diff --git a/.claude/agent-memory/e2e-test-engineer/general-e2e-patterns.md b/.claude/agent-memory/e2e-test-engineer/general-e2e-patterns.md
index 1da173d16..daaf718e2 100644
--- a/.claude/agent-memory/e2e-test-engineer/general-e2e-patterns.md
+++ b/.claude/agent-memory/e2e-test-engineer/general-e2e-patterns.md
@@ -112,6 +112,7 @@ an `<iframe>` whose target content type the headless Chromium shell can't native
 is the known case; likely also true for other browser-plugin-dependent content).**
 
 **Replacement pattern — verify the CSP contract server-side, not the browser's enforcement of it:**
+
 1. **Direct CSP header assertion** (the deterministic core): `page.request.get(route)` (shares
    the page's cookie jar/session automatically) then read
    `response.headers()['content-security-policy']`, regex out the specific directive
@@ -121,7 +122,7 @@ is the known case; likely also true for other browser-plugin-dependent content).
    asked to render the content. This is the primary, CI-reliable regression guard now.
 2. Keep a zero-CSP-console-violation assertion as defense in depth — real (non-headless-shell)
    browsers still log synchronously on a block, so this remains a meaningful second signal even
-   though it can't be the *only* signal in CI.
+   though it can't be the _only_ signal in CI.
 3. Do NOT try to fetch the iframe's `blob:` src from within the page as a third signal — see the
    "blob: fetch is connect-src-governed, not frame-src" entry immediately below for why that's a
    dead end, not just an unnecessary extra.
diff --git a/.claude/agent-memory/e2e-test-engineer/sandbox-live-verification.md b/.claude/agent-memory/e2e-test-engineer/sandbox-live-verification.md
index 8beaabc4c..9e5391947 100644
--- a/.claude/agent-memory/e2e-test-engineer/sandbox-live-verification.md
+++ b/.claude/agent-memory/e2e-test-engineer/sandbox-live-verification.md
@@ -53,7 +53,7 @@ Even with the container stack fully working, `npx playwright test` still fails a
    This is a `sbx policy allow network <domain>` decision for the user/host, not something to
    work around unilaterally.
 2. **Ubuntu's `chromium-browser` apt package is a non-functional snap stub.** `apt-get install
-   chromium-browser` succeeds and installs `/usr/bin/chromium-browser`, but running it (even
+chromium-browser` succeeds and installs `/usr/bin/chromium-browser`, but running it (even
    pointed to via a local `playwright.config.ts` override's `use.launchOptions.executablePath`)
    fails immediately:
    ```
@@ -66,8 +66,8 @@ Even with the container stack fully working, `npx playwright test` still fails a
    Ubuntu release. No other route to a real browser binary was found in this session
    (no cached `~/.cache/ms-playwright` binaries, no `google-chrome`/`firefox` either).
 
-**Net effect**: a fully live Playwright *browser* run is still not achievable in this sandbox
-class, even though the *container/app* side now works. If a future story's AC needs an actual
+**Net effect**: a fully live Playwright _browser_ run is still not achievable in this sandbox
+class, even though the _container/app_ side now works. If a future story's AC needs an actual
 red/green browser proof, either (a) ask the user to `sbx policy allow network
 playwright.download.prss.microsoft.com,cdn.playwright.dev` for that session, or (b) fall back
 to the established pattern: build+boot the containers to prove the app-level behavior (e.g. the
@@ -112,7 +112,7 @@ module resolution works — a file outside the workspace fails with `Cannot find
 - `rm` any scratch `playwright.*.config.ts` file.
 - `rm -rf e2e/e2e/ e2e/playwright-output/ e2e/playwright-report/ e2e/test-results/` — a
   misconfigured `--config` path or an interrupted run can leave a nested `e2e/e2e/test-results/
-  .state/containers.json` artifact (from `containers/setup.ts`'s state file) that `git status`
+.state/containers.json` artifact (from `containers/setup.ts`'s state file) that `git status`
   won't flag as tracked but that still clutters the worktree.
 - `docker images` / `docker rmi cornerstone:e2e` if you built a throwaway/deliberately-broken
   image for a red-test proof — a stale local image with the wrong config baked in will silently
diff --git a/.claude/agent-memory/e2e-test-engineer/story-1879-report-wizard.md b/.claude/agent-memory/e2e-test-engineer/story-1879-report-wizard.md
index 701dc7ef1..dcd5a08ec 100644
--- a/.claude/agent-memory/e2e-test-engineer/story-1879-report-wizard.md
+++ b/.claude/agent-memory/e2e-test-engineer/story-1879-report-wizard.md
@@ -96,13 +96,13 @@ failures (shard 2/16 desktop scenarios 1/4/9/11, shard 13/16 mobile scenario 10)
   skipped entirely when `invoice.documents` is empty), so the whole regen can complete fast
   enough that the overlay's "visible" window is never reliably observed by Playwright's
   polling. The suite's own established convention elsewhere
-  (`invoice-auto-itemize-page.spec.ts:1589`) only ever asserts the overlay's terminal *hidden*
+  (`invoice-auto-itemize-page.spec.ts:1589`) only ever asserts the overlay's terminal _hidden_
   state, never its transient appearance — same lesson applies here. Fixed by adding
   `ReportWizardPage.getPreviewSrc()` / `waitForPreviewRegenerated(previousSrc)` to the POM,
   which prove a regeneration happened via the iframe's `blob:` src actually changing (every
   `URL.createObjectURL()` call yields a unique URL) instead of racing the spinner.
 - **Scenario 4 (empty state) — TEST_BUG, fixed.** `ReportInvoiceList.tsx`'s `<EmptyState>` only
-  renders when BOTH this source's allocated invoices AND the *household-wide* unallocated list
+  renders when BOTH this source's allocated invoices AND the _household-wide_ unallocated list
   are empty — `sourceReportService.ts`'s `unallocRows` query has **no** `budget_source_id`
   filter at all (confirmed by reading the SQL), so it's global across every vendor/spec file.
   Under full 8-worker parallel CI this is essentially always non-zero, making the EmptyState
diff --git a/.claude/agent-memory/product-architect/MEMORY.md b/.claude/agent-memory/product-architect/MEMORY.md
index d05d99e3e..5cfe4ca71 100644
--- a/.claude/agent-memory/product-architect/MEMORY.md
+++ b/.claude/agent-memory/product-architect/MEMORY.md
@@ -4,6 +4,7 @@
 
 - [Recurring patterns & traps](recurring-patterns.md) — polymorphic FK cleanup, XOR CHECK vs SET NULL, forked-function drift, test smells, accepted N+1 sites
 - [Dual-rail aggregation](dual-rail-aggregation.md) — Rail A/B tagged-deposit invariants (#1891/PR #1894), residual-denominator rule, isSplit UNION
+- [Source-report split inference](source-report-split-inference.md) — budgetLines[]/deposits[] are this-source-scoped, so †/‡ classification is a proxy; proposed `splitKind`; pdfmake `'2*'` width trap
 - [Story reviews](story-reviews.md) — per-story and per-PR review log
 - [Client PDF pipeline](client-pdf-pipeline.md) — ADR-034 report PDF generation
 - [Diary drafts pattern](diary-drafts-pattern.md) — ADR-022 draft lifecycle via status column on parent table
diff --git a/.claude/agent-memory/product-architect/source-report-split-inference.md b/.claude/agent-memory/product-architect/source-report-split-inference.md
new file mode 100644
index 000000000..d4154d6cb
--- /dev/null
+++ b/.claude/agent-memory/product-architect/source-report-split-inference.md
@@ -0,0 +1,59 @@
+---
+name: source-report-split-inference
+description: Why the report PDF's †/‡ footnote classification is a proxy, not exact — budgetLines[] and deposits[] are both this-source-scoped, so one cross-source case is undetectable client-side (found reviewing PR #1902 / story #1898)
+metadata:
+  type: project
+---
+
+# Source-report split inference is a proxy, not a fact
+
+`client/src/lib/reportPdf/overviewPdf.ts` classifies footnotes as
+`† iff isSplit && budgetLines.length > 0`, `‡ iff isSplit && deposits.length > 0`
+(wording `constituted` iff a deposit carries `budgetSourceId === report.source.id`, else `reduced`).
+
+**Both arrays are this-source-scoped server-side** — this is the load-bearing fact:
+
+- `budgetLines[]` comes from Rail A rows, whose SQL `WHERE` is `wib2/hib2.budget_source_id = ${sourceId}`
+  (`sourceReportService.ts` step a → step i). **Only this source's lines**, never other sources'.
+- `deposits[]` is filtered `budgetSourceId === null || === sourceId` (step j).
+
+## The blind spot
+
+Invoice with all lines on source A + a deposit tagged to source B, no untagged deposits:
+`isSplit` true, `budgetLines.length > 0`, `deposits.length === 0` → renders `†` (generic split).
+AC #1898-4 says it should render `‡ reduced` — and that wording is *correct*, because the
+invoice-level residual rule means a B-tagged deposit does reduce A's Rail A share
+(see [[dual-rail-aggregation]]).
+
+**It is indistinguishable from a genuine A/B line split in the response.** Not fixable client-side.
+`overviewPdf.test.ts` [Scenario 15] pins the ambiguous shape as "pure line-split".
+
+The mirror view is correct: from B's report the same invoice has `budgetLines: []` +
+the tagged deposit → `‡ constituted`, no `†`.
+
+## Proposed fix (not yet filed as of 2026-07-31)
+
+Add to `SourceReportInvoice`, derived in the existing `isSplit` UNION query whose two arms already
+separate line-sourced from deposit-sourced `source_id`s — no extra query, no other-source data leak:
+
+```ts
+/** How the cross-source split arises. Only meaningful when isSplit. */
+splitKind: 'lines' | 'deposits' | 'both';
+```
+
+Client becomes `† iff splitKind !== 'deposits'`, `‡ iff splitKind !== 'lines'` — no `.length` proxies.
+
+## Wiki deviation to fix (open)
+
+`wiki/API-Contract.md` L~3610 and `shared/src/types/sourceReport.ts` both describe `budgetLines[]`
+as *"all ibl lines per invoice (even portion 0)"*. Wrong — it is all of **this source's** ibl lines.
+Pre-existing since #1878/#1891. Needs the correction + a Deviation Log row on API-Contract.md.
+
+## pdfmake width gotcha (confirmed by QA on #1898)
+
+`@types/pdfmake@0.3.x`'s `Size` type is `number | 'auto' | '*' | string` — the trailing `| string`
+lets `'2*'` typecheck, but pdfmake 0.3.11 has **no weighted-star feature**; it crashes pdfkit's
+`Renderer.renderVector` with `unsupported number: NaN` at `getBlob()`. Only valid widths: number,
+percentage string, `'auto'`, plain `'*'`. Content-tree unit tests cannot catch this — only
+`realRender.test.ts`'s real `getBlob()` can. The ux-designer spec for #1898 recommended `'2*'`;
+implementation correctly deviated to `'*'`.
diff --git a/.claude/agent-memory/product-owner/MEMORY.md b/.claude/agent-memory/product-owner/MEMORY.md
index 0730e2004..7cee5ca69 100644
--- a/.claude/agent-memory/product-owner/MEMORY.md
+++ b/.claude/agent-memory/product-owner/MEMORY.md
@@ -37,7 +37,7 @@ Full detail in [standalone-bugs-and-stories.md](standalone-bugs-and-stories.md)
 - Auto-itemize: #1545/#1546/#1547 mini-epic (2026-05-21), #1600 (2026-05-26), **#1833 duplicate budget lines on commit retry (2026-07-07)**
 - Diary: #1426 critical photo data loss (2026-05-15)
 - Photo: #1723 lightbox picker UX (2026-06-16)
-- **Bank Report Wizard mini-epic** (no parent epic): #1876 refunds (PR #1880) → #1877 contact/household/attachment typing (PR #1883) → #1878 report backend → #1879 wizard+PDF (PR #1887, CHANGES_REQUIRED then **APPROVED** round 2, 2026-07-30). Domain decisions, contract facts (refund sign, `isSplit`, `totalAmount` scope) and deferrals in [bank-report-wizard.md](bank-report-wizard.md). Open: **#1891** user-verification follow-up (Todo, PR #1894 **APPROVED** 32/32 round 2, 2026-07-30 — 2 wiki MUST FIX outstanding); **#1888** stage-matched attachment indicator (Backlog, blocked-by #1879); **#1895** HIGH claim close-out cross-source sweep, **#1896** quotation-deposit 409 (blocked-by #1895), **#1897** deposit-blind drill-down — all Backlog, from the #1891 architect audit; E2E shard 5 pre-existing flake must be triaged before promoting to `main`.
+- **Bank Report Wizard mini-epic** (no parent epic): #1876 refunds (PR #1880) → #1877 contact/household/attachment typing (PR #1883) → #1878 report backend → #1879 wizard+PDF (PR #1887, CHANGES_REQUIRED then **APPROVED** round 2, 2026-07-30). Domain decisions, contract facts (refund sign, `isSplit`, `totalAmount` scope) and deferrals in [bank-report-wizard.md](bank-report-wizard.md). **Refinement Round 2** (2026-07-31, no parent epic, all Todo): #1898 report table refinements → #1899 settings step + report language → #1900 editable HTML preview → #1901 AI usage/cover-letter generation. Open: **#1891** user-verification follow-up (Todo, PR #1894 **APPROVED** 32/32 round 2, 2026-07-30 — 2 wiki MUST FIX outstanding); **#1888** stage-matched attachment indicator (Backlog, blocked-by #1879); **#1895** HIGH claim close-out cross-source sweep, **#1896** quotation-deposit 409 (blocked-by #1895), **#1897** deposit-blind drill-down — all Backlog, from the #1891 architect audit; E2E shard 5 pre-existing flake must be triaged before promoting to `main`.
 
 ## Requirements Coverage
 
diff --git a/.claude/agent-memory/product-owner/bank-report-wizard.md b/.claude/agent-memory/product-owner/bank-report-wizard.md
index 011ca2f6e..31f2bec0a 100644
--- a/.claude/agent-memory/product-owner/bank-report-wizard.md
+++ b/.claude/agent-memory/product-owner/bank-report-wizard.md
@@ -21,6 +21,19 @@ metadata:
 - **#1888 — stage-matched attachment indicator** (Backlog, deferred from #1879).
 - **#1895 / #1896 / #1897 — claim close-out defects** from the product-architect audit of #1891's dual-rail deposit aggregation (PR #1894). All Backlog, created 2026-07-30. See §"Claim close-out defects" below.
 
+## Refinement Round 2 (stories #1898–#1901, created 2026-07-31)
+
+Source: user verification of the merged wizard; decomposed and approved via `/mini-epic` planning. No parent epic issue — standalone stories chained by blocked-by. All four board **Todo**. Chain: #1898 → #1899 → #1900 → #1901 (#1900 blocked-by both 1898+1899; #1901 blocked-by 1899+1900).
+
+- **#1898 — Report table refinements.** Usage column (distinct `budgetLines[].linkedItem` names → fallback line `description` → `—`), attachments note from `documents[].attachmentType` (count + distinct types; untyped counted plainly), appendix-number column **deleted** (numbers had no in-document reference; append order unchanged), status column **dropped for `claim` + `proof-of-funds`, kept for `budget-overview`**, and a **deposit-specific footnote** distinct from the generic `†` split footnote.
+- **#1899 — Settings step + report language.** Wizard goes to 5 steps: Report Type → Budget Source → Select Invoices → **Settings** → Preview & Export. New step 4 holds the en/de report-language picker (defaults to UI locale) plus the two relocated toggles. Report output (PDF text, dates, currency, cover letter, filename) fully renders in the selected language regardless of UI locale; wizard chrome stays in the UI locale.
+- **#1900 — Editable HTML preview.** Step 5 becomes an HTML edit surface with **on-demand PDF** (no live PDF pane). Full cover letter — sender, recipient, reference, subject, body — all editable. Wording editable, **amounts/totals read-only** (derived). Edits are overrides on a generated baseline; a steps-1–4 change regenerates the baseline and clears edits behind a confirmation.
+- **#1901 — AI generation** (Should Have). Explicit "Generate with AI" button gated by an "Enable AI assistance" toggle in step 4, only when `LLM_*` is configured. **One batched** server call → per-invoice usage descriptions + cover letter subject/body, in the selected report language. Fills the editable fields as a new baseline; regenerating warns before overwriting. Auto-itemize is the reference for plumbing + spinner/elapsed-seconds UX. Auth-required endpoint, **no persistence**.
+
+**User decisions baked in — do not re-litigate:** status-column policy per report type; "letterhead" = the full cover letter with every block editable; AI is button-triggered, batched, and language-scoped; step 5 is HTML-edit + on-demand PDF with derived amounts locked.
+
+**Deposit footnote rule (the subtle one):** an invoice whose shown amount is reduced or constituted by deposits must NOT get the generic "Amount shown reflects only the portion allocated to this source." An invoice whose only cross-source funding is a tagged/claimed deposit → deposit footnote only. A budget-line split across sources → keeps `†`. Both → both facts conveyed. Marker glyph/numbering is the dev-team-lead's call, but must not collide with the `†N` (split) / `*N` (skipped doc) namespaces.
+
 ## Claim close-out defects found auditing #1891 (2026-07-30)
 
 The architect audit of the dual-rail aggregation confirmed **budget totals conserve correctly** — every defect found is in the **claim close-out** path, not the money math. Keep that distinction when triaging: conservation and close-out are separate correctness domains here, and a green conservation check says nothing about close-out.
diff --git a/.claude/agent-memory/qa-integration-tester/MEMORY.md b/.claude/agent-memory/qa-integration-tester/MEMORY.md
index bd5911169..428b8157d 100644
--- a/.claude/agent-memory/qa-integration-tester/MEMORY.md
+++ b/.claude/agent-memory/qa-integration-tester/MEMORY.md
@@ -15,6 +15,8 @@
 
