Every other seeded
 row fails at least one account role/state, internship state, or inclusive date condition.
 For a missing business date, the service must immediately throw
 <code>IllegalArgumentException("Business date is required")</code>.
 ## RED
 **Command**
 ~~~text
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
 export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
 ./mvnw -Dtest=EligibleInternOptionIntegrationTest test
 ~~~
 **Observed result**
 ~~~text
 [ERROR] EligibleInternOptionIntegrationTest.java:[11,54] cannot find symbol
  symbol:   class EligibleInternOption
  location: package com.lab.labtimesheet.feature.account.model.dto
 BUILD FAILURE
 ~~~
 ## GREEN
 **Command**
 ~~~text
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
 export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
 ./mvnw -Dtest=EligibleInternOptionIntegrationTest test
 ~~~
 **Observed result**
 ~~~text
 PostgreSQL 18.4 Testcontainers started and Flyway applied V1 baseline.
 Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 ~~~
 ## Review follow-up: missing business date
 The public guard was temporarily removed solely to prove the new regression fails for the intended reason, then
 restored exactly before the GREEN checks. The follow-up commit contains only the regression test and evidence.
 ### RED
 **Command**
 ~~~text
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
 export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
 ./mvnw '-Dtest=EligibleInternOptionIntegrationTest#rejectsMissingBusinessDate' test
 ~~~
 **Observed result**
 ~~~text
 Tests run: 1, Failures: 1, Errors: 0, Skipped: 0
 java.lang.AssertionError: Expecting code to raise a throwable.
 BUILD FAILURE
 ~~~
 ### GREEN
 **Command**
 ~~~text
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
 export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
 ./mvnw '-Dtest=EligibleInternOptionIntegrationTest#rejectsMissingBusinessDate' test
 ~~~
 **Observed result**
 ~~~text
 PostgreSQL 18.4 Testcontainers started and Flyway applied V1 baseline.
 Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 ~~~
 ## Affected suite
 **Command and result**
 ~~~text
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
 export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
 ./mvnw -Dtest=EligibleInternOptionIntegrationTest,AccountActivationIntegrationTest,BootstrapIntegrationTest,AccountWebIntegrationTest,AuthenticationWebIntegrationTest,BootstrapOnboardingWebIntegrationTest test
 Selected account reports: 13 tests, 0 failures, 0 errors, 0 skipped.
 ./mvnw -Dtest=AccountActivationIntegrationTest test
 Tests run: 2, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 ./mvnw -Dtest=LayerStructureTest test
 Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 ./mvnw test
 Tests run: 105, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 ~~~
 ### Review follow-up affected account-service checks
 ~~~text
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
 export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
 ./mvnw '-Dtest=EligibleInternOptionIntegrationTest,AccountActivationIntegrationTest,BootstrapIntegrationTest' test
 EligibleInternOptionIntegrationTest: 2 tests, 0 failures, 0 errors, 0 skipped
 BootstrapIntegrationTest: 4 tests, 0 failures, 0 errors, 0 skipped
 AccountActivationIntegrationTest: 2 tests, 0 failures, 0 errors, 0 skipped
 Selected account-service reports: 8 tests, 0 failures, 0 errors, 0 skipped.
 BUILD SUCCESS
 ~~~
 ## External-test boundaries
 This query does not authorize Project membership itself; the consuming Project transaction must still recheck
 membership and ownership invariants. It does not test the later lifecycle mutation workflows that produce locked,
 deactivated, or completed rows.
@@ -0,0 +1,107 @@
 # Test Evidence: Production delivery baseline
 - **Test type:** Integration
 - **Requirement IDs:** `OPS-005`–`OPS-013`, `OPS-017`, `TST-001`, `TST-005`, `TST-009`
 - **Scenario IDs:** `AC-OPS-002`, `AC-OPS-003`, `AC-OPS-004`
 - **Test class/method:** `com.lab.labtimesheet.feature.account.service.BootstrapIntegrationTest.rootGuidesFreshInstallToBootstrapWhileOtherRoutesRemainHidden`, `src/test/js/delivery-contract.test.mjs`
 - **Implementation commit:** `cea4378f5699de4919c283b12371941d6742ca4b`
 ## Protected behavior
 The production image runs as a non-root Java 25 process, exposes health probes, and accepts the same environment-backed datasource configuration with either the optional PostgreSQL 18.4 Compose sidecar or an external database. Gitea verifies every pull request and push, publishes immutable SHA plus `main` image tags only from `main`, and skips native ARM64 work unless the matching runner is explicitly available.
 ## Test method
 The existing PostgreSQL-backed bootstrap integration test requests the liveness and readiness endpoints before initialization. A dependency-free Node contract checks the deployment files for the required runtime, Compose, trigger, permission, publication, and optional-runner boundaries. Docker and Compose validation then exercise the real build and both database topologies.
 ## Hand-derived expected result
 An absent ARM runner must skip the ARM job without blocking AMD64 publication. Enabling the runner creates an ARM64 architecture tag and a combined manifest, while the canonical SHA and `main` tags remain valid AMD64 images when ARM is disabled. Compose must preserve PostgreSQL data in a named volume and must not require the bundled database when an external JDBC URL is supplied.
 ## RED
 **Command**
 ```text
 env PATH=/opt/homebrew/opt/node@24/bin:/usr/bin:/bin node --test src/test/js/delivery-contract.test.mjs
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 \
  PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin \
  DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock \
  ./mvnw '-Dtest=BootstrapIntegrationTest#rootGuidesFreshInstallToBootstrapWhileOtherRoutesRemainHidden' test
 ```
 **Observed result**
 ```text
 The delivery contract ran 3 tests and failed all 3 because Dockerfile,
 .gitea/workflows/verify.yml, and .gitea/workflows/container.yml did not exist.
 The PostgreSQL-backed bootstrap test ran 1 test and failed because
 /actuator/health/liveness returned 404 instead of 200.
 ```
 ## GREEN
 **Command**
 ```text
 env PATH=/opt/homebrew/opt/node@24/bin:/usr/bin:/bin node --test src/test/js/delivery-contract.test.mjs
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 \
  PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin \
  DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock \
  ./mvnw '-Dtest=BootstrapIntegrationTest#rootGuidesFreshInstallToBootstrapWhileOtherRoutesRemainHidden' test
 ```
 **Observed result**
 ```text
 Delivery contract: 3 tests, 3 passed.
 Bootstrap health regression: 1 test, 1 passed against PostgreSQL 18.4.
 ```
 ## Affected suite
 **Command and result**
 ```text
 npm ci
 npm run test:ui
 npm run build
 git diff --exit-code -- src/main/resources/static/assets/app.css src/main/resources/static/assets/icons.svg
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 \
  PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin \
  DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock \
  ./mvnw test
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 \
  PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin \
  ./mvnw -DskipTests -Ddoclint=all javadoc:javadoc
 docker build --check .
 docker build --platform linux/amd64 --build-arg VCS_REF=validation -t labtimesheet:ci-amd64 .
 docker build --platform linux/arm64 --build-arg VCS_REF=validation -t labtimesheet:ci-arm64 .
 docker compose --env-file .env.compose.example config
 docker compose --env-file .env.compose.example --profile bundled-db config
 Frontend tests: 4 passed; generated assets remained byte-clean.
 Maven: 217 tests across 49 suites, 0 failures, 0 errors, 0 skipped.
 Javadoc: BUILD SUCCESS; 83 pre-existing repository-wide warnings.
 Dockerfile check: passed without warnings. Both Linux architecture images built
 and reported the requested platform, UID/GID 10001, and readiness HEALTHCHECK.
 Both Compose configurations parsed successfully.
 Real smoke tests used the AMD64 image with disposable resources. Bundled mode
 started PostgreSQL 18.4 with the named volume and returned UP from liveness and
 readiness on 127.0.0.1:28080. External mode used a separately started
 PostgreSQL 18.4 service and returned UP from readiness on 127.0.0.1:28081.
 All disposable containers, networks, and the bundled test volume were removed.
 git diff --check: passed.
 ```
 ## External-test boundaries
 Local validation cannot prove that the private Gitea registry credentials are configured or that an `ubuntu-latest-arm` runner is online. Repository variable `ARM64_RUNNER_AVAILABLE` is the scheduler-safe availability signal because an unavailable runner label cannot be discovered from inside a job that has not yet been scheduled.
@@ -0,0 +1,45 @@
 # Integration Test Evidence
 ## Requirement and scenario IDs
 - AUTH-001, AUTH-002, AUTH-011; PRJ-003, PRJ-004, PRJ-017; ERR-001, ERR-003; TST-001 through TST-010.
 - AC-AUTH-001, AC-AUTH-010, AC-PRJ-001, AC-TST-001.
 ## Behavior under test
 The owning Mentor adds several eligible nonmembers under one Project lock and transaction. Null, empty, duplicate, current-member, invalid, or stale/noneligible selections reject the whole batch; no valid prefix becomes a membership.
 ## Expected result derivation
 The fixture begins with one Leader. A successful two-Intern batch must yield three current memberships. Every rejected batch leaves the eligible and stale candidate membership count at zero.
 ## RED
 `env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH ./mvnw '-Dtest=ProjectControllerTest,ProjectServiceIntegrationTest' test` failed during test compilation with eight `cannot find symbol` errors for the requested `ProjectService.addMembers(long,long,List<Long>)` API. Production compiled first; the failure was the missing behavior boundary rather than the environment or fixture.
 ## GREEN
 The focused PostgreSQL command was:
 `env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw '-Dtest=ProjectServiceIntegrationTest#ownerAddsSeveralEligibleMembersInOneLockedTransaction+memberBatchRejectsMissingDuplicateCurrentAndStaleSelectionsWithoutPartialMutation' test`
 Result: 2 tests, 0 failures, 0 errors, 0 skipped against PostgreSQL 18.4. The
 successful case added two memberships; the rejection case covered null, empty, duplicate,
 invalid, current-member, and one-valid-plus-one-stale selections without partial persistence.
 ## Affected suite
 `env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw '-Dtest=ProjectServiceIntegrationTest' test`
 passed 9/9 tests with no failures, errors, or skips.
 The complete Project plus layer-architecture command was:
 `env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw '-Dtest=ProjectControllerTest,ProjectEntityTest,ProjectPersistenceStructureTest,ProjectServiceIntegrationTest,ProjectTaskMutationContextTest,LayerStructureTest' test`
 Result: 38 tests, 0 failures, 0 errors, 0 skipped.
 ## External boundaries
 PostgreSQL 18.4 Testcontainers provides the real schema, constraints, JPA transaction, and Project pessimistic lock path. The test does not exercise concurrent requests; existing Project locking coverage remains unchanged.
 After merging exact reviewed `main` `32c8a2d315d2175760c5d4792988cd0aa5ab6dd0`, the affected command was rerun with `UiContractWebTest` included. It passed 45/45 tests with no failures, errors, or skips; the Project service portion remained 9/9 against PostgreSQL 18.4.
@@ -0,0 +1,82 @@
 # Test Evidence: Windows legacy Vietnam timezone startup
 - **Test type:** Integration
 - **Requirement IDs:** `ARC-001`, `ARC-003`, `GOV-011`, `ATT-002`, `TST-001`, `TST-005`
 - **Scenario IDs:** `N/A — user-reported cross-platform startup defect`
 - **Test class/method:** `com.lab.labtimesheet.ApplicationTimeZoneIntegrationTest.mainCanonicalizesLegacyAliasBeforeStartingSpring`, `com.lab.labtimesheet.ApplicationTimeZoneIntegrationTest.canonicalizesLegacyVietnamAliasBeforePostgresConnects`, `com.lab.labtimesheet.ApplicationTimeZoneIntegrationTest.leavesSupportedSystemTimeZoneUnchanged`
 - **Implementation commit:** `a9fb9487692e84f5a7e7923570cbded58c362a2f`
 ## Protected behavior
 The executable entry point replaces the legacy Windows JVM timezone ID `Asia/Saigon` with the canonical business timezone ID `Asia/Ho_Chi_Minh` before pgJDBC opens a PostgreSQL connection. Other supported operating-system timezone IDs remain unchanged.
 ## Test method
 The entry-point test replaces Spring startup with Mockito's existing static test seam, invokes the real `main` method with a legacy JVM default, and checks that normalization happens before Spring starts. The PostgreSQL test starts a real PostgreSQL 18.4 Testcontainer, proves pgJDBC 42.7.11 is rejected while the JVM default is `Asia/Saigon`, invokes the same startup normalization, and then opens a valid JDBC connection. A negative test verifies that an unrelated supported timezone is not overwritten.
 ## Hand-derived expected result
 PostgreSQL does not accept `Asia/Saigon` as a startup `TimeZone`, while the approved business timezone is `Asia/Ho_Chi_Minh`. Therefore only the legacy alias is replaced, the following connection succeeds, and a supported non-Vietnam timezone remains unchanged.
 ## RED
 **Command**
 ```text
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw -Dtest=ApplicationTimeZoneIntegrationTest test
 ```
 **Observed result**
 ```text
 BUILD FAILURE during test compilation.
 ApplicationTimeZoneIntegrationTest.java: cannot find symbol normalizeDefaultTimeZone()
 ```
 The failing test established that the application had no pre-Spring normalization boundary.
 A second mutation check temporarily removed the new call from `main` and ran:
 ```text
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin ./mvnw '-Dtest=ApplicationTimeZoneIntegrationTest#mainCanonicalizesLegacyAliasBeforeStartingSpring' test
 ```
 It failed `1/1` with `expected: "Asia/Ho_Chi_Minh" but was: "Asia/Saigon"`, proving the test protects the entry-point ordering rather than only the helper.
 ## GREEN
 **Command**
 ```text
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw -Dtest=ApplicationTimeZoneIntegrationTest test
 ```
 **Observed result**
 ```text
 Tests run: 3, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 ```
 ## Affected suite
 **Command and result**
 ```text
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw '-Dtest=ApplicationTimeZoneIntegrationTest,LabtimesheetApplicationTests,PlatformFoundationTest,TimeConfigurationTest,CalendarDevelopmentProfileWebIntegrationTest' test
 Tests run: 8, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw test
 Tests run: 217, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/bin:/usr/bin:/bin ./mvnw -DskipTests -Ddoclint=all javadoc:javadoc
 BUILD SUCCESS
 ```
 A local Java 25 process was also started with `-Duser.timezone=Asia/Saigon` against a disposable PostgreSQL 18.4 database on port `55439`. Hikari connected, Flyway migrated the fresh database, Tomcat started on port `18080`, and Spring reported `Started LabtimesheetApplication`. The process shut down cleanly and the disposable database container was removed.
 ## External-test boundaries
 The regression executes the installed pgJDBC version against PostgreSQL 18.4 and reproduces the exact rejected timezone value from the Windows report. It does not run the Windows JVM itself; the supplied Windows log is the evidence that its OS/JDK mapping produced `Asia/Saigon`.
@@ -0,0 +1,210 @@
 # Test Evidence: durable fix-branch documentation workflow
 - **Test type:** Unit (documentation contract)
 - **Requirement IDs:** `OPS-019`, `TST-009`, `TST-010`
 - **Scenario IDs:** `AC-TST-001`
 - **Test class/method:** `scripts/verify-fix-branch-workflow.cjs --self-test`
 - **Implementation commit:** `f013ad7707b36959ddca891fe0d52f81bba3ee80`
 - **Round-1 review-fix commits:** `d617769499362e92d058684501af3c1ae6b145b0`, `719e02ea902bfb2dbeddc04f12be3617be3427b5`
 - **Round-2 all-guide regression commit:** `97e991317d55db4f7414678a89a45921802a14b8`
 - **Round-2 coordination-authority commit:** `9802d5d17f5c07511e1f9cf59ace4b7e48fcdc0e`
 - **Round-2 plan-contract commit:** `f98e7f39ef38c7882106ffb250155d2a72dcf0dd`
 - **Round-3 complete-workflow commit:** `445e4fedeb0e06724b876c5731437d2c355cacb2`
 ## Protected behavior
 Targeted repairs use the realizable `work/fix/<feature>/<what-fix>` branch and
 clean worktree from taskmaster-verified `main`. Contributor guidance must reject
 the impossible `work/<feature>/fix/<what-fix>` form while persistent
 `work/<feature>` refs exist. The tracked copies of root coordination authority
 must use the same rule. Every targeted-fix guide must also require the complete
 lifecycle: latest `main`, TDD RED → GREEN, Javadoc during implementation,
 companion evidence, independent review, and an authorized normal, non-force
 merge.
 ## Test method
 Use the tracked Node validator rather than an artificial Java test. It requires
 the exact approved branch statement and complete targeted-repair lifecycle in
 each of the six guides. Its self-test independently removes each of the six
 lifecycle elements from every guide and asserts the file-specific rejection. It
 also retains a fresh positive nested-branch mutation for every guide. The copied
 root coordination files are compared byte-for-byte with their main-root sources
 and checked for their exact approved rules. The original RED proves the
 required branch name was absent from the four contributor guides; the first
 review-fix RED proves the executable regression was absent.
 ## Hand-derived expected result
 The required fix-branch spelling appears exactly once in each of the six tracked
 documentation artifacts, and the only nested-form reference is inside that
 artifact's exact approved statement. Each independent simulated positive
 nested-branch recommendation must fail. The three tracked coordination files
 must exactly match the authorized main-root versions. Loss of any lifecycle
 element from any guide must fail. The existing SRS generator must still report
 260 requirements and 14 use cases.
 ## RED
 **Command**
 ```text
 rg -n -F 'work/fix/<feature>/<what-fix>' AGENTS.md README.md DEVELOPMENT.md TESTING.md
 ```
 **Observed result**
 ```text
 exit 1; no matching lines
 ```
 The failure was expected: the required realizable repair-branch rule was absent
 before this documentation change.
 ### Review-fix RED
 **Command**
 ```text
 node scripts/verify-fix-branch-workflow.cjs --self-test
 ```
 **Observed result**
 ```text
 exit 1
 Error: Cannot find module '.../scripts/verify-fix-branch-workflow.cjs'
 ```
 The executable regression required to reject a positive nested-branch
 recommendation did not exist.
 ### Round-2 RED
 **Command**
 ```text
 node scripts/verify-fix-branch-workflow.cjs --self-test | rg -x 'Positive nested branch recommendations: 6/6 rejected'
 ```
 **Observed result**
 ```text
 exit 1; no matching line
 ```
 The prior self-test reported only a singular rejection and mutated only
 `AGENTS.md`; it did not prove an independent rejection for each of the six
 guides.
 ### Round-3 RED
 **Command**
 ```text
 node --check scripts/verify-fix-branch-workflow.cjs
 node scripts/verify-fix-branch-workflow.cjs --self-test
 ```
 **Observed result**
 ```text
 exit 1
 Error: AGENTS.md must contain the complete required targeted-repair workflow exactly once
 README.md must contain the complete required targeted-repair workflow exactly once
 DEVELOPMENT.md must contain the complete required targeted-repair workflow exactly once
 TESTING.md must contain the complete required targeted-repair workflow exactly once
 docs/superpowers/specs/2026-08-15-access-navigation-icon-intern-picker-design.md must contain the complete required targeted-repair workflow exactly once
 docs/superpowers/plans/2026-08-15-access-navigation-icon-intern-picker.md must contain the complete required targeted-repair workflow exactly once
 ```
 The six guides had branch naming but not the complete lifecycle contract.
