fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/automation/automation.service.spec.ts

@@ -1,10 +1,10 @@
-import { NotFoundException } from '@nestjs/common';
+import { Logger, NotFoundException } from '@nestjs/common';
 import { AutomationService } from './automation.service';
 import { PrismaService } from '../prisma/prisma.service';
 import { AuditLogService } from '../audit/audit-log.service';
 import { NotificationsService } from '../notifications/notifications.service';
 import { WebhooksService } from '../webhooks/webhooks.service';
-import { AutomationTriggerType } from '../../generated/prisma';
+import { AutomationTriggerType, Prisma } from '../../generated/prisma';
 
 describe('AutomationService', () => {
   let service: AutomationService;
@@ -17,6 +17,8 @@ describe('AutomationService', () => {
     };
     automationSequence: { upsert: jest.Mock };
     task: { create: jest.Mock; findFirst: jest.Mock };
+    $transaction: jest.Mock;
+    $queryRaw: jest.Mock;
   };
   let auditLog: { record: jest.Mock };
   let notifications: { record: jest.Mock };
@@ -57,6 +59,9 @@ describe('AutomationService', () => {
         create: jest.fn().mockResolvedValue({ id: 'task-1' }),
         findFirst: jest.fn().mockResolvedValue(null),
       },
+      // Interactive transactions run against the same mocks.
+      $transaction: jest.fn((work: (tx: unknown) => unknown) => work(prisma)),
+      $queryRaw: jest.fn().mockResolvedValue([]),
     };
     auditLog = { record: jest.fn() };
     notifications = { record: jest.fn() };
@@ -91,6 +96,122 @@ describe('AutomationService', () => {
     expect(result).toHaveLength(3);
   });
 