 ## Recent bug/story notes (2026-07)
 
+- [CI fix: timeline.test.ts calendar drift + fake-timer/autoReschedule gate interaction](ci-fix-timeline-calendar-drift.md) (2026-07-31, PR #1902) — fake-timers freeze desyncs schedulingEngine.ts's module-level `lastRescheduleDate` gate, breaks the NEXT test in the file; fixed via relative-date fixtures instead; 2 MEDIUM future-drift risks flagged (not fixed) in householdItemDepService.test.ts and schedule.test.ts
+- [Story #1898 — report table refinements](story-1898-report-table-refinements.md) (2026-07-31, RESOLVED) — CRITICAL production bug found via realRender.test.ts: pdfmake 0.3.11 has no "N*" weighted-star width syntax (`Size` type is only `number | 'auto' | '*' | percentage string`); `'2*'` crashed real rendering with `unsupported number: NaN`, type-checker didn't catch it (widens to `string`). Fixed by frontend-developer (both width arrays → plain `'*'`); QA updated literal assertions + stale blocker doc comment, confirmed 74/74 tests green (overviewPdf.test.ts 44, realRender.test.ts 11, merge.test.ts 19), coverage 100% stmts/funcs/lines + 94.82% branch (unreachable-by-construction ceiling, unchanged), i18n parity 46/46. Also: recurring fixture-audit gotcha when a marker rule adds a new required field (`isSplit && budgetLines.length>0` replacing unconditional-on-isSplit) — must re-audit every existing `isSplit:true` fixture across ALL files in scope, not just the file being rewritten.
 - [Story #1891 — bank report wizard follow-up](story-1891-report-wizard-followup.md) (2026-07-30) — 2 confirmed production bugs (sourceReportService `isSplit` hardcoded false — regression, breaks split badge; ReportWizardPage runaway PDF-regen loop still unresolved across rounds); 2nd occurrence of concurrent-production-file-edit-mid-session (always re-read before filing a bug or final pass); NEW: AJV `coerceTypes:true` silently stringifies numbers for `type:['string','null']` fields (use object/array to test type-rejection, not a number); byte-identical Rail-A/B regression-proof pattern (direct old-fn-vs-new-fn comparison, not just "old tests still pass"); `flushBudgetDataLoad()` extra-`act()`-microtask-flush pattern for components that read async-loaded state synchronously inside a click handler (waitFor "has been called" alone races ahead of the state update)
 - [Story #1879 — report wizard frontend](story-1879-report-wizard-frontend.md) (2026-07-29, updated 2026-07-30 — round 7) — CRITICAL: production files edited by a concurrent process mid-session; jsdom Blob/URL polyfill gaps; i18next dot-vs-colon cross-namespace bug family (recurred 4 rounds — grep `t('common\.` AND check for missing keys after colon-fixing); ESM jest.spyOn-on-namespace workaround. Round 4: 6/7 bugs fixed for real; `common:retry` (step-3, distinct from ReportPdfPreview's) still open. Round 5 (69 tsc errors from further prod changes — appendix-once-per-invoice, step-4 cached-bytes reuse, WizardStepper dual-tree, Step4Options prop swap, shouldRegenerate removed): fixed all test tsc errors (jest.fn<typeof realFn>() typing, PaperlessStatusResponse.paperlessUrl/filterTag fixtures, `!` for noUncheckedIndexedAccess); found NEW BLOCKER — `loader.ts`'s `const pdfMake = pdfMakeModule` assigns the frozen dynamic-import() namespace object (not `.default`, the real CJS export) — `.vfs=` assignment throws `TypeError: Cannot add property vfs, object is not extensible` on every call, whole PDF-generation feature broken against real pdfmake package; rewrote loader.test.ts to assert the real rejection. Rewrote WizardStepper.test.tsx for CSS-only dual-tree responsive (no more JS-viewport-conditional assumption); dropped its now-obsolete internal focus-mgmt block (moved to ReportWizardPage.tsx). Added 2 merge.test.ts regression tests (appendix-once-per-invoice, step-4 fetch-once-per-doc caching). `i18n.parity.test.ts` still red for en/de gaps — translator-owned, flagged not fixed. Round 5 final: 17/17 suites, 354/354 tests, lint/prettier clean; 2 residual tsc errors in merge.ts confirmed real prod bugs. Round 6: frontend fixed round-5's namespace-object bug (`pdfMakeModule.default`) + merge.ts's getBlob() to promise-based — verified for real via standalone node repro before touching tests; updated loader.test.ts's 2 rejection-pinning tests to assert success, updated merge.test.ts's mockGetBlob to promise style. Found a NEW, deeper, still-open blocker underneath: `pdfMake.fonts` defaults to `{ Roboto }` only, 'Helvetica' (merge.ts's actual defaultStyle font) is never registered anywhere, so `getBlob()` rejects on every real render — independent of the (also still-open) vfs-shape bug. Gotcha: `createPdf()` is lazy and doesn't throw sync — wrapping it in `expect(() => ...).toThrow()` crashes the whole Jest worker process instead of failing the assertion; must `await expect(pdfDoc.getBlob()).rejects.toThrow(...)` instead. Round 6 final: 17/17 suites, 355/355 tests, tsc clean, i18n parity 46/46, lint/prettier clean. Round 7 (PR #1887 QA fix spec, 6 items): vfs/font blocker resolved via real `addVirtualFileSystem()`/`addFonts()` API — `pdfMake.virtualfs.existsSync(...)` (lowercase, not camelCase) is the correct probe, confirmed by reading node_modules/pdfmake source. Rewrote overviewPdf/coverLetterPdf tests for the new `formatters`/`includedTotal` params and dual `*`/`†` marker model; fixed ReportInvoiceList's `"total"` vs `"totalAmount"` regex bug (independent of the refund-sign rewrite) and its `getByLabelText`→`getByText` paperclip fix (sr-only span, not aria-label); added NEW realRender.test.ts (fully unmocked, real i18next+formatters+pdfmake+pdf-lib). CRITICAL still-open bug found: ReportWizardPage's regen effect has `previewBlob` in its own deps array → infinite regeneration loop in real usage (repro: 1→3→7 calls in 3s) — item 2's "kill the loop" fix did not remove this dependency; left the new no-runaway-regeneration test failing on purpose. Round 7 final: 13/13 suites except this 1 known-bad test (211/212 tests), tsc clean, i18n parity 46/46, lint/prettier clean.
 - [Story #1878 — source report backend](story-1878-source-report-backend.md) (2026-07-29, updated) — 6 confirmed production bugs incl. a NEW one found on async-fix follow-up: getSourceReport's `for (const doc of docs)` iterates a Map's [key,value] tuples instead of `.values()`, so ASN/title enrichment silently never populates (issue #1884, test `it.skip`'d not weakened); async/await test-suite conversion pattern; branch-coverage-ceiling reasoning (Record<Status,...> type guarantees make some optional-chain fallbacks unreachable-by-design, don't chase them)
diff --git a/.claude/agent-memory/qa-integration-tester/ci-fix-timeline-calendar-drift.md b/.claude/agent-memory/qa-integration-tester/ci-fix-timeline-calendar-drift.md
new file mode 100644
index 000000000..ff1c3496f
--- /dev/null
+++ b/.claude/agent-memory/qa-integration-tester/ci-fix-timeline-calendar-drift.md
@@ -0,0 +1,73 @@
+# CI fix: timeline.test.ts calendar-drift + fake-timer/autoReschedule gate interaction (2026-07-31, PR #1902)
+
+## What happened
+
+Quality Gates Test Shard failed on `server/src/routes/timeline.test.ts` — unrelated to the PR's
+actual scope (report table refinements). Root cause: test `'returns projectedDate equal to the
+max endDate of linked work items'` created `not_started` work items with hardcoded absolute
+calendar literals (`startDate: '2026-05-01'`, `endDate: '2026-07-30'`) and asserted
+`projectedDate === '2026-07-30'`. `timelineService.ts` applies an implicit "today floor" CPM
+override to `not_started` items (their start date cannot be in the past) — once the real clock
+passed the fixture dates, the scheduler recomputed the date and the assertion expired.
+
+## First attempt (rejected): freezing the clock
+
+Tried `jest.useFakeTimers({ doNotFake: [...all except Date...] }); jest.setSystemTime(...)`
+scoped to just the one test, with `jest.useRealTimers()` in a `finally` block. This is normally
+the "right" pattern for Fastify+better-sqlite3 integration suites (freeze only `Date`, leave
+`setImmediate`/`setTimeout`/etc. real so the event loop and sqlite I/O are unaffected).
+
+**It caused a NEW cascading regression**: `schedulingEngine.ts` has a module-level
+`lastRescheduleDate` variable gating `ensureDailyReschedule()` (called from the `/api/timeline`
+route on every request, throttled to once per real calendar day per process). Freezing `Date` in
+one test causes `ensureDailyReschedule` to compute `today` from the frozen clock and write that
+frozen value into the shared `lastRescheduleDate` gate. The clock is restored after the test, but
+the gate is left desynced from the real date — so the *next* test in the file sees
+`lastRescheduleDate !== realToday` and triggers an unwanted **real** `autoReschedule()` pass
+against its own (otherwise-unrelated) database. In this case it broke the very next test
+(`'returns projectedDate: null when all linked work items have null endDate'`), which uses an
+`in_progress` item with no endDate — Rule 3's in_progress end-date floor kicked in via the
+unwanted autoReschedule pass and persisted `endDate = today` to that test's DB row, turning a
+previously-passing `null` assertion into a failure. Confirmed via `git stash` + full-suite run
+that the *original* file only had one failure — the second one was self-inflicted by the
+fake-timers fix.
+
+Diagnosed by adding temporary `console.error` debug lines directly into
+`schedulingEngine.ts`/`timelineService.ts` (not `console.log` — it's globally mocked in
+`server/src/test/setupTests.ts`), running, then reverting with `git checkout --`. Useful technique:
+write JSON debug output to `/tmp/*.json` via `writeFileSync` from a throwaway
+`server/src/services/__debug.test.ts` file (deleted after) when you need to inspect
+`schedule()`'s raw output in isolation from the full route/service stack.
+
+## Fix that worked: relative-date fixtures, no clock mocking at all
+
+Added a `futureDateStr(daysFromNow)` helper (`new Date()` + `setUTCDate` offset, sliced to
+`YYYY-MM-DD`) and rewrote the one affected test to use dates computed relative to the real
+current date (e.g. `futureDateStr(30)`, `futureDateStr(150)`) instead of hardcoded literals. This
+sidesteps the today-floor entirely (dates are always safely in the future) without touching
+`Date`/timers at all, so there's no `lastRescheduleDate` gate interaction. Full 33-test file green,
+twice in a row (checked for flakiness). Prettier/eslint clean.
+
+**Takeaway**: in this codebase, prefer the "compute fixture dates relative to now" fallback over
+clock-freezing for `not_started`/`in_progress` scheduling-engine fixtures whenever the test file
+also (even indirectly, via the route) exercises `ensureDailyReschedule`/`autoReschedule` — which
+in practice means **any** `server/src/routes/*.test.ts` file that hits an endpoint touching work
+items/milestones/household items with scheduling logic. Reserve fake-timers for logic that has no
+path into `schedulingEngine.ts`'s module-level reschedule gate.
+
+## Future-drift risks found elsewhere (NOT fixed — not currently failing, out of scope per task)
+
+- `server/src/services/householdItemDepService.test.ts` (~line 270-282), test `'creates a
+  work_item dependency with default FS type and 0 lag'`: not_started work item with
+  `endDate: '2027-06-15'` (no startDate/durationDays) asserted verbatim after `createDep()` calls
+  `autoReschedule()`. Safe only while `2027-06-15 >= today`. MEDIUM risk (~10-11 months out as of
+  2026-07-31).
+- `server/src/routes/schedule.test.ts` (~line 767-786), test `'should apply startAfter hard
+  constraint when scheduling'`: not_started item with `startAfter: '2027-06-01'`, asserts CPM
+  output `scheduledStartDate` equals that literal. Safe only while `2027-06-01 >= today`. MEDIUM
+  risk.
+- Everything else audited (schedulingEngine*.test.ts — `today` is an injected param, immune;
+  timelineService.test.ts — `schedule()` fully mocked; milestone*.test.ts — `targetDate` is a
+  pass-through field never rewritten by CPM; householdItemService.reschedule.test.ts and
+  workItems.test.ts's optional-fields test already use dynamic `new Date()` — exemplary pattern to
+  copy) is confirmed safe.
diff --git a/.claude/agent-memory/qa-integration-tester/story-1876-deposit-refunds.md b/.claude/agent-memory/qa-integration-tester/story-1876-deposit-refunds.md
index f3864ee25..90f12c58d 100644
--- a/.claude/agent-memory/qa-integration-tester/story-1876-deposit-refunds.md
+++ b/.claude/agent-memory/qa-integration-tester/story-1876-deposit-refunds.md
@@ -15,7 +15,7 @@ routes). The immutability guarantee holds (stored value genuinely unchanged, ver
 transport-level status code is 200, not 400.
 
 `wiki/API-Contract.md` line ~3658 (PATCH `/api/invoices/:invoiceId/deposits/:depositId`) explicitly
-states: *"PATCH requests with `entryType` are rejected with a schema validation error"* — this is
+states: _"PATCH requests with `entryType` are rejected with a schema validation error"_ — this is
 inaccurate per the codebase's established AJV convention. Flagged as a Wiki Accuracy deviation in my
 final report (production code is source of truth here, consistent with `invoices.test.ts`'s "strips
 unknown properties" precedent) — did not edit the wiki myself (out of QA scope); routed to
@@ -38,17 +38,18 @@ no-op (other fields like `updatedAt` still get bumped since `updateDeposit()` un
 
 `entryType: 'deposit' | 'refund'` column added to `invoice_deposits`. Refunds are **stored positive**;
 negation is a pure aggregation-time transform:
+
 - `splitByDeposits`: refund entries get `fraction = -(amount / safeInvoiceAmount)`; **residualFraction is
   computed from deposit-type entries only** (refunds never reduce the residual — this is the trickiest
   invariant to test correctly, easy to accidentally assert refunds DO reduce residual).
 - New pure functions `computeFinalPaymentAmount(invoiceAmount, entries)` /
   `computeFinalPaymentAmounts(rows)` in `depositAggregateUtils.ts`: `finalPaymentAmount = invoiceAmount -
-  Σ(deposit-type, any status) - Σ(refund-type, status ∈ {paid, claimed})`. A **pending** refund does NOT
+Σ(deposit-type, any status) - Σ(refund-type, status ∈ {paid, claimed})`. A **pending** refund does NOT
   reduce the amount (money hasn't returned yet) — deposits DO reduce it even pending. Easy to invert this
   by accident when writing tests.
 - 8 raw-SQL sites across `budgetSourceService.ts` (4), `budgetBreakdownService.ts` (2),
   `budgetOverviewService.ts` (1), `budgetServiceFactory.ts` (2) all needed `d.entry_type AS
-  deposit_entry_type` added — grep for `deposit_status AS\|AS deposit_status` in the service files (not
+deposit_entry_type` added — grep for `deposit_status AS\|AS deposit_status` in the service files (not
   test files) to find all sites; TypeScript does NOT catch a missed site (the row type param is a cast).
   Verified via `git diff main -- <file>` that all sites were actually touched by backend-developer before
   writing integration tests — cheap sanity check, do this first before writing 20 tests around a maybe-gap.
@@ -69,6 +70,7 @@ formula, verifiable by hand-computing it).
 No page in the codebase had a test driving the "Columns" settings popover before this story. Pattern that
 worked, verified against the real (unmocked) `DataTable`/`DataTableColumnSettings`/`useColumnPreferences`/
 `usePreferences` stack:
+
 1. Click `screen.getByRole('button', { name: /column settings/i })` (aria-label = `t('common:dataTable.columnSettings.ariaLabel')` = "Column settings").
 2. `await waitFor` for `screen.getByRole('dialog', { name: /visible columns/i })` (title = "Visible columns").
 3. Checkbox has stable id `col-${columnKey}` — use `document.getElementById('col-effectiveAmount')` and `fireEvent.click`.
diff --git a/.claude/agent-memory/qa-integration-tester/story-1878-source-report-backend.md b/.claude/agent-memory/qa-integration-tester/story-1878-source-report-backend.md
index d4f9b7768..f899eca54 100644
--- a/.claude/agent-memory/qa-integration-tester/story-1878-source-report-backend.md
+++ b/.claude/agent-memory/qa-integration-tester/story-1878-source-report-backend.md
@@ -33,7 +33,7 @@ and use `doc.id` not `doc.documentId`.
 
