diff --git a/.agents/skills/work-in-nextcloud-app/SKILL.md b/.agents/skills/work-in-nextcloud-app/SKILL.md
index 35e0ff6..4650c39 100644
--- a/.agents/skills/work-in-nextcloud-app/SKILL.md
+++ b/.agents/skills/work-in-nextcloud-app/SKILL.md
@@ -57,7 +57,9 @@ Stop immediately if production systems, Git history rewriting, new production de
 - Develop executable UI logic test-first; additionally cover layout, accessibility, and Nextcloud integration with suitable smoke or browser checks.
 - Treat a time-boxed exploratory spike or hard-to-isolate Nextcloud integration as an explicitly justified deviation. Discard spike code or characterize it before adoption; choose the truthful broader integration level when isolation would hide the real contract.
 - Use the local fast entries named by `AGENTS.md`, normally `php tests/run.php` and `node tests/run-js.mjs`; dependency-light PHP smokes run in isolated processes. Run LocalBase and every affected consumer contract/smoke suite after a LocalBase contract change.
-- In local pre-production, app tests may use shared LocalBase test helpers through relative repository paths. Add heavier packaging/autoload structure or a larger test framework only when path handling, runners, assertions, mocks, or fixtures are materially duplicated or impair readability.
+- PHP classes must not remain coupled through distributed relative `require` or `require_once` chains. Production classes under `lib/` use Nextcloud's PSR-4 app autoloader; a bundled category-A dependency uses exactly one reproducibly generated, app-local, namespace-isolated Composer autoloader. Never use a shared workspace autoloader, shared cross-app `vendor/`, or neighboring production repository path as a delivery mechanism. Category-B services remain separate runtime apps and are consumed only through their public activation- and version-aware contracts.
+- Every app uses one central app-local test bootstrap/autoloader for dependency-light PHP tests. It may resolve a test-only LocalBase helper through exactly one central transition point until a versioned development dependency exists, but individual tests must not retain direct relative LocalBase class paths after migration. Nextcloud integration tests may load the documented Nextcloud test bootstrap; template partials, explicit process/test entrypoints, and the one-time bootstrap of a bundled Composer autoloader remain justified includes rather than class-load chains.
+- When a writing task first touches executable PHP or PHP tests in an app that has not yet migrated, include that app's complete autoload migration as a separate preparatory step in the same app scope. An app is complete only when distributed manual class requires and production fallback requires are gone, allowed includes are limited and reviewable, relevant app and provider/consumer PHP tests are green, and release checks contain neither development dependencies nor foreign repository paths. Documentation-only, formatting-only, and JavaScript-only work does not trigger an artificial PHP migration.
 - Known overall and app coverage must not decline unnoticed. Aim for at least 85 percent line coverage for new or materially changed executable code, report PHP and JavaScript separately, and fully cover security invariants regardless of percentages. Coverage is a warning and delivery indicator, not a substitute for meaningful assertions.
 - Do not prepare a commit or release with red relevant fast tests, contract tests, security checks, coverage gates, or delivery gates.
 
@@ -82,6 +84,7 @@ Stop immediately if production systems, Git history rewriting, new production de
 
 ## Git and completion report
 
+- When Simon asks for the next open steps, priorities, remaining work, or a similar outlook, include every applicable pending migration and unresolved decision from accepted ADRs and documented rollout plans. Report its current status, trigger, and required approval gate, and distinguish work executable now from work triggered by a later app change and work that is currently undecidable. Mentioning an item does not expand the current write scope or authorize a gated change.
 - Do not commit, push, release, deploy, or use `git add .` without Simon's explicit authorization. Stage individual files only when staging was requested.
 - Before a commit, show `git status --short`, `git diff --stat`, and `git diff --name-only`. Never use `git reset --hard`, `git clean`, force-push, history rewrite, or versioned backup copies.
 - Run relevant local tests, `git diff --check`, and the repository's own structure/fast check. For an explicitly authorized cross-app contract change, validate every provider and consumer repository from its own root and use the Parent workspace check only as an additional coordinator.
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 76644ec..49e9b3f 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -106,3 +106,12 @@ jobs:
             --check-coverage \
             --lines=86.47 \
             node tests/run-js.mjs
+
+  deploy-staging:
+    name: Staging-Deployment
+    if: github.event_name == 'push'
+    needs: [php, javascript]
+    uses: Filzmann/br-nextcloud-apps/.github/workflows/deploy-staging.yml@main
+    with:
+      app-id: adplaner
+    secrets: inherit
diff --git a/CHANGELOG.md b/CHANGELOG.md
index de4616b..a5cdcf1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.4.0-rc.2
+
+- Monatsplanänderungen und Statuswechsel gegen konkurrierende Freigaben serialisiert; genehmigte Schichtdefinitionen bleiben als unveränderlicher Planstand erhalten.
+- Strikte Monats-, Datums-, UTF-8-, Längen-, Boolean- und Schichtlistenvalidierung ergänzt.
+- Teameinstellungen, Tagesbemerkungen und Zuweisungen beim konkurrierenden erstmaligen Speichern gegen Unique-Constraint-Konflikte abgesichert.
+- Geleerte Tagesbemerkungen samt Bearbeitungsmetadaten entfernt; öffentliche Team- und Hinweisantworten auf aktuell schichtfähige Personen und benötigte Anzeigenamen reduziert.
+- Technische Monats-Locks von personenbezogenen Änderungsmetadaten getrennt und interne Demo-Fehler ohne Detailleck als Serverfehler beantwortet.
+- Fehler optionaler Hinweisprovider isoliert und öffentliche Planpayloads um interne Erstellerkennungen sowie teamfremde Hinweise bereinigt.
+- Lade-, Speicher- und Zuteilungsoberfläche gegen veraltete Antworten, Doppelstarts, unklare Nachladefehler sowie Tastatur-, Tabellen- und Fokusprobleme stabilisiert.
+
+## 0.4.0-rc.1
+
+- Kontrollierte Monatsplanstatus `draft`, `planned` und `approved` ergänzt; nur die zuständige Einsatzbegleitung darf wechseln und genehmigte Pläne sind gegen Änderungen gesperrt.
+- Optionale, datensparsame Urlaubs- und Kalenderhinweise über die öffentlichen LocalBase-Verträge eingebunden; fehlende Provider bleiben ein gültiger Standalone-Zustand.
+- Direkte Navigation zum vorherigen und nächsten Monat sowie sichtbarer Tabellen-Scrollbereich und fixierte Bemerkungsspalte ergänzt.
+- Additive Monatsplanstatus-Migration sowie automatisierte Service-, UI-, Migrations-, Datenbank- und DDEV-Rechteprüfungen ergänzt.
+
 ## 0.3.0-rc.1
 
 - Eigenständige Navigation ohne OrgSuite ergänzt.
diff --git a/README.md b/README.md
index 1dc53d5..db4c08b 100644
--- a/README.md
+++ b/README.md
@@ -17,8 +17,16 @@ AdPlaner funktioniert einzeln; optionale Abwesenheits- oder Kalenderhinweise ent
 
 Assistenzteams werden aus den zentral konfigurierten Nextcloud-Gruppen abgeleitet. Teambezogene Schichtkonfigurationen werden durch berechtigte Einsatzbegleitungen gepflegt.
 
+Die zuständige Einsatzbegleitung führt Monatspläne kontrolliert von `draft` über `planned` nach `approved`. Genehmigte Pläne sind bis zu einer ausdrücklichen Rücknahme gegen Wünsche, Zuweisungen und Bemerkungsänderungen gesperrt. Optionale Urlaubs- und Kalenderprovider liefern ausschließlich datensparsame, schreibgeschützte Planungshinweise.
+
+Genehmigte Pläne frieren die damaligen Schichtdefinitionen ein, speichern aber keine zusätzlichen historischen Personenstammdaten. Zuweisungen werden weiterhin nur für aktuell schichtfähige Mitglieder des jeweiligen Assistenzteams angezeigt.
+
 ## Roadmap
 
 Geplante Erweiterungen und offene Produktentscheidungen stehen in der [Roadmap](ROADMAP.md).
 