 ## Initial GREEN
 **Command**
 ```text
 node scripts/verify-fix-branch-workflow.cjs --self-test
 ```
 **Observed result**
 ```text
 Fix-branch workflow documentation: 6 approved statements validated
 Positive nested branch recommendation: rejected
 ```
 ### Round-2 GREEN
 **Command**
 ```text
 node --check scripts/verify-fix-branch-workflow.cjs
 node scripts/verify-fix-branch-workflow.cjs --self-test
 ```
 **Observed result**
 ```text
 Fix-branch workflow documentation: 6 approved statements validated
 Positive nested branch recommendations: 6/6 rejected
 ```
 ### Round-3 GREEN
 **Command**
 ```text
 node --check scripts/verify-fix-branch-workflow.cjs
 node scripts/verify-fix-branch-workflow.cjs --self-test
 ```
 **Observed result**
 ```text
 Fix-branch workflow documentation: 6 approved statements validated
 Targeted-repair workflow element removals: 36/36 rejected
 Positive nested branch recommendations: 6/6 rejected
 ```
 ## Affected suite
 **Command and result**
 ```text
 node labtimesheet-docs-hub/ui-mockups/build-srs.cjs
 node -e 'const fs=require("node:fs"); const checks=[["authoritative","labtimesheet-docs-hub/requirements-specification.md",/^\| ([A-Z]{2,4}-\d{3}) \|/gm],["explained","labtimesheet-docs-hub/explained/requirements-specification.md",/^\| ([A-Z]{2,4}-\d{3}) \|/gm],["simple","labtimesheet-docs-hub/explained/requirements-specification-simple.md",/^- \*\*([A-Z]{2,4}-\d{3}):\*\*/gm],["generated SRS","labtimesheet-docs-hub/software-requirements-specification.md",/^\| ([A-Z]{2,4}-\d{3}) \|/gm]]; for (const [name,file,pattern] of checks) { const ids=[...fs.readFileSync(file,"utf8").matchAll(pattern)].map(match=>match[1]); if (ids.length !== 260 || new Set(ids).size !== 260) throw new Error(`${name}: ${ids.length} rows, ${new Set(ids).size} unique`); console.log(`${name}: ${ids.length} rows, ${new Set(ids).size} unique IDs`); } const srs=fs.readFileSync("labtimesheet-docs-hub/software-requirements-specification.md","utf8"); const useCases=(srs.match(/^### 5\.\d+ UC-\d{2} —/gm)||[]).length; if (useCases !== 14) throw new Error(`SRS use cases: ${useCases}`); console.log(`generated SRS: ${useCases} use cases`);'
 node -e 'const fs=require("node:fs"); const path=require("node:path"); let checked=0; const broken=[]; for (const file of process.argv.slice(1)) { const text=fs.readFileSync(file,"utf8"); for (const match of text.matchAll(/!?\[[^\]]*\]\(([^)]+)\)/g)) { const target=match[1].trim().replace(/^<|>$/g,"").split("#")[0].split("?")[0]; if (!target || /^[a-z][a-z0-9+.-]*:/i.test(target) || target.startsWith("//")) continue; checked += 1; if (!fs.existsSync(path.resolve(path.dirname(file), decodeURIComponent(target)))) broken.push(`${file}: ${target}`); } } if (broken.length) throw new Error(`Broken local Markdown links:\n${broken.join("\n")}`); console.log(`Local Markdown links: ${checked} resolved`);' AGENTS.md README.md DEVELOPMENT.md TESTING.md docs/superpowers/specs/2026-08-15-access-navigation-icon-intern-picker-design.md docs/superpowers/plans/2026-08-15-access-navigation-icon-intern-picker.md docs/tests/unit/fix-branch-workflow-documentation.md
 cmp -s .agents/PROJECT_PLAN.md /Users/sechmachine/Documents/WebProjects/labtimesheet/.agents/PROJECT_PLAN.md && cmp -s .agents/skills/orchestrate-labtimesheet-iteration/SKILL.md /Users/sechmachine/Documents/WebProjects/labtimesheet/.agents/skills/orchestrate-labtimesheet-iteration/SKILL.md && cmp -s PRODUCT.md /Users/sechmachine/Documents/WebProjects/labtimesheet/PRODUCT.md && node -e 'const fs=require("node:fs"); const files=[".agents/PROJECT_PLAN.md",".agents/skills/orchestrate-labtimesheet-iteration/SKILL.md","PRODUCT.md"]; const forms=["work/fix/<feature>/<what-fix>","work/<feature>/fix/<what-fix>"]; for (const file of files) { const text=fs.readFileSync(file,"utf8"); for (const form of forms) { if (text.split(form).length !== 2) throw new Error(file+": expected one "+form); } } console.log("Root coordination authority: "+files.length+" approved branch rules match exactly");'
 git diff --check 8be1b754e188367b260981718a5d33fc2d4d8a3b 445e4fedeb0e06724b876c5731437d2c355cacb2
 ```
 The SRS regeneration and count assertion ran from the main root because the
 ignored requirements hub is local authority there. The root-authority
 comparisons, link assertion, and exact base-to-candidate `git diff --check`
 ran from this fix worktree; the SRS generator also rejects a broken local SRS
 target before it writes the generated file.
 ```text
 Wrote labtimesheet-docs-hub/software-requirements-specification.md
 Requirements: 260; use cases: 14; screens: 48; mockup embeds: 48
 authoritative: 260 rows, 260 unique IDs
 explained: 260 rows, 260 unique IDs
 simple: 260 rows, 260 unique IDs
 generated SRS: 260 rows, 260 unique IDs
 generated SRS: 14 use cases
 Fix-branch workflow documentation: 6 approved statements validated
 Targeted-repair workflow element removals: 36/36 rejected
 Positive nested branch recommendations: 6/6 rejected
 Root coordination authority: 3 approved branch rules match exactly
 Local Markdown links: 7 resolved
 git diff --check 8be1b754e188367b260981718a5d33fc2d4d8a3b 445e4fedeb0e06724b876c5731437d2c355cacb2: exit 0
 ```
 ## External-test boundaries
 This documentation contract does not create or manipulate Git branches, start
 the application, or replace branch-owner review. It validates the durable rule
 and SRS traceability only; a taskmaster still authorizes branch creation,
 integration, and any push.
@@ -0,0 +1,91 @@
 # Test Evidence: form-authenticated global calendar access
 - **Test type:** Web
 - **Requirement IDs:** `AUTH-002`, `CAL-001`, `SEC-001`, `SEC-013`
 - **Scenario IDs:** `AC-SEC-005`
 - **Test class/method:** `com.lab.labtimesheet.feature.attendance.controller.CalendarAuthorizationWebIntegrationTest#formAuthenticatedAdminCanOpenCalendarWhileMentorAndInternAreDenied`
 - **Implementation commit:** `c8d4e9eecc59c78941769487af30953fb31a83c5`
 ## Incident scope
 This record covers only the reported HTTP 403 for a fresh Admin session on
 `GET /attendance/calendar`. The separately supplied 500 about policy
 materialization is not a calendar-session or identity-mapping claim. It is
 cross-referenced to
 `.superpowers/sdd/access-navigation-icon-intern-picker/task-4-intern-dashboard-report.md`,
 which independently records valid current PostgreSQL policy/constraint state
 and no reproduction of that 500.
 ## Protected behavior
 The persisted first Admin can open global calendar management after a real CSRF-protected form login. Persisted Mentor and Intern accounts, each authenticated by the same form-login path, receive HTTP 403 for that route.
 ## Test method
 The test posts the actual bootstrap form, logs in through Spring Security, and follows the resulting session to `/attendance/calendar`. It configures a test-only SMTP probe solely to activate Mentor and Intern accounts through the public AccountService, then logs in those accounts before asserting denial. Spring Boot applies Flyway to PostgreSQL 18.4 through the shared Testcontainers configuration.
 ## Hand-derived expected result
 The bootstrap entity always has immutable `ADMIN` role, so its fresh authenticated session must receive HTTP 200 from the Admin-only calendar route. Immutable `MENTOR` and `INTERN` roles are not permitted by `CAL-001`, so their matching fresh authenticated sessions must receive HTTP 403. No calendar mutation is attempted.
 ## RED
 **Command**
 ```text
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
 export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
 ./mvnw '-Dtest=CalendarAuthorizationWebIntegrationTest#formAuthenticatedAdminCanOpenCalendarWhileMentorAndInternAreDenied' test
 ```
 **Observed result**
 ```text
 No valid RED occurred. On exact base 8be1b754e188367b260981718a5d33fc2d4d8a3b,
 the new incident reproducer passed immediately: Tests run: 1, Failures: 0,
 Errors: 0, Skipped: 0; BUILD SUCCESS. The production authorization guard was
 not temporarily weakened merely to manufacture a failing result.
 ```
 ## GREEN
 **Command**
 ```text
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
 export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
 ./mvnw '-Dtest=CalendarAuthorizationWebIntegrationTest#formAuthenticatedAdminCanOpenCalendarWhileMentorAndInternAreDenied' test
 ```
 **Observed result**
 ```text
 No production correction was warranted. The strengthened regression, including
 form-login authority assertions, passed: Tests run: 1, Failures: 0, Errors: 0,
 Skipped: 0; BUILD SUCCESS. It observed Admin HTTP 200 and Mentor/Intern HTTP
 403 after distinct persisted-account logins.
 ```
 ## Affected suite
 **Command and result**
 ```text
 export JAVA_HOME=/opt/homebrew/opt/openjdk@25
 export PATH="$JAVA_HOME/bin:$PATH"
 export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
 ./mvnw -Dtest=CalendarAuthorizationWebIntegrationTest,AttendanceControllerTest,AttendanceTemplateIntegrationTest,AuthenticationWebIntegrationTest,SecurityResponseIntegrationTest,RoleDashboardWebIntegrationTest test
 Tests run: 16, Failures: 0, Errors: 0, Skipped: 0; BUILD SUCCESS.
 Full backend suite:
 ./mvnw -q test
 Result: exit code 0 with Java 25.0.4 and PostgreSQL 18.4 Testcontainers.
 ```
 ## External-test boundaries
 This web test uses real Spring MVC, form authentication, account identity mapping, Flyway, and PostgreSQL 18.4. It substitutes only SMTP transport with an in-memory probe, does not exercise calendar mutations or a real browser, and does not establish production deployment configuration.
@@ -0,0 +1,70 @@
 # Test Evidence: dark icon sprite presentation
 - **Test type:** Web
 - **Requirement IDs:** `UI-006`, `UI-009`, `UI-010`, `UI-018`
 - **Scenario IDs:** `AC-UI-003`, `AC-UI-005`
 - **Test class/method:** `com.lab.labtimesheet.ui.UiContractWebTest#generatedLucideSymbolsRetainCurrentColorStrokePresentation`
 - **Implementation commit:** `pending`
 ## Protected behavior
 Every local Lucide sprite symbol retains the source presentation attributes so icons referenced with `<use>` inherit `currentColor` rather than rendering with the SVG default black fill on dark surfaces.
 ## Test method
 The focused web contract reads the generated classpath sprite, scans every emitted `<symbol>`, and checks the five presentation attributes on each symbol. It checks the deployable generated artifact rather than generator source text.
 ## Hand-derived expected result
 Lucide 1.27.0 line icons use `fill="none"`, `stroke="currentColor"`, `stroke-width="2"`, `stroke-linecap="round"`, and `stroke-linejoin="round"` on their SVG root. Each selected generated symbol must preserve those values.
 ## RED
 **Command**
 ```text
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH ./mvnw '-Dtest=UiContractWebTest#generatedLucideSymbolsRetainCurrentColorStrokePresentation' test
 ```
 **Observed result**
 ```text
 UiContractWebTest.generatedLucideSymbolsRetainCurrentColorStrokePresentation
 Missing fill on  id="bell" viewBox="0 0 24 24" ==> expected: <true> but was: <false>
 Tests run: 1, Failures: 1, Errors: 0, Skipped: 0
 BUILD FAILURE
 ```
 ## GREEN
 **Command**
 ```text
 env PATH=/opt/homebrew/opt/node@24/bin:$PATH npm ci
 env PATH=/opt/homebrew/opt/node@24/bin:$PATH npm run build
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH ./mvnw '-Dtest=UiContractWebTest#generatedLucideSymbolsRetainCurrentColorStrokePresentation' test
 ```
 **Observed result**
 ```text
 Node v24.19.0 and npm 11.17.0 installed the locked dependencies.
 Tailwind CSS v4.3.3 rebuilt app.css and build-icons regenerated icons.svg.
 Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 ```
 ## Affected suite
 **Command and result**
 ```text
 env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH ./mvnw '-Dtest=UiContractWebTest' test
 Tests run: 7, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 ```
 ## External-test boundaries
 The deterministic asset contract proves the generated sprite carries theme-aware Lucide presentation attributes. It does not replace the taskmaster-owned integrated browser/detector pass for rendered layout and interactive states.
@@ -0,0 +1,81 @@
 # Test Evidence: Fresh-install root navigation
 - **Test type:** Web
 - **Requirement IDs:** `ACC-001`
 - **Scenario IDs:** `N/A — user-reported fresh-install navigation regression`
 - **Test class/method:** `com.lab.labtimesheet.feature.account.service.BootstrapIntegrationTest.rootGuidesFreshInstallToBootstrapWhileOtherRoutesRemainHidden`
 - **Implementation commit:** `531c6078521341b156d69cb1013e54f65c092311`
 ## Protected behavior
 Before the first Admin exists, opening `/` redirects to the public one-time
 bootstrap workflow instead of rendering a Whitelabel 404 page. Other protected
 application routes remain concealed with HTTP 404 until bootstrap completes.
 ## Test method
 The production Spring Security and bootstrap filter chain runs against a fresh
 PostgreSQL 18.4 Testcontainer. MockMvc requests `/bootstrap`, health, `/`, and
 `/dashboard`, then verifies that only the root receives the new navigation
 redirect while the protected dashboard remains hidden.
 ## Hand-derived expected result
 On an uninitialized installation, GET `/` returns a 3xx response with Location
 `/bootstrap`. GET `/dashboard` still returns 404. The bootstrap form and health
 endpoint remain available.
 ## RED
 **Command**
 ```text
 export JAVA_HOME=/Users/sechmachine/Library/Java/JavaVirtualMachines/corretto-26.0.2/Contents/Home
 export PATH="$JAVA_HOME/bin:$PATH"
 export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
 ./mvnw -Dtest=BootstrapIntegrationTest#rootGuidesFreshInstallToBootstrapWhileOtherRoutesRemainHidden test
 ```
 **Observed result**
 ```text
 GET / returned 404.
 Expected a 3xx redirect to /bootstrap.
 Tests run: 1, Failures: 1, Errors: 0, Skipped: 0
 BUILD FAILURE
 ```
 ## GREEN
 **Command**
 ```text
 ./mvnw -Dtest=BootstrapIntegrationTest#rootGuidesFreshInstallToBootstrapWhileOtherRoutesRemainHidden test
 ```
 **Observed result**
 ```text
 Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 PostgreSQL: 18.4
 ```
 ## Affected suite
 **Command and result**
 ```text
 ./mvnw -Dtest=BootstrapIntegrationTest,AuthenticationWebIntegrationTest,BootstrapOnboardingWebIntegrationTest,SecurityResponseIntegrationTest test
 Tests run: 10, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 PostgreSQL: 18.4
 ```
 ## External-test boundaries
 MockMvc verifies server routing, security, and persistence-backed initialization
 state. It does not prove browser rendering or exercise the user's IntelliJ-run
 process. The existing browser screenshot independently established the original
 Whitelabel 404 symptom.
@@ -0,0 +1,52 @@
 # Web Test Evidence
 ## Requirement and scenario IDs
 - AUTH-001, AUTH-002, AUTH-011; PRJ-001, PRJ-004, PRJ-005, PRJ-006, PRJ-017; UI-001, UI-005, UI-014, UI-018; TST-001 through TST-010.
 - AC-AUTH-001, AC-AUTH-010, AC-PRJ-001, AC-PRJ-003, AC-PRJ-009, AC-UI-005, AC-TST-001.
 ## Behavior under test
 Project creation, direct member addition, and leadership reassignment render only server-provided eligible Intern choices. The native dialog picker exposes name, student code, and internship dates while numeric identifiers remain form values rather than visible labels. Local search, selection summaries, focus, apply, cancel, empty results, and retained server errors remain usable without adding a client API.
 ## Expected result derivation
 The expected options are literal fixtures from the Account public DTO. Project membership history independently determines which eligible users are valid nonmembers or current-member leadership candidates. Native dialog controls keep server forms and CSRF as the mutation boundary.
 ## RED
 `env PATH=/opt/homebrew/opt/node@24/bin:$PATH npm run test:ui` executed the dependency-free interaction contract first: 1 test, 1 failure. Opening the picker left `dialog.open` undefined because no picker behavior existed.
 The combined Java RED command was `env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH ./mvnw '-Dtest=ProjectControllerTest,ProjectServiceIntegrationTest' test`. After correcting test-only assertion imports, test compilation failed only because the requested `ProjectService.addMembers(long,long,List<Long>)` API did not exist. Controller rendering RED will be rerun after that producer API compiles.
 After the producer API compiled, `env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH ./mvnw '-Dtest=ProjectControllerTest' test` ran 19 tests with 4 expected assertion failures for the missing eligible-option model, filtered multi-select markup, and retained selection rendering. A separate no-roster regression ran 1 test with 1 assertion failure because the disabled picker trigger had no reachable explanatory copy.
 Independent review added rendered regressions before the correction. The same focused controller command ran 22 tests with exactly 3 failures and no errors: both closed-dialog radio contracts detected browser `required`, and stale batch recovery lacked the count-only replacement message. The new missing-selection POST contracts already passed through server Bean Validation.
 ## GREEN
 `env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH ./mvnw '-Dtest=ProjectControllerTest' test` passed the initial rendered picker suite at 19/19. After adding the no-roster regression, the affected Project command below passed the expanded controller suite at 20/20.
 `env PATH=/opt/homebrew/opt/node@24/bin:$PATH npm run test:ui` passed 1/1 executable tests with no failures, proving local name/student-code filtering, summary updates, initial search focus, apply retention, cancel rollback, and opener focus restoration.
 `env PATH=/opt/homebrew/opt/node@24/bin:$PATH npm run build` succeeded with Tailwind CSS 4.3.3 and the existing local icon builder. No dependency was added.
 After the review correction, the focused controller command passed 22/22. Creation and leadership radios no longer use closed-dialog browser constraint validation; missing selections re-render their server field errors. A failed member batch retains submitted option 21 when refreshed eligibility contains only 21, omits all rendered value/ID markup for stale option 22, and reports one unavailable selection without exposing its identifier.
 ## Affected suite
 `env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw '-Dtest=ProjectControllerTest,ProjectEntityTest,ProjectPersistenceStructureTest,ProjectServiceIntegrationTest,ProjectTaskMutationContextTest,LayerStructureTest' test` passed 38/38 tests with no failures, errors, or skips.
 `env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH ./mvnw -DskipTests compile` succeeded. Project-scoped `javadoc:javadoc` with `-Ddoclint=all` succeeded; it retained four non-fatal default-constructor warnings, including pre-existing advice/query types. `git diff --check` passed.
 ## External boundaries
 No browser loop or Impeccable detector is run on this branch; the root owner performs one integrated pass. MockMvc proves rendered semantics and a dependency-free Node test executes the dialog/search/selection behavior with controlled DOM boundaries.
 After merging exact reviewed `main` `32c8a2d315d2175760c5d4792988cd0aa5ab6dd0`, `npm ci`, the 1/1 UI test, frontend build, compile, Project-scoped Javadoc/doclint, and diff check all succeeded. The first affected Java command added the updated shared `UiContractWebTest` and passed 45/45 tests with no failures, errors, or skips.
 The bounded post-review affected command reran `ProjectControllerTest,ProjectEntityTest,ProjectPersistenceStructureTest,ProjectServiceIntegrationTest,ProjectTaskMutationContextTest,LayerStructureTest,UiContractWebTest` and passed 47/47 with no failures, errors, or skips, including 9/9 Project service tests against PostgreSQL 18.4. The UI test remained 1/1; frontend build, compile, Project-scoped Javadoc/doclint, and `git diff --check` also succeeded.
 The root-owned final full suite then exposed a branch-induced MVC-slice fixture RED: 213 tests ran with 0 failures and 3 errors, all `ProjectTaskFormAccessibilityWebTest` context errors because the slice did not provide the new ProjectController AccountService dependency. A focused reproduction ran the class at 3 tests, 0 failures, 3 errors and reported the same missing AccountService constructor dependency.
 The smallest test-only correction supplies the controller's AccountService and Clock dependencies and the existing ProjectQueryService mock's authenticated Mentor response. The intermediate focused runs exposed each dependency in order; no production code changed. Final focused GREEN: `env JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:$PATH ./mvnw '-Dtest=ProjectTaskFormAccessibilityWebTest' test` passed 3/3 with no failures, errors, or skips. The root owner retains the broader rerun.
@@ -0,0 +1,89 @@
 # Test Evidence: persistent Admin SMTP settings navigation
 - **Test type:** Web
 - **Requirement IDs:** `ACC-007`, `INT-001`, `AUTH-002`, `UI-003`, `UI-008`, `UI-009`, `UI-010`
 - **Scenario IDs:** `AC-ACC-003`, `AC-UI-002`, `AC-UI-003`
 - **Test class/method:** `com.lab.labtimesheet.feature.reporting.controller.DashboardControllerWebTest`, `com.lab.labtimesheet.feature.reporting.controller.RoleDashboardWebIntegrationTest#mentorAndInternDashboardsRenderRealScopedProjectTaskAndAttendanceData`
 - **Implementation commit:** pending
 ## Protected behavior
 An Admin always receives an SMTP settings destination in the shared sidebar, whether SMTP is restricted or active. The restricted-installation warning remains conditional. Mentor and Intern sidebars never expose the Admin-only destination, and the Admin link uses the local settings sprite plus the established collapsed-sidebar tooltip.
 ## Test method
 The MVC slice renders the real dashboard controller, Spring Security Thymeleaf dialect, and shared layout with only the SMTP state and dashboard query services mocked at their public boundaries. It checks both Admin SMTP states and the active-SMTP Mentor/Intern views. The PostgreSQL 18.4 integration test activates SMTP through the real service, extracts rendered navigation links, requires the Admin SMTP route only for Admin, and follows every discovered link through the real controller/security stack.