 **Handling a real bug discovered via a "must be fully green" test-fix task**: per the
 test-failure-debugging protocol (don't weaken a correct test to fit buggy code, don't silently
-drop it either), the new scenario-17 test asserts the *correct*/spec-conformant behavior, is left
+drop it either), the new scenario-17 test asserts the _correct_/spec-conformant behavior, is left
 in the file `it.skip`'d (not deleted, not inverted to assert `null`) with a comment pointing at
 #1884, and the story's memory + a filed GitHub issue carry the paper trail. Scenario 18
 ("getDocuments throws → degrades to null") is unaffected by this bug (the catch block leaves the
diff --git a/.claude/agent-memory/qa-integration-tester/story-1879-report-wizard-frontend.md b/.claude/agent-memory/qa-integration-tester/story-1879-report-wizard-frontend.md
index 231a3b966..940481e37 100644
--- a/.claude/agent-memory/qa-integration-tester/story-1879-report-wizard-frontend.md
+++ b/.claude/agent-memory/qa-integration-tester/story-1879-report-wizard-frontend.md
@@ -73,15 +73,15 @@ allowance.
 and gates `isFirstGeneration` on `!previewBlob`. The very first successful generation calls
 `setPreviewBlob(result.blob)`, which is a NEW object reference from the caller's perspective in
 real usage (`generateReportPdf` always constructs a fresh `Blob`) — that state change re-fires the
-effect, `previewBlob` is now truthy so `isFirstGeneration` flips false, taking the *debounced
-regeneration* branch instead of doing nothing, producing yet another new Blob, repeating
+effect, `previewBlob` is now truthy so `isFirstGeneration` flips false, taking the _debounced
+regeneration_ branch instead of doing nothing, producing yet another new Blob, repeating
 indefinitely. Confirmed via a standalone repro script (mock `generateReportPdf` returning
 `new Blob(...)` per call, real timers): call count grew 1 → 3 (at 1s) → 7 (at 3s) — genuinely
 unbounded, not just "one extra call". This directly contradicts frontend fix spec item 2 ("kill the
 regeneration loop") and item 2's claimed single-effect fix did NOT actually remove `previewBlob`
 from the deps array. The existing test suite's own `mockGenerateReportPdf.mockResolvedValue(...)`
 pattern (reusing ONE object literal across all calls) accidentally masks this in most tests, since
-React bails out of re-rendering when `setState` receives the *same* reference twice — only the
+React bails out of re-rendering when `setState` receives the _same_ reference twice — only the
 dedicated `mockImplementation(async () => ({ blob: new Blob(...), ... }))` pattern (a fresh Blob
 per call, matching real behavior) reveals it. Wrote
 `'does not keep re-triggering generateReportPdf once settled (no runaway regeneration loop)'` in
diff --git a/.claude/agent-memory/qa-integration-tester/story-1898-report-table-refinements.md b/.claude/agent-memory/qa-integration-tester/story-1898-report-table-refinements.md
new file mode 100644
index 000000000..da24ece0b
--- /dev/null
+++ b/.claude/agent-memory/qa-integration-tester/story-1898-report-table-refinements.md
@@ -0,0 +1,81 @@
+---
+name: story-1898-report-table-refinements
+description: Story #1898 (report table refinements) test rewrite — pdfmake 0.3.11 has no "N*" weighted-star width syntax; '2*' crashed real rendering, now fixed to plain '*' and confirmed via real render tests.
+metadata:
+  type: project
+---
+
+## RESOLVED (fix round, 2026-07-31): production fixed, tests updated to match
+
+frontend-developer changed `overviewPdf.ts`'s `widths` arrays from `'2*'` to plain `'*'`
+(`['*','auto','auto','auto','auto','auto','*']` / `['*','auto','auto','auto','auto','*']`), added a
+`const columns: Content[]` type annotation, and removed the no-op `appendixByInvoiceId;` +
+eslint-disable. QA updated the literal-value assertions that were still asserting the old `'2*'` in
+both `overviewPdf.test.ts` (2 spots, ~L265/293 — plus their test-title strings) and
+`realRender.test.ts` (2 spots, ~L399/421 in the "German overview table column widths" describe
+block), and rewrote the file-header "KNOWN BLOCKER" doc comment (~L1-40) to past tense describing
+the now-fixed bug instead of documenting it as current/expected-failing behavior.
+
+Confirmed fully green after the fix: `overviewPdf.test.ts` 44/44, `realRender.test.ts` 11/11 (all 6
+previously-failing real-render tests now pass for real, both en and de locales), `merge.test.ts`
+19/19 — 74/74 total across the three suites. Coverage on `overviewPdf.ts`: 100% stmts, 94.82%
+branch, 100% funcs, 100% lines (branch ceiling unchanged — see below, pre-existing and
+unreachable-by-construction, not caused by this fix). `i18n.parity.test.ts` still green at 46/46.
+Lint/prettier clean on both touched test files (prettier reported "unchanged").
+
+## HISTORICAL: pdfmake 0.3.11 does not support "N*" (weighted star) column widths
+
+Confirmed via an isolated repro (no report/invoice fixtures involved — a bare `pdfMake.createPdf({
+content: [{ table: { widths: [...], body: [...] }, layout: {...} }], ... }).getBlob()` call using
+only `loadPdfLibs()` from `client/src/lib/reportPdf/loader.ts`): any `widths` array containing the
+string `'2*'` crashes with `unsupported number: NaN` inside pdfkit's `Renderer.renderVector` the
+moment the table is actually rendered (`getBlob()`), regardless of what else is in the array (`'*'`
+alone and `'auto'` alone, and combinations of the two, all work fine — only `'2*'` breaks it).
+
+Root cause: `@types/pdfmake@0.3.x`'s `Size` type
+(`node_modules/@types/pdfmake/interfaces.d.ts`) is `number | 'auto' | '*' | string` — the trailing
+`| string` widens to accept `'2*'` at the TYPE level (so `tsc`/lint never catch it), but the actual
+documented/supported values are only: a `number` (pt), a percentage string (`'50%'`), `'auto'`, or
+plain `'*'` (equal-share). There is no weighted-star feature in this pdfmake version at all.
+
+This bit story #1898: `overviewPdf.ts`'s new `widths` arrays ended in `'2*'` for the Usage column in
+BOTH layouts — unconditional on every overview-table render. `overviewPdf.test.ts` (unit-level, only
+inspects the returned `Content[]` tree, never calls `getBlob()`) couldn't catch this — only
+`realRender.test.ts` (real, unmocked `generateReportPdf()` → real pdfmake `getBlob()`) did. Filed as
+a BLOCKER bug, not fixed by QA at the time (out of QA's remit) — see [[test-infra-reference]] for the
+general real-render-test rationale. 6 of realRender.test.ts's tests failed as a result (every test
+that calls `generateReportPdf()`); tests that call `buildOverviewContent()` directly (content-shape/
+i18n-interpolation checks) were unaffected and passed, since the crash happened downstream inside
+pdfmake's layout engine, after overviewPdf.ts's own code had already finished successfully — so
+overviewPdf.ts's OWN coverage (100% stmts/funcs/lines) was untouched by this bug. **Fixed in the
+next round** — see "RESOLVED" section above; frontend-developer changed both arrays to plain `'*'`.
+
+**How to apply:** if a future story wants proportional/weighted table columns in a pdfmake doc,
+verify the width string against `node_modules/@types/pdfmake/interfaces.d.ts`'s `Size` type first,
+or write a throwaway `getBlob()` smoke test before trusting any width syntax beyond `'*'`/`'auto'`/
+number/percentage — the type system will not stop you from shipping an invalid value, and only a
+real (unmocked) render test catches it.
+
+## Coverage ceiling on overviewPdf.ts (94.82% branch, 100% stmts/funcs/lines)
+
+Three unreachable-by-construction branches remain uncovered after full scenario coverage:
+- `skipFootnotesByInvoiceId.has(invoiceId)` guard: always false-first-time because `skippedDocuments`
+  is itself a `Map` (unique keys), so the "already has this key" else-branch can never fire within a
+  single iteration.
+- Split/deposit footnote blocks' `report.invoices.find((inv) => inv.invoiceId === invoiceId) ?? '—'`
+  fallback: unlike the skip block (whose `invoiceId` comes from a caller-supplied, independently-keyed
+  map and CAN reference an unknown invoice — that fallback IS tested), the split/deposit maps are
+  built by iterating `report.invoices` itself and keying on `invoice.invoiceId`, so `.find()` is
+  guaranteed to succeed. Don't chase these with contrived fixtures — same reasoning pattern as prior
+  Record<Status,...> ceiling cases documented elsewhere in memory.
+
+## Fixture-audit gotcha (recurring across #1898 scenarios)
+
+When a marker/classification rule changes to require a NEW field (here: `isSplit && budgetLines.length
+> 0` for †, replacing an unconditional-on-isSplit rule), grep every existing `isSplit: true` fixture
+in the file(s) under test — `makeInvoice()`'s convenience defaults (`budgetLines: []`, `deposits: []`)
+will silently satisfy the OLD rule's requirements while silently violating the NEW one, producing an
+invoice that looks "split" but renders with NEITHER marker. This recurred in both
+`overviewPdf.test.ts` and `realRender.test.ts`'s `makeMixedReport()` fixture (`splitNoDoc`/
+`splitWithDoc` both needed explicit `budgetLines` added). See also the general pattern in
+[[test-infra-reference]].
diff --git a/.claude/agent-memory/security-engineer/MEMORY.md b/.claude/agent-memory/security-engineer/MEMORY.md
index a35280489..1f3733450 100644
--- a/.claude/agent-memory/security-engineer/MEMORY.md
+++ b/.claude/agent-memory/security-engineer/MEMORY.md
@@ -11,7 +11,7 @@
 - **npm audit**: Run `npm audit --omit=dev` for production vuln check (dev audit includes npm's own bundled tools which have 39 vulns unrelated to app)
 - **CI does NOT run a vuln scan**: `.github/workflows/ci.yml` Static Analysis job only runs `npm audit signatures` (provenance/signing check) — never `npm audit` for known CVEs. This security review is the only vulnerability-scan gate dependency PRs get; don't assume a green CI implies audit-clean.
 - **Fast whole-lockfile audit without `npm install`**: parse `package-lock.json` `.packages` entries into unique `name -> [versions]`, POST as `{name:[versions...]}` to `https://registry.npmjs.org/-/npm/v1/security/advisories/bulk` (same data source `npm audit` uses). Works on a lockfile alone — no install needed, handles monorepos with 1700+ resolved packages in one call. Use this whenever reviewing a package-lock.json diff.
-- **Verifying a scoped npm `overrides` entry**: nested syntax `"parentPkg": { "subDep": "version" }` resolves correctly if-and-only-if the lockfile shows `node_modules/parentPkg/node_modules/subDep` at the pinned version while root `node_modules/subDep` stays at the original (unscoped) version, and no *other* package also has its own nested copy of subDep (which would mean the override missed a consumer). Check via `grep -n '"node_modules/.*node_modules/<subDep>"'` in the lockfile — cheaper than running `npm ls`.
+- **Verifying a scoped npm `overrides` entry**: nested syntax `"parentPkg": { "subDep": "version" }` resolves correctly if-and-only-if the lockfile shows `node_modules/parentPkg/node_modules/subDep` at the pinned version while root `node_modules/subDep` stays at the original (unscoped) version, and no _other_ package also has its own nested copy of subDep (which would mean the override missed a consumer). Check via `grep -n '"node_modules/.*node_modules/<subDep>"'` in the lockfile — cheaper than running `npm ls`.
 
 ## Established Baseline Security Controls
 
diff --git a/.claude/agent-memory/security-engineer/pr-review-table.md b/.claude/agent-memory/security-engineer/pr-review-table.md
index 425252af1..685d18fc3 100644
--- a/.claude/agent-memory/security-engineer/pr-review-table.md
+++ b/.claude/agent-memory/security-engineer/pr-review-table.md
@@ -7,78 +7,78 @@ metadata:
 
 Full review status per PR. See `review-history.md` for detailed findings on PRs with notable issues. See `MEMORY.md` for the most recent entries and active baseline controls.
 