+Für die fachliche, visuelle und sicherheitsbezogene Staging-Prüfung steht ein
+ausfüllbares [manuelles Abnahmeformular](docs/manual-acceptance.md) bereit.
+Zugangsdaten und personenbezogene Echtdaten werden darin nicht dokumentiert.
+
 Installations-, Betriebs- und Abnahmeunterlagen stehen im öffentlichen [AD-Suite-Projekt](https://github.com/Filzmann/ad-suite).
diff --git a/ROADMAP.md b/ROADMAP.md
index ee24f56..4e50044 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -4,18 +4,29 @@ Diese Datei bündelt geplante Erweiterungen und offene Produktentscheidungen. Ve
 
 ## Aktueller Fokus
 
+- Die manuellen Prüfungen werden im ausfüllbaren
+  [`docs/manual-acceptance.md`](docs/manual-acceptance.md) dokumentiert.
 - Produktive Rechte- und Datenschutzprüfung der Wunschdienstplanung.
 - Monatsplan, variable Schichten, EB-Koordination und Standalone-Betrieb auf einem realitätsnahen Staging fachlich abnehmen.
 
 ## Geplante Erweiterungen
 
+- **ADP-L10N – vollständige Lokalisierung (später, nicht freigegeben):**
+  AdPlaner wird im Rahmen des suiteweiten L10N-Rollouts auf die aktive
+  Nextcloud-Locale und Nextcloud-l10n umgestellt. Manuelle Monats- und
+  Wochentagsnamen sowie sichtbare UI-, Status-, Validierungs- und
+  Fehlermeldungen werden dabei vollständig migriert. ISO-Daten,
+  Monatsnummern, Schichtzeiten, Statuswerte, Teamcodes und API-Schlüssel
+  bleiben unverändert; Abkürzungen werden nicht durch Abschneiden gebildet.
+  Erforderlich sind Tests für deutsche Ausgabe, mindestens eine weitere
+  Locale, Fallback, Monats-/Jahresgrenzen, Pluralformen, Platzhalter und
+  Escaping in PHP und JavaScript. Pilot-App, Reihenfolge und Rohtext-Gate
+  werden vor Umsetzung suiteweit separat freigegeben.
 - Persönliche Monatsansicht „Alle meine Einsätze“ mit PDF-Export und optionaler Verbindung zu gängigen Kalendern.
 - Benachrichtigungen für relevante Planungs- und Statusänderungen.
-- Fachlich eindeutige Festschreibung eines Dienstplans.
 - Teambezogene Konfigurierbarkeit nur dort erweitern, wo konkrete Teams unterschiedliche Regeln benötigen.
 
 ## Vor der Umsetzung zu klären
 
 - Exportformate, Zielsysteme und Datenschutzumfang.
 - Benachrichtigungskanäle, Empfänger*innen und auslösende Ereignisse.
-- Bedeutung, Rechte und Rückbau einer Festschreibung sowie der Umgang mit späteren Änderungen.
diff --git a/appinfo/info.xml b/appinfo/info.xml
index 8ba1330..3216955 100644
--- a/appinfo/info.xml
+++ b/appinfo/info.xml
@@ -5,14 +5,14 @@
     <name>Assistenz Dienstplanung</name>
     <summary>Wunschdienstplanung für Assistenzteams.</summary>
     <description>Verwaltet monatliche Wunschdienstpläne für Assistenzteams auf Basis dynamischer Nextcloud-Gruppen.</description>
-    <version>0.3.0-rc.2</version>
+    <version>0.4.0-rc.2</version>
     <licence>agpl</licence>
     <author>Simon</author>
+    <namespace>AdPlaner</namespace>
+    <category>organization</category>
     <website>https://github.com/Filzmann/ad-suite</website>
     <bugs>https://github.com/Filzmann/nextcloud-adplaner/issues</bugs>
     <repository type="git">https://github.com/Filzmann/nextcloud-adplaner</repository>
-    <namespace>AdPlaner</namespace>
-    <category>organization</category>
     <dependencies>
         <php min-version="8.3"/>
         <nextcloud min-version="34" max-version="34"/>
diff --git a/appinfo/routes.php b/appinfo/routes.php
index 0506afe..4efa5be 100644
--- a/appinfo/routes.php
+++ b/appinfo/routes.php
@@ -6,10 +6,11 @@
 
         ['name' => 'api#state', 'url' => '/api/state', 'verb' => 'GET'],
         ['name' => 'api#monthPlan', 'url' => '/api/teams/{teamCode}/months/{month}', 'verb' => 'GET'],
+        ['name' => 'api#transitionMonthStatus', 'url' => '/api/teams/{teamCode}/months/{month}/status', 'verb' => 'POST'],
         ['name' => 'api#saveTeamSettings', 'url' => '/api/teams/{teamCode}/settings', 'verb' => 'POST'],
         ['name' => 'api#saveDayNote', 'url' => '/api/teams/{teamCode}/months/{month}/days/{workDate}/note', 'verb' => 'POST'],
-        ['name' => 'api#addShiftCandidate', 'url' => '/api/teams/{teamCode}/months/{month}/slots/{slotId}/candidates', 'verb' => 'POST'],
-        ['name' => 'api#removeShiftCandidate', 'url' => '/api/teams/{teamCode}/months/{month}/slots/{slotId}/candidates/remove', 'verb' => 'POST'],
+        ['name' => 'api#addShiftCandidate', 'url' => '/api/teams/{teamCode}/months/{month}/slots/{slotId}/candidates', 'verb' => 'POST', 'requirements' => ['slotId' => '\\d+']],
+        ['name' => 'api#removeShiftCandidate', 'url' => '/api/teams/{teamCode}/months/{month}/slots/{slotId}/candidates/remove', 'verb' => 'POST', 'requirements' => ['slotId' => '\\d+']],
         ['name' => 'demo_admin#install', 'url' => '/api/admin/demo-pack/install', 'verb' => 'POST'],
     ],
 ];
diff --git a/css/style.css b/css/style.css
index 3e5ff86..8175b4b 100644
--- a/css/style.css
+++ b/css/style.css
@@ -26,6 +26,8 @@
 .adp-controls,
 .adp-tabs,
 .adp-section-head,
+.adp-plan-meta,
+.adp-plan-status,
 .adp-cell-actions {
     display: flex;
     align-items: center;
@@ -101,6 +103,7 @@
 .adp-table-wrap {
     overflow: auto;
     max-width: 100%;
+    max-height: calc(100vh - 260px);
 }
 
 .adp-table {
@@ -133,6 +136,18 @@
     border-left: 1px solid var(--color-border);
 }
 
+.adp-month-table th:last-child,
+.adp-month-table td:last-child {
+    position: sticky;
+    right: 0;
+    z-index: 2;
+    box-shadow: -1px 0 0 var(--color-border);
+}
+
+.adp-month-table thead th:last-child {
+    z-index: 4;
+}
+
 .adp-table small,
 .adp-day small {
     display: block;
@@ -156,6 +171,25 @@
     color: var(--color-main-text);
 }
 