 ## Hand-derived expected result
 With SMTP restricted, an Admin dashboard contains the existing warning and a sidebar link to `/admin/smtp` identified by `data-tooltip="SMTP settings"`. After SMTP activation, the warning is absent but that same sidebar link remains. Mentor and Intern dashboards omit the SMTP-settings tooltip and route. The activated Admin link resolves successfully when followed.
 ## RED
 **Command**
 ```text
 JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/opt/node@24/bin:$PATH ./mvnw -DargLine=-javaagent:/Users/sechmachine/.m2/repository/net/bytebuddy/byte-buddy-agent/1.18.10/byte-buddy-agent-1.18.10.jar -Dtest=DashboardControllerWebTest test
 ```
 **Observed result**
 ```text
 Tests run: 6, Failures: 2, Errors: 0, Skipped: 0
 DashboardControllerWebTest.adminRendersAdminDashboardForAuthenticatedIdentity: expected data-tooltip="SMTP settings" but it was absent.
 DashboardControllerWebTest.activeSmtpKeepsAdminDashboardFreeOfTheRestrictedInstallationWarning: expected href="/admin/smtp" data-tooltip="SMTP settings" but it was absent.
 BUILD FAILURE
 ```
 The Mentor and Intern active-SMTP assertions passed in this RED run, so the failures establish the missing Admin navigation rather than an incorrect role fixture.
 **Command**
 ```text
 JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/opt/node@24/bin:$PATH DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw -DargLine=-javaagent:/Users/sechmachine/.m2/repository/net/bytebuddy/byte-buddy-agent/1.18.10/byte-buddy-agent-1.18.10.jar -Dtest=RoleDashboardWebIntegrationTest test
 ```
 **Observed result**
 ```text
 PostgreSQL: 18.4 Testcontainer
 Tests run: 1, Failures: 1, Errors: 0, Skipped: 0
 Expected Admin visible navigation paths to contain /admin/smtp, but rendered paths were /dashboard, /admin/accounts/new, /attendance/calendar.
 BUILD FAILURE
 ```
 ## GREEN
 **Command**
 ```text
 JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/opt/node@24/bin:$PATH ./mvnw -DargLine=-javaagent:/Users/sechmachine/.m2/repository/net/bytebuddy/byte-buddy-agent/1.18.10/byte-buddy-agent-1.18.10.jar -Dtest=DashboardControllerWebTest test
 JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/opt/node@24/bin:$PATH DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw -DargLine=-javaagent:/Users/sechmachine/.m2/repository/net/bytebuddy/byte-buddy-agent/1.18.10/byte-buddy-agent-1.18.10.jar -Dtest=RoleDashboardWebIntegrationTest test
 ```
 **Observed result**
 ```text
 DashboardControllerWebTest: Tests run: 6, Failures: 0, Errors: 0, Skipped: 0
 RoleDashboardWebIntegrationTest: PostgreSQL 18.4 Testcontainer; Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 ```
 ## Affected suite
 **Command and result**
 ```text
 PATH=/opt/homebrew/opt/node@24/bin:$PATH node --version && PATH=/opt/homebrew/opt/node@24/bin:$PATH npm --version && PATH=/opt/homebrew/opt/node@24/bin:$PATH npm ci && PATH=/opt/homebrew/opt/node@24/bin:$PATH npm run build
 Node v24.19.0; npm 11.17.0; Tailwind CSS v4.3.3
 BUILD SUCCESS
 JAVA_HOME=/opt/homebrew/opt/openjdk@25 PATH=/opt/homebrew/opt/openjdk@25/bin:/opt/homebrew/opt/node@24/bin:$PATH DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock ./mvnw -DargLine=-javaagent:/Users/sechmachine/.m2/repository/net/bytebuddy/byte-buddy-agent/1.18.10/byte-buddy-agent-1.18.10.jar -Dtest=SecurityResponseIntegrationTest,BootstrapOnboardingWebIntegrationTest,AccountWebIntegrationTest,SmtpOnboardingWebIntegrationTest,RoleDashboardWebIntegrationTest,UiContractWebTest,AccountTemplateIntegrationTest,AttendanceTemplateIntegrationTest,DashboardControllerWebTest,DashboardTemplateWebTest,ProjectTaskFormAccessibilityWebTest,SharedErrorTemplateWebTest,ProjectControllerTest,TaskControllerTest,AttendanceControllerTest test
 PostgreSQL 18.4 Testcontainers; Tests run: 81, Failures: 0, Errors: 0, Skipped: 0
 BUILD SUCCESS
 ```
 ## External-test boundaries
 MockMvc proves rendered role/state visibility, while the PostgreSQL integration test proves the real Admin route follow. They do not render the collapsed rail or inspect pixels, browser focus placement, or tooltip positioning; the existing CSS and local settings sprite are reused unchanged. Server-side direct-URL authorization remains the existing `/admin/**` Admin-only security rule and is not broadened by this layout-only change.
@@ -8,7 +8,8 @@
  "scripts": {
    "build": "npm run build:css && npm run build:icons",
    "build:css": "tailwindcss -i src/main/frontend/app.css -o src/main/resources/static/assets/app.css --minify",
-    "build:icons": "node src/main/frontend/build-icons.mjs"
+    "build:icons": "node src/main/frontend/build-icons.mjs",
    "test:ui": "node --test src/test/js/*.test.mjs"
  },
  "devDependencies": {
    "@tailwindcss/cli": "4.3.3",
@@ -0,0 +1,108 @@
 const assert = require('node:assert/strict');
 const fs = require('node:fs');
 const path = require('node:path');
 const repositoryRoot = path.resolve(__dirname, '..');
 const validForm = '`work/fix/<feature>/<what-fix>`';
 const invalidForm = '`work/<feature>/fix/<what-fix>`';
 const requiredWorkflow = 'Every targeted repair starts from the taskmaster-verified latest `main`, uses TDD RED → GREEN, adds Javadoc during implementation, records companion evidence, undergoes independent review, and uses a normal, non-force merge only when separately authorized.';
 const workflowElements = [
  'taskmaster-verified latest `main`',
  'TDD RED → GREEN',
  'Javadoc during implementation',
  'companion evidence',
  'independent review',
  'normal, non-force merge'
 ];
 const documents = [
  {
    file: 'AGENTS.md',
    approved: '- A targeted repair uses a clean, isolated `work/fix/<feature>/<what-fix>` branch and worktree from the taskmaster-verified current `main`. Do not use `work/<feature>/fix/<what-fix>`: the persistent `work/<feature>` ref already occupies that Git ref prefix.'
  },
  {
    file: 'README.md',
    approved: 'For a targeted repair, create a clean isolated branch and worktree from the\ntaskmaster-verified current `main` named\n`work/fix/<feature>/<what-fix>`. Do not nest it as\n`work/<feature>/fix/<what-fix>`: the persistent `work/<feature>` ref already\nuses that Git ref prefix.'
  },
  {
    file: 'DEVELOPMENT.md',
    approved: 'For a targeted repair, start a clean worktree from the taskmaster-verified\ncurrent `main` on `work/fix/<feature>/<what-fix>`. Keep it separate from the\nfive persistent `work/<feature>` branches. Do not use\n`work/<feature>/fix/<what-fix>` because the persistent `work/<feature>` ref\nalready occupies that Git ref prefix.'
  },
  {
    file: 'TESTING.md',
    approved: 'Run that check from the clean targeted-fix branch named\n`work/fix/<feature>/<what-fix>` when repairing one feature. Do not use\n`work/<feature>/fix/<what-fix>`: a persistent `work/<feature>` ref already\noccupies that Git ref prefix. Record the expected RED and the matching GREEN\nshell output in the evidence record.'
  },
  {
    file: 'docs/superpowers/specs/2026-08-15-access-navigation-icon-intern-picker-design.md',
    approved: 'Use `work/fix/<feature>/<what-fix>` for each targeted repair. Create its clean,\nisolated worktree from the taskmaster-verified current `main`. The `<feature>`\nsegment identifies the owning persistent area; it does not nest below that\npersistent branch.\n\nThe forbidden form is `work/<feature>/fix/<what-fix>`. A repair owner preserves\nother worktrees, records RED and GREEN evidence, commits locally, and does not\npush or merge without separate authority.'
  },
  {
    file: 'docs/superpowers/plans/2026-08-15-access-navigation-icon-intern-picker.md',
    approved: '2. Add one branch rule to contributor guides, design records, plans, and tracked\n   coordination authority: `work/fix/<feature>/<what-fix>` from verified\n   `main`.\n3. State why `work/<feature>/fix/<what-fix>` is invalid while its persistent\n   `work/<feature>` ref exists.'
  }
 ];
 /** Validates that every tracked guide contains only its approved branch wording. */
 function validate(contents) {
  const failures = [];
  for (const {file, approved} of documents) {
    const content = contents.get(file);
    if (count(content, validForm) !== 1) failures.push(`${file} must contain ${validForm} exactly once`);
    if (!content.includes(approved)) failures.push(`${file} is missing its approved branch workflow statement`);
    if (count(content, requiredWorkflow) !== 1) {
      failures.push(`${file} must contain the complete required targeted-repair workflow exactly once`);
    }
    const outsideApprovedStatement = content.replace(approved, '');
    if (outsideApprovedStatement.includes(validForm) || outsideApprovedStatement.includes(invalidForm)) {
      failures.push(`${file} contains an unapproved branch-form reference`);
    }
  }
  if (failures.length) throw new Error(failures.join('\n'));
 }
 function count(content, value) {
  return content.split(value).length - 1;
 }
 function readContents() {
  return new Map(documents.map(({file}) => [file, fs.readFileSync(path.join(repositoryRoot, file), 'utf8')]));
 }
 const contents = readContents();
 validate(contents);
 let workflowElementRejections = 0;
 if (process.argv.includes('--self-test')) {
  for (const {file} of documents) {
    for (const workflowElement of workflowElements) {
      const missingWorkflowElement = new Map(contents);
      missingWorkflowElement.set(
        file,
        contents.get(file).replace(requiredWorkflow, requiredWorkflow.replace(workflowElement, ''))
      );
      assert.throws(
        () => validate(missingWorkflowElement),
        (error) => error instanceof Error
          && error.message.includes(`${file} must contain the complete required targeted-repair workflow exactly once`)
      );
      workflowElementRejections += 1;
    }
    const positiveRecommendation = new Map(contents);
    positiveRecommendation.set(file, `${contents.get(file)}\nUse ${invalidForm} for a targeted repair.\n`);
    assert.throws(
      () => validate(positiveRecommendation),
      (error) => error instanceof Error
        && error.message.includes(`${file} contains an unapproved branch-form reference`)
    );
  }
 }
 console.log(`Fix-branch workflow documentation: ${documents.length} approved statements validated`);
 if (process.argv.includes('--self-test')) {
  console.log(`Targeted-repair workflow element removals: ${workflowElementRejections}/${workflowElements.length * documents.length} rejected`);
  console.log(`Positive nested branch recommendations: ${documents.length}/${documents.length} rejected`);
 }
@@ -120,6 +120,7 @@
  .primary-action { margin-left: auto; }
  .button { display: inline-flex; min-height: 2.35rem; align-items: center; justify-content: center; gap: .45rem; border: 1px solid var(--border-strong); border-radius: .5rem; padding: .5rem .8rem; background: var(--panel); color: var(--ink); font-weight: 650; text-decoration: none; cursor: pointer; }
  .button-primary { border-color: var(--ink); background: var(--ink); color: var(--panel); }
  .button:disabled { cursor: not-allowed; opacity: .55; }
  .button-danger { border-color: color-mix(in srgb, var(--danger), transparent 65%); background: color-mix(in srgb, var(--danger), transparent 90%); color: var(--danger); }
  .panel { border: 1px solid var(--border); border-radius: .75rem; background: var(--panel); box-shadow: 0 10px 28px rgb(20 25 35 / .06); }
  .panel-header { padding: .9rem 1rem; border-bottom: 1px solid var(--border); }
@@ -170,6 +171,21 @@
  .notification-menu { min-width: 18rem; padding: .75rem; }
  dialog { max-width: 30rem; border: 1px solid var(--border); border-radius: .9rem; background: var(--panel); color: var(--ink); padding: 1.25rem; }
  dialog::backdrop { background: rgb(0 0 0 / .45); }
  .picker-trigger { justify-content: flex-start; }
  .picker-summary { margin: 0; color: var(--muted); font-size: .78rem; }
  .picker-drawer { width: min(32rem, 100%); max-width: 32rem; height: 100dvh; max-height: 100dvh; margin: 0 0 0 auto; border-radius: .9rem 0 0 .9rem; padding: 0; }
  .picker-header, .picker-footer { display: flex; align-items: center; justify-content: space-between; gap: 1rem; padding: 1rem; }
  .picker-header { border-bottom: 1px solid var(--border); }
  .picker-header .field-help { margin: .2rem 0 0; }
  .picker-body { display: grid; gap: .5rem; padding: 1rem; }
  .picker-options { display: grid; gap: .5rem; margin-top: .5rem; }
  .picker-option { display: grid; grid-template-columns: auto minmax(0, 1fr); align-items: start; gap: .75rem; border: 1px solid var(--border); border-radius: .65rem; padding: .75rem; cursor: pointer; }
  .picker-option:hover { border-color: var(--border-strong); background: var(--panel-muted); }
  .picker-option input { margin-top: .2rem; }
  .picker-option span { display: grid; gap: .18rem; min-width: 0; }
  .picker-option small, .picker-empty { color: var(--muted); }
  .picker-empty { margin: 1rem 0; text-align: center; }
  .picker-footer { border-top: 1px solid var(--border); justify-content: flex-end; }
  @keyframes pulse { 50% { opacity: .45; } }
  @media (prefers-reduced-motion: reduce) { *, *::before, *::after { scroll-behavior: auto !important; animation-duration: .01ms !important; } }
 }
@@ -10,10 +10,14 @@ const names = [
 const output = resolve('src/main/resources/static/assets/icons.svg');
 const symbols = await Promise.all(names.map(async (name) => {
  const svg = await readFile(resolve(`node_modules/lucide-static/icons/${name}.svg`), 'utf8');
-  const viewBox = svg.match(/viewBox="([^"]+)"/)?.[1] ?? '0 0 24 24';
+  const root = svg.match(/<svg\b([^>]*)>/)?.[1];
  const viewBox = root?.match(/viewBox="([^"]+)"/)?.[1] ?? '0 0 24 24';
  const presentation = ['fill', 'stroke', 'stroke-width', 'stroke-linecap', 'stroke-linejoin']
    .map((attribute) => root?.match(new RegExp(`${attribute}="[^"]+"`))?.[0])
    .join(' ');
  const body = svg.match(/<svg[\s\S]*?>([\s\S]*?)<\/svg>/)?.[1];
  if (!body) throw new Error(`Invalid Lucide SVG: ${name}`);
-  return `<symbol id="${name}" viewBox="${viewBox}">${body.trim()}</symbol>`;
+  return `<symbol id="${name}" viewBox="${viewBox}" ${presentation}>${body.trim()}</symbol>`;
 }));
 await mkdir(dirname(output), { recursive: true });
@@ -1,23 +1,43 @@
 package com.lab.labtimesheet;
 import java.util.TimeZone;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import com.lab.labtimesheet.config.SecurityProperties;
-/** Application entry point and root component-scan boundary for Lab Timesheet. */
+/**
 * Application entry point and root component-scan boundary for Lab Timesheet.
 *
 * <p>The entry point also canonicalizes the legacy Windows Vietnam timezone alias before database
 * drivers inspect the JVM default timezone.
 */
@SpringBootApplication
@EnableConfigurationProperties(SecurityProperties.class)
 public class LabtimesheetApplication {
    private static final String LEGACY_VIETNAM_TIME_ZONE = "Asia/Saigon";
    private static final String BUSINESS_TIME_ZONE = "Asia/Ho_Chi_Minh";
    /**
-     * Starts the standalone Spring Boot process.
+     * Canonicalizes the process timezone and starts the standalone Spring Boot process.
     *
     * @param args command-line arguments forwarded to Spring Boot
     */
    public static void main(String[] args) {
        normalizeDefaultTimeZone();
        SpringApplication.run(LabtimesheetApplication.class, args);
    }
    /**
     * Replaces the legacy Windows Vietnam alias before pgJDBC sends it to PostgreSQL as a startup
     * parameter. Other supported system timezones remain unchanged.
     */
    static void normalizeDefaultTimeZone() {
        if (LEGACY_VIETNAM_TIME_ZONE.equals(TimeZone.getDefault().getID())) {
            TimeZone.setDefault(TimeZone.getTimeZone(BUSINESS_TIME_ZONE));
        }
    }
 }
@@ -12,8 +12,9 @@ import org.springframework.security.web.access.intercept.AuthorizationFilter;
 import org.springframework.security.web.header.writers.ReferrerPolicyHeaderWriter.ReferrerPolicy;
 /**
- * Defines form authentication, role-based Admin routes, CSRF protection, and response security headers.
+ * Defines form authentication, role-based Admin routes, public health probes, CSRF protection, and response
- * Bootstrap access is further constrained by {@link BootstrapAccessFilter} until initialization completes.
+ * security headers. Bootstrap access is further constrained by {@link BootstrapAccessFilter} until initialization
 * completes.
 */
@Configuration(proxyBeanMethods = false)
 class SecurityConfiguration {
@@ -34,7 +35,7 @@ class SecurityConfiguration {
                .authorizeHttpRequests(authorize -> authorize
                        .requestMatchers(
                                "/bootstrap/**", "/activate/**", "/login", "/error", "/assets/**",
-                                "/actuator/health")
+                                "/actuator/health", "/actuator/health/**")
                        .permitAll()
                        .requestMatchers("/admin/**").hasRole("ADMIN")
                        .anyRequest().authenticated())
@@ -19,7 +19,7 @@ public class BootstrapAccessFilter extends OncePerRequestFilter {
    private final BootstrapService bootstrap;
    /**
-     * Returns HTTP 404 for hidden routes before bootstrap so no authentication surface is exposed prematurely.
+     * Redirects the installation root to bootstrap and returns HTTP 404 for every other hidden route.
     *
     * @param request current HTTP request
     * @param response current HTTP response
@@ -31,6 +31,10 @@ public class BootstrapAccessFilter extends OncePerRequestFilter {
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {
        String path = request.getRequestURI();
        if (!bootstrap.isInitialized() && path.equals(request.getContextPath() + "/")) {
            response.sendRedirect(request.getContextPath() + "/bootstrap");
            return;
        }
        if (!bootstrap.isInitialized() && !allowedBeforeBootstrap(path)) {
            response.sendError(HttpServletResponse.SC_NOT_FOUND);
            return;
@@ -40,7 +44,8 @@ public class BootstrapAccessFilter extends OncePerRequestFilter {
    private static boolean allowedBeforeBootstrap(String path) {
        return path.equals("/bootstrap") || path.startsWith("/bootstrap/")
-                || path.equals("/actuator/health") || path.startsWith("/assets/")
+                || path.equals("/actuator/health") || path.startsWith("/actuator/health/")
                || path.startsWith("/assets/")
                || path.equals("/error");
    }
 }
@@ -0,0 +1,21 @@
 package com.lab.labtimesheet.feature.account.model.dto;
 import java.time.LocalDate;
 /**
 * Immutable non-secret selection data for an eligible Intern.
 * The numeric user ID is the internal form submission identity; displayed fields are not authorization identifiers.
 *
 * @param userId persistent account identifier submitted by a consuming form
 * @param displayName user-facing Intern name
 * @param studentCode university student code shown to distinguish Interns
 * @param internshipStart inclusive internship eligibility start date
 * @param internshipEnd inclusive internship eligibility end date
 */
 public record EligibleInternOption(
        long userId,
        String displayName,
        String studentCode,
        LocalDate internshipStart,
        LocalDate internshipEnd) {
 }
@@ -1,8 +1,12 @@
 package com.lab.labtimesheet.feature.account.repository;
 import java.time.LocalDate;
 import java.util.List;
 import com.lab.labtimesheet.feature.account.model.AccountStatus;
 import com.lab.labtimesheet.feature.account.model.GlobalRole;
 import com.lab.labtimesheet.feature.account.model.InternshipStatus;
 import com.lab.labtimesheet.feature.account.model.dto.EligibleInternOption;
 import com.lab.labtimesheet.feature.account.model.entity.InternProfile;
 import jakarta.persistence.LockModeType;
 import org.springframework.data.jpa.repository.JpaRepository;
@@ -19,6 +23,34 @@ public interface InternProfileRepository extends JpaRepository<InternProfile, Lo
    boolean existsByUserIdAndInternshipStatusAndInternshipStartDateLessThanEqualAndInternshipEndDateGreaterThanEqual(
            Long userId, InternshipStatus status, LocalDate latestStartDate, LocalDate earliestEndDate);
    /**
     * Projects account-owned non-secret selection data for Interns eligible on one inclusive business date.