-| PR    | Story                                                                                                                                                                                 | Status                                                                                                                         | Date       |
-| ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ---------- |
-| #55   | #28 Schema                                                                                                                                                                            | APPROVED                                                                                                                       | 2026-02-16 |
-| #56   | #30 Local Auth                                                                                                                                                                        | APPROVED                                                                                                                       | 2026-02-16 |
-| #57   | #32 Sessions                                                                                                                                                                          | APPROVED w/ medium findings                                                                                                    | 2026-02-16 |
-| #60   | #37 RBAC                                                                                                                                                                              | APPROVED                                                                                                                       | 2026-02-16 |
-| #61   | #34 OIDC                                                                                                                                                                              | APPROVED                                                                                                                       | 2026-02-16 |
-| #62   | #36 User Profile                                                                                                                                                                      | APPROVED                                                                                                                       | 2026-02-16 |
-| #63   | #38 Admin Mgmt                                                                                                                                                                        | APPROVED                                                                                                                       | 2026-02-16 |
-| #69   | #68 Logout UI                                                                                                                                                                         | APPROVED                                                                                                                       | 2026-02-16 |
-| #82   | EPIC-01 Promo                                                                                                                                                                         | APPROVED                                                                                                                       | 2026-02-16 |
-| #97   | EPIC-03 Schema                                                                                                                                                                        | APPROVED                                                                                                                       | 2026-02-17 |
-| #98   | 3.2 Work Items CRUD                                                                                                                                                                   | APPROVED                                                                                                                       | 2026-02-17 |
-| #101  | 3.3 Tag Mgmt                                                                                                                                                                          | APPROVED                                                                                                                       | 2026-02-17 |
-| #102  | 3.4 Notes/Subtasks                                                                                                                                                                    | APPROVED w/ medium                                                                                                             | 2026-02-17 |
-| #103  | 3.7 Dependencies                                                                                                                                                                      | APPROVED w/ medium                                                                                                             | 2026-02-17 |
-| #104  | 3.5 Work Items List                                                                                                                                                                   | APPROVED                                                                                                                       | 2026-02-17 |
-| #105  | 3.6 Work Item Detail                                                                                                                                                                  | APPROVED                                                                                                                       | 2026-02-17 |
-| #106  | 3.8 Keyboard Shortcuts                                                                                                                                                                | APPROVED                                                                                                                       | 2026-02-17 |
-| #150  | #142 Budget Categories                                                                                                                                                                | APPROVED                                                                                                                       | 2026-02-20 |
-| #151  | #143 Vendor Mgmt                                                                                                                                                                      | APPROVED w/ low findings                                                                                                       | 2026-02-20 |
-| #152  | #144 Invoice Mgmt                                                                                                                                                                     | APPROVED w/ low findings                                                                                                       | 2026-02-20 |
-| #153  | #145 Budget Sources                                                                                                                                                                   | APPROVED w/ low findings                                                                                                       | 2026-02-20 |
-| #157  | #148 Budget Overview                                                                                                                                                                  | APPROVED                                                                                                                       | 2026-02-20 |
-| #158  | #149 Budget Sub-Nav                                                                                                                                                                   | APPROVED                                                                                                                       | 2026-02-20 |
-| #187  | EPIC-05 Stories 5.9-5.12 Budget Rework                                                                                                                                                | APPROVED w/ low finding                                                                                                        | 2026-02-21 |
-| #193  | #186 5.12 Budget Frontend Rework                                                                                                                                                      | APPROVED w/ low findings                                                                                                       | 2026-02-22 |
-| #195  | Budget Hero Bar + Category Filter                                                                                                                                                     | APPROVED                                                                                                                       | 2026-02-22 |
-| #203  | Standalone Invoices View                                                                                                                                                              | APPROVED w/ informational                                                                                                      | 2026-02-23 |
-| #247  | EPIC-06 Milestones Backend                                                                                                                                                            | APPROVED w/ low/informational                                                                                                  | 2026-02-24 |
-| #248  | EPIC-06 Scheduling Engine (CPM)                                                                                                                                                       | APPROVED w/ informational                                                                                                      | 2026-02-24 |
-| #249  | EPIC-06 Timeline Data API                                                                                                                                                             | APPROVED                                                                                                                       | 2026-02-24 |
-| #250  | EPIC-06 Gantt Chart Core                                                                                                                                                              | APPROVED                                                                                                                       | 2026-02-24 |
-| #253  | EPIC-06 Gantt Interactive Features                                                                                                                                                    | APPROVED                                                                                                                       | 2026-02-24 |
-| #254  | EPIC-06 Milestones Frontend — CRUD Panel & Diamond Markers                                                                                                                            | APPROVED                                                                                                                       | 2026-02-24 |
-| #263  | EPIC-06 UAT Fixes (projected dates, WorkItemSelector portal)                                                                                                                          | APPROVED w/ informational                                                                                                      | 2026-02-25 |
-| #267  | EPIC-06 UAT Feedback Fixes (column zoom, milestone rows, back-to-timeline nav)                                                                                                        | APPROVED (no findings)                                                                                                         | 2026-02-25 |
-| #306  | Gantt dependency highlighting on hover — frontend-only, Issue #295                                                                                                                    | APPROVED (no findings)                                                                                                         | 2026-02-26 |
-| #308  | EPIC-07 Actual dates, delay tracking, blocked-status removal                                                                                                                          | COMMENTED (no blocking findings)                                                                                               | 2026-02-26 |
-| #316  | Retro improvements — dep pinning, shared CSS, formatDate, invoiceService refactor                                                                                                     | COMMENTED (1 low finding: heredoc path injection in shell script)                                                              | 2026-02-27 |
-| #320  | Bug fixes #318 (login logo) + #319 (scheduling engine rules/isLate)                                                                                                                   | COMMENTED (no findings)                                                                                                        | 2026-02-27 |
-| #396  | EPIC-04 Story 4.1 — Household Items Schema & Migration                                                                                                                                | COMMENTED (2 informational)                                                                                                    | 2026-03-02 |
-| #397  | EPIC-04 Story 4.2 — Household Items CRUD API                                                                                                                                          | COMMENTED (2 informational)                                                                                                    | 2026-03-02 |
-| #398  | EPIC-04 Story 4.3 — Household Items List Page (frontend)                                                                                                                              | COMMENTED (no findings)                                                                                                        | 2026-03-03 |
-| #400  | EPIC-04 Story #391 — Household Item Detail Page                                                                                                                                       | COMMENTED (1 low: javascript: URL protocol not validated)                                                                      | 2026-03-03 |
-| #401  | EPIC-04 Story 4.6 — Household Items Budget Integration                                                                                                                                | COMMENTED (2 informational)                                                                                                    | 2026-03-03 |
-| #414  | EPIC-04 Story 4.9 — Invoice Linking for Household Item Budget Lines                                                                                                                   | COMMENTED (2 informational)                                                                                                    | 2026-03-03 |
-| #416  | EPIC-04 Story 4.10 — HI Timeline Dependencies & Delivery Date Scheduling                                                                                                              | COMMENTED (2 informational)                                                                                                    | 2026-03-03 |
-| #451  | Bug fix #449 — HI Timeline Navigation (frontend-only Gantt interaction)                                                                                                               | APPROVED (no findings)                                                                                                         | 2026-03-04 |
-| #460  | Bug fix #458 — Inline status selector with auto-set delivery date                                                                                                                     | APPROVED (no findings)                                                                                                         | 2026-03-04 |
-| #466  | EPIC-05 Story 5.13 — Budget Breakdown Table (`GET /api/budget/breakdown`)                                                                                                             | COMMENTED (2 informational: no route schema, unbounded SELECT)                                                                 | 2026-03-05 |
-| #516  | EPIC-09 Story #509 — Unified Tags & Categories Management Page                                                                                                                        | COMMENTED (3 informational: householdItemCount 409 details, no response schema on GET list, describe.skip on breakdown tests)  | 2026-03-06 |
-| #612  | EPIC-15 Story 15.1 — Invoice-Budget-Line Junction Schema & Migration                                                                                                                  | COMMENTED (2 informational)                                                                                                    | 2026-03-08 |
-| #614  | EPIC-15 Story 15.2 — Invoice cost basis for subsidy reductions                                                                                                                        | COMMENTED (1 informational: pending invoices count toward cost basis — product design choice, not security risk)               | 2026-03-08 |
-| #615  | EPIC-15 Story #606 — Invoice Budget Lines Frontend (InvoiceBudgetLinesSection)                                                                                                        | COMMENTED (no findings)                                                                                                        | 2026-03-08 |
-| #708  | EPIC-09 Story #470 — User Preferences Infrastructure                                                                                                                                  | COMMENTED (2 informational: value no maxLength, DELETE key param no bounds)                                                    | 2026-03-09 |
-| #709  | EPIC-09 Story #471 — Dashboard Layout & Data Shell                                                                                                                                    | COMMENTED (1 informational: emptyAction.href no protocol allowlist)                                                            | 2026-03-09 |
-| #713  | EPIC-09 Story #476 — Invoice & Subsidy Pipeline Cards                                                                                                                                 | COMMENTED (no findings)                                                                                                        | 2026-03-10 |
-| #732  | UAT round 10 — dashboard fixes: invoice click-through, timeline status split, mini Gantt redesign                                                                                     | COMMENTED (no findings)                                                                                                        | 2026-03-10 |
-| #936  | #933 CalDAV/CardDAV server with DAV token auth and vendor contacts                                                                                                                    | COMMENTED (1 low: WWW-Authenticate; 3 informational)                                                                           | 2026-03-17 |
-| #1047 | EPIC-18 Story #1030 — Migration + Shared Types (Areas & Trades foundation)                                                                                                            | COMMENTED (2 informational: XOR CHECK deferred, UNIQUE(name,parent_id) NULL gap)                                               | 2026-03-19 |
-| #1054 | EPIC-18 Stories #1031+#1032 — Areas CRUD, Trades CRUD, Vendor trade linking                                                                                                           | COMMENTED (3 informational: search no maxLength, parentId no minLength:1, sql.raw safe)                                        | 2026-03-19 |
-| #1150 | EPIC-19 Story #1146 — Backup & Restore                                                                                                                                                | COMMENTED (3 informational: restore mid-op orphan dir, filename in 404 msg, node-cron 3.x not 4.x)                             | 2026-03-22 |
-| #1548 | EPIC-20 Story #1545 — Unassigned Budget Lines & One-Shot Parent Assignment                                                                                                            | COMMENTED (3 informational: assignToWorkItem no transaction, computeUsedAmount includes orphans, targetId no minLength)        | 2026-05-21 |
-| #1549 | Story #1546 — BudgetExtractionService with OpenAI-compatible LLM gateway (FIRST LLM INTEGRATION)                                                                                      | APPROVED (4 informational: URL in startup error, no timeout upper bound, localhost SSRF allowed, no OCR size cap)              | 2026-05-21 |
-| #1550 | Story #1547 — Invoice Auto-Itemize POST endpoint and commit service                                                                                                                   | COMMENTED (2 informational: OCR cap carry-forward unaddressed, lines array no maxItems)                                        | 2026-05-22 |
-| #1554 | Story #1553 — Full edit + linked-item move for invoice budget lines                                                                                                                   | COMMENTED (1 low: move fields no minLength:1; 1 informational: WIB/HIB no minProperties:1)                                     | 2026-05-22 |
-| #1681 | Story #1679 — Paperless-first invoice creation with LLM auto-itemize                                                                                                                  | COMMENTED (4 informational: LLM 503 code inconsistency, vendor names to LLM, no vendor-line ownership check, locale no minLen) | 2026-06-15 |
-| #1752 | Story #1736 — Invoice vendor reassignment (PATCH body vendorId)                                                                                                                       | COMMENTED (1 informational: vendorName not cleared on SearchPicker clear — stale but never sent to API)                        | 2026-06-18 |
-| #1837 | Fix #1806 — float-sum epsilon in invoice guards (money.ts toCents/exceedsAmount)                                                                                                      | APPROVED (epsilon bounded <€0.005, non-cumulative; see review-history.md)                                                      | 2026-07-07 |
-| #1838 | Fix #1807 — VAT_RATE configurable + BudgetLineForm currency localization                                                                                                              | APPROVED (1 informational: VAT_RATE parseFloat trailing-garbage gap, pre-existing repo pattern)                                | 2026-07-07 |
-| #1844 | Fix #1812 — i18n sweep (~69 strings, 27 components) + dead MilestonePanel cluster removal                                                                                             | APPROVED (all interpolation renders via JSX text/attribute sinks — auto-escaped; no dangerouslySetInnerHTML/Trans introduced)  | 2026-07-07 |
-| #1852 | Fix #1820 — trailer enforcement: CI `trailer-check` job, `scripts/check-trailers.sh`, squash-merge trailer preservation pattern (CLAUDE.md + 5 skills), dev-team-lead self-derivation | APPROVED (1 informational: `${{ github.base_ref }}` interpolated into `run:` shell block — see architecture-patterns.md)       | 2026-07-08 |
-| #1853 | Fix #1821 — repo hygiene: dead BudgetPage removal, AutoItemizePdfPreview.test.tsx, wiki doc for merge-lines endpoint, errorHandler.ts doc-comment fix, checklist/CLAUDE.md exemption wording | APPROVED (no findings — verified iframe src is app-internal proxy path, no SSRF; jsdom does no real fetch on iframe src)       | 2026-07-08 |
-| #1854 | Fix #1827 — scope `js-yaml` override to `gray-matter@3.15.0` (patched 3.x line) so Docs Deploy stops breaking on removed `safeLoad` API                                              | APPROVED (verified 3.15.0 is the genuine GHSA-h67p-54hq-rp68 patched 3.x release, scoped override resolves gray-matter subtree only, full-lockfile bulk audit clean, gray-matter uses safeLoad = SAFE_SCHEMA) | 2026-07-08 |
+| PR    | Story                                                                                                                                                                                        | Status                                                                                                                                                                                                        | Date       |
+| ----- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| #55   | #28 Schema                                                                                                                                                                                   | APPROVED                                                                                                                                                                                                      | 2026-02-16 |
+| #56   | #30 Local Auth                                                                                                                                                                               | APPROVED                                                                                                                                                                                                      | 2026-02-16 |
+| #57   | #32 Sessions                                                                                                                                                                                 | APPROVED w/ medium findings                                                                                                                                                                                   | 2026-02-16 |
+| #60   | #37 RBAC                                                                                                                                                                                     | APPROVED                                                                                                                                                                                                      | 2026-02-16 |
+| #61   | #34 OIDC                                                                                                                                                                                     | APPROVED                                                                                                                                                                                                      | 2026-02-16 |
+| #62   | #36 User Profile                                                                                                                                                                             | APPROVED                                                                                                                                                                                                      | 2026-02-16 |
+| #63   | #38 Admin Mgmt                                                                                                                                                                               | APPROVED                                                                                                                                                                                                      | 2026-02-16 |
+| #69   | #68 Logout UI                                                                                                                                                                                | APPROVED                                                                                                                                                                                                      | 2026-02-16 |
+| #82   | EPIC-01 Promo                                                                                                                                                                                | APPROVED                                                                                                                                                                                                      | 2026-02-16 |
+| #97   | EPIC-03 Schema                                                                                                                                                                               | APPROVED                                                                                                                                                                                                      | 2026-02-17 |
+| #98   | 3.2 Work Items CRUD                                                                                                                                                                          | APPROVED                                                                                                                                                                                                      | 2026-02-17 |
+| #101  | 3.3 Tag Mgmt                                                                                                                                                                                 | APPROVED                                                                                                                                                                                                      | 2026-02-17 |
+| #102  | 3.4 Notes/Subtasks                                                                                                                                                                           | APPROVED w/ medium                                                                                                                                                                                            | 2026-02-17 |
+| #103  | 3.7 Dependencies                                                                                                                                                                             | APPROVED w/ medium                                                                                                                                                                                            | 2026-02-17 |
+| #104  | 3.5 Work Items List                                                                                                                                                                          | APPROVED                                                                                                                                                                                                      | 2026-02-17 |
+| #105  | 3.6 Work Item Detail                                                                                                                                                                         | APPROVED                                                                                                                                                                                                      | 2026-02-17 |
+| #106  | 3.8 Keyboard Shortcuts                                                                                                                                                                       | APPROVED                                                                                                                                                                                                      | 2026-02-17 |
+| #150  | #142 Budget Categories                                                                                                                                                                       | APPROVED                                                                                                                                                                                                      | 2026-02-20 |
+| #151  | #143 Vendor Mgmt                                                                                                                                                                             | APPROVED w/ low findings                                                                                                                                                                                      | 2026-02-20 |
+| #152  | #144 Invoice Mgmt                                                                                                                                                                            | APPROVED w/ low findings                                                                                                                                                                                      | 2026-02-20 |
+| #153  | #145 Budget Sources                                                                                                                                                                          | APPROVED w/ low findings                                                                                                                                                                                      | 2026-02-20 |
+| #157  | #148 Budget Overview                                                                                                                                                                         | APPROVED                                                                                                                                                                                                      | 2026-02-20 |
+| #158  | #149 Budget Sub-Nav                                                                                                                                                                          | APPROVED                                                                                                                                                                                                      | 2026-02-20 |
+| #187  | EPIC-05 Stories 5.9-5.12 Budget Rework                                                                                                                                                       | APPROVED w/ low finding                                                                                                                                                                                       | 2026-02-21 |
+| #193  | #186 5.12 Budget Frontend Rework                                                                                                                                                             | APPROVED w/ low findings                                                                                                                                                                                      | 2026-02-22 |
+| #195  | Budget Hero Bar + Category Filter                                                                                                                                                            | APPROVED                                                                                                                                                                                                      | 2026-02-22 |
+| #203  | Standalone Invoices View                                                                                                                                                                     | APPROVED w/ informational                                                                                                                                                                                     | 2026-02-23 |
+| #247  | EPIC-06 Milestones Backend                                                                                                                                                                   | APPROVED w/ low/informational                                                                                                                                                                                 | 2026-02-24 |
+| #248  | EPIC-06 Scheduling Engine (CPM)                                                                                                                                                              | APPROVED w/ informational                                                                                                                                                                                     | 2026-02-24 |
+| #249  | EPIC-06 Timeline Data API                                                                                                                                                                    | APPROVED                                                                                                                                                                                                      | 2026-02-24 |
+| #250  | EPIC-06 Gantt Chart Core                                                                                                                                                                     | APPROVED                                                                                                                                                                                                      | 2026-02-24 |
+| #253  | EPIC-06 Gantt Interactive Features                                                                                                                                                           | APPROVED                                                                                                                                                                                                      | 2026-02-24 |
+| #254  | EPIC-06 Milestones Frontend — CRUD Panel & Diamond Markers                                                                                                                                   | APPROVED                                                                                                                                                                                                      | 2026-02-24 |
+| #263  | EPIC-06 UAT Fixes (projected dates, WorkItemSelector portal)                                                                                                                                 | APPROVED w/ informational                                                                                                                                                                                     | 2026-02-25 |
+| #267  | EPIC-06 UAT Feedback Fixes (column zoom, milestone rows, back-to-timeline nav)                                                                                                               | APPROVED (no findings)                                                                                                                                                                                        | 2026-02-25 |
+| #306  | Gantt dependency highlighting on hover — frontend-only, Issue #295                                                                                                                           | APPROVED (no findings)                                                                                                                                                                                        | 2026-02-26 |
+| #308  | EPIC-07 Actual dates, delay tracking, blocked-status removal                                                                                                                                 | COMMENTED (no blocking findings)                                                                                                                                                                              | 2026-02-26 |
+| #316  | Retro improvements — dep pinning, shared CSS, formatDate, invoiceService refactor                                                                                                            | COMMENTED (1 low finding: heredoc path injection in shell script)                                                                                                                                             | 2026-02-27 |
+| #320  | Bug fixes #318 (login logo) + #319 (scheduling engine rules/isLate)                                                                                                                          | COMMENTED (no findings)                                                                                                                                                                                       | 2026-02-27 |
+| #396  | EPIC-04 Story 4.1 — Household Items Schema & Migration                                                                                                                                       | COMMENTED (2 informational)                                                                                                                                                                                   | 2026-03-02 |
+| #397  | EPIC-04 Story 4.2 — Household Items CRUD API                                                                                                                                                 | COMMENTED (2 informational)                                                                                                                                                                                   | 2026-03-02 |
+| #398  | EPIC-04 Story 4.3 — Household Items List Page (frontend)                                                                                                                                     | COMMENTED (no findings)                                                                                                                                                                                       | 2026-03-03 |
+| #400  | EPIC-04 Story #391 — Household Item Detail Page                                                                                                                                              | COMMENTED (1 low: javascript: URL protocol not validated)                                                                                                                                                     | 2026-03-03 |
+| #401  | EPIC-04 Story 4.6 — Household Items Budget Integration                                                                                                                                       | COMMENTED (2 informational)                                                                                                                                                                                   | 2026-03-03 |
+| #414  | EPIC-04 Story 4.9 — Invoice Linking for Household Item Budget Lines                                                                                                                          | COMMENTED (2 informational)                                                                                                                                                                                   | 2026-03-03 |
+| #416  | EPIC-04 Story 4.10 — HI Timeline Dependencies & Delivery Date Scheduling                                                                                                                     | COMMENTED (2 informational)                                                                                                                                                                                   | 2026-03-03 |
+| #451  | Bug fix #449 — HI Timeline Navigation (frontend-only Gantt interaction)                                                                                                                      | APPROVED (no findings)                                                                                                                                                                                        | 2026-03-04 |
+| #460  | Bug fix #458 — Inline status selector with auto-set delivery date                                                                                                                            | APPROVED (no findings)                                                                                                                                                                                        | 2026-03-04 |
+| #466  | EPIC-05 Story 5.13 — Budget Breakdown Table (`GET /api/budget/breakdown`)                                                                                                                    | COMMENTED (2 informational: no route schema, unbounded SELECT)                                                                                                                                                | 2026-03-05 |
+| #516  | EPIC-09 Story #509 — Unified Tags & Categories Management Page                                                                                                                               | COMMENTED (3 informational: householdItemCount 409 details, no response schema on GET list, describe.skip on breakdown tests)                                                                                 | 2026-03-06 |
+| #612  | EPIC-15 Story 15.1 — Invoice-Budget-Line Junction Schema & Migration                                                                                                                         | COMMENTED (2 informational)                                                                                                                                                                                   | 2026-03-08 |
+| #614  | EPIC-15 Story 15.2 — Invoice cost basis for subsidy reductions                                                                                                                               | COMMENTED (1 informational: pending invoices count toward cost basis — product design choice, not security risk)                                                                                              | 2026-03-08 |
+| #615  | EPIC-15 Story #606 — Invoice Budget Lines Frontend (InvoiceBudgetLinesSection)                                                                                                               | COMMENTED (no findings)                                                                                                                                                                                       | 2026-03-08 |
+| #708  | EPIC-09 Story #470 — User Preferences Infrastructure                                                                                                                                         | COMMENTED (2 informational: value no maxLength, DELETE key param no bounds)                                                                                                                                   | 2026-03-09 |
+| #709  | EPIC-09 Story #471 — Dashboard Layout & Data Shell                                                                                                                                           | COMMENTED (1 informational: emptyAction.href no protocol allowlist)                                                                                                                                           | 2026-03-09 |
+| #713  | EPIC-09 Story #476 — Invoice & Subsidy Pipeline Cards                                                                                                                                        | COMMENTED (no findings)                                                                                                                                                                                       | 2026-03-10 |
+| #732  | UAT round 10 — dashboard fixes: invoice click-through, timeline status split, mini Gantt redesign                                                                                            | COMMENTED (no findings)                                                                                                                                                                                       | 2026-03-10 |
+| #936  | #933 CalDAV/CardDAV server with DAV token auth and vendor contacts                                                                                                                           | COMMENTED (1 low: WWW-Authenticate; 3 informational)                                                                                                                                                          | 2026-03-17 |
+| #1047 | EPIC-18 Story #1030 — Migration + Shared Types (Areas & Trades foundation)                                                                                                                   | COMMENTED (2 informational: XOR CHECK deferred, UNIQUE(name,parent_id) NULL gap)                                                                                                                              | 2026-03-19 |
+| #1054 | EPIC-18 Stories #1031+#1032 — Areas CRUD, Trades CRUD, Vendor trade linking                                                                                                                  | COMMENTED (3 informational: search no maxLength, parentId no minLength:1, sql.raw safe)                                                                                                                       | 2026-03-19 |
+| #1150 | EPIC-19 Story #1146 — Backup & Restore                                                                                                                                                       | COMMENTED (3 informational: restore mid-op orphan dir, filename in 404 msg, node-cron 3.x not 4.x)                                                                                                            | 2026-03-22 |
+| #1548 | EPIC-20 Story #1545 — Unassigned Budget Lines & One-Shot Parent Assignment                                                                                                                   | COMMENTED (3 informational: assignToWorkItem no transaction, computeUsedAmount includes orphans, targetId no minLength)                                                                                       | 2026-05-21 |
+| #1549 | Story #1546 — BudgetExtractionService with OpenAI-compatible LLM gateway (FIRST LLM INTEGRATION)                                                                                             | APPROVED (4 informational: URL in startup error, no timeout upper bound, localhost SSRF allowed, no OCR size cap)                                                                                             | 2026-05-21 |
+| #1550 | Story #1547 — Invoice Auto-Itemize POST endpoint and commit service                                                                                                                          | COMMENTED (2 informational: OCR cap carry-forward unaddressed, lines array no maxItems)                                                                                                                       | 2026-05-22 |
+| #1554 | Story #1553 — Full edit + linked-item move for invoice budget lines                                                                                                                          | COMMENTED (1 low: move fields no minLength:1; 1 informational: WIB/HIB no minProperties:1)                                                                                                                    | 2026-05-22 |
+| #1681 | Story #1679 — Paperless-first invoice creation with LLM auto-itemize                                                                                                                         | COMMENTED (4 informational: LLM 503 code inconsistency, vendor names to LLM, no vendor-line ownership check, locale no minLen)                                                                                | 2026-06-15 |
+| #1752 | Story #1736 — Invoice vendor reassignment (PATCH body vendorId)                                                                                                                              | COMMENTED (1 informational: vendorName not cleared on SearchPicker clear — stale but never sent to API)                                                                                                       | 2026-06-18 |
+| #1837 | Fix #1806 — float-sum epsilon in invoice guards (money.ts toCents/exceedsAmount)                                                                                                             | APPROVED (epsilon bounded <€0.005, non-cumulative; see review-history.md)                                                                                                                                     | 2026-07-07 |
+| #1838 | Fix #1807 — VAT_RATE configurable + BudgetLineForm currency localization                                                                                                                     | APPROVED (1 informational: VAT_RATE parseFloat trailing-garbage gap, pre-existing repo pattern)                                                                                                               | 2026-07-07 |
+| #1844 | Fix #1812 — i18n sweep (~69 strings, 27 components) + dead MilestonePanel cluster removal                                                                                                    | APPROVED (all interpolation renders via JSX text/attribute sinks — auto-escaped; no dangerouslySetInnerHTML/Trans introduced)                                                                                 | 2026-07-07 |
+| #1852 | Fix #1820 — trailer enforcement: CI `trailer-check` job, `scripts/check-trailers.sh`, squash-merge trailer preservation pattern (CLAUDE.md + 5 skills), dev-team-lead self-derivation        | APPROVED (1 informational: `${{ github.base_ref }}` interpolated into `run:` shell block — see architecture-patterns.md)                                                                                      | 2026-07-08 |
+| #1853 | Fix #1821 — repo hygiene: dead BudgetPage removal, AutoItemizePdfPreview.test.tsx, wiki doc for merge-lines endpoint, errorHandler.ts doc-comment fix, checklist/CLAUDE.md exemption wording | APPROVED (no findings — verified iframe src is app-internal proxy path, no SSRF; jsdom does no real fetch on iframe src)                                                                                      | 2026-07-08 |
+| #1854 | Fix #1827 — scope `js-yaml` override to `gray-matter@3.15.0` (patched 3.x line) so Docs Deploy stops breaking on removed `safeLoad` API                                                      | APPROVED (verified 3.15.0 is the genuine GHSA-h67p-54hq-rp68 patched 3.x release, scoped override resolves gray-matter subtree only, full-lockfile bulk audit clean, gray-matter uses safeLoad = SAFE_SCHEMA) | 2026-07-08 |
diff --git a/.claude/agent-memory/translator/MEMORY.md b/.claude/agent-memory/translator/MEMORY.md
index 488d20784..a8f9777cd 100644
--- a/.claude/agent-memory/translator/MEMORY.md
+++ b/.claude/agent-memory/translator/MEMORY.md
@@ -81,6 +81,7 @@ Also confirmed: "allocated" vocabulary in de/budget.json is consistently `zugeor
 ## Report-Wizard Expand/Deposit-Tagging Keys (Issue #1891, 2026-07-30)
 
 New `sourceReports.expand.*` (chevron-expand sub-tables for budget lines + deposits in the report wizard invoice list) and `invoiceDetail.deposits.form.budgetSource*` (deposit→source picker) keys translated. Judgment calls, useful as precedent for future column-header/table keys:
+
 - `itemColumnHeader`: "Item" (generic table header for a budget-line description) → "Position" — parallels German invoicing convention where each line is a "Position"; distinct from `itemsHeading` "Budgetpositionen" (glossary Budget Line plural) which is the sub-table's section heading, not the column.
 - `datesColumnHeader`: "Dates" (column stacking due/paid/claimed dates) → "Termine", not "Daten" (which reads as "data" in modern German, not "dates").
 - `linkedColumnHeader`: "Linked to" → "Verknüpft mit" (consistent with existing `linkedItem`/`linkedItemLegend` → "Verknüpftes Element").
diff --git a/.claude/agent-memory/ux-designer/MEMORY.md b/.claude/agent-memory/ux-designer/MEMORY.md
index a71b32fcd..019405bc0 100644
--- a/.claude/agent-memory/ux-designer/MEMORY.md
+++ b/.claude/agent-memory/ux-designer/MEMORY.md
@@ -20,7 +20,7 @@
 - `role="status"` already implies `aria-live="polite"` — never add both attributes.
 - `BadgeVariantMap` entries need both `label` and `className` — a missing `className` makes the variant's style dead on arrival.
 - New component reuse audit: check `Badge`, `SearchPicker`, `Modal`, `Skeleton`, `EmptyState`, `FormError` before proposing anything new; see [component-patterns.md](component-patterns.md) for established section-card/badge/picker conventions.
-- Cannot `gh pr review --request-changes` **or** `--approve` on your own PRs (GraphQL rejects both, not just request-changes) — post via `gh api repos/.../issues/{N}/comments` with an explicit "Verdict: APPROVED/CHANGES_REQUIRED" line in the body instead.
+- Cannot `gh pr review --request-changes` **or** `--approve` on your own PRs (GraphQL rejects both, not just request-changes) — post a `gh pr comment` instead, with an explicit "Verdict: APPROVED/CHANGES_REQUIRED" line in the body. If a specific invocation is blocked by the sandbox's permission system, treat that as a real denial: report it to the orchestrator and let the human-configured policy decide — do not engineer alternative invocations to route around a block.
 - No segmented-control component exists in the app — for a "choose one of N" form field that isn't a `<select>`, reuse the plain `<input type="radio">` + `role="group"` pattern from `AutoItemizePage.module.css` `.modeSelector` (the only radio group in the codebase) rather than inventing a segmented/button-group look. See Issue #1876 in [feature-spec-history.md](feature-spec-history.md).
 - For a "this is a negative/refund/adjustment row" signal, don't rely on red text color alone — pair it with a `Badge` carrying a real text label (reuse `--color-status-blocked-bg`/`-text`, the existing red badge pair — there's no separate `--color-danger-badge-*` family) plus `formatCurrency(-amount)`'s literal minus sign. Don't recolor a _computed remainder_ (e.g. "remaining amount") red just because refunds reduce it — that falsely implies an error state; only the actual refund row gets the negative treatment.
 - `Intl.NumberFormat` enables thousands-grouping by default; `toFixed()`/manual string-building never did. When a PR swaps a `toFixed()` call for a locale formatter, script-verify the _old vs new_ output isn't just per-locale-correct but also identical for large values (≥1000) — grouping separators are an easy-to-miss 3rd English-output regression beyond whatever the PR explicitly discloses. See PR #1845 in [pr-review-findings.md](pr-review-findings.md).
diff --git a/.claude/agent-memory/ux-designer/feature-spec-history.md b/.claude/agent-memory/ux-designer/feature-spec-history.md
index a131dcb3d..5ed006f05 100644
--- a/.claude/agent-memory/ux-designer/feature-spec-history.md
+++ b/.claude/agent-memory/ux-designer/feature-spec-history.md
@@ -87,6 +87,19 @@ See `story-4-9-invoice-linking-hi.md`. Entity type toggle (`role="group"` + `rol
 - `SelectionActionBar`'s count `<span>` has no `aria-live` — pre-existing gap, worth fixing opportunistically (shared component) whenever a story adds more granular controls that drive its total.
 - Deposit status badges can reuse the SAME `.pending`/`.paid`/`.claimed` classes already defined for invoice-status badges within the SAME file, when the value domains match — check for existing same-file classes before adding new ones or reaching for another file's copy.
 