+.adp-day-hints {
+    display: grid;
+    gap: 3px;
+    margin-top: 6px;
+}
+
+.adp-day .adp-hint {
+    display: inline-flex;
+    width: max-content;
+    max-width: 160px;
+    border-radius: 6px;
+    padding: 1px 5px;
+    background: var(--color-background-hover);
+    color: var(--color-main-text);
+    font-size: .8rem;
+    font-weight: 600;
+    white-space: normal;
+}
+
 .adp-candidates {
     display: flex;
     align-items: flex-start;
@@ -199,15 +233,48 @@
     text-align: center;
 }
 
-.adp-assignment-control,
-.adp-assignment-picker {
+.adp-month-control {
     display: inline-flex;
     align-items: center;
     gap: 4px;
 }
 
-.adp-assignment-picker select {
-    width: 150px;
+.adp-month-control .adp-icon-button {
+    min-height: 34px;
+    margin: 0;
+}
+
+.adp-assignment-control {
+    position: relative;
+    display: inline-flex;
+    align-items: center;
+    gap: 4px;
+}
+
+.adp-assignment-picker {
+    position: absolute;
+    left: 0;
+    top: calc(100% + 4px);
+    z-index: 5;
+    display: grid;
+    gap: 4px;
+    min-width: 180px;
+    max-height: 240px;
+    overflow-y: auto;
+    border: 1px solid var(--color-border);
+    border-radius: 8px;
+    padding: 6px;
+    background: var(--color-main-background);
+    box-shadow: 0 4px 16px rgba(0, 0, 0, .18);
+}
+
+.adp-assignment-picker[hidden] {
+    display: none;
+}
+
+.adp-assignment-picker .adp-small {
+    width: 100%;
+    text-align: left;
 }
 