     * Results are ordered by display name, student code, then user ID for deterministic form rendering.
     *
     * @param globalRole required immutable Intern role
     * @param accountStatus required active account state
     * @param internshipStatus required active internship state
     * @param businessDate date that must fall within the inclusive internship range
     * @return eligible Intern selection projections without duplicate profile rows
     */
    @Query("""
            select new com.lab.labtimesheet.feature.account.model.dto.EligibleInternOption(
                u.id, u.displayName, p.studentCode, p.internshipStartDate, p.internshipEndDate)
            from InternProfile p
            join AppUser u on u.id = p.userId
            where u.globalRole = :globalRole
              and u.accountStatus = :accountStatus
              and p.internshipStatus = :internshipStatus
              and p.internshipStartDate <= :businessDate
              and p.internshipEndDate >= :businessDate
            order by u.displayName asc, p.studentCode asc, u.id asc
            """)
    List<EligibleInternOption> findEligibleInternOptions(
            @Param("globalRole") GlobalRole globalRole,
            @Param("accountStatus") AccountStatus accountStatus,
            @Param("internshipStatus") InternshipStatus internshipStatus,
            @Param("businessDate") LocalDate businessDate);
    /** Counts Intern profiles in a lifecycle state. */
    long countByInternshipStatus(InternshipStatus status);
@@ -8,6 +8,7 @@ import java.time.Clock;
 import java.time.Duration;
 import java.time.LocalDate;
 import java.util.Base64;
 import java.util.List;
 import com.lab.labtimesheet.feature.account.model.AccountStatus;
 import com.lab.labtimesheet.feature.account.model.GlobalRole;
@@ -17,6 +18,7 @@ import com.lab.labtimesheet.feature.account.model.dto.AccountCreation;
 import com.lab.labtimesheet.feature.account.model.dto.AccountIdentity;
 import com.lab.labtimesheet.feature.account.model.dto.AccountSummary;
 import com.lab.labtimesheet.feature.account.model.dto.CreateAccountCommand;
 import com.lab.labtimesheet.feature.account.model.dto.EligibleInternOption;
 import com.lab.labtimesheet.feature.account.model.entity.AppUser;
 import com.lab.labtimesheet.feature.account.model.entity.InternProfile;
 import com.lab.labtimesheet.feature.account.model.entity.UserActionToken;
@@ -238,6 +240,24 @@ public class AccountService {
                .isPresent();
    }
    /**
     * Lists non-secret Intern selection options eligible on an explicit business date.
     * The result requires active account and internship states plus inclusive internship dates, but it does not
     * authorize a consuming Project operation; that operation must recheck its own ownership and membership rules.
     *
     * @param businessDate server-derived business date to evaluate inclusively
     * @return deterministic options ordered by display name, student code, then account ID
     * @throws IllegalArgumentException when {@code businessDate} is {@code null}
     */
    @Transactional(readOnly = true)
    public List<EligibleInternOption> eligibleInternOptions(LocalDate businessDate) {
        if (businessDate == null) {
            throw new IllegalArgumentException("Business date is required");
        }
        return internProfiles.findEligibleInternOptions(
                GlobalRole.INTERN, AccountStatus.ACTIVE, InternshipStatus.ACTIVE, businessDate);
    }
    /**
     * Resolves the cross-feature identity of a currently eligible Intern.
     *
@@ -1,13 +1,21 @@
 package com.lab.labtimesheet.feature.project.controller;
 import com.lab.labtimesheet.feature.account.model.dto.EligibleInternOption;
 import com.lab.labtimesheet.feature.account.service.AccountService;
 import com.lab.labtimesheet.feature.project.exception.ProjectAccessDeniedException;
 import com.lab.labtimesheet.feature.project.exception.ProjectRuleViolationException;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectCreateForm;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectMemberForm;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectMembersForm;
 import com.lab.labtimesheet.feature.project.service.ProjectQueryService;
 import com.lab.labtimesheet.feature.project.service.ProjectService;
 import jakarta.validation.Valid;
 import java.security.Principal;
 import java.time.Clock;
 import java.time.LocalDate;
 import java.util.List;
 import java.util.Set;
 import java.util.stream.Collectors;
 import lombok.RequiredArgsConstructor;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
@@ -33,6 +41,8 @@ public class ProjectController {
    private final ProjectQueryService pages;
    private final ProjectService projects;
    private final AccountService accounts;
    private final Clock clock;
    /**
     * Lists only Projects visible to the authenticated actor and exposes Project creation only
@@ -64,6 +74,7 @@ public class ProjectController {
            throw new ProjectAccessDeniedException();
        }
        model.addAttribute("projectForm", new ProjectCreateForm());
        model.addAttribute("eligibleInternOptions", eligibleInternOptions());
        return "projects/form";
    }
@@ -73,22 +84,30 @@ public class ProjectController {
     * @param principal authenticated user
     * @param projectForm validated browser input
     * @param bindingResult binding and domain validation results
     * @param model response model used when validation fails
     * @return a redirect to the created Project, or the creation form on validation failure
     */
    @PostMapping
    public String create(
            Principal principal,
            @Valid @ModelAttribute("projectForm") ProjectCreateForm projectForm,
-            BindingResult bindingResult) {
+            BindingResult bindingResult,
            Model model) {
        var actor = pages.authenticatedActor(principal.getName());
        if (!"MENTOR".equals(actor.role())) {
            throw new ProjectAccessDeniedException();
        }
        if (bindingResult.hasErrors()) {
            model.addAttribute("eligibleInternOptions", eligibleInternOptions());
            return "projects/form";
        }
        try {
-            long projectId = projects.create(actorId(principal), projectForm.toCommand());
+            long projectId = projects.create(actor.userId(), projectForm.toCommand());
            return "redirect:/projects/" + projectId;
        } catch (ProjectRuleViolationException exception) {
            bindingResult.rejectValue(
                    "initialLeaderUserId", "project.initialLeader.ineligible", exception.getMessage());
            model.addAttribute("eligibleInternOptions", eligibleInternOptions());
            return "projects/form";
        }
    }
@@ -139,41 +158,51 @@ public class ProjectController {
    @GetMapping("/{projectId}/members")
    public String members(Principal principal, @PathVariable long projectId, Model model) {
        long actorId = actorId(principal);
-        model.addAttribute("project", pages.detail(actorId, projectId));
+        populateMembersModel(actorId, projectId, model);
-        model.addAttribute("members", pages.members(actorId, projectId));
+        model.addAttribute("projectMembersForm", new ProjectMembersForm());
        model.addAttribute("projectMemberForm", new ProjectMemberForm(null));
        return "projects/members";
    }
    /**
-     * Adds an eligible Intern or re-renders membership history with the submitted identifier
+     * Adds all selected eligible Interns atomically or re-renders membership history with every
-     * and a safe validation message.
+     * still-eligible selection retained and a count of unavailable choices.
     *
     * @param principal authenticated user
     * @param projectId owning Project identifier
-     * @param memberForm validated Intern selection
+     * @param membersForm validated Intern selection
     * @param bindingResult binding and domain validation results
     * @param model response model used on failure
     * @return a membership redirect after success, or the membership view on validation failure
     */
    @PostMapping("/{projectId}/members")
-    public String addMember(
+    public String addMembers(
            Principal principal,
            @PathVariable long projectId,
-            @Valid @ModelAttribute("projectMemberForm") ProjectMemberForm memberForm,
+            @Valid @ModelAttribute("projectMembersForm") ProjectMembersForm membersForm,
            BindingResult bindingResult,
            Model model) {
        long actorId = actorId(principal);
        boolean rejectedByService = false;
        if (!bindingResult.hasErrors()) {
            try {
-                projects.addMember(actorId, projectId, memberForm.internUserId());
+                projects.addMembers(actorId, projectId, membersForm.internUserIds());
                return "redirect:/projects/" + projectId + "/members";
            } catch (ProjectRuleViolationException exception) {
-                bindingResult.rejectValue("internUserId", "project.member.ineligible", exception.getMessage());
+                rejectedByService = true;
                bindingResult.rejectValue(
                        "internUserIds", "project.members.ineligible", exception.getMessage());
            }
        }
-        model.addAttribute("project", pages.detail(actorId, projectId));
+        var refreshedOptions = populateMembersModel(actorId, projectId, model);
-        model.addAttribute("members", pages.members(actorId, projectId));
+        if (rejectedByService) {
            Set<Long> refreshedIds = refreshedOptions.stream()
                    .map(EligibleInternOption::userId)
                    .collect(Collectors.toUnmodifiableSet());
            long unavailableSelectionCount = membersForm.internUserIds().stream()
                    .filter(userId -> !refreshedIds.contains(userId))
                    .count();
            model.addAttribute("unavailableSelectionCount", unavailableSelectionCount);
        }
        return "projects/members";
    }
@@ -189,8 +218,7 @@ public class ProjectController {
    @GetMapping("/{projectId}/leadership")
    public String leadership(Principal principal, @PathVariable long projectId, Model model) {
        long actorId = actorId(principal);
-        model.addAttribute("project", pages.detail(actorId, projectId));
+        populateLeadershipModel(actorId, projectId, model);
        model.addAttribute("leadership", pages.leadership(actorId, projectId));
        model.addAttribute("projectMemberForm", new ProjectMemberForm(null));
        return "projects/leadership";
    }
@@ -221,11 +249,48 @@ public class ProjectController {
                bindingResult.rejectValue("internUserId", "project.leader.ineligible", exception.getMessage());
            }
        }
-        model.addAttribute("project", pages.detail(actorId, projectId));
+        populateLeadershipModel(actorId, projectId, model);
        model.addAttribute("leadership", pages.leadership(actorId, projectId));
        return "projects/leadership";
    }
    private List<EligibleInternOption> populateMembersModel(long actorId, long projectId, Model model) {
        var project = pages.detail(actorId, projectId);
        var members = pages.members(actorId, projectId);
        model.addAttribute("project", project);
        model.addAttribute("members", members);
        if (project.canManage()) {
            Set<Long> currentMemberIds = members.stream()
                    .filter(member -> member.leftAt() == null)
                    .map(member -> member.internUserId())
                    .collect(Collectors.toUnmodifiableSet());
            var options = eligibleInternOptions().stream()
                    .filter(option -> !currentMemberIds.contains(option.userId()))
                    .toList();
            model.addAttribute("eligibleInternOptions", options);
            return options;
        }
        return List.of();
    }
    private void populateLeadershipModel(long actorId, long projectId, Model model) {
        var project = pages.detail(actorId, projectId);
        model.addAttribute("project", project);
        model.addAttribute("leadership", pages.leadership(actorId, projectId));
        if (project.canManage()) {
            Set<Long> replacementIds = pages.members(actorId, projectId).stream()
                    .filter(member -> member.leftAt() == null && !member.currentLeader())
                    .map(member -> member.internUserId())
                    .collect(Collectors.toUnmodifiableSet());
            model.addAttribute("eligibleInternOptions", eligibleInternOptions().stream()
                    .filter(option -> replacementIds.contains(option.userId()))
                    .toList());
        }
    }
    private List<EligibleInternOption> eligibleInternOptions() {
        return accounts.eligibleInternOptions(LocalDate.now(clock));
    }
    private long actorId(Principal principal) {
        return pages.authenticatedUserId(principal.getName());
    }
@@ -0,0 +1,18 @@
 package com.lab.labtimesheet.feature.project.model.dto;
 import jakarta.validation.constraints.NotEmpty;
 import jakarta.validation.constraints.Positive;
 import java.util.List;
 /**
 * Browser form for one atomic owning-Mentor direct-add selection.
 *
 * @param internUserIds distinct positive Intern account identifiers selected in the picker
 */
 public record ProjectMembersForm(@NotEmpty List<@Positive Long> internUserIds) {
    /** Creates an empty form for the initial membership page. */
    public ProjectMembersForm() {
        this(List.of());
    }
 }
@@ -1,6 +1,7 @@
 package com.lab.labtimesheet.feature.project.service;
 import com.lab.labtimesheet.feature.project.exception.ProjectAccessDeniedException;
 import com.lab.labtimesheet.feature.project.exception.ProjectRuleViolationException;
 import com.lab.labtimesheet.feature.account.service.AccountService;
 import com.lab.labtimesheet.feature.project.model.ProjectInternEligibility;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectCreateCommand;
@@ -9,6 +10,9 @@ import com.lab.labtimesheet.feature.project.model.entity.ProjectEntity;
 import com.lab.labtimesheet.feature.project.repository.ProjectRepository;
 import com.lab.labtimesheet.feature.task.service.TaskQueryService;
 import java.time.Clock;
 import java.time.LocalDate;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 import java.util.stream.Collectors;
 import lombok.RequiredArgsConstructor;
@@ -68,9 +72,42 @@ public class ProjectService {
     */
    @Transactional
    public void addMember(long actorUserId, long projectId, long internUserId) {
        addMembers(actorUserId, projectId, List.of(internUserId));
    }
    /**
     * Adds a complete selection of eligible nonmembers while holding one Project write lock.
     * Every identifier is revalidated after owner authorization and before the aggregate changes,
     * so missing, duplicate, stale, ineligible, or current-member selections leave membership
     * unchanged.
     *
     * @param actorUserId authenticated owning Mentor
     * @param projectId Project to update
     * @param internUserIds distinct eligible Intern account identifiers
     * @throws com.lab.labtimesheet.feature.project.exception.ProjectRuleViolationException when
     *         the selection is null, empty, malformed, duplicate, stale, ineligible, or already
     *         contains a current member
     */
    @Transactional
    public void addMembers(long actorUserId, long projectId, List<Long> internUserIds) {
        var project = lockedProject(projectId);
        project.authorizeOwner(actorUserId);
-        project.addMember(actorUserId, eligibleIntern(internUserId), clock.instant());
+        if (internUserIds == null || internUserIds.isEmpty()) {
            throw new ProjectRuleViolationException("Select at least one Intern");
        }
        if (internUserIds.stream().anyMatch(userId -> userId == null || userId <= 0)
                || new HashSet<>(internUserIds).size() != internUserIds.size()) {
            throw new ProjectRuleViolationException("Intern selection is invalid");
        }
        var selectedInterns = internUserIds.stream().map(this::eligibleIntern).toList();
        if (selectedInterns.stream().anyMatch(intern -> !intern.isEligible())
                || selectedInterns.stream().anyMatch(intern -> project.hasCurrentMember(intern.userId()))) {
            throw new ProjectRuleViolationException("One or more selected Interns are no longer eligible");
        }
        var addedAt = clock.instant();
        selectedInterns.forEach(intern -> project.addMember(actorUserId, intern, addedAt));
        projects.flush();
    }
@@ -145,7 +182,7 @@ public class ProjectService {
    }
    private ProjectInternEligibility eligibleIntern(long userId) {
-        return new ProjectInternEligibility(userId, accounts.isEligibleIntern(userId));
+        return new ProjectInternEligibility(userId, accounts.isEligibleIntern(userId, LocalDate.now(clock)));
    }
    private void requireActiveMentor(long userId) {
@@ -1,35 +0,0 @@
 # Development profile. Values that differ between machines come from an untracked .env file.
 server.port=${LAB_SERVER_PORT}
 server.forward-headers-strategy=${LAB_FORWARD_HEADERS_STRATEGY}
 server.servlet.session.cookie.http-only=true
 server.servlet.session.cookie.secure=false
 server.servlet.session.cookie.same-site=lax
 server.error.include-message=never
 server.error.include-stacktrace=never
 spring.datasource.url=${LAB_DB_URL}
 spring.datasource.username=${LAB_DB_USERNAME}
 spring.datasource.password=${LAB_DB_PASSWORD}
 spring.jpa.hibernate.ddl-auto=validate
 spring.jpa.open-in-view=false
 spring.jpa.properties.hibernate.jdbc.time_zone=UTC
 spring.flyway.enabled=true
 spring.flyway.locations=classpath:db/migration
 spring.docker.compose.enabled=false
 # Mailpit keeps Spring's mail health check local. User-facing SMTP credentials remain Admin-console data.
 spring.mail.host=${LAB_SMTP_HOST}
 spring.mail.port=${LAB_SMTP_PORT}
 spring.mail.protocol=smtp
 spring.mail.test-connection=false
 spring.mail.properties.mail.smtp.auth=false
 spring.mail.properties.mail.smtp.starttls.enable=false
 spring.mail.properties.mail.smtp.connectiontimeout=5000
 spring.mail.properties.mail.smtp.timeout=5000
 spring.mail.properties.mail.smtp.writetimeout=5000
 management.endpoints.web.exposure.include=health,info
 management.endpoint.health.show-details=when_authorized
 lab.public-origin=${LAB_PUBLIC_ORIGIN}
 lab.security.master-key=${LAB_SECURITY_MASTER_KEY}
@@ -0,0 +1,60 @@
 # Development profile. Machine-specific values come from the ignored root .env file.
 spring:
  config:
    import: "optional:file:${LAB_DEV_ENV_FILE:.env}[.properties]"
  datasource:
    url: "${LAB_DB_URL}"
    username: "${LAB_DB_USERNAME}"
    password: "${LAB_DB_PASSWORD}"
  jpa:
    hibernate:
      ddl-auto: validate
    open-in-view: false
  flyway:
    enabled: true
    locations: classpath:db/migration
  docker:
    compose:
      enabled: false
  # Mailpit keeps Spring's mail health check local. User-facing SMTP credentials remain Admin-console data.
  mail:
    host: "${LAB_SMTP_HOST}"
    port: "${LAB_SMTP_PORT}"
    protocol: smtp
    test-connection: false
    properties:
      mail:
        smtp:
          auth: false
          starttls:
            enable: false
          connectiontimeout: 5000
          timeout: 5000
          writetimeout: 5000
 server:
  port: "${LAB_SERVER_PORT}"
  forward-headers-strategy: "${LAB_FORWARD_HEADERS_STRATEGY}"
  servlet:
    session:
      cookie:
        http-only: true
        secure: false
        same-site: lax
  error:
    include-message: never
    include-stacktrace: never
 management:
  endpoints:
    web:
      exposure:
        include: "health,info"
  endpoint:
    health:
      show-details: when_authorized
 lab:
  public-origin: "${LAB_PUBLIC_ORIGIN}"
  security:
    master-key: "${LAB_SECURITY_MASTER_KEY}"