+## Issue #1898 — Bank Report PDF: Usage column, attachment notes, deposit footnote (pdfmake, not CSS)
+
+First spec written for `client/src/lib/reportPdf/overviewPdf.ts` — a `pdfmake` content tree, not a React component. No tokens.css, no dark mode, no Component Reuse Audit apply here; state that explicitly in the spec so reviewers don't look for it.
+
+- **PDF style inventory** (`merge.ts`): `defaultStyle` fontSize 11/lineHeight 1.4; `tableHeader` 10pt bold white-on-`#1f2937`; `tableCell` 10pt; `small` 9pt `#6b7280` (the one reusable "muted text" token — used for footnotes, source-info stack, header/footer timestamps; reuse it verbatim for any new secondary/subordinate PDF text rather than inventing a new style). `REFUND_TEXT_COLOR = #991b1b` in `shared.ts`. No `italics: true` anywhere in this file — don't introduce it as a first here.
+- `#6b7280` on white paper ≈ 4.83:1 contrast — passes WCAG AA 4.5:1 for the 9pt `small` style (below the large-text exemption threshold). Worth recomputing/citing this whenever adding new muted-text PDF content, since pdfmake output isn't covered by the app's normal stylelint/token contrast tooling.
+- Two-family footnote marker precedent already existed (`*N` skip-doc, `†N` split) before this story added a third (`‡N` deposit) — pattern for adding an Nth footnote family: own independent counter per family, append as a new block in the flat footnote list (no headers), and add top-margin only at each new family's *first* entry (not between same-family entries) once 2+ glyph systems coexist.
+- Caught and corrected a column-count assumption in the requesting brief ("overview: 6 cols" was off by one — recomputed to 7 once Usage is added on top of the existing 6 base columns, appendix having been conditional/extra, not one of the 6). Always recompute column-set arithmetic myself rather than trusting a parent-agent's inline count — it's exactly the kind of thing a visual spec exists to pin down precisely.
+- Flagged (not fixed — out of scope for a visual spec) a structural risk: `overviewPdf.ts`'s subtotal/total rows hardcode the bold-label cell to a fixed column index. Recommended an index-agnostic rule instead: label always sits immediately left of Invoice Amount, everything else (including new trailing columns) empty — avoids per-report-type branching bugs as columns become conditional.
+- Width strategy for a 2nd prose column: don't split remaining `'*'` space evenly with the existing prose column (Vendor) — weight the new, more content-heavy column higher via pdfmake's `'2*'` syntax (Vendor `'*'`, Usage `'2*'`, all `auto` columns unchanged).
+
+**Correction (PR #1902, reviewed and approved)**: pdfmake **0.3.11 does not support weighted-star width syntax at all** — `'2*'` isn't parsed as "2 shares," it crashes the real (unmocked) renderer with `unsupported number: NaN` (`@types/pdfmake`'s `Size` type is only `number | 'auto' | '*' | percentage-string` — no weighted-star). QA/dev caught this via `pdfMake.createPdf().getBlob()` real-render tests, which mocked-only tests can't catch. **Never spec `'N*'` weighted-star widths for this pdfmake version again** — for a 2nd flexible/prose column, either (a) accept an equal `'*'`/`'*'` split (what shipped, and what I approved — still strictly better than the pre-story 100%-to-one-column state, and safe across locales), or (b) if genuine 1:N weighting is required, it needs a fixed-point-number width (pdfmake supports plain numbers, e.g. `120`) computed against a known page width, not a percentage (percentages risk overflow against the variable-width `auto` columns, especially since German status/date labels run wider than English — this file already has a prior width regression from exactly that cause, see the "German overview table column widths" test block in `realRender.test.ts`). Point of reference for future specs: `client/src/lib/reportPdf/shared.ts` (`TABLE_LAYOUT`) and `overviewPdf.ts`/`realRender.test.ts` are the pdfmake-specific width/layout precedent files now, not `tokens.css`.
+
 ## Story #1804 — Backup Scheduler Status (node-cron 4.5 adoption)
 
 - Spec posted on issue #1804; implemented in PR #1834 (approved — see [pr-review-findings.md](pr-review-findings.md))
diff --git a/client/src/i18n/de/budget.json b/client/src/i18n/de/budget.json
index 0920a7fce..dd62c7d85 100644
--- a/client/src/i18n/de/budget.json
+++ b/client/src/i18n/de/budget.json
@@ -1198,13 +1198,24 @@
       "status": "Status",
       "invoiceAmount": "Rechnungsbetrag",
       "allocatedAmount": "Zugeordneter Betrag",
-      "appendix": "Anhang",
       "subtotal": "Zwischensumme",
       "total": "Gesamt",
       "refundNote": "(Rückerstattung)",
       "footnoteFetchFailed": "Dokument konnte nicht abgerufen werden",
       "footnoteInvalidPdf": "Dokument ist keine gültige PDF-Datei",
-      "splitFootnote": "Der angezeigte Betrag umfasst nur den dieser Quelle zugeordneten Anteil."
+      "splitFootnote": "Der angezeigte Betrag umfasst nur den dieser Quelle zugeordneten Anteil.",
+      "usage": "Verwendung",
+      "attachmentType": {
+        "quotation": "Angebot",
+        "deposit": "Abschlagszahlung",
+        "invoice": "Rechnung"
+      },
+      "attachmentsNote_one": "{{count}} Anhang: {{types}}",
+      "attachmentsNote_other": "{{count}} Anhänge: {{types}}",
+      "attachmentsNoteNoType_one": "{{count}} Anhang",
+      "attachmentsNoteNoType_other": "{{count}} Anhänge",
+      "depositReducedFootnote": "Diese Position berücksichtigt separat eingereichte Abschlagszahlungen.",
+      "depositConstitutedFootnote": "Dies ist eine Abschlagszahlung."
     },
     "sourceType": {
       "bank_loan": "Bankdarlehen",
diff --git a/client/src/i18n/en/budget.json b/client/src/i18n/en/budget.json
index 557ef5e12..67323adbb 100644
--- a/client/src/i18n/en/budget.json
+++ b/client/src/i18n/en/budget.json
@@ -1198,13 +1198,24 @@
       "status": "Status",
       "invoiceAmount": "Invoice Amount",
       "allocatedAmount": "Allocated Amount",
-      "appendix": "Appendix",
+      "usage": "Usage",
+      "attachmentType": {
+        "quotation": "Quotation",
+        "deposit": "Deposit",
+        "invoice": "Invoice"
+      },
+      "attachmentsNote_one": "{{count}} attachment: {{types}}",
+      "attachmentsNote_other": "{{count}} attachments: {{types}}",
+      "attachmentsNoteNoType_one": "{{count}} attachment",
+      "attachmentsNoteNoType_other": "{{count}} attachments",
       "subtotal": "Subtotal",
       "total": "Total",
       "refundNote": "(refund)",
       "footnoteFetchFailed": "Document could not be retrieved",
       "footnoteInvalidPdf": "Document is not a valid PDF",
-      "splitFootnote": "Amount shown reflects only the portion allocated to this source."
+      "splitFootnote": "Amount shown reflects only the portion allocated to this source.",
+      "depositReducedFootnote": "This position reflects deposits claimed separately.",
+      "depositConstitutedFootnote": "This is a deposit."
     },
     "sourceType": {
       "bank_loan": "Bank Loan",
diff --git a/client/src/lib/reportPdf/overviewPdf.test.ts b/client/src/lib/reportPdf/overviewPdf.test.ts
index 0fd8caed2..961ffed80 100644
--- a/client/src/lib/reportPdf/overviewPdf.test.ts
+++ b/client/src/lib/reportPdf/overviewPdf.test.ts
@@ -1,42 +1,62 @@
 /**
  * Unit tests for client/src/lib/reportPdf/overviewPdf.ts
  *
- * Covers: columns incl. conditional Appendix column, the dual footnote-marker model (`*` = a
- * skipped document, unconditional per skip; `†` = a split invoice, unconditional per included
- * isSplit row — both may concatenate on the same cell), refund-adjustment rows (no sign
- * negation — allocatedAmount/invoiceAmount arrive already correctly signed from the server per
- * frontend fix spec item 3), per-status subtotal rows, the `includedTotal` grand-total param, and
- * skipped-document footnotes with vendor/invoice-number attribution.
+ * Story #1898 rewrite. The table layout changed substantially from the prior implementation:
+ *   - The Status column is now conditional on `useCase === 'budget-overview'` (previously
+ *     unconditional — always rendered regardless of useCase). This shifts column indices for
+ *     every non-overview ('claim' / 'proof-of-funds') fixture used below relative to the old
+ *     test file.
+ *   - The Appendix column is REMOVED entirely. `appendixByInvoiceId` is still accepted as a
+ *     parameter (call-site/signature stability for merge.ts) but is never rendered — see the
+ *     "Appendix never renders" scenario below.
+ *   - A new trailing Usage column was added (last column in both layouts), which can render a
+ *     plain text cell or a `stack` of [usage text, attachment note] when the invoice has linked
+ *     documents.
+ *   - The split marker (`†`) is no longer unconditional for every `isSplit: true` invoice. It now
+ *     requires `isSplit && budgetLines.length > 0`. A new deposit marker (`‡`) was added,
+ *     requiring `isSplit && deposits.length > 0`, with wording depending on whether any deposit is
+ *     tagged to this source (`budgetSourceId === report.source.id`).
  *
- * FIXED (frontend fix spec item 6): `buildOverviewContent` no longer imports a module-level
- * `formatCurrencyForPdf`/`formatDateForPdf` from ./shared.js (both were deleted — see
- * shared.test.ts). It now takes an optional `formatters: Formatters` param and falls back to '—'
- * (amount cells) or the raw ISO date string (date cells) when omitted. TABLE_LAYOUT and
- * REFUND_TEXT_COLOR are still imported from the real (unmocked) ./shared.js — they're simple
- * constants with no formatting logic worth isolating.
+ * Column layouts:
+ *   - budget-overview (isOverview=true), 7 columns: vendor(0) invoiceNumber(1) date(2) status(3)
+ *     invoiceAmount(4) allocatedAmount(5) usage(6).
+ *   - claim / proof-of-funds (isOverview=false), 6 columns: vendor(0) invoiceNumber(1) date(2)
+ *     invoiceAmount(3) allocatedAmount(4) usage(5).
  *
- * FIXED (frontend fix spec item 3): allocatedAmount/invoiceAmount are NEVER negated by this
- * builder — the server already returns a negative allocatedAmount for refund-adjustment lines
- * (invoiceAmount stays positive). Fixtures below reflect that sign contract directly.
+ * Summary-row (subtotal/total) leading-cell count is layout-aware: leadingCount = isOverview ? 4
+ * : 3. The bold label lands at index `leadingCount - 1`; the bold right-aligned amount at index
+ * `leadingCount + 1` (an empty invoiceAmount cell sits at `leadingCount`); the trailing usage cell
+ * is always empty.
  *
- * FIXED (frontend fix spec item 5): the grand total row renders the `includedTotal` param passed
- * in by the caller (merge.ts computes it once, respecting exclusions and signs, and forwards the
- * same value to both builders) — NOT a re-derivation of `report.totalAmount`. See merge.test.ts
- * for coverage of the includedTotal computation itself.
- *
- * FIXED (frontend fix spec item 11): the split marker (`†`) is now assigned to EVERY included
- * invoice with `isSplit === true`, independent of whether it has an appendix number (previously
- * it was implicitly gated on appendixByInvoiceId containing the invoice). Skip footnotes
- * (`*`) now include vendor/invoice-number attribution, matching the split footnote's format.
+ * Audit note (scenario 21): every `isSplit: true` fixture below carries EXPLICIT `budgetLines`
+ * and/or `deposits` arrays — `makeInvoice()`'s defaults (`budgetLines: []`, `deposits: []`) would
+ * otherwise silently produce a split invoice with NEITHER marker under the new classification
+ * rules, which is almost never the scenario under test. No fixture relies on the empty defaults
+ * while also setting `isSplit: true`, except the one dedicated "isSplit true but no lines/deposits
+ * -> neither marker" case, where that's the explicit point being tested.
  */
-import { describe, it, expect } from '@jest/globals';
+import { describe, it, expect, jest } from '@jest/globals';
 import type { TFunction } from 'i18next';
-import type { SourceReportResponse, SourceReportInvoice } from '@cornerstone/shared';
+import type {
+  SourceReportResponse,
+  SourceReportInvoice,
+  SourceReportBudgetLine,
+  SourceReportDeposit,
+  SourceReportDocument,
+} from '@cornerstone/shared';
 import type { Formatters } from '../formatters.js';
 import { buildOverviewContent } from './overviewPdf.js';
 
 const t = ((key: string) => key) as unknown as TFunction;
 
+/** A `t` that records every call for assertions on interpolation options (raw-key-echo style — no
+ * real interpolation happens; realRender.test.ts covers actual plural/interpolation output via a
+ * real i18next instance). */
+function makeTrackedT(): { t: TFunction; calls: () => unknown[][] } {
+  const fn = jest.fn((key: string) => key);
+  return { t: fn as unknown as TFunction, calls: () => fn.mock.calls as unknown[][] };
+}
+
 const formatters: Formatters = {
   formatCurrency: (n: number) => `€${n.toFixed(2)}`,
   formatDate: (d) => (typeof d === 'string' ? `date(${d})` : '—'),
@@ -61,6 +81,40 @@ function makeInvoice(overrides: Partial<SourceReportInvoice> = {}): SourceReport
   };
 }
 
+function makeBudgetLine(overrides: Partial<SourceReportBudgetLine> = {}): SourceReportBudgetLine {
+  return {
+    id: 'bl-1',
+    description: null,
+    allocatedPortion: 100,
+    linkedItem: null,
+    ...overrides,
+  };
+}
+
+function makeDeposit(overrides: Partial<SourceReportDeposit> = {}): SourceReportDeposit {
+  return {
+    id: 'dep-1',
+    amount: 100,
+    status: 'paid',
+    entryType: 'deposit',
+    dueDate: '2026-01-01',
+    paidDate: null,
+    claimedDate: null,
+    budgetSourceId: null,
+    ...overrides,
+  };
+}
+
+function makeDocument(overrides: Partial<SourceReportDocument> = {}): SourceReportDocument {
+  return {
+    documentId: 1,
+    archiveSerialNumber: null,
+    title: null,
+    attachmentType: null,
+    ...overrides,
+  };
+}
+
 function makeReport(invoices: SourceReportInvoice[]): SourceReportResponse {
   return {
     type: 'claim',
@@ -78,7 +132,8 @@ function makeReport(invoices: SourceReportInvoice[]): SourceReportResponse {
   };
 }
 
-// Flattens a pdfmake `table.body` row into plain text strings for easy assertions.
+// Flattens a pdfmake `table.body` row into plain text strings for easy assertions. Cells that are
+// `stack`s (the Usage column when an attachment note is present) yield `undefined`.
 function rowTexts(row: unknown): (string | undefined)[] {
   return (row as { text?: string }[]).map((cell) => cell.text);
 }
@@ -191,23 +246,23 @@ describe('buildOverviewContent', () => {
     expect(refLine).toBeDefined();
   });
 
-  it('uses exactly the 6 spec-defined columns when no appendix is present', () => {
+  // ─── Scenario 1 & 2: header columns per layout ─────────────────────────────
+
+  it('[Scenario 1] budget-overview header is exactly [vendor, invoiceNumber, date, status, invoiceAmount, allocatedAmount, usage], widths ["*","auto","auto","auto","auto","auto","*"]', () => {
     const report = makeReport([]);
     const content = buildOverviewContent(
       report,
       new Set(),
       new Map(),
       new Map(),
-      'claim',
+      'budget-overview',
       t,
       formatters,
       0,
     );
     const table = getTable(content);
 
-    expect(table.widths).toHaveLength(6);
-    expect(table.widths[0]).toBe('*');
-    expect(table.widths.slice(1)).toEqual(['auto', 'auto', 'auto', 'auto', 'auto']);
+    expect(table.widths).toEqual(['*', 'auto', 'auto', 'auto', 'auto', 'auto', '*']);
     const headerRow = rowTexts(table.body[0]);
     expect(headerRow).toEqual([
       'sourceReports.table.vendor',
@@ -216,28 +271,64 @@ describe('buildOverviewContent', () => {
       'sourceReports.table.status',
       'sourceReports.table.invoiceAmount',
       'sourceReports.table.allocatedAmount',
+      'sourceReports.table.usage',
     ]);
   });
 
-  it('adds a 7th Appendix column only when appendixByInvoiceId is non-empty, keeping the "*" + auto width pattern', () => {
+  it('[Scenario 2] claim/proof-of-funds header has exactly 6 cells with no status column, widths ["*","auto","auto","auto","auto","*"]', () => {
+    const report = makeReport([]);
+    for (const useCase of ['claim', 'proof-of-funds'] as const) {
+      const content = buildOverviewContent(
+        report,
+        new Set(),
+        new Map(),
+        new Map(),
+        useCase,
+        t,
+        formatters,
+        0,
+      );
+      const table = getTable(content);
+
+      expect(table.widths).toEqual(['*', 'auto', 'auto', 'auto', 'auto', '*']);
+      const headerRow = rowTexts(table.body[0]);
+      expect(headerRow).toEqual([
+        'sourceReports.table.vendor',
+        'sourceReports.table.invoiceNumber',
+        'sourceReports.table.date',
+        'sourceReports.table.invoiceAmount',
+        'sourceReports.table.allocatedAmount',
+        'sourceReports.table.usage',
+      ]);
+    }
+  });
+
+  // ─── Scenario 3: appendix never renders ────────────────────────────────────
+
+  it('[Scenario 3] never renders an Appendix column, even with a non-empty appendixByInvoiceId, in either useCase', () => {
     const invoice = makeInvoice();
     const report = makeReport([invoice]);
-    const content = buildOverviewContent(
-      report,
-      new Set(['inv-1']),
-      new Map([['inv-1', 1]]),
-      new Map(),
-      'claim',
-      t,
-      formatters,
-      1000,
-    );
-    const table = getTable(content);
-    expect(table.widths).toHaveLength(7);
-    expect(table.widths[0]).toBe('*');
-    expect(table.widths.slice(1)).toEqual(['auto', 'auto', 'auto', 'auto', 'auto', 'auto']);
-    const headerRow = rowTexts(table.body[0]);
-    expect(headerRow[6]).toBe('sourceReports.table.appendix');
+    const nonEmptyAppendixMap = new Map([['inv-1', 1]]);
+
+    for (const useCase of ['budget-overview', 'claim'] as const) {
+      const content = buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        nonEmptyAppendixMap,
+        new Map(),
+        useCase,
+        t,
+        formatters,
+        1000,
+      );
+      const table = getTable(content);
+      const expectedCols = useCase === 'budget-overview' ? 7 : 6;
+      expect(table.widths).toHaveLength(expectedCols);
+      const headerRow = rowTexts(table.body[0]);
+      expect(headerRow).not.toContain('sourceReports.table.appendix');
+      // The row must not gain an extra trailing appendix cell beyond the usage cell.
+      expect((table.body[1] as unknown[]).length).toBe(expectedCols);
+    }
   });
 
   it('only includes invoices present in includedInvoiceIds (excluded ones are skipped entirely)', () => {
@@ -279,16 +370,18 @@ describe('buildOverviewContent', () => {
     );
     const table = getTable(content);
     const row = rowTexts(table.body[1]);
+    // claim layout: vendor(0) invoiceNumber(1) date(2) invoiceAmount(3) allocatedAmount(4) usage(5)
     expect(row[1]).toBe('—'); // invoiceNumber ?? '—'
     expect(row[2]).toBe('2026-02-01'); // raw date, no formatters
-    expect(row[4]).toBe('—'); // invoiceAmountText fallback
-    expect(row[5]).toBe('—'); // allocatedText fallback
+    expect(row[3]).toBe('—'); // invoiceAmountText fallback
+    expect(row[4]).toBe('—'); // allocatedText fallback
+    expect(row[5]).toBe('—'); // usage placeholder ('—' — empty budgetLines default)
 
     const subtotalRow = rowTexts(table.body[2]);
-    expect(subtotalRow[5]).toBe('—'); // subtotalText fallback
+    expect(subtotalRow[4]).toBe('—'); // subtotalText fallback
 
     const totalRow = rowTexts(table.body[table.body.length - 1]);
-    expect(totalRow[5]).toBe('—'); // totalText fallback (includedTotal ?? 0, still no formatters)
+    expect(totalRow[4]).toBe('—'); // totalText fallback (includedTotal ?? 0, still no formatters)
   });
 
   it('renders the invoice date via formatters.formatDate', () => {
@@ -330,9 +423,9 @@ describe('buildOverviewContent', () => {
       const table = getTable(content);
       const row = rowTexts(table.body[1]);
 