 .adp-note-cell textarea {
diff --git a/docs/manual-acceptance.md b/docs/manual-acceptance.md
new file mode 100644
index 0000000..5db11ee
--- /dev/null
+++ b/docs/manual-acceptance.md
@@ -0,0 +1,181 @@
+# Manuelles Abnahmeformular – AdPlaner
+
+Dieses Formular dokumentiert die fachliche und visuelle Abnahme der
+Assistenzplanung auf einem realitätsnahen Staging-System. Pro Prüffall wird
+genau ein Ergebnis markiert und unter „Warum/Beleg/Abweichung“ knapp
+festgehalten, was beobachtet wurde.
+
+Keine personenbezogenen Echtdaten, Gesundheits- oder Urlaubsdetails,
+Zugangsdaten oder internen Kennungen eintragen. Ausschließlich neutrale
+Testkonten, synthetische Teams, Schichten und Bemerkungen verwenden.
+
+## Kopfdaten
+
+| Feld | Eintrag |
+|---|---|
+| Datum und Uhrzeit | 02.08.2026, ca. 18:26–19:31 Uhr |
+| Prüfer*in | Simon |
+| Umgebung und URL | DEV/Staging – `https://nextcloud-dev.ddev.site/index.php/apps/adplaner/` |
+| AdPlaner-Version | 0.3.0-rc.2 |
+| Nextcloud-Version | Nextcloud Hub 26 Spring – 34.0.2 |
+| Browser und Version | Google Chrome 150.0.7871.186, offizieller 64-Bit-Build unter Ubuntu |
+| Fenstergröße / Zoom | ungefähr zwei Drittel von 1920 px, Zoom 100 % |
+| Neutrale Testkonten, Teams und Rollen | `adc-test-eb-sued` (EB-Testkonto), `admin` (in AdPlaner normales schichtfähiges Teammitglied ohne EB-Rechte), `west` (Nur-EB-Testkontext); Teams `KaKü` und `HaHü`; weitere neutrale Testkonten im Verlauf verwendet, aber nicht einzeln dokumentiert |
+| Aktive optionale Apps | Grundsätzlich alle, einschließlich OrgSuite, AD Urlaub und AD Kalender; OrgSuite für A1 vorübergehend deaktiviert, AD Urlaub für D1 und AD Kalender für D2 vorübergehend deaktiviert |
+
+Ergebniskennzeichnung: `[x] erfolgreich` / `[x] nicht erfolgreich` /
+`[x] nicht geprüft`. Bei „nicht erfolgreich“ oder „nicht geprüft“ ist eine
+Begründung verpflichtend.
+
+## A. Einstieg, Navigation und Monatsplan
+
+| ID | Was wird geprüft? | Auszuführende Schritte | Erwartetes Ergebnis | Ergebnis | Warum/Beleg/Abweichung |
+|---|---|---|---|---|---|
+| A1 | Standalone-Einstieg | AdPlaner ohne aktive OrgSuite öffnen. | Ein eigener Nextcloud-Einstieg ist vorhanden und der Monatsplan wird ohne andere Fachapps geladen. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Eigener Nextcloud-Einstieg vorhanden; Monatsplan vollständig geladen und ohne OrgSuite bedienbar. Keine Fehler oder fehlenden Komponenten festgestellt. |
+| A2 | Suite-Einstieg | AdPlaner mit aktiver OrgSuite über den AD-Einstieg öffnen und zwischen aktivierten AD-Apps wechseln. | Es gibt keinen doppelten Haupteinstieg; AdPlaner ist im gemeinsamen Menü korrekt markiert. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Gemeinsamer AD-Einstieg vorhanden; kein doppelter Haupteinstieg; AdPlaner im gemeinsamen Menü sichtbar und korrekt markiert. Wechsel zwischen AD-Apps und Laden des Monatsplans funktionieren. |
+| A3 | Team und Monat | Zwischen mindestens zwei synthetischen Teams sowie vorherigem und nächstem Monat wechseln. | Auswahl, Überschrift, Tage, Schichten und Zuweisungen gehören stets zum gewählten Team und Monat. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Wechsel zwischen zwei Teams sowie vorherigem und nächstem Monat funktionierte korrekt. Überschrift, Tage, Schichten und Zuweisungen gehörten jeweils zum gewählten Team und Monat. Keine vermischten oder veralteten Daten sichtbar. |
+| A4 | Monatsgrenzen | Februar sowie einen Monats-/Jahreswechsel öffnen. | Kalendertage und gespeicherte Planwerte werden ohne fehlende oder doppelte Tage angezeigt. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Februar einschließlich Schaltjahr sowie Monats-/Jahreswechsel geprüft. Keine fehlenden oder doppelten Tage; gespeicherte Planwerte korrekt. Verbesserungsbedarf: Es gibt keine Schalter für „vorheriger Monat“ und „nächster Monat“; der Wechsel ist nur über das Datumsfeld möglich. |
+| A5 | Tastatur und Fokus | Team-, Monats-, Tab- und Plansteuerung nur mit Tastatur bedienen. | Alle Funktionen sind erreichbar, der Fokus ist sichtbar und die Tabs melden Auswahl und Zielbereich korrekt. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Teamauswahl, Monatssteuerung, Tabs und Plansteuerung waren per Tastatur bedienbar. Der Fokus war sichtbar, die aktive Tab-Auswahl erkennbar und es bestand keine Tastaturfalle. |
+| A6 | Responsivität und Scrollen | Viele Schichten und Personen bei kleinem Fenster anzeigen und horizontal sowie vertikal scrollen. | App-Inhalte bleiben erreichbar; der App-Root scrollt vertikal und breite Planungselemente sprengen nicht die Nextcloud-Seite. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Kleines Fenster geprüft; vertikales Scrollen funktioniert, alle Inhalte bleiben erreichbar und die Nextcloud-Seite wird nicht horizontal gesprengt. Keine doppelten oder überlagernden Scrollleisten. Verbesserungsbedarf: Die horizontale Scrollleiste ist erst am Ende des gesamten Inhalts erreichbar und sollte wie im AD Kalender am unteren Rand des sichtbaren Planbereichs verfügbar bleiben. |
+
+## B. Schichtkonfiguration und Wunschplanung
+
+| ID | Was wird geprüft? | Auszuführende Schritte | Erwartetes Ergebnis | Ergebnis | Warum/Beleg/Abweichung |
+|---|---|---|---|---|---|
+| B1 | Variable Schichtliste | Als zuständige EB eine Schicht ergänzen, umbenennen, zeitlich ändern, deaktivieren und wieder aktivieren. | Die strukturierte Teamkonfiguration bleibt nach Neuladen erhalten und steuert den Monatsplan. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Mit `adc-test-eb-sued` im Team `KaKü` wurde eine Schicht ergänzt, nach Neuladen erhalten, umbenannt, zeitlich geändert, deaktiviert und wieder aktiviert. Der Monatsplan reagierte korrekt. Offene UI-Punkte: Der Speicherbutton für Kommentare liegt rechts außerhalb des sichtbaren Bereichs. Die Mitarbeiterauswahl soll zunächst verborgen bleiben und erst nach Betätigung des `+`-Schalters als kompakte Buttonliste in einem Overlay erscheinen. |
+| B2 | Lücken und Überlappungen | Synthetische Schichten mit einer Lücke und einer zeitlichen Überlappung speichern. | Beide fachlich zulässigen Konfigurationen werden nicht vorschnell abgewiesen und erscheinen nachvollziehbar. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Schichtkonfigurationen mit zeitlicher Lücke und mit Überlappung wurden gespeichert und blieben nach Neuladen korrekt erhalten. Zeiten wurden nicht automatisch verändert. Testkonto und Testteam nicht dokumentiert. |
+| B3 | Schicht über Mitternacht | Eine Nachtschicht mit Ende am Folgetag konfigurieren und im Monatsplan prüfen. | Die Schicht wird dem Ausgangstag eindeutig zugeordnet und mit ihrem Zeitraum verständlich dargestellt. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Die Nachtschicht wurde gespeichert, blieb nach dem Neuladen erhalten, war eindeutig dem Ausgangstag zugeordnet und als über Mitternacht laufend verständlich dargestellt. Es entstand kein doppelter Eintrag am Folgetag. Präzisierung: Eine gesonderte Darstellung am Folgetag oder Prüfung der Monatsgrenze ist fachlich nicht erforderlich; jede Schicht wird einmal dem Tag ihres Beginns zugeordnet, Monatspläne sind voneinander abgegrenzt. |
+| B4 | Eigener Wunsch | Als schichtfähiges Teammitglied einen eigenen Wunsch hinzufügen, Bemerkung speichern und den Wunsch wieder entfernen. | Nur der eigene Eintrag wird verändert; Status und Bemerkung bleiben nach Neuladen erhalten. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Mit `admin` als normalem Assistenz-Teammitglied im Team `KaKü` konnte der eigene Wunsch hinzugefügt, nach Neuladen erhalten und wieder entfernt werden. Fremde Einträge blieben unverändert. Präzisiertes Soll: Normale Teammitglieder dürfen keine Bemerkungen speichern; Bemerkungen sind ausschließlich durch die zuständige EB bearbeitbar. |
+| B5 | Fremdzuweisung durch EB | Als zuständige EB eine andere schichtfähige Person zuweisen und wieder entfernen. | Die Zuweisung ist möglich und betrifft ausschließlich das gewählte Team und die gewählte Schicht. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Fremdzuweisung durch eine zuständige EB insgesamt erfolgreich geprüft. Konkrete Testperson, Team, Schicht und Einzelschritte wurden nicht separat dokumentiert. Keine Abweichungen angegeben. |
+| B6 | EB nicht schichtfähig | Versuchen, das reine EB-Testkonto selbst einer Schicht zuzuweisen. | Das EB-Konto wird nicht als schichtfähige Person angeboten beziehungsweise serverseitig abgewiesen. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Das reine EB-Konto wurde in der Personenauswahl nicht angeboten; eine Zuweisung über die UI war nicht möglich. Direkte serverseitige Negativprüfung nicht durchgeführt. |
+| B7 | Planstatus | Als EB die angebotenen Statuswechsel einschließlich `planned` und `approved` durchführen; als normales Teammitglied wiederholen. | Nur die EB kann den Status wechseln; unberechtigte Versuche verändern den Plan nicht. | [ ] erfolgreich [x] nicht erfolgreich [ ] nicht geprüft | Es gibt derzeit keine Option für den Planstatus. Die zuständige EB muss den Monatsplan mindestens als `planned` und `approved` festschreiben können. Ein als `approved` festgeschriebener Plan darf anschließend nicht mehr verändert werden. Normale Teammitglieder dürfen den Status nicht ändern. |
+
+## C. Team- und Rechteabgrenzung
+
+| ID | Was wird geprüft? | Auszuführende Schritte | Erwartetes Ergebnis | Ergebnis | Warum/Beleg/Abweichung |
+|---|---|---|---|---|---|
+| C1 | Teammitgliedschaft | Mit einem neutralen Konto aus Team A Team A und Team B direkt aufrufen. | Nur der erlaubte Teamkontext ist nutzbar; ein direkter unberechtigter Request auf Team B wird serverseitig abgewiesen. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Der erlaubte Teamkontext war nutzbar; der Zugriff auf ein nicht erlaubtes Team wurde insgesamt erfolgreich als abgegrenzt bewertet. Testkonto, Teams und Einzelprüfungen wurden nicht dokumentiert. |
+| C2 | EB-Schnittmenge | Ein Testkonto nur in der EB-Rollengruppe, ein Konto nur im Team und ein Konto in beiden Gruppen vergleichen. | EB-Rechte entstehen nur aus der vorgesehenen Team-und-Rolle-Schnittmenge. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Die vorgesehenen Rechte entstanden nur bei der Kombination aus Teamzugehörigkeit und EB-Rolle. Als Nur-EB-Testkontext wurde `west` angegeben. Weitere Konten und Einzelprüfungen wurden nicht separat dokumentiert. |
+| C3 | Fremdänderung durch normales Mitglied | Als normales Teammitglied eine fremde Zuweisung über UI und direkten API-Aufruf ändern. | Beide Wege werden abgewiesen; der bestehende Eintrag bleibt unverändert. | [ ] erfolgreich [ ] nicht erfolgreich [x] nicht geprüft | Mit `admin` im Team `KaKü` war eine fremde Änderung über die UI nicht möglich und der bestehende Eintrag blieb unverändert. Die erforderliche serverseitige Prüfung über einen direkten API-Aufruf wurde nicht durchgeführt. |
+| C4 | Bereichs- und Teamtrennung | Zwei Teams mit ähnlich benannten neutralen Konten und unterschiedlichen Konfigurationen prüfen. | Zuweisungen, Schichten, Bemerkungen und Rechte werden nicht zwischen Teams vermischt. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Die Teams `HaHü` und `KaKü` wurden verglichen. Schichten, Zuweisungen, Bemerkungen und Rechte blieben getrennt. Auch nach Team- und Monatswechsel trat keine Vermischung auf. |