@@ -0,0 +1,53 @@
 # Production profile. Supply every LAB_* value from the deployment environment.
 spring:
  datasource:
    url: "${LAB_DB_URL}"
    username: "${LAB_DB_USERNAME}"
    password: "${LAB_DB_PASSWORD}"
  flyway:
    enabled: true
    locations: classpath:db/migration
  jpa:
    hibernate:
      ddl-auto: validate
    open-in-view: false
  docker:
    compose:
      enabled: false
  lifecycle:
    timeout-per-shutdown-phase: 30s
 server:
  port: 8080
  shutdown: graceful
  forward-headers-strategy: "${LAB_FORWARD_HEADERS_STRATEGY}"
  servlet:
    session:
      cookie:
        http-only: true
        secure: true
        same-site: strict
  error:
    include-message: never
    include-stacktrace: never
 management:
  endpoints:
    web:
      exposure:
        include: "health,info"
  endpoint:
    health:
      show-details: never
      probes:
        enabled: true
      group:
        liveness:
          include: "livenessState"
        readiness:
          include: "readinessState,db"
 lab:
  public-origin: "${LAB_PUBLIC_ORIGIN}"
  security:
    master-key: "${LAB_SECURITY_MASTER_KEY}"
@@ -10,3 +10,9 @@ spring:
    hibernate:
      ddl-auto: validate
    open-in-view: false
 management:
  endpoint:
    health:
      probes:
        enabled: true
@@ -37,4 +37,57 @@ document.addEventListener('DOMContentLoaded', () => {
    try { localStorage.setItem('labtimesheet-sidebar', collapsed ? 'collapsed' : 'expanded'); }
    catch (_) { /* Collapse still works for this page. */ }
  });
  document.querySelectorAll('[data-intern-picker]').forEach((picker) => {
    const open = picker.querySelector('[data-picker-open]');
    const dialog = picker.querySelector('[data-picker-dialog]');
    const search = picker.querySelector('[data-picker-search]');
    const summary = picker.querySelector('[data-picker-summary]');
    const empty = picker.querySelector('[data-picker-empty]');
    const cancel = picker.querySelector('[data-picker-cancel]');
    const apply = picker.querySelector('[data-picker-apply]');
    const options = [...picker.querySelectorAll('[data-picker-option]')];
    let initialSelection = [];
    const inputs = () => options.map((option) => option.querySelector('input'));
    const updateSummary = () => {
      const selected = options
        .filter((option) => option.querySelector('input').checked)
        .map((option) => option.querySelector('[data-picker-label]').textContent.trim());
      summary.textContent = selected.length === 0
        ? `No Intern${inputs()[0]?.type === 'radio' ? '' : 's'} selected`
        : `${selected.length} Intern${selected.length === 1 ? '' : 's'} selected: ${selected.join(', ')}`;
    };
    const filter = () => {
      const query = search.value.trim().toLocaleLowerCase();
      let visible = 0;
      options.forEach((option) => {
        option.hidden = !option.dataset.pickerSearch.toLocaleLowerCase().includes(query);
        if (!option.hidden) visible += 1;
      });
      empty.hidden = visible !== 0;
    };
    const restore = () => {
      inputs().forEach((input, index) => { input.checked = initialSelection[index]; });
      updateSummary();
    };
    inputs().forEach((input) => input.addEventListener('change', updateSummary));
    search.addEventListener('input', filter);
    open.addEventListener('click', () => {
      initialSelection = inputs().map((input) => input.checked);
      search.value = '';
      filter();
      dialog.showModal();
      search.focus();
    });
    cancel.addEventListener('click', () => {
      restore();
      dialog.close();
    });
    dialog.addEventListener('cancel', restore);
    dialog.addEventListener('close', () => open.focus());
    apply.addEventListener('click', () => dialog.close());
    updateSummary();
  });
 });
@@ -1,5 +1,5 @@
-<svg xmlns="http://www.w3.org/2000/svg" style="display:none"><symbol id="bell" viewBox="0 0 24 24"><path d="M10.268 21a2 2 0 0 0 3.464 0" />
+<svg xmlns="http://www.w3.org/2000/svg" style="display:none"><symbol id="bell" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10.268 21a2 2 0 0 0 3.464 0" />
-  <path d="M3.262 15.326A1 1 0 0 0 4 17h16a1 1 0 0 0 .74-1.673C19.41 13.956 18 12.499 18 8A6 6 0 0 0 6 8c0 4.499-1.411 5.956-2.738 7.326" /></symbol><symbol id="calendar-days" viewBox="0 0 24 24"><path d="M8 2v4" />
+  <path d="M3.262 15.326A1 1 0 0 0 4 17h16a1 1 0 0 0 .74-1.673C19.41 13.956 18 12.499 18 8A6 6 0 0 0 6 8c0 4.499-1.411 5.956-2.738 7.326" /></symbol><symbol id="calendar-days" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M8 2v4" />
  <path d="M16 2v4" />
  <rect width="18" height="18" x="3" y="4" rx="2" />
  <path d="M3 10h18" />
@@ -8,27 +8,27 @@
  <path d="M16 14h.01" />
  <path d="M8 18h.01" />
  <path d="M12 18h.01" />
-  <path d="M16 18h.01" /></symbol><symbol id="check-circle-2" viewBox="0 0 24 24"><circle cx="12" cy="12" r="10" />
+  <path d="M16 18h.01" /></symbol><symbol id="check-circle-2" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10" />
-  <path d="m9 12 2 2 4-4" /></symbol><symbol id="chevron-left" viewBox="0 0 24 24"><path d="m15 18-6-6 6-6" /></symbol><symbol id="chevron-right" viewBox="0 0 24 24"><path d="m9 18 6-6-6-6" /></symbol><symbol id="circle-user-round" viewBox="0 0 24 24"><path d="M17.925 20.056a6 6 0 0 0-11.851.001" />
+  <path d="m9 12 2 2 4-4" /></symbol><symbol id="chevron-left" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m15 18-6-6 6-6" /></symbol><symbol id="chevron-right" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m9 18 6-6-6-6" /></symbol><symbol id="circle-user-round" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M17.925 20.056a6 6 0 0 0-11.851.001" />
  <circle cx="12" cy="11" r="4" />
-  <circle cx="12" cy="12" r="10" /></symbol><symbol id="clock" viewBox="0 0 24 24"><circle cx="12" cy="12" r="10" />
+  <circle cx="12" cy="12" r="10" /></symbol><symbol id="clock" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10" />
-  <path d="M12 6v6l4 2" /></symbol><symbol id="folder-kanban" viewBox="0 0 24 24"><path d="M4 20h16a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.93a2 2 0 0 1-1.66-.9l-.82-1.2A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13c0 1.1.9 2 2 2Z" />
+  <path d="M12 6v6l4 2" /></symbol><symbol id="folder-kanban" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4 20h16a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.93a2 2 0 0 1-1.66-.9l-.82-1.2A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13c0 1.1.9 2 2 2Z" />
  <path d="M8 10v4" />
  <path d="M12 10v2" />
-  <path d="M16 10v6" /></symbol><symbol id="folder-open" viewBox="0 0 24 24"><path d="m6 14 1.5-2.9A2 2 0 0 1 9.24 10H20a2 2 0 0 1 1.94 2.5l-1.54 6a2 2 0 0 1-1.95 1.5H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h3.9a2 2 0 0 1 1.69.9l.81 1.2a2 2 0 0 0 1.67.9H18a2 2 0 0 1 2 2v2" /></symbol><symbol id="inbox" viewBox="0 0 24 24"><polyline points="22 12 16 12 14 15 10 15 8 12 2 12" />
+  <path d="M16 10v6" /></symbol><symbol id="folder-open" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m6 14 1.5-2.9A2 2 0 0 1 9.24 10H20a2 2 0 0 1 1.94 2.5l-1.54 6a2 2 0 0 1-1.95 1.5H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h3.9a2 2 0 0 1 1.69.9l.81 1.2a2 2 0 0 0 1.67.9H18a2 2 0 0 1 2 2v2" /></symbol><symbol id="inbox" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="22 12 16 12 14 15 10 15 8 12 2 12" />
-  <path d="M5.45 5.11 2 12v6a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-6l-3.45-6.89A2 2 0 0 0 16.76 4H7.24a2 2 0 0 0-1.79 1.11z" /></symbol><symbol id="layout-dashboard" viewBox="0 0 24 24"><rect width="7" height="9" x="3" y="3" rx="1" />
+  <path d="M5.45 5.11 2 12v6a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-6l-3.45-6.89A2 2 0 0 0 16.76 4H7.24a2 2 0 0 0-1.79 1.11z" /></symbol><symbol id="layout-dashboard" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="7" height="9" x="3" y="3" rx="1" />
  <rect width="7" height="5" x="14" y="3" rx="1" />
  <rect width="7" height="9" x="14" y="12" rx="1" />
-  <rect width="7" height="5" x="3" y="16" rx="1" /></symbol><symbol id="list-check" viewBox="0 0 24 24"><path d="M16 5H3" />
+  <rect width="7" height="5" x="3" y="16" rx="1" /></symbol><symbol id="list-check" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M16 5H3" />
  <path d="M16 12H3" />
  <path d="M11 19H3" />
-  <path d="m15 18 2 2 4-4" /></symbol><symbol id="log-out" viewBox="0 0 24 24"><path d="m16 17 5-5-5-5" />
+  <path d="m15 18 2 2 4-4" /></symbol><symbol id="log-out" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m16 17 5-5-5-5" />
  <path d="M21 12H9" />
-  <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" /></symbol><symbol id="monitor" viewBox="0 0 24 24"><rect width="20" height="14" x="2" y="3" rx="2" />
+  <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" /></symbol><symbol id="monitor" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="20" height="14" x="2" y="3" rx="2" />
  <line x1="8" x2="16" y1="21" y2="21" />
-  <line x1="12" x2="12" y1="17" y2="21" /></symbol><symbol id="moon" viewBox="0 0 24 24"><path d="M20.985 12.486a9 9 0 1 1-9.473-9.472c.405-.022.617.46.402.803a6 6 0 0 0 8.268 8.268c.344-.215.825-.004.803.401" /></symbol><symbol id="panel-left" viewBox="0 0 24 24"><rect width="18" height="18" x="3" y="3" rx="2" />
+  <line x1="12" x2="12" y1="17" y2="21" /></symbol><symbol id="moon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20.985 12.486a9 9 0 1 1-9.473-9.472c.405-.022.617.46.402.803a6 6 0 0 0 8.268 8.268c.344-.215.825-.004.803.401" /></symbol><symbol id="panel-left" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect width="18" height="18" x="3" y="3" rx="2" />
-  <path d="M9 3v18" /></symbol><symbol id="settings" viewBox="0 0 24 24"><path d="M9.671 4.136a2.34 2.34 0 0 1 4.659 0 2.34 2.34 0 0 0 3.319 1.915 2.34 2.34 0 0 1 2.33 4.033 2.34 2.34 0 0 0 0 3.831 2.34 2.34 0 0 1-2.33 4.033 2.34 2.34 0 0 0-3.319 1.915 2.34 2.34 0 0 1-4.659 0 2.34 2.34 0 0 0-3.32-1.915 2.34 2.34 0 0 1-2.33-4.033 2.34 2.34 0 0 0 0-3.831A2.34 2.34 0 0 1 6.35 6.051a2.34 2.34 0 0 0 3.319-1.915" />
+  <path d="M9 3v18" /></symbol><symbol id="settings" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9.671 4.136a2.34 2.34 0 0 1 4.659 0 2.34 2.34 0 0 0 3.319 1.915 2.34 2.34 0 0 1 2.33 4.033 2.34 2.34 0 0 0 0 3.831 2.34 2.34 0 0 1-2.33 4.033 2.34 2.34 0 0 0-3.319 1.915 2.34 2.34 0 0 1-4.659 0 2.34 2.34 0 0 0-3.32-1.915 2.34 2.34 0 0 1-2.33-4.033 2.34 2.34 0 0 0 0-3.831A2.34 2.34 0 0 1 6.35 6.051a2.34 2.34 0 0 0 3.319-1.915" />
-  <circle cx="12" cy="12" r="3" /></symbol><symbol id="sun" viewBox="0 0 24 24"><circle cx="12" cy="12" r="4" />
+  <circle cx="12" cy="12" r="3" /></symbol><symbol id="sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="4" />
  <path d="M12 2v2" />
  <path d="M12 20v2" />
  <path d="m4.93 4.93 1.41 1.41" />
@@ -36,10 +36,10 @@
  <path d="M2 12h2" />
  <path d="M20 12h2" />
  <path d="m6.34 17.66-1.41 1.41" />
-  <path d="m19.07 4.93-1.41 1.41" /></symbol><symbol id="triangle-alert" viewBox="0 0 24 24"><path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3" />
+  <path d="m19.07 4.93-1.41 1.41" /></symbol><symbol id="triangle-alert" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3" />
  <path d="M12 9v4" />
-  <path d="M12 17h.01" /></symbol><symbol id="users" viewBox="0 0 24 24"><path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2" />
+  <path d="M12 17h.01" /></symbol><symbol id="users" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2" />
  <path d="M16 3.128a4 4 0 0 1 0 7.744" />
  <path d="M22 21v-2a4 4 0 0 0-3-3.87" />
-  <circle cx="9" cy="7" r="4" /></symbol><symbol id="x" viewBox="0 0 24 24"><path d="M18 6 6 18" />
+  <circle cx="9" cy="7" r="4" /></symbol><symbol id="x" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 6 6 18" />
  <path d="m6 6 12 12" /></symbol></svg>
@@ -23,6 +23,7 @@
                <li><a class="nav-link" th:href="@{/dashboard}" data-tooltip="Overview" th:attr="aria-current=${activeNav == 'dashboard'} ? 'page' : null">
                    <svg class="nav-icon" aria-hidden="true"><use th:href="@{/assets/icons.svg#layout-dashboard}"></use></svg><span class="sidebar-label">Overview</span></a></li>
                <li sec:authorize="hasRole('ADMIN')"><a class="nav-link" th:href="@{/admin/accounts/new}" data-tooltip="Accounts" th:attr="aria-current=${activeNav == 'accounts'} ? 'page' : null"><svg class="nav-icon" aria-hidden="true"><use th:href="@{/assets/icons.svg#users}"></use></svg><span class="sidebar-label">Accounts</span></a></li>
                <li sec:authorize="hasRole('ADMIN')"><a class="nav-link" th:href="@{/admin/smtp}" data-tooltip="SMTP settings" th:attr="aria-current=${activeNav == 'smtp'} ? 'page' : null"><svg class="nav-icon" aria-hidden="true"><use th:href="@{/assets/icons.svg#settings}"></use></svg><span class="sidebar-label">SMTP settings</span></a></li>
                <li sec:authorize="hasRole('ADMIN')"><a class="nav-link" th:href="@{/attendance/calendar}" data-tooltip="Global calendar" th:attr="aria-current=${activeNav == 'calendar'} ? 'page' : null"><svg class="nav-icon" aria-hidden="true"><use th:href="@{/assets/icons.svg#calendar-days}"></use></svg><span class="sidebar-label">Global calendar</span></a></li>
                <li sec:authorize="hasRole('MENTOR')"><a class="nav-link" th:href="@{/projects}" data-tooltip="Owned Projects" th:attr="aria-current=${activeNav == 'projects'} ? 'page' : null"><svg class="nav-icon" aria-hidden="true"><use th:href="@{/assets/icons.svg#folder-kanban}"></use></svg><span class="sidebar-label">Owned Projects</span></a></li>
                <li sec:authorize="hasRole('INTERN')"><a class="nav-link" th:href="@{/attendance}" data-tooltip="My attendance" th:attr="aria-current=${activeNav == 'attendance'} ? 'page' : null"><svg class="nav-icon" aria-hidden="true"><use th:href="@{/assets/icons.svg#clock}"></use></svg><span class="sidebar-label">My attendance</span></a></li>
@@ -26,10 +26,29 @@
        <div class="form-grid form-grid-three">
            <div class="field"><label class="field-label" for="startDate">Start date</label><input class="control" id="startDate" type="date" th:field="*{startDate}" required th:attr="aria-invalid=${#fields.hasErrors('startDate')},aria-describedby=${#fields.hasErrors('startDate') ? 'startDate-error' : null}"><p class="field-error" id="startDate-error" role="alert" th:if="${#fields.hasErrors('startDate')}" th:errors="*{startDate}">Start date error</p></div>
            <div class="field"><label class="field-label" for="endDate">End date</label><input class="control" id="endDate" type="date" th:field="*{endDate}" required th:attr="aria-invalid=${#fields.hasErrors('endDate') or #fields.hasErrors('dateRangeValid')},aria-describedby=${#fields.hasErrors('endDate') ? 'endDate-error' : (#fields.hasErrors('dateRangeValid') ? 'dateRangeValid-error' : null)}"><p class="field-error" id="endDate-error" role="alert" th:if="${#fields.hasErrors('endDate')}" th:errors="*{endDate}">End date error</p><p class="field-error" id="dateRangeValid-error" role="alert" th:if="${#fields.hasErrors('dateRangeValid')}" th:errors="*{dateRangeValid}">Date range error</p></div>
-            <div class="field">
+            <div class="field" data-intern-picker>
-                <label class="field-label" for="leader">Initial Leader user ID</label>
+                <span class="field-label">Initial Leader</span>
-                <input class="control" id="leader" type="number" min="1" th:field="*{initialLeaderUserId}" required th:attr="aria-invalid=${#fields.hasErrors('initialLeaderUserId')},aria-describedby=${#fields.hasErrors('initialLeaderUserId') ? 'initialLeaderUserId-error' : null}">
+                <button class="button picker-trigger" type="button" data-picker-open
                        th:disabled="${#lists.isEmpty(eligibleInternOptions)}"
                        th:attr="aria-invalid=${#fields.hasErrors('initialLeaderUserId')},aria-describedby=${#fields.hasErrors('initialLeaderUserId') ? 'initialLeaderUserId-error' : null}">Choose an eligible Intern</button>
                <p class="picker-summary" data-picker-summary aria-live="polite">No Intern selected</p>
                <p class="field-help" th:if="${#lists.isEmpty(eligibleInternOptions)}">No eligible Interns are available.</p>
                <p class="field-error" id="initialLeaderUserId-error" role="alert" th:if="${#fields.hasErrors('initialLeaderUserId')}" th:errors="*{initialLeaderUserId}">Leader error</p>
                <dialog class="picker-drawer" data-picker-dialog aria-labelledby="leader-picker-title">
                    <div class="picker-header"><div><h2 class="panel-title" id="leader-picker-title">Choose initial Leader</h2><p class="field-help">Only currently eligible Interns are available.</p></div><button class="button" type="button" data-picker-cancel>Cancel</button></div>
                    <div class="picker-body">
                        <label class="field-label" for="leader-search">Search by name or Student Code</label>
                        <input class="control" id="leader-search" type="search" autocomplete="off" data-picker-search>
                        <div class="picker-options">
                            <label class="picker-option" data-picker-option th:each="option : ${eligibleInternOptions}" th:attr="data-picker-search=${option.displayName + ' ' + option.studentCode}">
                                <input type="radio" th:field="*{initialLeaderUserId}" th:value="${option.userId}">
                                <span><strong data-picker-label th:text="|${option.displayName} (${option.studentCode})|">Intern (Code)</strong><small th:text="|${#temporals.format(option.internshipStart, 'dd/MM/yyyy')} – ${#temporals.format(option.internshipEnd, 'dd/MM/yyyy')}|">Dates</small></span>
                            </label>
                            <p class="picker-empty" data-picker-empty th:hidden="${!#lists.isEmpty(eligibleInternOptions)}">No matching eligible Interns.</p>
                        </div>
                    </div>
                    <div class="picker-footer"><button class="button button-primary" type="button" data-picker-apply>Use selection</button></div>
                </dialog>
            </div>
        </div>
        <div class="form-actions"><a class="button" th:href="@{/projects}">Cancel</a><button class="button button-primary" type="submit">Create Project</button></div>
@@ -20,10 +20,32 @@
            <tbody><tr th:each="term : ${leadership}"><td th:text="${term.leaderName}">Leader</td><td th:text="${#temporals.format(term.startedAt, 'dd/MM/yyyy HH:mm')}">Started</td><td th:text="${term.endedAt == null ? 'Current' : #temporals.format(term.endedAt, 'dd/MM/yyyy HH:mm')}">Current</td></tr></tbody>
        </table></div>
    </section>
-    <form class="panel form-panel filter-form" th:if="${project.canManage}" method="post" th:action="@{/projects/{id}/leadership(id=${project.id})}" th:object="${projectMemberForm}">
+    <form class="panel form-panel form-grid" th:if="${project.canManage}" method="post" th:action="@{/projects/{id}/leadership(id=${project.id})}" th:object="${projectMemberForm}">