+  // Rule evaluation runs after the triggering record is committed. A failure
+  // here must not turn that request into an error - the client would retry
+  // and store the inspection or treatment a second time.
+  describe('post-commit evaluation', () => {
+    let errorSpy: jest.SpyInstance;
+
+    beforeEach(() => {
+      errorSpy = jest
+        .spyOn(Logger.prototype, 'error')
+        .mockImplementation(() => undefined);
+      prisma.automationRule.upsert.mockRejectedValue(new Error('db down'));
+    });
+
+    afterEach(() => {
+      errorSpy.mockRestore();
+    });
+
+    const colony = { id: 'colony-1', healthStatus: 'GOOD' };
+    const evaluations: [string, string, (s: AutomationService) => unknown][] = [
+      [
+        'evaluateInspection',
+        'Inspection inspection-1',
+        (s) =>
+          s.evaluateInspection({
+            id: 'inspection-1',
+            colonyId: 'colony-1',
+          } as never),
+      ],
+      [
+        'evaluateVarroaMeasurement',
+        'VarroaMeasurement measurement-1',
+        (s) =>
+          s.evaluateVarroaMeasurement({
+            id: 'measurement-1',
+            colonyId: 'colony-1',
+          } as never),
+      ],
+      [
+        'evaluateSwarmControlCheck',
+        'SwarmControlCheck check-1',
+        (s) =>
+          s.evaluateSwarmControlCheck({
+            id: 'check-1',
+            colonyId: 'colony-1',
+          } as never),
+      ],
+      [
+        'evaluateColonyHealth',
+        'Colony colony-1',
+        (s) =>
+          s.evaluateColonyHealth(
+            colony as never,
+            { ...colony, healthStatus: 'CRITICAL' } as never,
+          ),
+      ],
+      [
+        'evaluateStockItem',
+        'StockItem item-1',
+        (s) =>
+          s.evaluateStockItem({
+            id: 'item-1',
+            quantity: 1,
+            minThreshold: 5,
+          } as never),
+      ],
+      [
+        'evaluateRawMaterialLow',
+        'RawMaterialKind BEESWAX',
+        (s) => s.evaluateRawMaterialLow('BEESWAX', 100),
+      ],
+      [
+        'evaluateTreatment',
+        'Treatment treatment-1',
+        (s) =>
+          s.evaluateTreatment({
+            id: 'treatment-1',
+            colonyId: 'colony-1',
+            date: new Date('2026-08-01'),
+            endDate: null,
+            product: 'Ameisensäure',
+          } as never),
+      ],
+      [
+        'evaluateFeeding',
+        'Feeding feeding-1',
+        (s) =>
+          s.evaluateFeeding({
+            id: 'feeding-1',
+            colonyId: 'colony-1',
+            date: new Date('2026-09-01'),
+            amount: 5,
+            unit: 'l',
+          } as never),
+      ],
+    ];
+
+    it.each(evaluations)(
+      '%s never throws and logs the failure with the record',
+      async (_name, subject, evaluate) => {
+        await expect(evaluate(service)).resolves.toBeUndefined();
+
+        expect(errorSpy).toHaveBeenCalledTimes(1);
+        const [message] = errorSpy.mock.calls[0] as [string];
+        expect(message).toContain(subject);
+        expect(message).toContain('db down');
+      },
+    );
+
+    it('still throws from generateNumber, which runs before the write', async () => {
+      await expect(
+        service.generateNumber('HONEY_BATCH_NUMBER_FORMAT'),
+      ).rejects.toThrow('db down');
+      expect(errorSpy).not.toHaveBeenCalled();
+    });
+  });
+
   describe('evaluateInspection', () => {
     it('creates a task and notification when queen not seen and no eggs present', async () => {
       prisma.automationRule.findMany.mockResolvedValue([queenlessRule]);
@@ -238,6 +359,37 @@ describe('AutomationService', () => {
         select: { id: true },
       });
     });
+
+    it('checks for an open task and creates one under a lock on the rule row', async () => {
+      prisma.automationRule.findUnique.mockResolvedValue(varroaRule);
+
+      await service.evaluateVarroaMeasurement({
+        id: 'measurement-6',
+        colonyId: 'colony-1',
+        method: 'NATURAL_MITE_FALL',
+        calculatedValue: 25,
+        miteCount: 25,
+      } as never);
+
+      expect(prisma.$transaction).toHaveBeenCalledTimes(1);
+      const [sql, ...values] = prisma.$queryRaw.mock.calls[0] as [
+        TemplateStringsArray,
+        ...unknown[],
+      ];
+      expect(sql.join('?')).toMatch(
+        /SELECT id FROM "AutomationRule" WHERE id = \? FOR UPDATE/,
+      );
+      expect(values).toEqual(['rule-3']);
+      // Lock first, then check, then create - all in that one transaction.
+      const [lockOrder] = prisma.$queryRaw.mock.invocationCallOrder;
+      const [checkOrder] = prisma.task.findFirst.mock.invocationCallOrder;
+      const [createOrder] = prisma.task.create.mock.invocationCallOrder;
+      expect(lockOrder).toBeLessThan(checkOrder);
+      expect(checkOrder).toBeLessThan(createOrder);
+      // Webhook and warning follow the commit, outside the lock.
+      const [dispatchOrder] = webhooks.dispatch.mock.invocationCallOrder;
+      expect(dispatchOrder).toBeGreaterThan(createOrder);
+    });
   });
 
   describe('evaluateSwarmControlCheck', () => {
@@ -412,6 +564,34 @@ describe('AutomationService', () => {
         }),
       );
     });
+
+    it('clears the config on null so the rule falls back to its defaults', async () => {
+      prisma.automationRule.findUnique.mockResolvedValue(varroaRule);
+      prisma.automationRule.update.mockResolvedValue({
+        ...varroaRule,
+        config: null,
+      });
+
+      await service.update('rule-3', { config: null as never }, 'user-1');
+
+      const [[updateArg]] = prisma.automationRule.update.mock.calls as [
+        [{ data: { config?: unknown } }],
+      ];
+      // A Json column is cleared with DbNull - a plain null fails the write.
+      expect(updateArg.data.config).toBe(Prisma.DbNull);
+    });
+
+    it('leaves the config untouched when it is omitted', async () => {
+      prisma.automationRule.findUnique.mockResolvedValue(varroaRule);
+      prisma.automationRule.update.mockResolvedValue(varroaRule);
+
+      await service.update('rule-3', { active: true }, 'user-1');
+
+      const [[updateArg]] = prisma.automationRule.update.mock.calls as [
+        [{ data: { config?: unknown } }],
+      ];
+      expect(updateArg.data.config).toBeUndefined();
+    });
   });
 
   describe('generateNumber', () => {