+| C5 | Demo-Pack-Schutz | Adminbereich öffnen, Installation ohne Bestätigung versuchen und anschließend nur in einer dafür vorgesehenen Testumgebung bestätigen. | Ohne ausdrückliche Bestätigung bleibt die Aktion gesperrt; es werden ausschließlich synthetische Konten und Teams verwendet. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Installation ohne Bestätigung wurde blockiert und erzeugte keine Daten. Nach ausdrücklicher Bestätigung war die Installation möglich. Es wurden ausschließlich synthetische Konten, Teams und Plandaten erzeugt; bestehende Daten blieben unverändert. Eine erneute Installation wurde sicher behandelt. |
+
+## D. Optionale Integrationen und Fehlerzustände
+
+| ID | Was wird geprüft? | Auszuführende Schritte | Erwartetes Ergebnis | Ergebnis | Warum/Beleg/Abweichung |
+|---|---|---|---|---|---|
+| D1 | Betrieb ohne AD Urlaub | AD Urlaub deaktiviert lassen und Monatsplan, Einstellungen und Zuweisungen prüfen. | Der Monatsplan bleibt vollständig nutzbar; fehlende Abwesenheitshinweise blockieren keine Aktion. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Bei deaktiviertem AD Urlaub wurden Monatsplan, Team- und Monatswechsel, Einstellungen, eigene Wünsche und Fremdzuweisungen vollständig genutzt. Die fehlende Integration erzeugte weder Fehler noch blockierte Aktionen. |
+| D2 | Betrieb ohne AD Kalender | AD Kalender deaktiviert lassen und dieselben Kernabläufe wiederholen. | Die Assistenzplanung bleibt nutzbar; der fehlende optionale Provider wird nicht als Planfehler behandelt. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Bei deaktiviertem AD Kalender blieben Monatsplan, Team- und Monatswechsel, Schichten, Einstellungen, eigene Wünsche und Fremdzuweisungen vollständig nutzbar. Der fehlende Kalenderprovider erzeugte weder Fehler noch blockierte Aktionen. Zusätzliche Beobachtung: Vorhandener Urlaub hatte zu diesem Zeitpunkt noch keine sichtbare Auswirkung auf AdPlaner; dies wurde in D3 bewertet. |
+| D3 | Optionale Hinweise | Mit aktivem, neutral vorbereitetem Urlaubs- oder Kalenderprovider dessen Hinweise im Monatsplan prüfen. | Hinweise werden read-only dargestellt und verändern weder Teamrechte noch die führenden AdPlaner-Daten. | [ ] erfolgreich [x] nicht erfolgreich [ ] nicht geprüft | AD Urlaub und AD Kalender waren aktiv. Ein vorhandener synthetischer Urlaub wurde im Monatsplan nicht als Hinweis dargestellt; die Read-only-Eigenschaft war daher nicht prüfbar. Ein Kalenderhinweis war nicht vorhanden. Teamrechte und führende AdPlaner-Daten wurden nicht verändert. |
+| D4 | Verständliche Validierung | Leere Namen, unvollständige Zeiten und ungültige Eingaben in Einstellungen und Planung versuchen. | Fehler werden am richtigen Kontext verständlich angezeigt; gültige bestehende Daten bleiben erhalten. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Leere Namen, unvollständige Zeiten und weitere ungültige Eingaben wurden verständlich und am richtigen Kontext abgewiesen. Bestehende gültige Daten blieben erhalten; die Eingaben konnten unmittelbar korrigiert werden. Fehlermeldungen erscheinen vor einem etwaigen Neuladen, sodass kein kommentarloser Reload erfolgt. |
+| D5 | Datensparsame Abnahme | Formular und Screenshots prüfen. | Es wurden nur synthetische Team-, Dienst- und Kontodaten dokumentiert. | [x] erfolgreich [ ] nicht erfolgreich [ ] nicht geprüft | Ausschließlich neutrale Testkonten sowie synthetische oder freigegebene Teams und Schichten dokumentiert. Keine personenbezogenen Bemerkungen, Gesundheits- oder Urlaubsdetails, Zugangsdaten, Tokens oder unzulässigen Echtdaten in Screenshots. |
+
+## Abschlussentscheidung
+
+| Feld | Eintrag |
+|---|---|
+| Anzahl erfolgreich | 20 |
+| Anzahl nicht erfolgreich | 2 |
+| Anzahl nicht geprüft | 1 |
+| Kritische Abweichungen / Ticketreferenzen | B7: Planstatus `planned`/`approved` und Änderungssperre fehlen.<br>D3: Optionale Urlaubs- und Kalenderhinweise werden nicht wie vorgesehen read-only dargestellt.<br>C3: Direkte serverseitige Negativprüfung einer Fremdänderung steht aus.<br>Weitere UI-Punkte: Monatsnavigation A4, sichtbare horizontale Scrollleiste A6, Kommentar-Speicherbutton und Mitarbeiterauswahl B1. |
+| Erneute Prüfung erforderlich bis | Vor Freigabe einer abnahmefähigen Version; kein konkretes Datum festgelegt |
+| Gesamtentscheidung | [ ] abgenommen [ ] mit Auflagen abgenommen [x] nicht abgenommen |
+| Begründung der Gesamtentscheidung | Die zentrale Planfreigabe einschließlich Statusverwaltung und Änderungssperre fehlt. Außerdem werden optionale Urlaubs- beziehungsweise Kalenderhinweise nicht wie vorgesehen dargestellt. C3 ist serverseitig noch nicht vollständig geprüft. |
+| Name / Datum | Simon / 02.08.2026 |
+
+## Zu bearbeitende Punkte
+
+### Hohe Priorität
+
+1. **B7 – Planstatus ergänzen**
+   - Status `planned` und `approved` implementieren.
+   - Nur die zuständige EB darf den Status ändern.
+   - Ein `approved`-Plan muss gegen Änderungen an Schichten, Zuweisungen, Wünschen und Bemerkungen gesperrt sein.
+   - Status muss nach Neuladen erhalten bleiben.
+   - Ein ausdrücklicher, berechtigter Entsperr- oder Rücksetzweg muss festgelegt werden.
+
+2. **D3 – Optionale Hinweise darstellen**
+   - Vorhandenen Urlaub einer schichtfähigen Person am betroffenen Tag im Monatsplan sichtbar machen.
+   - Hinweise ausschließlich read-only darstellen.
+   - Optional vorhandene Kalenderhinweise ebenfalls read-only anzeigen.
+   - Hinweise dürfen weder Teamrechte noch führende AdPlaner-Daten verändern.
+   - Die fachliche Wirkung auf Wünsche und Zuweisungen ist noch ausdrücklich festzulegen.
+
+### Mittlere Priorität
+
+3. **A6 – Horizontale Scrollleiste erreichbar halten**
+   - Horizontale Scrollleiste am unteren Rand des sichtbaren Plan-Viewports bereitstellen.
+   - Umsetzung am Verhalten des AD Kalenders orientieren.
+
+4. **B1 – Kommentar-Speicherbutton im sichtbaren Bereich halten**
+   - Speicheraktion ohne horizontales Scrollen erreichbar machen.
+
+5. **B1 – Mitarbeiterauswahl verdichten**
+   - Mitarbeiterauswahl zunächst verbergen.
+   - Erst nach Betätigung des `+`-Schalters als kompakte Buttonliste in einem Overlay öffnen.
+
+### Niedrige Priorität / Nachprüfung
+
+6. **A4 – Monatsnavigation ergänzen**
+   - Schalter für vorherigen und nächsten Monat ergänzen.
+
+7. **B4 – Prüfkriterium und Dokumentation korrigieren**
+   - Normale Teammitglieder dürfen eigene Wünsche hinzufügen und entfernen.
+   - Bemerkungen bleiben ausschließlich durch die zuständige EB bearbeitbar.
+
+8. **C3 – Serverseitige Rechteprüfung nachholen**
+   - Fremdänderung durch ein normales Teammitglied über einen direkten API-Aufruf versuchen.
+   - Verifizieren, dass der Server die Änderung abweist und der bestehende Eintrag unverändert bleibt.
+
+## Automatisierter Nachweis nach der historischen Abnahme
+
+Die vorstehenden Ergebnisse und die Gesamtentscheidung bleiben als historischer
+manueller Stand vom 02.08.2026 unverändert. Für `0.4.0-rc.1` sind B7 und D3
+technisch umgesetzt und durch Service-, API-, JavaScript- und Layouttests
+abgesichert: Die zuständige EB kann ausschließlich die erlaubten Übergänge
+`draft` → `planned` → `approved` sowie die ausdrücklichen Rückwege ausführen,
+ein genehmigter Monatsplan ist serverseitig und in der Oberfläche gesperrt,
+und optionale Urlaubs-/Kalenderhinweise bleiben read-only. Der reale
+DDEV-Integrationslauf belegt Statuspersistenz und unzulässige Übergänge gegen
+die Nextcloud-34-Datenbank. Die selbstbereinigende DDEV-Rechtematrix deckt den
+direkten serverseitigen Negativfall aus C3 ab.
+
+Auch die technischen Korrekturen zu A4 und A6 sind automatisiert belegt:
+direkte Vor-/Zurücknavigation und ein begrenzter, horizontal wie vertikal
+scrollbarer Plan-Viewport mit sichtbarer rechter Aktionsspalte. Die manuelle
+visuelle und fachliche Wiederholungsabnahme sowie die konkrete fachliche
+Wirkung der optionalen Hinweise auf Wünsche und Zuweisungen bleiben vor einer
+Produktfreigabe erforderlich.
+
+Für `0.4.0-rc.2` belegen zusätzliche Repository-, Service-, Routen- und
+JavaScript-Tests die Serialisierung konkurrierender Planänderungen, strikte
+Eingabegrenzen, idempotente Erstschreibvorgänge, das datensparsame Entfernen
+geleerter Tagesbemerkungen, ausschließlich aktuell schichtfähige Personen in
+öffentlichen Teamantworten sowie UID-freie read-only Planungshinweise. Der
+technische Monats-Lock verändert keine personenbezogenen fachlichen
+Änderungsmetadaten. Unbekannte Planstatus bleiben auch in der Oberfläche
+gesperrt; Tabellenüberschriften und Bemerkungsfelder sind programmatisch
+beschriftet. Diese automatisierten Nachweise ersetzen die ausstehende visuelle
+und fachliche Wiederholungsabnahme nicht.
+
+Ein zusätzlicher selbstbereinigender Nextcloud-34-DDEV-Smoke bestätigt diese
+Datenschutzverträge über den echten Gruppen-, HTTP-/CSRF- und Datenbankpfad:
+Deaktivierte Konten und EB-Konten werden nicht als schichtfähig ausgeliefert,
+das Leeren einer Tagesbemerkung entfernt deren Datenbankzeile, und technische
+Monats-Locks überschreiben keine fachlichen Änderungsmetadaten. Die getrennte
+Cleanup-Nachprüfung fand anschließend weder synthetische AdPlaner-Daten noch
+die temporären Konten oder die temporäre Gruppe.
+
+Eine selbstbereinigende Headless-Chrome-Wiederholungsabnahme belegt zusätzlich
+die gerenderte und interaktive Oberfläche in Nextcloud 34 mit einem
+synthetischen EB- und einem normalen Teamkonto. Geprüft wurden direkte
+Monatsnavigation, Tastaturwechsel der Tabs, Fremdzuweisung durch EB, eigener
+Wunsch, persistierte Tagesbemerkung und Schichtkonfiguration, die Übergänge
+`draft` → `planned` → `approved` einschließlich Sperre und ausdrücklichem
+Entsperren, schreibgeschützte Einstellungen für normale Mitglieder sowie das
+reale vertikale und horizontale Scrollverhalten bei schmalem Viewport. Ein
+temporärer Sichtnachweis wurde nur im Testverzeichnis unter `/tmp` erzeugt und
+mit dem Browserprofil gelöscht. Eine unabhängige Nachprüfung fand danach keine
+synthetischen Konten oder über deren Bearbeiterkennung auffindbaren Plan- und
+Bemerkungsdaten. Nicht Bestandteil dieses Laufs war das Umschalten von
+OrgSuite oder optionalen Provider-Apps.
diff --git a/js/admin.js b/js/admin.js
index bbaf31a..a6f299a 100644
--- a/js/admin.js
+++ b/js/admin.js
@@ -7,13 +7,13 @@
     const client = new window.LocalBase.api.ApiClient({ appId: 'adplaner' });
     confirmation.addEventListener('change', () => { button.disabled = !confirmation.checked; });
     button.addEventListener('click', async () => {
-        if (!confirmation.checked) return;
+        if (!confirmation.checked || button.disabled) return;
         button.disabled = true;
         notice.hidden = false;
         notice.className = 'adp-admin-notice';
         notice.textContent = 'Demo-Pack wird geprüft und installiert …';
         try {
-            const response = await client.request('/api/admin/demo-pack/install', { method: 'POST', body: '{}' });
+            const response = await client.request('/api/admin/demo-pack/install', { method: 'POST', body: '{"confirmed":true}' });
             notice.classList.add('is-success');
             notice.textContent = `${response.result.teams.join(', ')} wurden als Demoteams angelegt.`;
             confirmation.checked = false;
diff --git a/js/components/assignment-control.js b/js/components/assignment-control.js
index c17b9f9..4829b9c 100644
--- a/js/components/assignment-control.js
+++ b/js/components/assignment-control.js
@@ -6,22 +6,20 @@
         const assistants = (team.assistants || []).filter(assistant => {
             return assistant.canReceiveShifts !== false && !assigned.has(assistant.uid);
         });
+        const pickerId = `adp-assignment-picker-${esc(slot.id)}`;
 