        <div class="alert alert-error" role="alert" th:if="${#fields.hasAnyErrors()}">Please correct the Leader selection.</div>
-        <div class="field"><label class="field-label" for="leader">New Leader user ID</label><input class="control" id="leader" th:field="*{internUserId}" type="number" min="1" required th:attr="aria-invalid=${#fields.hasErrors('internUserId')},aria-describedby=${#fields.hasErrors('internUserId') ? 'leadership-intern-user-error' : null}"><p class="field-error" id="leadership-intern-user-error" role="alert" th:if="${#fields.hasErrors('internUserId')}" th:errors="*{internUserId}"></p></div>
+        <div class="field" data-intern-picker>
-        <span></span><button class="button button-primary" type="submit">Change Leader</button>
+            <span class="field-label">New Leader</span>
            <button class="button picker-trigger" type="button" data-picker-open th:disabled="${#lists.isEmpty(eligibleInternOptions)}"
                    th:attr="aria-invalid=${#fields.hasErrors('internUserId')},aria-describedby=${#fields.hasErrors('internUserId') ? 'leadership-intern-user-error' : null}">Choose a current member</button>
            <p class="picker-summary" data-picker-summary aria-live="polite">No Intern selected</p>
            <p class="field-help" th:if="${#lists.isEmpty(eligibleInternOptions)}">No eligible current members are available.</p>
            <p class="field-error" id="leadership-intern-user-error" role="alert" th:if="${#fields.hasErrors('internUserId')}" th:errors="*{internUserId}"></p>
            <dialog class="picker-drawer" data-picker-dialog aria-labelledby="leadership-picker-title">
                <div class="picker-header"><div><h2 class="panel-title" id="leadership-picker-title">Choose new Leader</h2><p class="field-help">Only eligible current members other than the current Leader are available.</p></div><button class="button" type="button" data-picker-cancel>Cancel</button></div>
                <div class="picker-body">
                    <label class="field-label" for="leadership-search">Search by name or Student Code</label>
                    <input class="control" id="leadership-search" type="search" autocomplete="off" data-picker-search>
                    <div class="picker-options">
                        <label class="picker-option" data-picker-option th:each="option : ${eligibleInternOptions}" th:attr="data-picker-search=${option.displayName + ' ' + option.studentCode}">
                            <input type="radio" th:field="*{internUserId}" th:value="${option.userId}">
                            <span><strong data-picker-label th:text="|${option.displayName} (${option.studentCode})|">Intern (Code)</strong><small th:text="|${#temporals.format(option.internshipStart, 'dd/MM/yyyy')} – ${#temporals.format(option.internshipEnd, 'dd/MM/yyyy')}|">Dates</small></span>
                        </label>
                        <p class="picker-empty" data-picker-empty th:hidden="${!#lists.isEmpty(eligibleInternOptions)}">No matching eligible current members.</p>
                    </div>
                </div>
                <div class="picker-footer"><button class="button button-primary" type="button" data-picker-apply>Use selection</button></div>
            </dialog>
        </div>
        <div class="form-actions"><button class="button button-primary" type="submit">Change Leader</button></div>
    </form>
 </main>
 </body>
@@ -20,10 +20,34 @@
            <tbody><tr th:each="member : ${members}"><td th:text="${member.displayName}">Intern</td><td th:text="${#temporals.format(member.joinedAt, 'dd/MM/yyyy HH:mm')}">Joined</td><td th:text="${member.leftAt == null ? 'Current' : #temporals.format(member.leftAt, 'dd/MM/yyyy HH:mm')}">Current</td><td><span class="badge" th:classappend="${member.currentLeader ? ' badge-success' : ''}" th:text="${member.currentLeader ? 'Leader' : 'Member'}">Member</span></td></tr></tbody>
        </table></div>
    </section>
-    <form class="panel form-panel filter-form" th:if="${project.canManage}" method="post" th:action="@{/projects/{id}/members(id=${project.id})}" th:object="${projectMemberForm}">
+    <form class="panel form-panel form-grid" th:if="${project.canManage}" method="post" th:action="@{/projects/{id}/members(id=${project.id})}" th:object="${projectMembersForm}">
-        <div class="alert alert-error" role="alert" th:if="${#fields.hasAnyErrors()}">Please correct the member selection.</div>
+        <div class="alert alert-error" role="alert" th:if="${#fields.hasAnyErrors()}"><strong>Member selection could not be saved.</strong><ul><li th:each="fieldError : ${#fields.allErrors()}" th:text="${fieldError}">Selection error</li></ul></div>
-        <div class="field"><label class="field-label" for="intern">Intern user ID</label><input class="control" id="intern" th:field="*{internUserId}" type="number" min="1" required th:attr="aria-invalid=${#fields.hasErrors('internUserId')},aria-describedby=${#fields.hasErrors('internUserId') ? 'member-intern-user-error' : null}"><p class="field-error" id="member-intern-user-error" role="alert" th:if="${#fields.hasErrors('internUserId')}" th:errors="*{internUserId}"></p></div>
+        <div class="field" data-intern-picker>
-        <span></span><button class="button button-primary" type="submit">Add member</button>
+            <span class="field-label">Interns to add</span>
            <button class="button picker-trigger" type="button" data-picker-open th:disabled="${#lists.isEmpty(eligibleInternOptions)}"
                    th:attr="aria-invalid=${#fields.hasErrors('internUserIds')},aria-describedby=${#fields.hasErrors('internUserIds') ? 'member-intern-user-error' : null}">Choose eligible Interns</button>
            <p class="picker-summary" data-picker-summary aria-live="polite">No Interns selected</p>
            <p class="field-help" th:if="${#lists.isEmpty(eligibleInternOptions)}">No eligible nonmembers are available.</p>
            <p class="field-error" id="member-intern-user-error" role="alert" th:if="${#fields.hasErrors('internUserIds')}" th:errors="*{internUserIds}"></p>
            <p class="field-help" role="status" th:if="${unavailableSelectionCount != null and unavailableSelectionCount > 0}"
               th:text="${unavailableSelectionCount == 1 ? '1 previously selected Intern is no longer eligible; choose a replacement.' : unavailableSelectionCount + ' previously selected Interns are no longer eligible; choose replacements.'}">Unavailable selection recovery</p>
            <dialog class="picker-drawer" data-picker-dialog aria-labelledby="member-picker-title">
                <div class="picker-header"><div><h2 class="panel-title" id="member-picker-title">Add Project members</h2><p class="field-help">Select one or more eligible Interns who are not current members.</p></div><button class="button" type="button" data-picker-cancel>Cancel</button></div>
                <div class="picker-body">
                    <label class="field-label" for="member-search">Search by name or Student Code</label>
                    <input class="control" id="member-search" type="search" autocomplete="off" data-picker-search>
                    <div class="picker-options">
                        <label class="picker-option" data-picker-option th:each="option : ${eligibleInternOptions}" th:attr="data-picker-search=${option.displayName + ' ' + option.studentCode}">
                            <input type="checkbox" th:field="*{internUserIds}" th:value="${option.userId}">
                            <span><strong data-picker-label th:text="|${option.displayName} (${option.studentCode})|">Intern (Code)</strong><small th:text="|${#temporals.format(option.internshipStart, 'dd/MM/yyyy')} – ${#temporals.format(option.internshipEnd, 'dd/MM/yyyy')}|">Dates</small></span>
                        </label>
                        <p class="picker-empty" data-picker-empty th:hidden="${!#lists.isEmpty(eligibleInternOptions)}">No matching eligible Interns.</p>
                    </div>
                </div>
                <div class="picker-footer"><button class="button button-primary" type="button" data-picker-apply>Use selection</button></div>
            </dialog>
        </div>
        <div class="form-actions"><button class="button button-primary" type="submit">Add selected members</button></div>
    </form>
 </main>
 </body>
@@ -0,0 +1,80 @@
 package com.lab.labtimesheet;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.Mockito.mockStatic;
 import java.sql.Connection;
 import java.sql.DriverManager;
 import java.sql.SQLException;
 import java.util.TimeZone;
 import org.junit.jupiter.api.Test;
 import org.mockito.MockedStatic;
 import org.springframework.boot.SpringApplication;
 import org.testcontainers.postgresql.PostgreSQLContainer;
 import org.testcontainers.utility.DockerImageName;
 class ApplicationTimeZoneIntegrationTest {
    @Test
    void mainCanonicalizesLegacyAliasBeforeStartingSpring() {
        TimeZone originalTimeZone = TimeZone.getDefault();
        String[] args = {"--spring.profiles.active=test"};
        try (MockedStatic<SpringApplication> springApplication = mockStatic(SpringApplication.class)) {
            TimeZone.setDefault(TimeZone.getTimeZone("Asia/Saigon"));
            LabtimesheetApplication.main(args);
            assertThat(TimeZone.getDefault().getID()).isEqualTo("Asia/Ho_Chi_Minh");
            springApplication.verify(() -> SpringApplication.run(LabtimesheetApplication.class, args));
        } finally {
            TimeZone.setDefault(originalTimeZone);
        }
    }
    @Test
    void canonicalizesLegacyVietnamAliasBeforePostgresConnects() throws SQLException {
        TimeZone originalTimeZone = TimeZone.getDefault();
        try (PostgreSQLContainer postgres =
                new PostgreSQLContainer(DockerImageName.parse("postgres:18.4"))) {
            postgres.start();
            TimeZone.setDefault(TimeZone.getTimeZone("Asia/Saigon"));
            assertThat(TimeZone.getDefault().getID()).isEqualTo("Asia/Saigon");
            assertThatThrownBy(() -> openConnection(postgres))
                    .isInstanceOf(SQLException.class)
                    .hasMessageContaining("Asia/Saigon");
            LabtimesheetApplication.normalizeDefaultTimeZone();
            assertThat(TimeZone.getDefault().getID()).isEqualTo("Asia/Ho_Chi_Minh");
            try (Connection connection = openConnection(postgres)) {
                assertThat(connection.isValid(1)).isTrue();
            }
        } finally {
            TimeZone.setDefault(originalTimeZone);
        }
    }
    @Test
    void leavesSupportedSystemTimeZoneUnchanged() {
        TimeZone originalTimeZone = TimeZone.getDefault();
        try {
            TimeZone.setDefault(TimeZone.getTimeZone("Europe/Paris"));
            LabtimesheetApplication.normalizeDefaultTimeZone();
            assertThat(TimeZone.getDefault().getID()).isEqualTo("Europe/Paris");
        } finally {
            TimeZone.setDefault(originalTimeZone);
        }
    }
    private static Connection openConnection(PostgreSQLContainer postgres) throws SQLException {
        return DriverManager.getConnection(postgres.getJdbcUrl(), postgres.getUsername(), postgres.getPassword());
    }
 }
@@ -2,6 +2,7 @@ package com.lab.labtimesheet.feature.account.service;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 import java.time.LocalDate;
@@ -57,10 +58,15 @@ class BootstrapIntegrationTest {
    private DataSource dataSource;
    @Test
-    void onlyBootstrapAndHealthAreAvailableBeforeInitialization() throws Exception {
+    void rootGuidesFreshInstallToBootstrapWhileOtherRoutesRemainHidden() throws Exception {
        mockMvc.perform(get("/bootstrap")).andExpect(status().isOk());
        mockMvc.perform(get("/actuator/health")).andExpect(status().isOk());
-        mockMvc.perform(get("/")).andExpect(status().isNotFound());
+        mockMvc.perform(get("/actuator/health/liveness")).andExpect(status().isOk());
        mockMvc.perform(get("/actuator/health/readiness")).andExpect(status().isOk());
        mockMvc.perform(get("/"))
                .andExpect(status().is3xxRedirection())
                .andExpect(redirectedUrl("/bootstrap"));
        mockMvc.perform(get("/dashboard")).andExpect(status().isNotFound());
        bootstrapService.bootstrap("admin@example.com", "Admin", "correct horse battery staple");
        mockMvc.perform(get("/bootstrap")).andExpect(status().isNotFound());
@@ -0,0 +1,165 @@
 package com.lab.labtimesheet.feature.account.service;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import java.sql.Timestamp;
 import java.time.Instant;
 import java.time.LocalDate;
 import java.util.List;
 import com.lab.labtimesheet.config.TestcontainersConfiguration;
 import com.lab.labtimesheet.feature.account.model.GlobalRole;
 import com.lab.labtimesheet.feature.account.model.dto.EligibleInternOption;
 import com.lab.labtimesheet.feature.account.model.entity.AppUser;
 import com.lab.labtimesheet.feature.account.model.entity.InternProfile;
 import com.lab.labtimesheet.feature.account.repository.AppUserRepository;
 import com.lab.labtimesheet.feature.account.repository.InternProfileRepository;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.context.annotation.Import;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
@Import(TestcontainersConfiguration.class)
@SpringBootTest
@ActiveProfiles("test")
@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_EACH_TEST_METHOD)
 class EligibleInternOptionIntegrationTest {
    private static final Instant NOW = Instant.parse("2026-08-14T00:00:00Z");
    private static final LocalDate BUSINESS_DATE = LocalDate.of(2026, 8, 14);
    @Autowired
    private AccountService accounts;
    @Autowired
    private AppUserRepository users;
    @Autowired
    private InternProfileRepository internProfiles;
    @Autowired
    private JdbcTemplate jdbc;
    private AppUser admin;
    private int userSequence;
    @BeforeEach
    void setUp() {
        admin = users.saveAndFlush(AppUser.bootstrapAdmin(
                "picker-admin@example.com", "Picker Admin", "encoded-password", NOW));
    }
    @Test
    void listsOnlyActiveInternsWithActiveInclusiveInternshipsInPickerOrder() {
        long lowerBoundary = activeIntern("Alpha", "STU-100", BUSINESS_DATE, BUSINESS_DATE.plusDays(10));
        long upperBoundary = activeIntern("Alpha", "STU-200", BUSINESS_DATE.minusDays(10), BUSINESS_DATE);
        long laterName = activeIntern("Zeta", "STU-300", BUSINESS_DATE.minusDays(1), BUSINESS_DATE.plusDays(1));
        pendingInternWithActiveProfile("Ignored Pending", "STU-400");
        long locked = activeIntern("Ignored Locked", "STU-500", BUSINESS_DATE.minusDays(1), BUSINESS_DATE.plusDays(1));
        lock(locked);
        long deactivated = activeIntern(
                "Ignored Deactivated", "STU-600", BUSINESS_DATE.minusDays(1), BUSINESS_DATE.plusDays(1));
        deactivate(deactivated);
        activeMentorWithActiveProfile("Ignored Mentor", "STU-700");
        activeInternWithNotStartedProfile("Ignored Not Started", "STU-800");
        activeIntern("Ignored Ended", "STU-900", BUSINESS_DATE.minusDays(10), BUSINESS_DATE.minusDays(1));
        long completed = activeIntern(
                "Ignored Completed", "STU-1000", BUSINESS_DATE.minusDays(1), BUSINESS_DATE.plusDays(1));
        completeInternship(completed);
        List<EligibleInternOption> options = accounts.eligibleInternOptions(BUSINESS_DATE);
        assertThat(options).containsExactly(
                new EligibleInternOption(
                        lowerBoundary, "Alpha", "STU-100", BUSINESS_DATE, BUSINESS_DATE.plusDays(10)),
                new EligibleInternOption(
                        upperBoundary, "Alpha", "STU-200", BUSINESS_DATE.minusDays(10), BUSINESS_DATE),
                new EligibleInternOption(
                        laterName, "Zeta", "STU-300", BUSINESS_DATE.minusDays(1), BUSINESS_DATE.plusDays(1)));
        assertThat(options).extracting(EligibleInternOption::userId).doesNotHaveDuplicates();
    }
    @Test
    void rejectsMissingBusinessDate() {
        assertThatThrownBy(() -> accounts.eligibleInternOptions(null))
                .isInstanceOf(IllegalArgumentException.class)
                .hasMessage("Business date is required");
    }
    private long activeIntern(String displayName, String studentCode, LocalDate startDate, LocalDate endDate) {
        long userId = activeUser(GlobalRole.INTERN, displayName);
        activeProfile(userId, studentCode, startDate, endDate);
        return userId;
    }
    private void pendingInternWithActiveProfile(String displayName, String studentCode) {
        long userId = pendingUser(GlobalRole.INTERN, displayName);
        activeProfile(userId, studentCode, BUSINESS_DATE.minusDays(1), BUSINESS_DATE.plusDays(1));
    }
    private void activeMentorWithActiveProfile(String displayName, String studentCode) {
        long userId = activeUser(GlobalRole.MENTOR, displayName);
        activeProfile(userId, studentCode, BUSINESS_DATE.minusDays(1), BUSINESS_DATE.plusDays(1));
    }
    private void activeInternWithNotStartedProfile(String displayName, String studentCode) {
        long userId = activeUser(GlobalRole.INTERN, displayName);
        internProfiles.saveAndFlush(InternProfile.notStarted(
                userId, studentCode, BUSINESS_DATE.minusDays(1), BUSINESS_DATE.plusDays(1), NOW));
    }
    private long activeUser(GlobalRole role, String displayName) {
        AppUser user = AppUser.pending(nextEmail(), displayName, role, admin, NOW);
        user.activate("encoded-password", NOW);
        return users.saveAndFlush(user).getId();
    }
    private long pendingUser(GlobalRole role, String displayName) {
        return users.saveAndFlush(AppUser.pending(nextEmail(), displayName, role, admin, NOW)).getId();
    }
    private void activeProfile(long userId, String studentCode, LocalDate startDate, LocalDate endDate) {
        InternProfile profile = InternProfile.notStarted(userId, studentCode, startDate, endDate, NOW);
        profile.activate(NOW);
        internProfiles.saveAndFlush(profile);
    }
    private void lock(long userId) {
        assertThat(jdbc.update(
                """
                update app_users
                set account_status = 'LOCKED', locked_at = ?, updated_at = ?
                where id = ?
                """,
                Timestamp.from(NOW), Timestamp.from(NOW), userId)).isOne();
    }
    private void deactivate(long userId) {
        assertThat(jdbc.update(
                """
                update app_users
                set account_status = 'DEACTIVATED', deactivated_at = ?, updated_at = ?
                where id = ?
                """,
                Timestamp.from(NOW), Timestamp.from(NOW), userId)).isOne();
    }
    private void completeInternship(long userId) {
        assertThat(jdbc.update(
                """
                update intern_profiles
                set internship_status = 'COMPLETED', completed_at = ?, updated_at = ?
                where user_id = ?