-      expect(row[4]).toBe('€200.00');
+      expect(row[3]).toBe('€200.00');
       const rawRow = table.body[1] as { color?: string }[];
-      expect(rawRow[4]!.color).toBe('#991b1b');
+      expect(rawRow[3]!.color).toBe('#991b1b');
     });
 
     it('renders the already-negative allocated amount as-is (no double negation) with a refund note', () => {
@@ -356,26 +449,289 @@ describe('buildOverviewContent', () => {
       const table = getTable(content);
       const row = rowTexts(table.body[1]);
 
-      expect(row[5]).toContain('€-200.00');
-      expect(row[5]).toContain('sourceReports.table.refundNote');
+      expect(row[4]).toContain('€-200.00');
+      expect(row[4]).toContain('sourceReports.table.refundNote');
       const rawRow = table.body[1] as { color?: string }[];
-      expect(rawRow[5]!.color).toBe('#991b1b');
+      expect(rawRow[4]!.color).toBe('#991b1b');
     });
   });
 
-  describe('dual footnote-marker model', () => {
-    it('marks a split invoice with "†N" unconditionally, even with NO appendix number assigned', () => {
-      const split = makeInvoice({
-        invoiceId: 'inv-split',
+  // ─── Scenarios 4-13: Usage column ──────────────────────────────────────────
+
+  describe('Usage column', () => {
+    it('[Scenario 4] dedupes a repeated linked-item name and comma-joins distinct names in first-occurrence order', () => {
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        budgetLines: [
+          makeBudgetLine({ linkedItem: { type: 'work_item', id: 'wi-1', name: 'Kitchen' } }),
+          makeBudgetLine({ linkedItem: { type: 'work_item', id: 'wi-2', name: 'Bathroom' } }),
+          makeBudgetLine({ linkedItem: { type: 'work_item', id: 'wi-1', name: 'Kitchen' } }),
+        ],
+      });
+      const report = makeReport([invoice]);
+      const content = buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'claim',
+        t,
+        formatters,
+        1000,
+      );
+      const table = getTable(content);
+      expect(rowTexts(table.body[1])[5]).toBe('Kitchen, Bathroom');
+    });
+
+    it('[Scenario 5] falls back to distinct budget-line descriptions when no line has a linkedItem', () => {
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        budgetLines: [
+          makeBudgetLine({ linkedItem: null, description: 'Materials' }),
+          makeBudgetLine({ linkedItem: null, description: 'Labor' }),
+          makeBudgetLine({ linkedItem: null, description: 'Materials' }),
+        ],
+      });
+      const report = makeReport([invoice]);
+      const content = buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'claim',
+        t,
+        formatters,
+        1000,
+      );
+      const table = getTable(content);
+      expect(rowTexts(table.body[1])[5]).toBe('Materials, Labor');
+    });
+
+    it('[Scenario 6] shows only the linked item name(s) when linked and unlinked-with-description lines are mixed (binary discriminator)', () => {
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        budgetLines: [
+          makeBudgetLine({
+            linkedItem: { type: 'household_item', id: 'hi-1', name: 'Kitchen' },
+            description: null,
+          }),
+          makeBudgetLine({ linkedItem: null, description: 'Misc costs' }),
+        ],
+      });
+      const report = makeReport([invoice]);
+      const content = buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'claim',
+        t,
+        formatters,
+        1000,
+      );
+      const table = getTable(content);
+      expect(rowTexts(table.body[1])[5]).toBe('Kitchen');
+    });
+
+    it('[Scenario 7] renders "—" when budgetLines is empty', () => {
+      const invoice = makeInvoice({ invoiceId: 'inv-1', budgetLines: [] });
+      const report = makeReport([invoice]);
+      const content = buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'claim',
+        t,
+        formatters,
+        1000,
+      );
+      const table = getTable(content);
+      expect(rowTexts(table.body[1])[5]).toBe('—');
+    });
+
+    it('[Scenario 8] renders a plain { text } cell (not a stack) when the invoice has no documents', () => {
+      const invoice = makeInvoice({ invoiceId: 'inv-1', documents: [] });
+      const report = makeReport([invoice]);
+      const content = buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'claim',
+        t,
+        formatters,
+        1000,
+      );
+      const table = getTable(content);
+      const cell = (table.body[1] as unknown[])[5] as { text?: string; stack?: unknown };
+      expect(cell.stack).toBeUndefined();
+      expect(cell.text).toBe('—');
+    });
+
+    it('[Scenario 9] singular typed attachment note: attachmentsNote_one with {count, types} interpolation options (raw-key-echo)', () => {
+      const { t: trackedT, calls } = makeTrackedT();
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        documents: [makeDocument({ attachmentType: 'invoice' })],
+      });
+      const report = makeReport([invoice]);
+      const content = buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'claim',
+        trackedT,
+        formatters,
+        1000,
+      );
+      const table = getTable(content);
+      const cell = (table.body[1] as unknown[])[5] as { stack: { text: string }[] };
+      expect(cell.stack).toBeDefined();
+      // Note text is the raw echoed key (unit-level t has no real interpolation).
+      expect(cell.stack[1]!.text).toBe('sourceReports.table.attachmentsNote_one');
+
+      expect(calls()).toContainEqual([
+        'sourceReports.table.attachmentsNote_one',
+        { count: 1, types: 'sourceReports.table.attachmentType.invoice' },
+      ]);
+    });
+
+    it('[Scenario 10] plural, multiple distinct types deduped: attachmentsNote_other with all distinct type labels joined', () => {
+      const { t: trackedT, calls } = makeTrackedT();
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        documents: [
+          makeDocument({ documentId: 1, attachmentType: 'invoice' }),
+          makeDocument({ documentId: 2, attachmentType: 'quotation' }),
+          makeDocument({ documentId: 3, attachmentType: 'invoice' }),
+        ],
+      });
+      const report = makeReport([invoice]);
+      buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'claim',
+        trackedT,
+        formatters,
+        1000,
+      );
+      expect(calls()).toContainEqual([
+        'sourceReports.table.attachmentsNote_other',
+        {
+          count: 3,
+          types:
+            'sourceReports.table.attachmentType.invoice, sourceReports.table.attachmentType.quotation',
+        },
+      ]);
+    });
+
+    it('[Scenario 11] a type repeated across multiple documents is listed only once', () => {
+      const { t: trackedT, calls } = makeTrackedT();
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        documents: [
+          makeDocument({ documentId: 1, attachmentType: 'quotation' }),
+          makeDocument({ documentId: 2, attachmentType: 'quotation' }),
+        ],
+      });
+      const report = makeReport([invoice]);
+      buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'claim',
+        trackedT,
+        formatters,
+        1000,
+      );
+      expect(calls()).toContainEqual([
+        'sourceReports.table.attachmentsNote_other',
+        { count: 2, types: 'sourceReports.table.attachmentType.quotation' },
+      ]);
+    });
+
+    it('[Scenario 12] all-null-type documents render attachmentsNoteNoType_one / _other (count only, no types option)', () => {
+      const { t: trackedT, calls } = makeTrackedT();
+      const singleDocInvoice = makeInvoice({
+        invoiceId: 'inv-1',
+        documents: [makeDocument({ documentId: 1, attachmentType: null })],
+      });
+      const multiDocInvoice = makeInvoice({
+        invoiceId: 'inv-2',
+        documents: [
+          makeDocument({ documentId: 2, attachmentType: null }),
+          makeDocument({ documentId: 3, attachmentType: null }),
+        ],
+      });
+      const report = makeReport([singleDocInvoice, multiDocInvoice]);
+      buildOverviewContent(
+        report,
+        new Set(['inv-1', 'inv-2']),
+        new Map(),
+        new Map(),
+        'claim',
+        trackedT,
+        formatters,
+        1000,
+      );
+      expect(calls()).toContainEqual([
+        'sourceReports.table.attachmentsNoteNoType_one',
+        { count: 1 },
+      ]);
+      expect(calls()).toContainEqual([
+        'sourceReports.table.attachmentsNoteNoType_other',
+        { count: 2 },
+      ]);
+    });
+
+    it('[Scenario 13] mixed typed+null documents: count includes all documents, types option lists only the typed label', () => {
+      const { t: trackedT, calls } = makeTrackedT();
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        documents: [
+          makeDocument({ documentId: 1, attachmentType: 'deposit' }),
+          makeDocument({ documentId: 2, attachmentType: null }),
+        ],
+      });
+      const report = makeReport([invoice]);
+      buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'claim',
+        trackedT,
+        formatters,
+        1000,
+      );
+      expect(calls()).toContainEqual([
+        'sourceReports.table.attachmentsNote_other',
+        { count: 2, types: 'sourceReports.table.attachmentType.deposit' },
+      ]);
+    });
+  });
+
+  // ─── Scenarios 14-19: split/deposit footnote markers ───────────────────────
+
+  describe('split (†) and deposit (‡) footnote markers', () => {
+    it('[Scenario 14 / AC1] deposit-only, cross-source: isSplit true, no budget lines, a tagged deposit -> ‡1 "constituted", no †', () => {
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
         isSplit: true,
         allocatedAmount: 400,
-        invoiceAmount: 1000,
+        budgetLines: [],
+        deposits: [makeDeposit({ budgetSourceId: 'src-1' })], // tagged to report.source.id
       });
-      const report = makeReport([split]);
+      const report = makeReport([invoice]);
       const content = buildOverviewContent(
         report,
-        new Set(['inv-split']),
-        new Map(), // no appendix entry
+        new Set(['inv-1']),
+        new Map(),
         new Map(),
         'claim',
         t,
@@ -383,73 +739,146 @@ describe('buildOverviewContent', () => {
         400,
       );
       const table = getTable(content);
-      const row = rowTexts(table.body[1]);
-      expect(row[5]).toBe('€400.00†1');
+      expect(rowTexts(table.body[1])[4]).toBe('€400.00‡1');
     });
 
-    it('does not mark a non-split invoice, regardless of appendix presence', () => {
-      const invoice = makeInvoice({ invoiceId: 'inv-1', isSplit: false });
+    it('[Scenario 15 / AC2] pure line-split: isSplit true, budget lines, no deposits -> †1, no ‡', () => {
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        isSplit: true,
+        allocatedAmount: 400,
+        budgetLines: [makeBudgetLine()],
+        deposits: [],
+      });
       const report = makeReport([invoice]);
       const content = buildOverviewContent(
         report,
         new Set(['inv-1']),
-        new Map([['inv-1', 1]]),
+        new Map(),
         new Map(),
         'claim',
         t,
         formatters,
-        1000,
+        400,
       );
       const table = getTable(content);
-      const row = rowTexts(table.body[1]);
-      expect(row[5]).toBe('€1000.00');
+      expect(rowTexts(table.body[1])[4]).toBe('€400.00†1');
     });
 
-    it('marks a skipped document with "*N" on the invoice with the failed/invalid document', () => {
-      const invoice = makeInvoice({ invoiceId: 'inv-1' });
+    it('[Scenario 16 / AC3] both budget lines and a tagged deposit -> †1 AND ‡1 "constituted", neither suppressed', () => {
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        isSplit: true,
+        allocatedAmount: 400,
+        budgetLines: [makeBudgetLine()],
+        deposits: [makeDeposit({ budgetSourceId: 'src-1' })],
+      });
       const report = makeReport([invoice]);
-      const skipped = new Map<string, string[]>([['inv-1', ['footnoteFetchFailed']]]);
       const content = buildOverviewContent(
         report,
         new Set(['inv-1']),
         new Map(),
-        skipped,
+        new Map(),
         'claim',
         t,
         formatters,
-        1000,
+        400,
       );
       const table = getTable(content);
-      const row = rowTexts(table.body[1]);
-      expect(row[5]).toBe('€1000.00*1');
+      expect(rowTexts(table.body[1])[4]).toBe('€400.00†1‡1');
+
+      const notesStack = content[content.length - 1] as { stack: { text: string }[] };
+      const depositNote = notesStack.stack.find((s) => s.text.startsWith('‡1'));
+      expect(depositNote?.text).toBe(
+        '‡1: ACME Builders (INV-001) — sourceReports.table.depositConstitutedFootnote',
+      );
     });
 
-    it('concatenates both markers ("*N†M") on a single cell when a split invoice also has a skipped document', () => {
-      const invoice = makeInvoice({ invoiceId: 'inv-1', isSplit: true, allocatedAmount: 400 });
+    it('[Scenario 17] reduced wording boundary: budget lines + an untagged-only deposit -> †1 + ‡1 "reduced"', () => {
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        isSplit: true,
+        allocatedAmount: 400,
+        budgetLines: [makeBudgetLine()],
+        deposits: [makeDeposit({ budgetSourceId: null })], // untagged
+      });
       const report = makeReport([invoice]);
-      const skipped = new Map<string, string[]>([['inv-1', ['footnoteInvalidPdf']]]);
       const content = buildOverviewContent(
         report,
         new Set(['inv-1']),
         new Map(),
-        skipped,
+        new Map(),
         'claim',
         t,
         formatters,
         400,
       );
       const table = getTable(content);
-      const row = rowTexts(table.body[1]);
-      // Skip marker(s) always precede the split marker in markerText concatenation order.
-      expect(row[5]).toBe('€400.00*1†1');
+      expect(rowTexts(table.body[1])[4]).toBe('€400.00†1‡1');
+
+      const notesStack = content[content.length - 1] as { stack: { text: string }[] };
+      const depositNote = notesStack.stack.find((s) => s.text.startsWith('‡1'));
+      expect(depositNote?.text).toBe(
+        '‡1: ACME Builders (INV-001) — sourceReports.table.depositReducedFootnote',
+      );
     });
 
-    it('numbers multiple skip reasons on the same invoice sequentially', () => {
-      const invoice = makeInvoice({ invoiceId: 'inv-1' });
+    it('[Scenario 18 / AC4] isSplit false suppresses both markers regardless of budgetLines/deposits content', () => {
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        isSplit: false,
+        allocatedAmount: 400,
+        budgetLines: [makeBudgetLine()],
+        deposits: [makeDeposit({ budgetSourceId: 'src-1' })],
+      });
       const report = makeReport([invoice]);
-      const skipped = new Map<string, string[]>([
-        ['inv-1', ['footnoteFetchFailed', 'footnoteInvalidPdf']],
-      ]);
+      const content = buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'claim',
+        t,
+        formatters,
+        400,
+      );
+      const table = getTable(content);
+      expect(rowTexts(table.body[1])[4]).toBe('€400.00');
+    });
+
+    it('isSplit true with neither budget lines nor deposits produces neither marker', () => {
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        isSplit: true,
+        allocatedAmount: 400,
+        budgetLines: [],
+        deposits: [],
+      });
+      const report = makeReport([invoice]);
+      const content = buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'claim',
+        t,
+        formatters,
+        400,
+      );
+      const table = getTable(content);
+      expect(rowTexts(table.body[1])[4]).toBe('€400.00');
+    });
+
+    it('[Scenario 19] marker concatenation order is *N -> †N -> ‡N on the same cell', () => {
+      const invoice = makeInvoice({
+        invoiceId: 'inv-1',
+        isSplit: true,
+        allocatedAmount: 400,
+        budgetLines: [makeBudgetLine()],
+        deposits: [makeDeposit({ budgetSourceId: 'src-1' })],
+      });
+      const report = makeReport([invoice]);
+      const skipped = new Map<string, string[]>([['inv-1', ['footnoteFetchFailed']]]);
       const content = buildOverviewContent(
         report,
         new Set(['inv-1']),
@@ -458,31 +887,85 @@ describe('buildOverviewContent', () => {
         'claim',
         t,
         formatters,
-        1000,
+        400,
       );
       const table = getTable(content);
-      const row = rowTexts(table.body[1]);
-      expect(row[5]).toBe('€1000.00*1*2');
+      expect(rowTexts(table.body[1])[4]).toBe('€400.00*1†1‡1');
     });
-  });
 
-  it('renders the appendix column value or an em-dash placeholder when appendix tracking is active', () => {
-    const withAppendix = makeInvoice({ invoiceId: 'inv-1' });
-    const withoutAppendix = makeInvoice({ invoiceId: 'inv-2' });
-    const report = makeReport([withAppendix, withoutAppendix]);
-    const content = buildOverviewContent(
-      report,
-      new Set(['inv-1', 'inv-2']),
-      new Map([['inv-1', 1]]),
-      new Map(),
-      'claim',
-      t,
-      formatters,
-      2000,
-    );
-    const table = getTable(content);
-    expect(rowTexts(table.body[1])[6]).toBe('1');
-    expect(rowTexts(table.body[2])[6]).toBe('—');
+    it('[Scenario 20] footnote block margins: split-first and deposit-first entries carry margin [0,4,0,0]; skip entries and non-first split/deposit entries do not', () => {
+      const skippedInvoice = makeInvoice({
+        invoiceId: 'inv-skip',
+        vendorName: 'Skip Vendor',
+        invoiceNumber: 'K-1',
+        isSplit: false,
+      });
+      const splitOnly = makeInvoice({
+        invoiceId: 'inv-split-only',
+        vendorName: 'Split Only',
+        invoiceNumber: 'S-1',
+        isSplit: true,
+        allocatedAmount: 100,
+        budgetLines: [makeBudgetLine()],
+        deposits: [],
+      });
+      const splitAndTaggedDeposit = makeInvoice({
+        invoiceId: 'inv-split-deposit-1',
+        vendorName: 'Split Deposit One',
+        invoiceNumber: 'SD-1',
+        isSplit: true,
+        allocatedAmount: 200,
+        budgetLines: [makeBudgetLine()],
+        deposits: [makeDeposit({ budgetSourceId: 'src-1' })],
+      });
+      const splitAndUntaggedDeposit = makeInvoice({
+        invoiceId: 'inv-split-deposit-2',
+        vendorName: 'Split Deposit Two',
+        invoiceNumber: 'SD-2',
+        isSplit: true,
+        allocatedAmount: 300,
+        budgetLines: [makeBudgetLine()],
+        deposits: [makeDeposit({ budgetSourceId: null })],
+      });
+      const report = makeReport([
+        skippedInvoice,
+        splitOnly,
+        splitAndTaggedDeposit,
+        splitAndUntaggedDeposit,
+      ]);
+      const skipped = new Map<string, string[]>([['inv-skip', ['footnoteFetchFailed']]]);
+      const content = buildOverviewContent(
+        report,
+        new Set(['inv-skip', 'inv-split-only', 'inv-split-deposit-1', 'inv-split-deposit-2']),
+        new Map(),
+        skipped,
+        'claim',
+        t,
+        formatters,
+        600,
+      );
+      const notesStack = content[content.length - 1] as {
+        stack: (Record<string, unknown> & { text: string })[];
+      };
+      const notes = notesStack.stack;
+
+      // Block order: skip, split, deposit.
+      expect(notes).toHaveLength(1 + 3 + 2);
+
+      const skipEntry = notes.find((n) => n.text.startsWith('*1'))!;
+      expect(skipEntry.margin).toBeUndefined();
+
+      const splitEntries = notes.filter((n) => /^†\d/.test(n.text));
+      expect(splitEntries).toHaveLength(3);
+      expect(splitEntries[0]!.margin).toEqual([0, 4, 0, 0]); // †1 (splitOnly) — first of block
+      expect(splitEntries[1]!.margin).toBeUndefined(); // †2 (splitAndTaggedDeposit)
+      expect(splitEntries[2]!.margin).toBeUndefined(); // †3 (splitAndUntaggedDeposit)
+
+      const depositEntries = notes.filter((n) => /^‡\d/.test(n.text));
+      expect(depositEntries).toHaveLength(2);
+      expect(depositEntries[0]!.margin).toEqual([0, 4, 0, 0]); // ‡1 — first of block
+      expect(depositEntries[1]!.margin).toBeUndefined(); // ‡2
+    });
   });
 
   it('adds one subtotal row per distinct status present among included invoices', () => {
@@ -539,6 +1022,63 @@ describe('buildOverviewContent', () => {
     expect(table.body).toHaveLength(4);
   });
 