         return `
             <span class="adp-assignment-control" data-assignment-control="${esc(slot.id)}">
-                <button type="button" class="adp-small adp-icon-button" title="Assistenz zuteilen" data-action="open-assignment-picker" data-slot-id="${esc(slot.id)}">+</button>
-                <span class="adp-assignment-picker" data-assignment-picker="${esc(slot.id)}" hidden>
-                    <select data-add-select="${esc(slot.id)}" ${assistants.length === 0 ? 'disabled' : ''}>
-                        ${assistants.map(option).join('')}
-                    </select>
-                    <button type="button" class="adp-small adp-icon-button" title="Zuteilen" data-action="add-selected" data-slot-id="${esc(slot.id)}" ${assistants.length === 0 ? 'disabled' : ''}>&#10003;</button>
+                <button type="button" class="adp-small adp-icon-button" aria-label="Assistenz zuteilen" aria-controls="${pickerId}" aria-expanded="false" data-action="open-assignment-picker" data-assignment-trigger="${esc(slot.id)}" data-slot-id="${esc(slot.id)}" ${assistants.length === 0 ? 'disabled' : ''}>+</button>
+                <span id="${pickerId}" class="adp-assignment-picker" role="group" aria-label="Assistenz auswählen" data-assignment-picker="${esc(slot.id)}" hidden>
+                    ${assistants.length === 0 ? '<span>Keine Assistenz verfügbar</span>' : assistants.map(assistant => option(assistant, slot.id)).join('')}
                 </span>
             </span>
         `;
     }
 