                """,
                Timestamp.from(NOW), Timestamp.from(NOW), userId)).isOne();
    }
    private String nextEmail() {
        return "picker-" + ++userSequence + "@example.com";
    }
 }
@@ -0,0 +1,154 @@
 package com.lab.labtimesheet.feature.attendance.controller;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 import com.lab.labtimesheet.config.TestcontainersConfiguration;
 import com.lab.labtimesheet.feature.account.model.GlobalRole;
 import com.lab.labtimesheet.feature.account.model.dto.CreateAccountCommand;
 import com.lab.labtimesheet.feature.account.service.AccountService;
 import com.lab.labtimesheet.feature.integration.model.SecurityMode;
 import com.lab.labtimesheet.feature.integration.model.dto.SmtpConnection;
 import com.lab.labtimesheet.feature.integration.model.dto.SmtpDraft;
 import com.lab.labtimesheet.feature.integration.service.SmtpConfigurationService;
 import com.lab.labtimesheet.feature.integration.service.SmtpProbe;
 import java.time.LocalDate;
 import java.util.ArrayList;
 import java.util.List;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.context.TestConfiguration;
 import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Import;
 import org.springframework.context.annotation.Primary;
 import org.springframework.mock.web.MockHttpSession;
 import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.web.servlet.MockMvc;
@Import({TestcontainersConfiguration.class, CalendarAuthorizationWebIntegrationTest.MailProbeConfiguration.class})
@SpringBootTest
@AutoConfigureMockMvc
@ActiveProfiles("test")
@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_EACH_TEST_METHOD)
 class CalendarAuthorizationWebIntegrationTest {
    private static final String PASSWORD = "correct horse battery staple";
    private static final String ADMIN_EMAIL = "admin@example.test";
    @Autowired
    private MockMvc mockMvc;
    @Autowired
    private AccountService accounts;
    @Autowired
    private SmtpConfigurationService smtp;
    @Autowired
    private RecordingSmtpProbe mail;
    @Test
    void formAuthenticatedAdminCanOpenCalendarWhileMentorAndInternAreDenied() throws Exception {
        bootstrapFirstAdminThroughTheForm();
        MockHttpSession adminSession = login(ADMIN_EMAIL, PASSWORD, "ADMIN");
        mockMvc.perform(get("/attendance/calendar").session(adminSession))
                .andExpect(status().isOk());
        long adminId = accounts.requireActiveAdminId(ADMIN_EMAIL);
        configureSmtp(adminId);
        createAndActivate(adminId, new CreateAccountCommand(
                "mentor@example.test", "Mentor", GlobalRole.MENTOR, null, null, null));
        createAndActivate(adminId, new CreateAccountCommand(
                "intern@example.test",
                "Intern",
                GlobalRole.INTERN,
                "INT-001",
                LocalDate.of(2026, 8, 1),
                LocalDate.of(2026, 12, 31)));
        mockMvc.perform(get("/attendance/calendar").session(login("mentor@example.test", PASSWORD, "MENTOR")))
                .andExpect(status().isForbidden());
        mockMvc.perform(get("/attendance/calendar").session(login("intern@example.test", PASSWORD, "INTERN")))
                .andExpect(status().isForbidden());
    }
    private void bootstrapFirstAdminThroughTheForm() throws Exception {
        mockMvc.perform(post("/bootstrap")
                        .with(csrf())
                        .param("email", ADMIN_EMAIL)
                        .param("displayName", "Admin")
                        .param("password", PASSWORD))
                .andExpect(status().is3xxRedirection())
                .andExpect(redirectedUrl("/admin/smtp?onboarding"));
    }
    private MockHttpSession login(String email, String password, String role) throws Exception {
        var result = mockMvc.perform(post("/login")
                        .with(csrf())
                        .param("username", email)
                        .param("password", password))
                .andExpect(status().is3xxRedirection())
                .andExpect(authenticated().withUsername(email))
                .andExpect(authenticated().withRoles(role))
                .andReturn();
        return (MockHttpSession) result.getRequest().getSession(false);
    }
    private void configureSmtp(long adminId) {
        long draftId = smtp.saveDraft(adminId, new SmtpDraft(
                "mailpit", 1025, SecurityMode.NONE, null, null, ADMIN_EMAIL, "Lab Timesheet"));
        smtp.testDraft(draftId, adminId, ADMIN_EMAIL);
        smtp.activate(draftId, adminId);
        mail.clear();
    }
    private void createAndActivate(long adminId, CreateAccountCommand command) {
        var creation = accounts.create(command, adminId);
        assertThat(creation.deliverySucceeded()).isTrue();
        assertThat(accounts.activate(mail.activationTokenFor(command.email()), PASSWORD)).isTrue();
    }
    @TestConfiguration(proxyBeanMethods = false)
    static class MailProbeConfiguration {
        @Bean
        @Primary
        RecordingSmtpProbe recordingSmtpProbe() {
            return new RecordingSmtpProbe();
        }
    }
    static final class RecordingSmtpProbe implements SmtpProbe {
        private final List<Message> messages = new ArrayList<>();
        @Override
        public void send(SmtpConnection connection, String recipient, String subject, String body) {
            messages.add(new Message(recipient, body));
        }
        void clear() {
            messages.clear();
        }
        String activationTokenFor(String recipient) {
            String body = messages.stream()
                    .filter(message -> message.recipient().equals(recipient))
                    .findFirst()
                    .orElseThrow()
                    .body();
            int tokenStart = body.indexOf("token=");
            assertThat(tokenStart).isGreaterThanOrEqualTo(0);
            return body.substring(tokenStart + "token=".length()).trim();
        }
    }
    record Message(String recipient, String body) {
    }
 }
@@ -0,0 +1,87 @@
 package com.lab.labtimesheet.feature.attendance.controller;
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 import com.lab.labtimesheet.config.TestcontainersConfiguration;
 import java.util.TimeZone;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
 import org.springframework.context.ApplicationContextInitializer;
 import org.springframework.context.ConfigurableApplicationContext;
 import org.springframework.context.annotation.Import;
 import org.springframework.mock.web.MockHttpSession;
 import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.ContextConfiguration;
 import org.springframework.test.web.servlet.MockMvc;
@Import(TestcontainersConfiguration.class)
@SpringBootTest(properties = {
        "LAB_SMTP_HOST=localhost",
        "LAB_SMTP_PORT=1025",
        "LAB_SERVER_PORT=0",
        "LAB_FORWARD_HEADERS_STRATEGY=none",
        "LAB_PUBLIC_ORIGIN=http://localhost:8080",
        "LAB_SECURITY_MASTER_KEY=AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
 })
@AutoConfigureMockMvc
@ActiveProfiles({"dev", "test"})
@ContextConfiguration(initializers = CalendarDevelopmentProfileWebIntegrationTest.AsiaHoChiMinhTimeZoneInitializer.class)
@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_CLASS)
 class CalendarDevelopmentProfileWebIntegrationTest {
    private static final String ADMIN_EMAIL = "admin@example.test";
    private static final String PASSWORD = "correct horse battery staple";
    @Autowired
    private MockMvc mockMvc;
    @Test
    void v1SeededPolicyLetsFormAuthenticatedAdminOpenCalendarInAsiaHoChiMinhDevelopmentProfile() throws Exception {
        mockMvc.perform(post("/bootstrap")
                        .with(csrf())
                        .param("email", ADMIN_EMAIL)
                        .param("displayName", "Admin")
                        .param("password", PASSWORD))
                .andExpect(status().is3xxRedirection())
                .andExpect(redirectedUrl("/admin/smtp?onboarding"));
        var login = mockMvc.perform(post("/login")
                        .with(csrf())
                        .param("username", ADMIN_EMAIL)
                        .param("password", PASSWORD))
                .andExpect(status().is3xxRedirection())
                .andExpect(authenticated().withUsername(ADMIN_EMAIL))
                .andReturn();
        mockMvc.perform(get("/attendance/calendar")
                        .session((MockHttpSession) login.getRequest().getSession(false)))
                .andExpect(status().isOk());
    }
    @AfterAll
    static void restoreSystemDefaultTimeZone() {
        TimeZone.setDefault(AsiaHoChiMinhTimeZoneInitializer.originalDefaultTimeZone());
    }
    static final class AsiaHoChiMinhTimeZoneInitializer
            implements ApplicationContextInitializer<ConfigurableApplicationContext> {
        private static final TimeZone ORIGINAL_DEFAULT_TIME_ZONE = TimeZone.getDefault();
        @Override
        public void initialize(ConfigurableApplicationContext applicationContext) {
            TimeZone.setDefault(TimeZone.getTimeZone("Asia/Ho_Chi_Minh"));
        }
        static TimeZone originalDefaultTimeZone() {
            return ORIGINAL_DEFAULT_TIME_ZONE;
        }
    }
 }
@@ -1,5 +1,7 @@
 package com.lab.labtimesheet.feature.project.controller;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
@@ -17,6 +19,8 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
 import com.lab.labtimesheet.feature.project.exception.ProjectAccessDeniedException;
 import com.lab.labtimesheet.feature.project.exception.ProjectRuleViolationException;
 import com.lab.labtimesheet.feature.account.model.dto.EligibleInternOption;
 import com.lab.labtimesheet.feature.account.service.AccountService;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectCreateCommand;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectActorView;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectDetail;
@@ -27,9 +31,13 @@ import com.lab.labtimesheet.feature.project.service.ProjectQueryService;
 import com.lab.labtimesheet.feature.project.service.ProjectService;
 import com.lab.labtimesheet.feature.integration.service.SmtpConfigurationService;
 import java.time.Instant;
 import java.time.Clock;
 import java.time.LocalDate;
 import java.time.ZoneId;
 import java.util.List;
 import java.util.regex.Pattern;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.ValueSource;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -50,9 +58,120 @@ class ProjectControllerTest {
    @MockitoBean
    private ProjectService projects;
    @MockitoBean
    private AccountService accounts;
    @MockitoBean
    private Clock clock;
    @MockitoBean
    private SmtpConfigurationService smtpConfiguration;
    @BeforeEach
    void serverBusinessDate() {
        when(clock.instant()).thenReturn(Instant.parse("2026-08-15T01:00:00Z"));
        when(clock.getZone()).thenReturn(ZoneId.of("Asia/Ho_Chi_Minh"));
    }
    @Test
    @WithMockUser(username = "mentor@example.test")
    void projectCreationRendersSearchableEligibleLeaderOptionsWithoutVisibleNumericIds() throws Exception {
        when(pages.authenticatedActor("mentor@example.test"))
                .thenReturn(new ProjectActorView(10L, "MENTOR"));
        when(accounts.eligibleInternOptions(LocalDate.of(2026, 8, 15))).thenReturn(List.of(
                option(20L, "Nguyen An", "STU-020"),
                option(21L, "Tran Binh", "STU-021")));
        String html = mvc.perform(get("/projects/new"))
                .andExpect(status().isOk())
                .andExpect(model().attributeExists("eligibleInternOptions"))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(containsString("data-intern-picker")))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(containsString("type=\"radio\"")))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(containsString("Nguyen An")))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(containsString("STU-020")))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(containsString("01/08/2026 – 31/12/2026")))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(not(containsString("Initial Leader user ID"))))
                .andReturn().getResponse().getContentAsString();
        assertFalse(containsRequiredRadio(html));
    }
    @Test
    @WithMockUser(username = "mentor@example.test")
    void projectCreationExplainsWhenNoEligibleLeaderIsAvailable() throws Exception {
        when(pages.authenticatedActor("mentor@example.test"))
                .thenReturn(new ProjectActorView(10L, "MENTOR"));
        when(accounts.eligibleInternOptions(LocalDate.of(2026, 8, 15))).thenReturn(List.of());
        mvc.perform(get("/projects/new"))
                .andExpect(status().isOk())
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(containsString("No eligible Interns are available.")));
    }
    @Test
    @WithMockUser(username = "mentor@example.test")
    void memberAndLeadershipPickersExposeOnlyValidServerFilteredOptions() throws Exception {
        when(pages.authenticatedUserId("mentor@example.test")).thenReturn(10L);
        when(pages.detail(10L, 30L)).thenReturn(plannedOwnerDetail());
        when(pages.members(10L, 30L)).thenReturn(List.of(
                new ProjectMemberView(40L, 20L, "Current Leader", Instant.parse("2026-08-15T00:00:00Z"), null, true),
                new ProjectMemberView(41L, 21L, "Current Member", Instant.parse("2026-08-15T00:00:00Z"), null, false)));
        when(pages.leadership(10L, 30L)).thenReturn(List.of());
        when(accounts.eligibleInternOptions(LocalDate.of(2026, 8, 15))).thenReturn(List.of(
                option(20L, "Current Leader", "STU-020"),
                option(21L, "Current Member", "STU-021"),
                option(22L, "Eligible Nonmember", "STU-022")));
        String membersHtml = mvc.perform(get("/projects/30/members"))
                .andExpect(status().isOk())
                .andReturn().getResponse().getContentAsString();
        assertTrue(membersHtml.contains("name=\"internUserIds\""));
        assertTrue(membersHtml.contains("Eligible Nonmember"));
        assertFalse(membersHtml.contains("data-picker-label>Current Member"));
        String leadershipHtml = mvc.perform(get("/projects/30/leadership"))
                .andExpect(status().isOk())
                .andReturn().getResponse().getContentAsString();
        assertTrue(leadershipHtml.contains("type=\"radio\""));
        assertTrue(leadershipHtml.contains("Current Member"));
        assertFalse(leadershipHtml.contains("Eligible Nonmember"));
        assertFalse(leadershipHtml.contains("data-picker-label>Current Leader"));
        assertFalse(containsRequiredRadio(leadershipHtml));
    }
    @Test
    @WithMockUser(username = "mentor@example.test")
    void rejectedMemberBatchRetainsEligibleSelectionsAndExplainsUnavailableCountWithoutIds() throws Exception {
        when(pages.authenticatedUserId("mentor@example.test")).thenReturn(10L);
        when(pages.detail(10L, 30L)).thenReturn(plannedOwnerDetail());
        when(pages.members(10L, 30L)).thenReturn(List.of());
        when(accounts.eligibleInternOptions(LocalDate.of(2026, 8, 15))).thenReturn(List.of(
                option(21L, "First Intern", "STU-021")));
        doThrow(new ProjectRuleViolationException("One or more selected Interns are no longer eligible"))
                .when(projects).addMembers(10L, 30L, List.of(21L, 22L));
        mvc.perform(post("/projects/30/members")
                        .with(csrf())
                        .param("internUserIds", "21", "22"))
                .andExpect(status().isOk())
                .andExpect(view().name("projects/members"))
                .andExpect(model().attributeHasFieldErrors("projectMembersForm", "internUserIds"))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(containsString("One or more selected Interns are no longer eligible")))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(containsString("1 previously selected Intern is no longer eligible; choose a replacement.")))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(containsString("value=\"21\" id=\"internUserIds1\" name=\"internUserIds\" checked=\"checked\"")))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(not(containsString("value=\"22\""))));
    }
    @Test
    @WithMockUser(username = "mentor@example.test")
    void listsOnlyTheAuthenticatedUsersAuthorizedProjects() throws Exception {
@@ -144,7 +263,8 @@ class ProjectControllerTest {
    @Test
    @WithMockUser(username = "mentor@example.test")
    void validCreateSubmissionUsesAuthenticatedMentorAndRedirectsToDetail() throws Exception {
-        when(pages.authenticatedUserId("mentor@example.test")).thenReturn(10L);
+        when(pages.authenticatedActor("mentor@example.test"))
                .thenReturn(new ProjectActorView(10L, "MENTOR"));
        when(projects.create(
                        10L,
                        new ProjectCreateCommand(
@@ -166,6 +286,50 @@ class ProjectControllerTest {
                .andExpect(redirectedUrl("/projects/30"));
    }
    @Test
    @WithMockUser(username = "mentor@example.test")
    void missingInitialLeaderReRendersServerFieldError() throws Exception {
        when(pages.authenticatedActor("mentor@example.test"))
                .thenReturn(new ProjectActorView(10L, "MENTOR"));
        mvc.perform(post("/projects")
                        .with(csrf())
                        .param("name", "Intern Portal Refresh")
                        .param("startDate", "2026-08-15")
                        .param("endDate", "2026-09-30"))
                .andExpect(status().isOk())
                .andExpect(view().name("projects/form"))
                .andExpect(model().attributeHasFieldErrors("projectForm", "initialLeaderUserId"))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(containsString("id=\"initialLeaderUserId-error\"")));
        verify(projects, never()).create(org.mockito.ArgumentMatchers.anyLong(), org.mockito.ArgumentMatchers.any());
    }
    @Test
    @WithMockUser(username = "mentor@example.test")
    void missingReplacementLeaderReRendersServerFieldError() throws Exception {
        when(pages.authenticatedUserId("mentor@example.test")).thenReturn(10L);
        when(pages.detail(10L, 30L)).thenReturn(plannedOwnerDetail());
        when(pages.leadership(10L, 30L)).thenReturn(List.of());
        when(pages.members(10L, 30L)).thenReturn(List.of(new ProjectMemberView(
                41L, 21L, "Current Member", Instant.parse("2026-08-15T00:00:00Z"), null, false)));
        when(accounts.eligibleInternOptions(LocalDate.of(2026, 8, 15))).thenReturn(List.of(
                option(21L, "Current Member", "STU-021")));
        mvc.perform(post("/projects/30/leadership").with(csrf()))
                .andExpect(status().isOk())
                .andExpect(view().name("projects/leadership"))
                .andExpect(model().attributeHasFieldErrors("projectMemberForm", "internUserId"))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(containsString("id=\"leadership-intern-user-error\"")));
        verify(projects, never()).changeLeader(
                org.mockito.ArgumentMatchers.anyLong(),
                org.mockito.ArgumentMatchers.anyLong(),
                org.mockito.ArgumentMatchers.anyLong());
    }
    @Test
    @WithMockUser(username = "mentor@example.test")
    void owningMentorCanActivateAPlannedProject() throws Exception {
@@ -217,6 +381,9 @@ class ProjectControllerTest {
    @Test
    @WithMockUser(username = "mentor@example.test")
    void invalidCreateSubmissionStaysOnSafeFormWithoutMutation() throws Exception {
        when(pages.authenticatedActor("mentor@example.test"))
                .thenReturn(new ProjectActorView(10L, "MENTOR"));
        mvc.perform(post("/projects")
                        .with(csrf())
                        .param("name", " ")
@@ -239,6 +406,8 @@ class ProjectControllerTest {
    @Test
    @WithMockUser(username = "mentor@example.test")
    void domainValidationErrorsStayOnTheirSafeFormsWithRetainedInput() throws Exception {
        when(pages.authenticatedActor("mentor@example.test"))
                .thenReturn(new ProjectActorView(10L, "MENTOR"));
        when(pages.authenticatedUserId("mentor@example.test")).thenReturn(10L);
        when(pages.detail(10L, 30L)).thenReturn(plannedOwnerDetail());
        when(pages.members(10L, 30L)).thenReturn(List.of(new ProjectMemberView(
@@ -255,7 +424,7 @@ class ProjectControllerTest {
                                99L)))
                .thenThrow(new ProjectRuleViolationException("Intern must have an active account and internship"));
        doThrow(new ProjectRuleViolationException("Intern is already a current Project member"))
-                .when(projects).addMember(10L, 30L, 20L);
+                .when(projects).addMembers(10L, 30L, List.of(20L));
        doThrow(new ProjectRuleViolationException("Selected Intern is already the current Leader"))
                .when(projects).changeLeader(10L, 30L, 20L);
@@ -274,12 +443,14 @@ class ProjectControllerTest {
        mvc.perform(post("/projects/30/members")
                        .with(csrf())
-                        .param("internUserId", "20"))
+                        .param("internUserIds", "20"))
                .andExpect(status().isOk())
                .andExpect(view().name("projects/members"))
-                .andExpect(model().attributeHasFieldErrors("projectMemberForm", "internUserId"))
+                .andExpect(model().attributeHasFieldErrors("projectMembersForm", "internUserIds"))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
-                        .string(containsString("value=\"20\"")));
+                        .string(containsString("Intern is already a current Project member")))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(not(containsString("value=\"20\""))));
        mvc.perform(post("/projects/30/leadership")
                        .with(csrf())
@@ -288,7 +459,9 @@ class ProjectControllerTest {
                .andExpect(view().name("projects/leadership"))
                .andExpect(model().attributeHasFieldErrors("projectMemberForm", "internUserId"))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
-                        .string(containsString("value=\"20\"")));
+                        .string(containsString("Selected Intern is already the current Leader")))
                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.content()
                        .string(not(containsString("value=\"20\""))));
    }
    @Test
@@ -388,4 +561,19 @@ class ProjectControllerTest {
                "Current Leader",
                true);
    }
    private static EligibleInternOption option(long userId, String name, String studentCode) {
        return new EligibleInternOption(
                userId,
                name,
                studentCode,
                LocalDate.of(2026, 8, 1),
                LocalDate.of(2026, 12, 31));
    }
    private static boolean containsRequiredRadio(String html) {
        return Pattern.compile("<input(?=[^>]*type=\\\"radio\\\")(?=[^>]*required(?:=|\\s|>))[^>]*>")
                .matcher(html)
                .find();
    }
 }
@@ -106,6 +106,53 @@ class ProjectServiceIntegrationTest {
                        user("other-mentor@example.test", "MENTOR"), projectId, Long.MAX_VALUE));
    }
    @Test
    void ownerAddsSeveralEligibleMembersInOneLockedTransaction() {
        long mentorId = user("mentor-batch-add@example.test", "MENTOR");
        long leaderId = intern("leader-batch-add@example.test", "I017");
        long firstMemberId = intern("first-batch-add@example.test", "I018");
        long secondMemberId = intern("second-batch-add@example.test", "I019");
        long projectId = createProject(mentorId, leaderId, "Batch membership");
        projectService.addMembers(mentorId, projectId, List.of(firstMemberId, secondMemberId));
        assertEquals(3, count("""
                select count(*) from project_memberships
                where project_id = ? and left_at is null
                """, projectId));
    }
    @Test
    void memberBatchRejectsMissingDuplicateCurrentAndStaleSelectionsWithoutPartialMutation() {
        long mentorId = user("mentor-batch-guard@example.test", "MENTOR");
        long leaderId = intern("leader-batch-guard@example.test", "I020");
        long eligibleId = intern("eligible-batch-guard@example.test", "I021");
        long staleId = intern("stale-batch-guard@example.test", "I022");
        long projectId = createProject(mentorId, leaderId, "Batch guard");
        jdbc.update("update intern_profiles set internship_end_date = date '2026-08-13' where user_id = ?", staleId);
        entityManager.clear();
        assertThrows(ProjectRuleViolationException.class,
                () -> projectService.addMembers(mentorId, projectId, null));
        assertThrows(ProjectRuleViolationException.class,
                () -> projectService.addMembers(mentorId, projectId, List.of()));
        assertThrows(ProjectRuleViolationException.class,
                () -> projectService.addMembers(mentorId, projectId, List.of(eligibleId, eligibleId)));
        assertThrows(ProjectRuleViolationException.class,
                () -> projectService.addMembers(mentorId, projectId, List.of(Long.MAX_VALUE)));
        assertThrows(ProjectRuleViolationException.class,
                () -> projectService.addMembers(mentorId, projectId, List.of(mentorId)));
        assertThrows(ProjectRuleViolationException.class,
                () -> projectService.addMembers(mentorId, projectId, List.of(leaderId)));
        assertThrows(ProjectRuleViolationException.class,
                () -> projectService.addMembers(mentorId, projectId, List.of(eligibleId, staleId)));
        assertEquals(0, count("""
                select count(*) from project_memberships
                where project_id = ? and intern_user_id in (?, ?) and left_at is null
                """, projectId, eligibleId, staleId));
    }
    @Test
    void leaderChangeClosesOneTermAndDoesNotMoveTaskAssignments() {
        long mentorId = user("mentor-leader@example.test", "MENTOR");
@@ -44,7 +44,9 @@ class DashboardControllerWebTest {
                .andExpect(model().attribute("dashboard", dashboard))
                .andExpect(content().string(org.hamcrest.Matchers.containsString(
                        "This installation remains restricted until tested SMTP is active.")))
-                .andExpect(content().string(org.hamcrest.Matchers.containsString("href=\"/admin/smtp\"")));
+                .andExpect(content().string(org.hamcrest.Matchers.containsString("href=\"/admin/smtp\"")))
                .andExpect(content().string(org.hamcrest.Matchers.containsString(
                        "data-tooltip=\"SMTP settings\"")));
        verify(dashboards).admin("admin@example.test");
    }
@@ -58,20 +60,25 @@ class DashboardControllerWebTest {
        mvc.perform(get("/dashboard").with(user("admin@example.test").roles("ADMIN")))
                .andExpect(status().isOk())
                .andExpect(content().string(org.hamcrest.Matchers.not(org.hamcrest.Matchers.containsString(
-                        "This installation remains restricted until tested SMTP is active."))));
+                        "This installation remains restricted until tested SMTP is active."))))
                .andExpect(content().string(org.hamcrest.Matchers.containsString(
                        "href=\"/admin/smtp\" data-tooltip=\"SMTP settings\"")));
    }
    @Test
    void mentorRendersMentorDashboardForAuthenticatedIdentity() throws Exception {
        var dashboard = new DashboardView.Mentor("Mentor", 2, 4, 1);
        given(dashboards.mentor("mentor@example.test")).willReturn(dashboard);
        given(smtpConfiguration.hasActiveConfiguration()).willReturn(true);
        mvc.perform(get("/dashboard").with(user("mentor@example.test").roles("MENTOR")))
                .andExpect(status().isOk())
                .andExpect(view().name("dashboard/mentor"))
                .andExpect(model().attribute("dashboard", dashboard))
                .andExpect(content().string(org.hamcrest.Matchers.not(org.hamcrest.Matchers.containsString(
-                        "This installation remains restricted until tested SMTP is active."))));
+                        "This installation remains restricted until tested SMTP is active."))))