+  // ─── Scenario 22: summary-row (subtotal/total) cell shape per layout ──────
+
+  describe('[Scenario 22] summary-row shape', () => {
+    it('budget-overview (isOverview=true): label at index 3 (leadingCount-1=3), amount at index 5, all other cells empty text, trailing usage cell empty', () => {
+      const invoice = makeInvoice({ invoiceId: 'inv-1', allocatedAmount: 500 });
+      const report = makeReport([invoice]);
+      const content = buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'budget-overview',
+        t,
+        formatters,
+        500,
+      );
+      const table = getTable(content);
+      const totalRow = table.body[table.body.length - 1] as Record<string, unknown>[];
+
+      expect(totalRow).toEqual([
+        { text: '', style: 'tableCell' },
+        { text: '', style: 'tableCell' },
+        { text: '', style: 'tableCell' },
+        { text: 'sourceReports.table.total', style: 'tableCell', bold: true },
+        { text: '', style: 'tableCell' },
+        { text: '€500.00', style: 'tableCell', alignment: 'right', bold: true },
+        { text: '', style: 'tableCell' },
+      ]);
+    });
+
+    it('claim (isOverview=false): label at index 2 (leadingCount-1=2), amount at index 4, all other cells empty text, trailing usage cell empty', () => {
+      const invoice = makeInvoice({ invoiceId: 'inv-1', allocatedAmount: 500 });
+      const report = makeReport([invoice]);
+      const content = buildOverviewContent(
+        report,
+        new Set(['inv-1']),
+        new Map(),
+        new Map(),
+        'claim',
+        t,
+        formatters,
+        500,
+      );
+      const table = getTable(content);
+      const totalRow = table.body[table.body.length - 1] as Record<string, unknown>[];
+
+      expect(totalRow).toEqual([
+        { text: '', style: 'tableCell' },
+        { text: '', style: 'tableCell' },
+        { text: 'sourceReports.table.total', style: 'tableCell', bold: true },
+        { text: '', style: 'tableCell' },
+        { text: '€500.00', style: 'tableCell', alignment: 'right', bold: true },
+        { text: '', style: 'tableCell' },
+      ]);
+    });
+  });
+
   describe('grand total row (includedTotal param)', () => {
     it('renders the includedTotal param passed by the caller, not a re-derived sum of visible rows', () => {
       const invoice = makeInvoice({ invoiceId: 'inv-1', allocatedAmount: 500 });
@@ -557,8 +1097,8 @@ describe('buildOverviewContent', () => {
       );
       const table = getTable(content);
       const totalRow = rowTexts(table.body[table.body.length - 1]);
-      expect(totalRow[3]).toBe('sourceReports.table.total');
-      expect(totalRow[5]).toBe('€999.00');
+      expect(totalRow[2]).toBe('sourceReports.table.total');
+      expect(totalRow[4]).toBe('€999.00');
     });
 
     it('defaults includedTotal to 0 when the param is omitted', () => {
@@ -575,7 +1115,7 @@ describe('buildOverviewContent', () => {
       );
       const table = getTable(content);
       const totalRow = rowTexts(table.body[table.body.length - 1]);
-      expect(totalRow[5]).toBe('€0.00');
+      expect(totalRow[4]).toBe('€0.00');
     });
 
     it('renders a negative includedTotal as-is (a net-refund report)', () => {
@@ -599,7 +1139,7 @@ describe('buildOverviewContent', () => {
       );
       const table = getTable(content);
       const totalRow = rowTexts(table.body[table.body.length - 1]);
-      expect(totalRow[5]).toBe('€-200.00');
+      expect(totalRow[4]).toBe('€-200.00');
     });
   });
 
@@ -660,6 +1200,7 @@ describe('buildOverviewContent', () => {
         invoiceNumber: 'G-9',
         isSplit: true,
         allocatedAmount: 400,
+        budgetLines: [makeBudgetLine()],
       });
       const report = makeReport([split]);
       const content = buildOverviewContent(
@@ -691,6 +1232,7 @@ describe('buildOverviewContent', () => {
         invoiceNumber: 'B-2',
         isSplit: true,
         allocatedAmount: 400,
+        budgetLines: [makeBudgetLine()],
       });
       const report = makeReport([skippedInv, splitInv]);
       const skipped = new Map<string, string[]>([['inv-1', ['footnoteFetchFailed']]]);
@@ -712,7 +1254,7 @@ describe('buildOverviewContent', () => {
       expect(notesStack.stack[1]!.text).toBe('†1: Beta (B-2) — sourceReports.table.splitFootnote');
     });
 
-    it('does not render a footnotes block when there are no skipped documents and no split invoices', () => {
+    it('does not render a footnotes block when there are no skipped documents and no split/deposit-marked invoices', () => {
       const report = makeReport([]);
       const content = buildOverviewContent(
         report,
diff --git a/client/src/lib/reportPdf/overviewPdf.ts b/client/src/lib/reportPdf/overviewPdf.ts
index fe5d37bfa..9f955da09 100644
--- a/client/src/lib/reportPdf/overviewPdf.ts
+++ b/client/src/lib/reportPdf/overviewPdf.ts
@@ -3,21 +3,119 @@
  */
 import type { TFunction } from 'i18next';
 import type { Content } from 'pdfmake/build/pdfmake';
-import type { SourceReportResponse, InvoiceStatus } from '@cornerstone/shared';
+import type { SourceReportResponse, InvoiceStatus, SourceReportType } from '@cornerstone/shared';
 import type { Formatters } from '../formatters.js';
 import { TABLE_LAYOUT, REFUND_TEXT_COLOR } from './shared.js';
 
+/**
+ * Helper: deduplicate array preserving order via Set.
+ */
+function uniqueInOrder<T>(items: T[]): T[] {
+  return Array.from(new Set(items));
+}
+
+/**
+ * Helper: get usage text from invoice budget lines.
+ * Returns distinct linked item names if any line has linkedItem; else distinct descriptions; else '—'.
+ */
+function getUsageText(invoice: {
+  budgetLines: Array<{ linkedItem: { name: string } | null; description: string | null }>;
+}): string {
+  const hasLinkedItems = invoice.budgetLines.some((line) => line.linkedItem !== null);
+
+  if (hasLinkedItems) {
+    const linkedNames = invoice.budgetLines
+      .filter((line) => line.linkedItem !== null)
+      .map((line) => line.linkedItem!.name);
+    return uniqueInOrder(linkedNames).join(', ');
+  }
+
+  const descriptions = invoice.budgetLines
+    .filter((line) => line.description !== null)
+    .map((line) => line.description!);
+  if (descriptions.length > 0) {
+    return uniqueInOrder(descriptions).join(', ');
+  }
+
+  return '—';
+}
+
+/**
+ * Helper: get attachment note from invoice documents.
+ * Returns null if no documents; else formatted note with deduped types or count-only.
+ */
+function getAttachmentNote(
+  invoice: {
+    documents: Array<{ attachmentType: string | null }>;
+  },
+  t: TFunction,
+): string | null {
+  const { documents } = invoice;
+  if (documents.length === 0) {
+    return null;
+  }
+
+  const attachmentTypes = documents
+    .map((doc) => doc.attachmentType)
+    .filter((type) => type !== null) as string[];
+
+  if (attachmentTypes.length === 0) {
+    // All null types
+    const count = documents.length;
+    return t(`sourceReports.table.attachmentsNoteNoType_${count === 1 ? 'one' : 'other'}`, {
+      count,
+    });
+  }
+
+  // Deduplicate types and translate
+  const deducedTypes = uniqueInOrder(attachmentTypes);
+  const typeLabels = deducedTypes.map((type) => t(`sourceReports.table.attachmentType.${type}`));
+
+  const count = documents.length;
+  return t(`sourceReports.table.attachmentsNote_${count === 1 ? 'one' : 'other'}`, {
+    count,
+    types: typeLabels.join(', '),
+  });
+}
+
+/**
+ * Helper: build usage cell with optional attachment note.
+ */
+function buildUsageCell(
+  invoice: {
+    budgetLines: Array<{ linkedItem: { name: string } | null; description: string | null }>;
+    documents: Array<{ attachmentType: string | null }>;
+  },
+  t: TFunction,
+): Content {
+  const usageText = getUsageText(invoice);
+  const note = getAttachmentNote(invoice, t);
+
+  if (!note) {
+    return { text: usageText, style: 'tableCell' };
+  }
+
+  // Stack: usage text + attachment note
+  return {
+    stack: [
+      { text: usageText, style: 'tableCell' },
+      { text: note, style: 'small', margin: [0, 2, 0, 0] },
+    ],
+  };
+}
+
 export function buildOverviewContent(
   report: SourceReportResponse,
   includedInvoiceIds: Set<string>,
   appendixByInvoiceId: Map<string, number>,
   skippedDocuments: Map<string, string[]>,
-  useCase: string,
+  useCase: SourceReportType,
   t: TFunction,
   formatters?: Formatters,
   includedTotal?: number,
 ): Content[] {
   const content: Content[] = [];
+  const isOverview = useCase === 'budget-overview';
 
   // Title
   const titleKey = `sourceReports.table.title.${useCase}`;
@@ -50,18 +148,54 @@ export function buildOverviewContent(
   });
 
   // Build table columns
-  const columns = [
+  const columns: Content[] = [
     { text: t('sourceReports.table.vendor'), style: 'tableHeader' },
     { text: t('sourceReports.table.invoiceNumber'), style: 'tableHeader' },
     { text: t('sourceReports.table.date'), style: 'tableHeader' },
-    { text: t('sourceReports.table.status'), style: 'tableHeader' },
+  ];
+
+  // Add status column only if budget-overview
+  if (isOverview) {
+    columns.push({ text: t('sourceReports.table.status'), style: 'tableHeader' });
+  }
+
+  columns.push(
     { text: t('sourceReports.table.invoiceAmount'), style: 'tableHeader', alignment: 'right' },
     { text: t('sourceReports.table.allocatedAmount'), style: 'tableHeader', alignment: 'right' },
-  ];
+    { text: t('sourceReports.table.usage'), style: 'tableHeader' },
+  );
+
+  /**
+   * Helper: build summary row (subtotal/total) with label at last leading index.
+   */
+  function buildSummaryRow(labelText: string, amountText: string): Content[] {
+    const leadingCount = isOverview ? 4 : 3;
+    const row: Content[] = [];
+
+    // Leading cells: empty except the last one which has the label
+    for (let i = 0; i < leadingCount; i++) {
+      if (i === leadingCount - 1) {
+        row.push({ text: labelText, style: 'tableCell', bold: true });
+      } else {
+        row.push({ text: '', style: 'tableCell' });
+      }
+    }
+
+    // Empty invoiceAmount cell
+    row.push({ text: '', style: 'tableCell' });
 
-  // Add appendix column if needed
-  if (appendixByInvoiceId.size > 0) {
-    columns.push({ text: t('sourceReports.table.appendix'), style: 'tableHeader' });
+    // Bold right-aligned amount
+    row.push({
+      text: amountText,
+      style: 'tableCell',
+      alignment: 'right',
+      bold: true,
+    });
+
+    // Empty trailing usage cell
+    row.push({ text: '', style: 'tableCell' });
+
+    return row;
   }
 
   // Build table rows
@@ -73,13 +207,27 @@ export function buildOverviewContent(
     quotation: 0,
   };
 
-  // Track split invoice indices for footnote numbering
+  // Track split and deposit footnotes with independent counters
   const splitFootnotesByInvoiceId = new Map<string, number>();
+  const depositFootnotesByInvoiceId = new Map<
+    string,
+    { num: number; wording: 'reduced' | 'constituted' }
+  >();
   let splitFootnoteNum = 1;
+  let depositFootnoteNum = 1;
   for (const invoice of report.invoices) {
-    if (includedInvoiceIds.has(invoice.invoiceId) && invoice.isSplit) {
-      splitFootnotesByInvoiceId.set(invoice.invoiceId, splitFootnoteNum);
-      splitFootnoteNum++;
+    if (!includedInvoiceIds.has(invoice.invoiceId) || !invoice.isSplit) {
+      continue;
+    }
+    if (invoice.budgetLines.length > 0) {
+      splitFootnotesByInvoiceId.set(invoice.invoiceId, splitFootnoteNum++);
+    }
+    if (invoice.deposits.length > 0) {
+      const taggedDeposit = invoice.deposits.some((d) => d.budgetSourceId === report.source.id);
+      depositFootnotesByInvoiceId.set(invoice.invoiceId, {
+        num: depositFootnoteNum++,
+        wording: taggedDeposit ? 'constituted' : 'reduced',
+      });
     }
   }
 
@@ -109,9 +257,13 @@ export function buildOverviewContent(
       { text: invoice.vendorName, style: 'tableCell' },
       { text: invoice.invoiceNumber ?? '—', style: 'tableCell' },
       { text: formatters?.formatDate(invoice.date) ?? invoice.date, style: 'tableCell' },
-      { text: t(`sources.lines.invoiceStatus.${status}`), style: 'tableCell' },
     ];
 
+    // Add status cell only if budget-overview
+    if (isOverview) {
+      row.push({ text: t(`sources.lines.invoiceStatus.${status}`), style: 'tableCell' });
+    }
+
     // Invoice amount
     const invoiceAmountText = formatters?.formatCurrency(invoice.invoiceAmount) ?? '—';
     if (invoice.lineKind === 'refund-adjustment') {
@@ -133,6 +285,7 @@ export function buildOverviewContent(
     const allocatedText = formatters?.formatCurrency(invoice.allocatedAmount) ?? '—';
     const skipMarkers = skipFootnotesByInvoiceId.get(invoice.invoiceId) ?? [];
     const splitMarker = splitFootnotesByInvoiceId.get(invoice.invoiceId);
+    const depositMarker = depositFootnotesByInvoiceId.get(invoice.invoiceId);
     let markerText = '';
     for (const noteNum of skipMarkers) {
       markerText += `*${noteNum}`;
@@ -140,6 +293,9 @@ export function buildOverviewContent(
     if (splitMarker) {
       markerText += `†${splitMarker}`;
     }
+    if (depositMarker) {
+      markerText += `‡${depositMarker.num}`;
+    }
 
     if (invoice.lineKind === 'refund-adjustment') {
       row.push({
@@ -156,14 +312,11 @@ export function buildOverviewContent(
       });
     }
 
-    // Appendix column
-    if (appendixByInvoiceId.size > 0) {
-      const appendixNum = appendixByInvoiceId.get(invoice.invoiceId);
-      row.push({
-        text: appendixNum ? `${appendixNum}` : '—',
-        style: 'tableCell',
-      });
-    }
+    // No longer rendered (appendix column removed, story #1898) — kept for call-site/signature
+    // stability; still used by merge.ts for PDF page embed ordering.
+
+    // Usage cell
+    row.push(buildUsageCell(invoice, t));
 
     rows.push(row);
   }
@@ -185,72 +338,32 @@ export function buildOverviewContent(
       const subtotal = invoicesWithStatus.reduce((sum, inv) => sum + inv.allocatedAmount, 0);
 
       const subtotalText = formatters?.formatCurrency(subtotal) ?? '—';
-      const subtotalRow: Content[] = [
-        { text: '', style: 'tableCell' },
-        { text: '', style: 'tableCell' },
-        { text: '', style: 'tableCell' },
-        {
-          text: `${t(statusLabels[status as InvoiceStatus])} ${t('sourceReports.table.subtotal')}`,
-          style: 'tableCell',
-          bold: true,
-        },
-        { text: '', style: 'tableCell' },
-        {
-          text: subtotalText,
-          style: 'tableCell',
-          alignment: 'right',
-          bold: true,
-        },
-      ];
-
-      if (appendixByInvoiceId.size > 0) {
-        subtotalRow.push({ text: '', style: 'tableCell' });
-      }
-
-      rows.push(subtotalRow as Content[]);
+      const labelText = `${t(statusLabels[status as InvoiceStatus])} ${t('sourceReports.table.subtotal')}`;
+      rows.push(buildSummaryRow(labelText, subtotalText));
     }
   }
 
   // Add total row
   const totalText = formatters?.formatCurrency(includedTotal ?? 0) ?? '—';
-  const totalRow: Content[] = [
-    { text: '', style: 'tableCell' },
-    { text: '', style: 'tableCell' },
-    { text: '', style: 'tableCell' },
-    { text: t('sourceReports.table.total'), style: 'tableCell', bold: true },
-    { text: '', style: 'tableCell' },
-    {
-      text: totalText,
-      style: 'tableCell',
-      alignment: 'right',
-      bold: true,
-    },
-  ];
-
-  if (appendixByInvoiceId.size > 0) {
-    totalRow.push({ text: '', style: 'tableCell' });
-  }
-
-  rows.push(totalRow as Content[]);
+  rows.push(buildSummaryRow(t('sourceReports.table.total'), totalText));
 
   // Add table
   content.push({
     table: {
       headerRows: 1,
-      widths:
-        appendixByInvoiceId.size > 0
-          ? ['*', 'auto', 'auto', 'auto', 'auto', 'auto', 'auto']
-          : ['*', 'auto', 'auto', 'auto', 'auto', 'auto'],
+      widths: isOverview
+        ? ['*', 'auto', 'auto', 'auto', 'auto', 'auto', '*']
+        : ['*', 'auto', 'auto', 'auto', 'auto', '*'],
       body: rows,
     },
     layout: TABLE_LAYOUT,
     margin: [0, 0, 0, 20],
   });
 
-  // Add footnotes (skip and split)
+  // Add footnotes (skip, split, deposit blocks in order)
   const footnotes: Content[] = [];
 
-  // Add skipped documents footnotes
+  // Skip block (unchanged)
   if (skippedDocuments.size > 0) {
     let skipFootnoteNum = 1;
     for (const [invoiceId, reasons] of skippedDocuments) {
@@ -268,17 +381,51 @@ export function buildOverviewContent(
     }
   }
 
-  // Add split invoice footnotes
+  // Split block (first entry gets margin)
   if (splitFootnotesByInvoiceId.size > 0) {
+    let isFirst = true;
     for (const [invoiceId, splitNum] of splitFootnotesByInvoiceId) {
       const invoice = report.invoices.find((inv) => inv.invoiceId === invoiceId);
       const vendorName = invoice?.vendorName ?? '—';
       const invoiceNumber = invoice?.invoiceNumber ?? '—';
 