-    function option(assistant) {
-        return `<option value="${esc(assistant.uid)}">${esc(assistant.displayName || assistant.uid)}</option>`;
+    function option(assistant, slotId) {
+        return `<button type="button" class="adp-small" data-action="add-selected" data-slot-id="${esc(slotId)}" data-target-uid="${esc(assistant.uid)}">${esc(assistant.displayName || assistant.uid)}</button>`;
     }
 
     function open(button) {
@@ -30,14 +28,33 @@
             return;
         }
 
-        document.querySelectorAll('[data-assignment-picker]').forEach(picker => {
-            picker.hidden = picker.dataset.assignmentPicker !== slotId;
+        const picker = document.querySelector(`[data-assignment-picker="${CSS.escape(slotId)}"]`);
+        const shouldOpen = !!picker && picker.hidden;
+        document.querySelectorAll('[data-assignment-picker]').forEach(candidate => {
+            candidate.hidden = true;
+        });
+        document.querySelectorAll('[data-assignment-trigger]').forEach(trigger => {
+            trigger.setAttribute('aria-expanded', 'false');
         });
+        if (!shouldOpen) {
+            return;
+        }
 
-        const picker = document.querySelector(`[data-assignment-picker="${CSS.escape(slotId)}"]`);
-        const select = picker ? picker.querySelector('select') : null;
-        if (select) {
-            select.focus();
+        picker.hidden = false;
+        button.setAttribute('aria-expanded', 'true');
+        if (!picker.dataset.escapeBound) {
+            picker.addEventListener('keydown', event => {
+                if (event.key !== 'Escape') return;
+                event.preventDefault();
+                picker.hidden = true;
+                button.setAttribute('aria-expanded', 'false');
+                button.focus();
+            });
+            picker.dataset.escapeBound = 'true';
+        }
+        const firstOption = picker ? picker.querySelector('button[data-action="add-selected"]') : null;
+        if (firstOption) {
+            firstOption.focus();
         }
     }
 
diff --git a/js/components/candidate-chip.js b/js/components/candidate-chip.js
index b937c79..c780b8d 100644
--- a/js/components/candidate-chip.js
+++ b/js/components/candidate-chip.js
@@ -1,13 +1,14 @@
 (function() {
     const { esc } = window.ADPlaner.ui;
 
-    function render(candidate, canCoordinate, slotId) {
-        const removable = canCoordinate || candidate.isSelf;
+    function render(candidate, canCoordinate, slotId, mutable = true) {
+        const removable = mutable && (canCoordinate || candidate.isSelf);
+        const displayName = candidate.displayName || candidate.uid;
 
         return `
             <span class="adp-chip">
-                ${esc(candidate.displayName || candidate.uid)}
-                ${removable ? `<button type="button" title="Entfernen" data-action="remove-candidate" data-slot-id="${esc(slotId)}" data-target-uid="${esc(candidate.uid)}">x</button>` : ''}
+                ${esc(displayName)}
+                ${removable ? `<button type="button" aria-label="${esc(displayName)} entfernen" data-action="remove-candidate" data-slot-id="${esc(slotId)}" data-target-uid="${esc(candidate.uid)}">&times;</button>` : ''}
             </span>
         `;
     }
diff --git a/js/components/day-note-control.js b/js/components/day-note-control.js
index e969f27..192a5d8 100644
--- a/js/components/day-note-control.js
+++ b/js/components/day-note-control.js
@@ -1,5 +1,5 @@
 (function() {
-    const { esc } = window.ADPlaner.ui;
+    const { esc, dateShort } = window.ADPlaner.ui;
 
     function render(day, canCoordinate) {
         if (!canCoordinate) {
@@ -7,8 +7,8 @@
         }
 
         return `
-            <textarea rows="2" data-note-date="${esc(day.date)}">${esc(day.note || '')}</textarea>
-            <button type="button" class="adp-small adp-icon-button" title="Bemerkung speichern" data-action="save-note" data-date="${esc(day.date)}">&#10003;</button>
+            <textarea rows="2" maxlength="2000" aria-label="Bemerkung für ${esc(dateShort(day.date))}" data-note-date="${esc(day.date)}">${esc(day.note || '')}</textarea>
+            <button type="button" class="adp-small adp-icon-button" aria-label="Bemerkung für ${esc(dateShort(day.date))} speichern" data-action="save-note" data-date="${esc(day.date)}">&#10003;</button>
         `;
     }
 
diff --git a/js/components/month-plan.js b/js/components/month-plan.js
index 3aef0f5..7787032 100644
--- a/js/components/month-plan.js
+++ b/js/components/month-plan.js
@@ -12,24 +12,29 @@
         const team = plan.team;
         const segments = plan.segments || [];
         const canCoordinate = !!team.canCoordinate;
+        const status = typeof plan.status === 'string' ? plan.status : '';
+        const mutable = status === 'draft' || status === 'planned';
 
         return `
             <section class="adp-section">
                 <div class="adp-section-head">
                     <h2>${esc(team.displayName || team.code)} - ${esc(plan.month)}</h2>
-                    ${team.settings && team.settings.meetingDay ? `<span class="adp-badge">Treffen ${esc(dateShort(team.settings.meetingDay))}</span>` : ''}
+                    <div class="adp-plan-meta">
+                        ${team.settings && team.settings.meetingDay ? `<span class="adp-badge">Treffen ${esc(dateShort(team.settings.meetingDay))}</span>` : ''}
+                        ${renderStatus(status, canCoordinate)}
+                    </div>
                 </div>
                 <div class="adp-table-wrap">
                     <table class="adp-table adp-month-table">
                         <thead>
                             <tr>
-                                <th>Tag</th>
-                                ${segments.map(segment => `<th>${esc(segment.label)}<small>${esc(segment.startsAt)}-${esc(segment.endsAt)}</small></th>`).join('')}
-                                <th>Bemerkungen</th>
+                                <th scope="col">Tag</th>
+                                ${segments.map(segment => `<th scope="col">${esc(segment.label)}<small>${esc(segment.startsAt)}-${esc(segment.endsAt)}</small></th>`).join('')}
+                                <th scope="col">Bemerkungen</th>
                             </tr>
                         </thead>
                         <tbody>
-                            ${(plan.days || []).map(day => dayRow(day, segments, team, currentUser, canCoordinate)).join('')}
+                            ${(plan.days || []).map(day => dayRow(day, segments, team, currentUser, canCoordinate, mutable)).join('')}
                         </tbody>
                     </table>
                 </div>
@@ -37,7 +42,20 @@
         `;
     }
 
-    function dayRow(day, segments, team, currentUser, canCoordinate) {
+    function renderStatus(status, canCoordinate) {
+        const labels = { draft: 'Entwurf', planned: 'Geplant', approved: 'Genehmigt' };
+        const actions = {
+            draft: [['planned', 'Als geplant festschreiben']],
+            planned: [['draft', 'Auf Entwurf zurücksetzen'], ['approved', 'Genehmigen']],
+            approved: [['planned', 'Genehmigung aufheben']],
+        };
+        return `<div class="adp-plan-status" data-plan-status="${esc(status)}">
+            <span class="adp-badge">Status: ${esc(labels[status] || status)}</span>
+            ${canCoordinate ? (actions[status] || []).map(([target, label]) => `<button type="button" class="adp-small" data-action="transition-status" data-target-status="${esc(target)}">${esc(label)}</button>`).join('') : ''}
+        </div>`;
+    }
+
+    function dayRow(day, segments, team, currentUser, canCoordinate, mutable) {
         const slotsByKey = {};
         (day.slots || []).forEach(slot => {
             slotsByKey[slot.segmentKey] = slot;
@@ -45,14 +63,21 @@
 
         return `
             <tr>
-                <th class="adp-day">${dayHeader(day)}<small>${esc(dateShort(day.date))}</small></th>
-                ${segments.map(segment => slotCell(slotsByKey[segment.key], team, currentUser, canCoordinate)).join('')}
-                <td class="adp-note-cell">${renderDayNoteControl(day, canCoordinate)}</td>
+                <th scope="row" class="adp-day">${dayHeader(day)}<small>${esc(dateShort(day.date))}</small>${renderHints(day.hints || [])}</th>
+                ${segments.map(segment => slotCell(slotsByKey[segment.key], team, currentUser, canCoordinate, mutable)).join('')}
+                <td class="adp-note-cell">${renderDayNoteControl(day, canCoordinate && mutable)}</td>
             </tr>
         `;
     }
 