                .andExpect(content().string(org.hamcrest.Matchers.not(org.hamcrest.Matchers.containsString(
                        "data-tooltip=\"SMTP settings\""))));
        verify(dashboards).mentor("mentor@example.test");
    }
@@ -81,11 +88,14 @@ class DashboardControllerWebTest {
        var dashboard = new DashboardView.Intern(
                "Intern", DashboardView.AttendanceState.NOT_CHECKED_IN, 1, 0, List.of());
        given(dashboards.intern("intern@example.test")).willReturn(dashboard);
        given(smtpConfiguration.hasActiveConfiguration()).willReturn(true);
        mvc.perform(get("/dashboard").with(user("intern@example.test").roles("INTERN")))
                .andExpect(status().isOk())
                .andExpect(view().name("dashboard/intern"))
-                .andExpect(model().attribute("dashboard", dashboard));
+                .andExpect(model().attribute("dashboard", dashboard))
                .andExpect(content().string(org.hamcrest.Matchers.not(org.hamcrest.Matchers.containsString(
                        "data-tooltip=\"SMTP settings\""))));
        verify(dashboards).intern("intern@example.test");
    }
@@ -8,14 +8,20 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 import com.lab.labtimesheet.feature.account.service.AccountService;
 import com.lab.labtimesheet.feature.integration.service.SmtpConfigurationService;
 import com.lab.labtimesheet.feature.project.controller.ProjectController;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectActorView;
 import com.lab.labtimesheet.feature.project.service.ProjectQueryService;
 import com.lab.labtimesheet.feature.project.service.ProjectService;
 import com.lab.labtimesheet.feature.task.controller.TaskController;
 import com.lab.labtimesheet.feature.task.model.dto.TaskAssigneeChoice;
 import com.lab.labtimesheet.feature.task.service.TaskService;
 import java.time.Clock;
 import java.time.Instant;
 import java.time.ZoneId;
 import java.util.List;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
@@ -34,12 +40,26 @@ class ProjectTaskFormAccessibilityWebTest {
    @MockitoBean
    private ProjectService projects;
    @MockitoBean
    private AccountService accounts;
    @MockitoBean
    private Clock clock;
    @MockitoBean
    private TaskService tasks;
    @MockitoBean
    private SmtpConfigurationService smtpConfiguration;
    @BeforeEach
    void mentorActor() {
        given(projectQueries.authenticatedActor("mentor@example.test"))
                .willReturn(new ProjectActorView(10L, "MENTOR"));
        given(clock.instant()).willReturn(Instant.parse("2026-08-15T01:00:00Z"));
        given(clock.getZone()).willReturn(ZoneId.of("Asia/Ho_Chi_Minh"));
    }
    @Test
    void projectFieldErrorsHaveStableIdsAndInputAssociations() throws Exception {
        mvc.perform(post("/projects")
@@ -136,12 +136,12 @@ class RoleDashboardWebIntegrationTest {
                .andExpect(content().string(containsString("BLOCKED")))
                .andExpect(content().string(containsString("20/08/2026")));
-        followEveryVisibleNavigationLink("admin@example.test", "ADMIN");
+        followEveryVisibleNavigationLink("admin@example.test", "ADMIN", true);
-        followEveryVisibleNavigationLink("mentor@example.test", "MENTOR");
+        followEveryVisibleNavigationLink("mentor@example.test", "MENTOR", false);
-        followEveryVisibleNavigationLink("intern@example.test", "INTERN");
+        followEveryVisibleNavigationLink("intern@example.test", "INTERN", false);
    }
-    private void followEveryVisibleNavigationLink(String email, String role) throws Exception {
+    private void followEveryVisibleNavigationLink(String email, String role, boolean expectsSmtpSettings) throws Exception {
        String dashboard = mvc.perform(get("/dashboard").with(user(email).roles(role)))
                .andExpect(status().isOk())
                .andReturn()
@@ -153,6 +153,11 @@ class RoleDashboardWebIntegrationTest {
            paths.add(matcher.group(1));
        }
        assertThat(paths).isNotEmpty();
        if (expectsSmtpSettings) {
            assertThat(paths).contains("/admin/smtp");
        } else {
            assertThat(paths).doesNotContain("/admin/smtp");
        }
        for (String path : paths) {
            mvc.perform(get(path).with(user(email).roles(role)))
                    .andExpect(status().isOk());
@@ -97,6 +97,26 @@ class UiContractWebTest {
        assertTrue(themeBootstrap.contains("matchMedia('(prefers-color-scheme: dark)')"));
    }
    @Test
    void generatedLucideSymbolsRetainCurrentColorStrokePresentation() throws Exception {
        String icons = new ClassPathResource("static/assets/icons.svg")
                .getContentAsString(StandardCharsets.UTF_8);
        Matcher symbols = Pattern.compile("<symbol\\b([^>]*)>").matcher(icons);
        int symbolCount = 0;
        while (symbols.find()) {
            String attributes = symbols.group(1);
            assertTrue(attributes.contains("fill=\"none\""), () -> "Missing fill on " + attributes);
            assertTrue(attributes.contains("stroke=\"currentColor\""), () -> "Missing stroke on " + attributes);
            assertTrue(attributes.contains("stroke-width=\"2\""), () -> "Missing stroke width on " + attributes);
            assertTrue(attributes.contains("stroke-linecap=\"round\""), () -> "Missing stroke linecap on " + attributes);
            assertTrue(attributes.contains("stroke-linejoin=\"round\""), () -> "Missing stroke linejoin on " + attributes);
            symbolCount++;
        }
        assertTrue(symbolCount > 0, "The generated sprite must contain symbols");
    }
    @Test
    @WithMockUser(username = "admin@example.test", roles = "ADMIN")
    void collapsedSidebarExposesStateAndKeyboardVisibleControlNames() throws Exception {
@@ -0,0 +1,88 @@
 import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import test from "node:test";
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
 const read = (path) => readFileSync(resolve(root, path), "utf8");
 const expectedActionPins = new Map([
  ["actions/checkout", "3d3c42e5aac5ba805825da76410c181273ba90b1"],
  ["actions/setup-java", "b6effb05e454b25005698d916606bdc6ffcbf961"],
  ["actions/setup-node", "820762786026740c76f36085b0efc47a31fe5020"],
  ["docker/setup-buildx-action", "bb05f3f5519dd87d3ba754cc423b652a5edd6d2c"],
  ["docker/login-action", "dbcb813823bdd20940b903addbd779551569679f"],
  ["docker/build-push-action", "53b7df96c91f9c12dcc8a07bcb9ccacbed38856a"],
 ]);
 test("production image and Compose keep one image usable with bundled or external PostgreSQL", () => {
  const dockerfile = read("Dockerfile");
  const compose = read("compose.yaml");
  const environment = read(".env.compose.example");
  const production = read("src/main/resources/application-prod.yaml");
  assert.match(dockerfile, /FROM node:24-alpine@sha256:/);
  assert.match(dockerfile, /FROM eclipse-temurin:25-jre-alpine@sha256:/);
  assert.match(dockerfile, /USER 10001:10001/);
  assert.match(dockerfile, /HEALTHCHECK .*health\/readiness/);
  assert.match(compose, /profiles: \["bundled-db"\]/);
  assert.match(compose, /condition: service_healthy/);
  assert.match(compose, /required: false/);
  assert.match(compose, /postgres_data:\s*$/m);
  assert.match(environment, /^LAB_DB_URL=/m);
  assert.match(environment, /^LAB_IMAGE=/m);
  assert.match(production, /same-site: strict/);
  assert.match(production, /include: "readinessState,db"/);
 });
 test("verification workflow checks every pull request and pushed branch without write permission", () => {
  const workflow = read(".gitea/workflows/verify.yml");
  assert.match(workflow, /pull_request:/);
  assert.match(workflow, /push:/);
  assert.match(workflow, /contents: read/);
  assert.match(workflow, /npm ci/);
  assert.match(workflow, /npm run test:ui/);
  assert.match(workflow, /npm run build/);
  assert.match(workflow, /\.\/mvnw -B test/);
  assert.match(workflow, /TESTCONTAINERS_HOST_OVERRIDE: host\.docker\.internal/);
  assert.doesNotMatch(workflow, /permissions:\s*write-all/);
 });
 test("container workflow runs only manually or on main and verifies before either image build", () => {
  const workflow = read(".gitea/workflows/container.yml");
  assert.match(workflow, /'on':\n  workflow_dispatch:\n  push:\n    branches:\n      - main/);
  assert.doesNotMatch(workflow, /^  pull_request:/m);
  assert.match(workflow, /jobs:\n  verify:/);
  assert.match(workflow, /amd64:\n    needs: verify/);
  assert.match(workflow, /arm64:[\s\S]*?needs: verify/);
  assert.match(workflow, /TESTCONTAINERS_HOST_OVERRIDE: host\.docker\.internal/);
  assert.match(workflow, /runs-on: ubuntu-latest-arm/);
  assert.match(workflow, /vars\.ARM64_RUNNER_AVAILABLE == 'true'/);
  assert.match(workflow, /gitea\.ref == 'refs\/heads\/main'/);
  assert.match(workflow, /sha-\$\{GITEA_SHA\}-amd64/);
  assert.match(workflow, /sha-\$\{GITEA_SHA\}-arm64/);
  assert.match(workflow, /imagetools create/);
  assert.match(workflow, /REGISTRY: git\.sechmachine\.io\.vn/);
  assert.match(workflow, /IMAGE_NAME: sechmachine\/labtimesheet/);
  assert.match(workflow, /username: \$\{\{ gitea\.actor \}\}/);
  assert.match(workflow, /password: \$\{\{ secrets\.REGISTRY_TOKEN \}\}/);
  assert.doesNotMatch(workflow, /CONTAINER_IMAGE|REGISTRY_USERNAME/);
  assert.doesNotMatch(workflow, /ssh|DEPLOY_HOST|DEPLOY_KEY/i);
 });
 test("workflows pin every action to the latest reviewed immutable release", () => {
  const workflows = [
    read(".gitea/workflows/verify.yml"),
    read(".gitea/workflows/container.yml"),
  ].join("\n");
  const uses = [...workflows.matchAll(/uses:\s+([^@\s]+)@([0-9a-f]{40})/g)];
  assert.ok(uses.length > 0);
  for (const [, action, pin] of uses) {
    assert.equal(pin, expectedActionPins.get(action), `unexpected pin for ${action}`);
  }
  assert.deepEqual(new Set(uses.map(([, action]) => action)), new Set(expectedActionPins.keys()));
  assert.doesNotMatch(workflows, /uses:\s+[^\s]+@v\d/);
 });
@@ -0,0 +1,98 @@
 import assert from 'node:assert/strict';
 import {readFileSync} from 'node:fs';
 import test from 'node:test';
 import vm from 'node:vm';
 class Target {
  listeners = new Map();
  addEventListener(type, listener) {
    this.listeners.set(type, listener);
  }
  dispatch(type) {
    this.listeners.get(type)?.({preventDefault() {}, target: this});
  }
 }
 test('picker searches name and student code, summarizes selection, and cancels safely', () => {
  const open = Object.assign(new Target(), {focus() { this.focused = true; }});
  const cancel = new Target();
  const apply = new Target();
  const search = Object.assign(new Target(), {value: '', focus() { this.focused = true; }});
  const summary = {textContent: ''};
  const empty = {hidden: true};
  const firstInput = Object.assign(new Target(), {checked: false, type: 'checkbox'});
  const secondInput = Object.assign(new Target(), {checked: false, type: 'checkbox'});
  const options = [
    option('Nguyen An STU-020', 'Nguyen An (STU-020)', firstInput),
    option('Tran Binh STU-021', 'Tran Binh (STU-021)', secondInput),
  ];
  const dialog = Object.assign(new Target(), {
    showModal() { this.open = true; },
    close() { this.open = false; this.dispatch('close'); },
  });
  const picker = {
    querySelector(selector) {
      return new Map([
        ['[data-picker-open]', open], ['[data-picker-dialog]', dialog],
        ['[data-picker-search]', search], ['[data-picker-summary]', summary],
        ['[data-picker-empty]', empty], ['[data-picker-cancel]', cancel],
        ['[data-picker-apply]', apply],
      ]).get(selector) ?? null;
    },
    querySelectorAll(selector) {
      return selector === '[data-picker-option]' ? options : [];
    },
  };
  let ready;
  const document = {
    documentElement: {dataset: {}, style: {}},
    addEventListener(type, listener) { if (type === 'DOMContentLoaded') ready = listener; },
    querySelector() { return null; },
    querySelectorAll(selector) { return selector === '[data-intern-picker]' ? [picker] : []; },
  };
  vm.runInNewContext(readFileSync('src/main/resources/static/assets/app.js', 'utf8'), {
    document,
    localStorage: {getItem() { return null; }, setItem() {}, removeItem() {}},
    matchMedia() { return {matches: false}; },
  });
  ready();
  open.dispatch('click');
  assert.equal(dialog.open, true);
  assert.equal(search.focused, true);
  search.value = 'stu-021';
  search.dispatch('input');
  assert.equal(options[0].hidden, true);
  assert.equal(options[1].hidden, false);
  assert.equal(empty.hidden, true);
  secondInput.checked = true;
  secondInput.dispatch('change');
  assert.equal(summary.textContent, '1 Intern selected: Tran Binh (STU-021)');
  cancel.dispatch('click');
  assert.equal(secondInput.checked, false);
  assert.equal(summary.textContent, 'No Interns selected');
  assert.equal(open.focused, true);
  open.dispatch('click');
  secondInput.checked = true;
  secondInput.dispatch('change');
  apply.dispatch('click');
  assert.equal(secondInput.checked, true);
 });
 function option(searchValue, label, input) {
  return {
    hidden: false,
    dataset: {pickerSearch: searchValue},
    querySelector(selector) {
      if (selector === 'input') return input;
      if (selector === '[data-picker-label]') return {textContent: label};
      return null;
    },
  };
 }
Author	SHA1	Message	Date
sechmachine	58a087b118	docs: add assisted exit transfer and history design documents Verify / verify (push) Successful in 2m57s Details Container / verify (push) Successful in 3m0s Details Container / arm64 (push) Skipped Details Container / amd64 (push) Successful in 1m52s Details Container / manifest (push) Skipped Details	2026-08-20 17:22:28 +07:00
sechmachine	8878326839	docs: add comprehensive technology stack reference Verify / verify (push) Successful in 4m5s Details Container / verify (push) Successful in 4m14s Details Container / arm64 (push) Skipped Details Container / amd64 (push) Successful in 1m37s Details Container / manifest (push) Skipped Details	2026-08-16 00:33:55 +07:00
sechmachine	200a17e5bd	docs(test): pin registry workflow evidence Container / verify (push) Canceled after 4m34s Details Container / amd64 (push) Canceled after 0s Details Container / arm64 (push) Canceled after 0s Details Container / manifest (push) Canceled after 0s Details Verify / verify (push) Successful in 8m31s Details	2026-08-16 00:28:46 +07:00
sechmachine	4dd9f96a23	fix(ci): use Gitea actor for registry publishing	2026-08-16 00:28:15 +07:00
sechmachine	d044277194	docs(test): record Gitea runner verification Container / amd64 (push) Failing after 6m24s Details Container / manifest (push) Skipped Details Container / verify (push) Successful in 3m12s Details Container / arm64 (push) Skipped Details Verify / verify (push) Successful in 8m59s Details	2026-08-15 23:55:52 +07:00
sechmachine	d13443e338	fix(ci): gate images behind verified Testcontainers Verify / verify (push) Successful in 8m52s Details	2026-08-15 23:21:23 +07:00
sechmachine	7a6139017f	docs(test): record production delivery evidence Container / amd64 (push) Failing after 19m25s Details Container / arm64 (push) Skipped Details Container / manifest (push) Skipped Details Verify / verify (push) Failing after 12m3s Details	2026-08-15 22:46:19 +07:00
sechmachine	cea4378f56	feat(platform): add production CI and containers	2026-08-15 22:45:35 +07:00
sechmachine	b13c547068	docs(test): pin Windows timezone evidence	2026-08-15 22:07:56 +07:00
sechmachine	a9fb948769	fix(platform): normalize legacy Vietnam timezone	2026-08-15 22:07:27 +07:00
sechmachine	7bac998866	Merge commit '28ecfabe37b8a7360f0bda7be1533561e1005e20'	2026-08-15 15:56:20 +07:00
sechmachine	28ecfabe37	fix: preserve dev attendance policy wall-clock times	2026-08-15 15:51:43 +07:00
sechmachine	c8735c8ab8	Merge commit '6de463221b6a7e9ae59768ae82d75303b65c0779'	2026-08-15 15:26:51 +07:00
sechmachine	6de463221b	test(projects): repair accessibility MVC slice	2026-08-15 15:25:35 +07:00
sechmachine	0a139d5470	Merge commit 'f3ffdab48e3d5ce558ca20aef29079abfd123c75'	2026-08-15 15:18:39 +07:00
sechmachine	f3ffdab48e	fix(projects): preserve server picker recovery	2026-08-15 15:16:28 +07:00
sechmachine	5df9eff21e	docs(tests): record merged picker verification	2026-08-15 15:03:55 +07:00
sechmachine	e5ff128502	Merge commit '32c8a2d315d2175760c5d4792988cd0aa5ab6dd0' into work/fix/projects/intern-picker	2026-08-15 15:02:18 +07:00
sechmachine	169da1a9f4	feat(projects): replace numeric Intern inputs with picker	2026-08-15 15:02:03 +07:00
sechmachine	64c9370aa0	feat(projects): add Intern members atomically	2026-08-15 15:01:48 +07:00
sechmachine	32c8a2d315	Merge commit 'c64ec659e74ce44debf82903234428e04b371833'	2026-08-15 15:00:22 +07:00
sechmachine	c64ec659e7	test: record complete repair workflow validation	2026-08-15 14:57:48 +07:00
sechmachine	445e4fedeb	docs: require complete targeted repair workflow	2026-08-15 14:56:14 +07:00
sechmachine	10196d55b0	Merge commit 'bed8b502d461cda892bcbaee374ed165fc416ca2' into work/fix/platform/fix-branch-workflow	2026-08-15 14:47:58 +07:00
sechmachine	5b8a58f520	test: record all-guide branch workflow validation	2026-08-15 14:47:39 +07:00
sechmachine	bed8b502d4	Merge commit 'ef08717ce54c83d431f191447dc8551040575a4c'	2026-08-15 14:46:15 +07:00
sechmachine	90e412cffa	Merge commit '46279f740b584ac64398033804d759cc4c64fa97'	2026-08-15 14:46:15 +07:00
sechmachine	207c0bfe89	Merge commit '159e634ffcd4a77507802a432ebfb9e836442b86'	2026-08-15 14:46:15 +07:00
sechmachine	f98e7f39ef	test: align fix branch plan contract	2026-08-15 14:43:03 +07:00
sechmachine	9802d5d17f	docs: align repair branch coordination authority	2026-08-15 14:41:48 +07:00
sechmachine	826054c3c5	Merge commit '432389220f53e06df88971f8a7b711a42cb85fee'	2026-08-15 14:38:46 +07:00
sechmachine	97e991317d	test: cover every fix branch guide mutation	2026-08-15 14:38:12 +07:00
sechmachine	ef08717ce5	docs(test): scope calendar authorization evidence	2026-08-15 14:36:29 +07:00
sechmachine	432389220f	test(account): cover missing picker business date	2026-08-15 14:36:11 +07:00
sechmachine	719e02ea90	test: strengthen fix branch workflow evidence	2026-08-15 14:32:26 +07:00
sechmachine	d617769499	test: harden fix branch documentation regression	2026-08-15 14:31:07 +07:00
sechmachine	c8d4e9eecc	test(attendance): cover form-authenticated calendar access	2026-08-15 14:26:51 +07:00
sechmachine	e70159a81b	feat(account): add eligible Intern picker query	2026-08-15 14:23:45 +07:00
sechmachine	46279f740b	fix(ui): keep SMTP settings in Admin navigation	2026-08-15 14:20:52 +07:00
sechmachine	93ea47ae4a	test: record fix branch workflow validation	2026-08-15 14:18:56 +07:00
sechmachine	f013ad7707	docs: define durable fix branch workflow	2026-08-15 14:18:13 +07:00
sechmachine	159e634ffc	fix(ui): preserve Lucide sprite presentation attributes	2026-08-15 14:17:04 +07:00
sechmachine	8be1b754e1	docs: add comprehensive implementation and design guidelines	2026-08-15 13:04:50 +07:00
sechmachine	bca30e6e4b	docs(platform): pin bootstrap startup evidence	2026-08-15 12:47:47 +07:00
sechmachine	531c607852	fix(platform): repair development bootstrap flow	2026-08-15 12:47:25 +07:00