-      footnotes.push({
+      const footnote: Content = {
         text: `†${splitNum}: ${vendorName} (${invoiceNumber}) — ${t('sourceReports.table.splitFootnote')}`,
         style: 'small',
-      });
+      };
+
+      if (isFirst) {
+        footnote.margin = [0, 4, 0, 0];
+        isFirst = false;
+      }
+
+      footnotes.push(footnote);
+    }
+  }
+
+  // Deposit block (first entry gets margin)
+  if (depositFootnotesByInvoiceId.size > 0) {
+    let isFirst = true;
+    for (const [invoiceId, depositMarker] of depositFootnotesByInvoiceId) {
+      const invoice = report.invoices.find((inv) => inv.invoiceId === invoiceId);
+      const vendorName = invoice?.vendorName ?? '—';
+      const invoiceNumber = invoice?.invoiceNumber ?? '—';
+      const wordingKey =
+        depositMarker.wording === 'constituted'
+          ? 'depositConstitutedFootnote'
+          : 'depositReducedFootnote';
+
+      const footnote: Content = {
+        text: `‡${depositMarker.num}: ${vendorName} (${invoiceNumber}) — ${t(`sourceReports.table.${wordingKey}`)}`,
+        style: 'small',
+      };
+
+      if (isFirst) {
+        footnote.margin = [0, 4, 0, 0];
+        isFirst = false;
+      }
+
+      footnotes.push(footnote);
     }
   }
 
diff --git a/client/src/lib/reportPdf/realRender.test.ts b/client/src/lib/reportPdf/realRender.test.ts
index 62abc8dc0..4579c1eab 100644
--- a/client/src/lib/reportPdf/realRender.test.ts
+++ b/client/src/lib/reportPdf/realRender.test.ts
@@ -18,6 +18,14 @@
  * invoice WITH a (successfully embedded) document, a refund-adjustment line (negative
  * allocatedAmount per the frontend fix spec item 3 sign contract), a skipped document (fetch
  * 404), and an EXCLUDED invoice that must never appear in the grand total or the generated PDF.
+ *
+ * NOTE (story #1898 fix round): overviewPdf.ts's `widths` arrays previously ended in the string
+ * literal `'2*'` (both the 6- and 7-column layouts), which pdfmake 0.3.11 does not support as a
+ * width unit (@types/pdfmake@0.3.x's `Size` type is only `number | 'auto' | '*' | <percentage
+ * string>` — see node_modules/@types/pdfmake/interfaces.d.ts) and crashed the real pdfmake
+ * renderer with `unsupported number: NaN` the first time any overview table was rendered via
+ * `pdfMake.createPdf(...).getBlob()`. This has been fixed in production code (both arrays now end
+ * in a plain `'*'`); every test below renders successfully.
  */
 import { describe, it, expect, beforeAll } from '@jest/globals';
 import i18next from 'i18next';
@@ -129,6 +137,12 @@ async function makeMixedReport(): Promise<{
     isSplit: true,
     invoiceAmount: 800,
     allocatedAmount: 300,
+    // Explicit budgetLines: the split (†) marker requires isSplit && budgetLines.length > 0
+    // (story #1898) — makeInvoice()'s default `budgetLines: []` would silently produce a split
+    // invoice with NO marker at all under the new classification rules.
+    budgetLines: [
+      { id: 'bl-split-nodoc', description: null, allocatedPortion: 300, linkedItem: null },
+    ],
   });
   const splitWithDoc = makeInvoice({
     invoiceId: 'inv-split-doc',
@@ -138,6 +152,9 @@ async function makeMixedReport(): Promise<{
     invoiceAmount: 700,
     allocatedAmount: 250,
     documents: [{ documentId: 1, archiveSerialNumber: null, title: null, attachmentType: null }],
+    budgetLines: [
+      { id: 'bl-split-doc', description: null, allocatedPortion: 250, linkedItem: null },
+    ],
   });
   const refund = makeInvoice({
     invoiceId: 'inv-refund',
@@ -344,8 +361,12 @@ describe('report PDF pipeline — real, unmocked end-to-end render', () => {
     );
   });
 
-  describe('German overview table column widths (frontend fix spec item 15)', () => {
-    it('uses the "*"-first / "auto"-rest width pattern for the 7-column (appendix-present) table — the layout contract that keeps German label text from overflowing', async () => {
+  describe('German overview table column widths (frontend fix spec item 15; updated story #1898)', () => {
+    // [Scenario 24] The appendix column was removed entirely in story #1898 — appendixByInvoiceId
+    // no longer affects the rendered column count at all (see overviewPdf.test.ts "[Scenario 3]").
+    // This test now exercises the 6-column claim/proof-of-funds layout (no status, no appendix)
+    // rather than the old "appendix-present" 7-column case, which no longer exists.
+    it('uses the "*"-first / "auto"-rest width pattern for the 6-column claim/proof-of-funds table — the layout contract that keeps German label text from overflowing', async () => {
       // pdfmake's public Node API does not expose the LAYOUT ENGINE'S COMPUTED pixel widths for
       // 'auto' columns after createPdf()/getBlob() — there is no documented way to introspect the
       // resolved column widths of a generated PDF without re-implementing pdfmake's internal
@@ -359,8 +380,8 @@ describe('report PDF pipeline — real, unmocked end-to-end render', () => {
       const { report, includedIds } = await makeMixedReport();
       const formatters = formattersFor('de-DE');
 
-      // Force the appendix column into existence (7 columns) the same way merge.ts does — via a
-      // non-empty appendixByInvoiceId map.
+      // appendixByInvoiceId is still passed (call-site/signature stability) but is provably
+      // irrelevant to the rendered width contract now — non-empty here on purpose.
       const content = buildOverviewContent(
         report,
         includedIds,
@@ -375,16 +396,300 @@ describe('report PDF pipeline — real, unmocked end-to-end render', () => {
         (c) => typeof c === 'object' && c !== null && 'table' in c,
       ) as { table: { widths: string[] } };
 
-      expect(tableItem.table.widths).toHaveLength(7);
-      expect(tableItem.table.widths[0]).toBe('*');
-      expect(tableItem.table.widths.slice(1)).toEqual([
-        'auto',
-        'auto',
-        'auto',
-        'auto',
-        'auto',
-        'auto',
-      ]);
+      expect(tableItem.table.widths).toEqual(['*', 'auto', 'auto', 'auto', 'auto', '*']);
+    });
+
+    it('uses the "*"-first / "auto"-rest width pattern for the 7-column budget-overview table (status column included)', async () => {
+      const { buildOverviewContent } = await import('./overviewPdf.js');
+      const { report, includedIds } = await makeMixedReport();
+      const formatters = formattersFor('de-DE');
+
+      const content = buildOverviewContent(
+        report,
+        includedIds,
+        new Map(),
+        new Map(),
+        'budget-overview',
+        tDe,
+        formatters,
+        1300,
+      );
+      const tableItem = content.find(
+        (c) => typeof c === 'object' && c !== null && 'table' in c,
+      ) as { table: { widths: string[] } };
+
+      expect(tableItem.table.widths).toEqual(['*', 'auto', 'auto', 'auto', 'auto', 'auto', '*']);
+    });
+  });
+
+  // ─── Scenarios 23 & 25: Usage column, attachment note, deposit-footnote wordings — real,
+  // unmocked i18next + formatters, both locales ────────────────────────────────────────────────
+
+  describe('Usage column, attachment note, and deposit-footnote wordings (real en+de rendering)', () => {
+    // Dedicated fixture, independent of makeMixedReport / stubFetch — these invoices exercise
+    // Usage/attachment/deposit features only and are never fed through generateReportPdf's
+    // document-fetch pipeline (attachDocuments stays false everywhere below), so no new document
+    // IDs need to be wired into stubFetch's routing.
+    function makeUsageFeatureReport(): SourceReportResponse {
+      const linkedUsage = makeInvoice({
+        invoiceId: 'inv-usage-linked',
+        vendorName: 'Linked Vendor',
+        invoiceNumber: 'U-1',
+        budgetLines: [
+          {
+            id: 'bl-linked-1',
+            description: null,
+            allocatedPortion: 100,
+            linkedItem: { type: 'work_item', id: 'wi-1', name: 'Roof Replacement' },
+          },
+          {
+            id: 'bl-linked-2',
+            description: null,
+            allocatedPortion: 50,
+            linkedItem: { type: 'work_item', id: 'wi-1', name: 'Roof Replacement' },
+          },
+        ],
+      });
+      const attachSingle = makeInvoice({
+        invoiceId: 'inv-attach-single',
+        vendorName: 'Single Attach Vendor',
+        invoiceNumber: 'U-3',
+        documents: [
+          { documentId: 101, archiveSerialNumber: null, title: null, attachmentType: 'invoice' },
+        ],
+      });
+      const attachMulti = makeInvoice({
+        invoiceId: 'inv-attach-multi',
+        vendorName: 'Multi Attach Vendor',
+        invoiceNumber: 'U-4',
+        documents: [
+          {
+            documentId: 102,
+            archiveSerialNumber: null,
+            title: null,
+            attachmentType: 'quotation',
+          },
+          { documentId: 103, archiveSerialNumber: null, title: null, attachmentType: 'invoice' },
+        ],
+      });
+      const depositConstituted = makeInvoice({
+        invoiceId: 'inv-deposit-constituted',
+        vendorName: 'Constituted Vendor',
+        invoiceNumber: 'U-5',
+        isSplit: true,
+        invoiceAmount: 250,
+        allocatedAmount: 250,
+        budgetLines: [],
+        deposits: [
+          {
+            id: 'dep-constituted',
+            amount: 250,
+            status: 'paid',
+            entryType: 'deposit',
+            dueDate: '2026-01-01',
+            paidDate: '2026-01-05',
+            claimedDate: null,
+            budgetSourceId: 'src-1', // tagged to THIS source -> "constituted" wording
+          },
+        ],
+      });
+      const depositReduced = makeInvoice({
+        invoiceId: 'inv-deposit-reduced',
+        vendorName: 'Reduced Vendor',
+        invoiceNumber: 'U-6',
+        isSplit: true,
+        invoiceAmount: 150,
+        allocatedAmount: 150,
+        budgetLines: [
+          { id: 'bl-reduced', description: null, allocatedPortion: 150, linkedItem: null },
+        ],
+        deposits: [
+          {
+            id: 'dep-reduced',
+            amount: 50,
+            status: 'pending',
+            entryType: 'deposit',
+            dueDate: '2026-02-01',
+            paidDate: null,
+            claimedDate: null,
+            budgetSourceId: null, // untagged -> "reduced" wording
+          },
+        ],
+      });
+
+      return {
+        type: 'claim',
+        source: {
+          id: 'src-1',
+          name: 'Home Loan',
+          sourceType: 'bank_loan',
+          reference: null,
+          contactAddress: null,
+        },
+        invoices: [linkedUsage, attachSingle, attachMulti, depositConstituted, depositReduced],
+        // Sum of each invoice's allocatedAmount (linkedUsage/attachSingle/attachMulti default to
+        // 100 via makeInvoice(); depositConstituted=250, depositReduced=150 explicitly above).
+        totalAmount: 100 + 100 + 100 + 250 + 150,
+        unallocatedInvoices: [],
+        generatedAt: '2026-02-15T00:00:00.000Z',
+      };
+    }
+
+    // Recursively collects every string value anywhere in the pdfmake Content[] tree (text cells,
+    // stacks, table bodies, nested columns, etc.) — deliberately structure-agnostic so it doesn't
+    // need to know pdfmake's exact node shapes.
+    function collectAllStrings(node: unknown, out: string[] = []): string[] {
+      if (typeof node === 'string') {
+        out.push(node);
+      } else if (Array.isArray(node)) {
+        for (const item of node) collectAllStrings(item, out);
+      } else if (node !== null && typeof node === 'object') {
+        for (const value of Object.values(node as Record<string, unknown>)) {
+          collectAllStrings(value, out);
+        }
+      }
+      return out;
+    }
+
+    it.each([['en', 'en-US', () => tEn] as const, ['de', 'de-DE', () => tDe] as const])(
+      '[Scenario 23] generates a real, non-empty PDF for the %s locale from the Usage/attachment/deposit fixture, with no raw i18n keys leaked anywhere in the content tree',
+      async (_label, localeStr, getT) => {
+        const { generateReportPdf } = await import('./merge.js');
+        const { buildOverviewContent } = await import('./overviewPdf.js');
+        const report = makeUsageFeatureReport();
+        const includedIds = new Set(report.invoices.map((inv) => inv.invoiceId));
+        const formatters = formattersFor(localeStr as 'en-US' | 'de-DE');
+        const t = getT();
+
+        const result = await generateReportPdf(
+          report,
+          includedIds,
+          'claim',
+          { attachDocuments: false, includeCoverLetter: true },
+          household,
+          t,
+          formatters,
+        );
+        expect(result.blob).toBeInstanceOf(Blob);
+        expect(result.blob.size).toBeGreaterThan(0);
+
+        const content = buildOverviewContent(
+          report,
+          includedIds,
+          new Map(),
+          new Map(),
+          'claim',
+          t,
+          formatters,
+          700, // sum of all 5 fixture invoices' allocatedAmount
+        );
+        const allStrings = collectAllStrings(content);
+        const leakedKeys = allStrings.filter((s) => /^sourceReports\.[a-zA-Z.]+$/.test(s));
+        expect(leakedKeys).toEqual([]);
+      },
+    );
+
+    it('[Scenario 4/5 real-render cross-check] renders comma-joined distinct linked-item names for the Usage column', async () => {
+      const { buildOverviewContent } = await import('./overviewPdf.js');
+      const report = makeUsageFeatureReport();
+      const includedIds = new Set(report.invoices.map((inv) => inv.invoiceId));
+      const content = buildOverviewContent(
+        report,
+        includedIds,
+        new Map(),
+        new Map(),
+        'claim',
+        tEn,
+        formattersFor('en-US'),
+        700, // sum of all 5 fixture invoices' allocatedAmount
+      );
+      const tableItem = content.find(
+        (c) => typeof c === 'object' && c !== null && 'table' in c,
+      ) as { table: { body: unknown[][] } };
+      const linkedRow = tableItem.table.body[1] as { text?: string }[];
+      // Deduped despite the two budget lines sharing the same linkedItem name.
+      expect(linkedRow[5]!.text).toBe('Roof Replacement');
+    });
+
+    it('[Scenario 25] plural selection: real i18next chooses attachmentsNote_one for 1 doc and attachmentsNote_other for 2+, in both locales', async () => {
+      const { buildOverviewContent } = await import('./overviewPdf.js');
+      const report = makeUsageFeatureReport();
+      const includedIds = new Set(report.invoices.map((inv) => inv.invoiceId));
+
+      for (const [t, formatters, expected] of [
+        [
+          tEn,
+          formattersFor('en-US'),
+          { single: '1 attachment: Invoice', multi: '2 attachments: Quotation, Invoice' },
+        ],
+        [
+          tDe,
+          formattersFor('de-DE'),
+          { single: '1 Anhang: Rechnung', multi: '2 Anhänge: Angebot, Rechnung' },
+        ],
+      ] as const) {
+        const content = buildOverviewContent(
+          report,
+          includedIds,
+          new Map(),
+          new Map(),
+          'claim',
+          t,
+          formatters,
+          700, // sum of all 5 fixture invoices' allocatedAmount
+        );
+        const tableItem = content.find(
+          (c) => typeof c === 'object' && c !== null && 'table' in c,
+        ) as { table: { body: unknown[][] } };
+
+        // Row order matches report.invoices: [linkedUsage, attachSingle, attachMulti, ...]
+        const singleRow = tableItem.table.body[2] as { stack: { text: string }[] }[];
+        const multiRow = tableItem.table.body[3] as { stack: { text: string }[] }[];
+        expect(singleRow[5]!.stack[1]!.text).toBe(expected.single);
+        expect(multiRow[5]!.stack[1]!.text).toBe(expected.multi);
+      }
+    });
+
+    it('renders both real deposit-footnote wordings ("constituted" vs "reduced") in both locales', async () => {
+      const { buildOverviewContent } = await import('./overviewPdf.js');
+      const report = makeUsageFeatureReport();
+      const includedIds = new Set(report.invoices.map((inv) => inv.invoiceId));
+
+      for (const [t, formatters, expected] of [
+        [
+          tEn,
+          formattersFor('en-US'),
+          {
+            constituted: '‡1: Constituted Vendor (U-5) — This is a deposit.',
+            reduced:
+              '‡2: Reduced Vendor (U-6) — This position reflects deposits claimed separately.',
+          },
+        ],
+        [
+          tDe,
+          formattersFor('de-DE'),
+          {
+            constituted: '‡1: Constituted Vendor (U-5) — Dies ist eine Abschlagszahlung.',
+            reduced:
+              '‡2: Reduced Vendor (U-6) — Diese Position berücksichtigt separat eingereichte Abschlagszahlungen.',
+          },
+        ],
+      ] as const) {
+        const content = buildOverviewContent(
+          report,
+          includedIds,
+          new Map(),
+          new Map(),
+          'claim',
+          t,
+          formatters,
+          700, // sum of all 5 fixture invoices' allocatedAmount
+        );
+        const notesStack = content[content.length - 1] as { stack: { text: string }[] };
+        const texts = notesStack.stack.map((n) => n.text);
+        expect(texts).toContain(expected.constituted);
+        expect(texts).toContain(expected.reduced);
+      }
     });
   });
 });
diff --git a/server/src/routes/timeline.test.ts b/server/src/routes/timeline.test.ts
index 442fa3b5d..5413a4a33 100644
--- a/server/src/routes/timeline.test.ts
+++ b/server/src/routes/timeline.test.ts
@@ -139,6 +139,21 @@ describe('Timeline Routes', () => {
     app.db.insert(milestoneWorkItems).values({ milestoneId, workItemId }).run();
   }
 
+  /**
+   * Returns a YYYY-MM-DD date string `daysFromNow` days after the current real date.
+   *
+   * Used instead of hardcoded absolute calendar literals for not_started work item
+   * fixtures: not_started items get an implicit "today floor" CPM override applied
+   * by the scheduling engine (their start date cannot be in the past — see
+   * timelineService.ts), so a fixture date that is comfortably in the future never
+   * triggers that override and stays immune to calendar drift as real time advances.
+   */
+  function futureDateStr(daysFromNow: number): string {
+    const d = new Date();
+    d.setUTCDate(d.getUTCDate() + daysFromNow);
+    return d.toISOString().slice(0, 10);
+  }
+
   // ─── Authentication ────────────────────────────────────────────────────────
 
   describe('authentication', () => {
@@ -416,20 +431,36 @@ describe('Timeline Routes', () => {
     });
 
     it('returns projectedDate equal to the max endDate of linked work items', async () => {
+      // These fixtures are not_started work items. timelineService applies an
+      // implicit "today floor" CPM override to not_started items (their start
+      // date cannot be in the past — see timelineService.ts), so hardcoded
+      // absolute calendar literals would eventually fall into the past and this
+      // assertion would expire. Using dates comfortably in the future (relative
+      // to whenever the test actually runs) keeps the fixture permanently immune
+      // to that drift.
+      //
+      // Note: freezing the clock (jest.useFakeTimers/setSystemTime) was tried
+      // here first and rejected — it pollutes the shared module-level
+      // `lastRescheduleDate` gate in schedulingEngine.ts (used by
+      // ensureDailyReschedule), which then causes the *next* test in this file
+      // to unexpectedly trigger a real autoReschedule pass against its own
+      // database. Relative-date fixtures avoid touching the clock entirely.
       const { userId, cookie } = await createUserWithSession(
         'user@example.com',
         'Test User',
         'password123',
       );
+      const wiAEndDate = futureDateStr(75);
+      const wiBEndDate = futureDateStr(150);
       const wiA = createTestWorkItem(userId, 'Task A', {
-        startDate: '2026-03-01',
-        endDate: '2026-04-15',
+        startDate: futureDateStr(30),
+        endDate: wiAEndDate,
       });
       const wiB = createTestWorkItem(userId, 'Task B', {
-        startDate: '2026-05-01',
-        endDate: '2026-07-30',
+        startDate: futureDateStr(90),
+        endDate: wiBEndDate,
       });
-      const msId = createTestMilestone(userId, 'Phase 1 Done', '2026-08-01');
+      const msId = createTestMilestone(userId, 'Phase 1 Done', futureDateStr(180));
       linkMilestoneToWorkItem(msId, wiA);
       linkMilestoneToWorkItem(msId, wiB);
 
@@ -443,8 +474,9 @@ describe('Timeline Routes', () => {
       const body = response.json<TimelineResponse>();
       const ms = body.milestones.find((m) => m.id === msId);
       expect(ms).toBeDefined();
-      // projectedDate = max endDate = 2026-07-30
-      expect(ms!.projectedDate).toBe('2026-07-30');
+      // projectedDate = max endDate = wiB's endDate (both fixture start dates are
+      // safely in the future, so the CPM today-floor never overrides them).
+      expect(ms!.projectedDate).toBe(wiBEndDate);
     });
 
     it('returns projectedDate: null when all linked work items have null endDate', async () => {