-    function slotCell(slot, team, currentUser, canCoordinate) {
+    function renderHints(hints) {
+        if (!hints.length) return '';
+        return `<div class="adp-day-hints" aria-label="Planungshinweise">${hints.map(hint =>
+            `<span class="adp-hint" title="${esc(hint.label || 'Hinweis')}">${esc(hint.marker || '•')} ${esc(hint.displayName || hint.employeeUid || '')}</span>`
+        ).join('')}</div>`;
+    }
+
+    function slotCell(slot, team, currentUser, canCoordinate, mutable) {
         if (!slot) {
             return '<td class="adp-empty"></td>';
         }
@@ -60,18 +85,18 @@
         const candidates = slot.candidates || [];
         const selfUid = currentUser && currentUser.uid ? currentUser.uid : '';
         const hasSelf = candidates.some(candidate => candidate.uid === selfUid);
-        const selfAction = !canCoordinate && !hasSelf
+        const selfAction = mutable && !canCoordinate && !hasSelf
             ? `<button type="button" class="adp-small" data-action="add-self" data-slot-id="${esc(slot.id)}">+ ich</button>`
             : '';
 
         return `
             <td>
                 <div class="adp-candidates">
-                    ${candidates.map(candidate => renderCandidateChip(candidate, canCoordinate, slot.id)).join('')}
+                    ${candidates.map(candidate => renderCandidateChip(candidate, canCoordinate, slot.id, mutable)).join('')}
                 </div>
                 <div class="adp-cell-actions">
                     ${selfAction}
-                    ${canCoordinate ? renderAssignmentControl(slot, team, candidates) : ''}
+                    ${canCoordinate && mutable ? renderAssignmentControl(slot, team, candidates) : ''}
                 </div>
             </td>
         `;
diff --git a/js/components/plan-chrome.js b/js/components/plan-chrome.js
index 343fbac..b3ef712 100644
--- a/js/components/plan-chrome.js
+++ b/js/components/plan-chrome.js
@@ -11,11 +11,23 @@
             this.onViewChange = options.onViewChange;
             this.teamSelect = this.byId('team-select');
             this.monthInput = this.byId('month-input');
+            this.monthPrevious = this.byId('month-prev');
+            this.monthNext = this.byId('month-next');
             this.panel = this.byId('adp-panel');
+            this.currentMonth = '';
             this.tabs = document.querySelector('.adp-tabs');
             this.tabButtons = Array.from(document.querySelectorAll('.adp-tab'));
             this.teamSelect.addEventListener('change', event => this.onTeamChange(event.target.value));
-            this.monthInput.addEventListener('change', event => this.onMonthChange(event.target.value));
+            this.monthInput.addEventListener('change', event => {
+                const value = event.target.value;
+                if (!this.isValidMonth(value)) {
+                    event.target.value = this.currentMonth;
+                    return;
+                }
+                return this.onMonthChange(value);
+            });
+            this.monthPrevious.addEventListener('click', () => this.changeMonthBy(-1));
+            this.monthNext.addEventListener('click', () => this.changeMonthBy(1));
             this.tabs.addEventListener('click', event => {
                 const button = event.target instanceof Element ? event.target.closest('button[data-view]') : null;
                 if (button) return this.onViewChange(button.dataset.view || 'month');
@@ -37,13 +49,36 @@
             });
         }
 
+        offsetMonth(month, delta) {
+            const match = /^(\d{4})-(\d{2})$/.exec(month || '');
+            if (!match) return month;
+            const value = new Date(Date.UTC(Number(match[1]), Number(match[2]) - 1 + delta, 1));
+            return `${value.getUTCFullYear()}-${String(value.getUTCMonth() + 1).padStart(2, '0')}`;
+        }
+
+        isValidMonth(month) {
+            const match = /^(\d{4})-(0[1-9]|1[0-2])$/.exec(month || '');
+            if (!match) return false;
+            const year = Number(match[1]);
+            return year >= 2000 && year <= 2100;
+        }
+
+        changeMonthBy(delta) {
+            const target = this.offsetMonth(this.monthInput.value, delta);
+            if (!this.isValidMonth(target)) return;
+            return this.onMonthChange(target);
+        }
+
         render(state) {
             this.teamSelect.innerHTML = state.teams.map(team => {
                 const selected = team.code === state.selectedTeamCode ? ' selected' : '';
                 return `<option value="${this.esc(team.code)}"${selected}>${this.esc(team.displayName || team.code)}</option>`;
             }).join('');
             this.teamSelect.disabled = state.teams.length === 0;
+            this.currentMonth = state.month;
             this.monthInput.value = state.month;
+            this.monthPrevious.disabled = state.month === '2000-01';
+            this.monthNext.disabled = state.month === '2100-12';
             let activeTabId = '';
             this.tabButtons.forEach(button => {
                 const active = button.dataset.view === state.activeView;
diff --git a/js/components/settings-panel.js b/js/components/settings-panel.js
index 5d5d51c..7147fb1 100644
--- a/js/components/settings-panel.js
+++ b/js/components/settings-panel.js
@@ -32,7 +32,7 @@
                     <h2>${esc(team.displayName || team.code)}</h2>
                 </div>
                 <form id="settings-form" class="adp-settings-form">
-                    <label>Anzeigename <input name="displayName" type="text" maxlength="255" value="${esc(team.displayName || team.code)}"></label>
+                    <label>Anzeigename <input name="displayName" type="text" maxlength="255" required value="${esc(team.displayName || team.code)}"></label>
                     <label>Assistentinnentreffen <input name="meetingDay" type="date" value="${esc(settings.meetingDay || '')}"></label>
                     <fieldset>
                         <legend>Schichten</legend>
diff --git a/js/components/shift-settings-list.js b/js/components/shift-settings-list.js
index 9c4fa5a..5f81851 100644
--- a/js/components/shift-settings-list.js
+++ b/js/components/shift-settings-list.js
@@ -34,7 +34,7 @@
                 <label>Von <input name="shiftStart" type="time" required value="${esc(shift.startsAt || '08:00')}"></label>
                 <label>Bis <input name="shiftEnd" type="time" required value="${esc(shift.endsAt || '14:00')}"></label>
                 <label class="adp-check"><input name="shiftEnabled" type="checkbox" ${shift.enabled === false ? '' : 'checked'}> aktiv</label>
-                <button type="button" class="adp-small" title="Schicht entfernen" data-action="remove-shift-row">x</button>
+                <button type="button" class="adp-small" aria-label="Schicht ${esc(shift.label || ('Schicht ' + (index + 1)))} entfernen" data-action="remove-shift-row">&times;</button>
             </div>
         `;
     }
diff --git a/js/models/shift-candidate.js b/js/models/shift-candidate.js
index e5cf894..96f3df5 100644
--- a/js/models/shift-candidate.js
+++ b/js/models/shift-candidate.js
@@ -11,8 +11,6 @@
             this.assistantUid = data.assistantUid || data.assistant_uid || data.uid || '';
             this.uid = this.assistantUid;
             this.displayName = data.displayName || data.display_name || this.uid;
-            this.createdByUid = data.createdByUid || data.created_by_uid || '';
-            this.createdAt = data.createdAt || data.created_at || '';
             this.isSelf = !!(data.isSelf ?? data.is_self ?? false);
         }
 
@@ -23,8 +21,6 @@
                 assistantUid: this.assistantUid,
                 uid: this.uid,
                 displayName: this.displayName,
-                createdByUid: this.createdByUid,
-                createdAt: this.createdAt,
                 isSelf: this.isSelf
             };
         }
diff --git a/js/modules/plan-app.js b/js/modules/plan-app.js
index 53b43d2..64b1a79 100644
--- a/js/modules/plan-app.js
+++ b/js/modules/plan-app.js
@@ -10,6 +10,8 @@
             this.repository = options.repository;
             this.showNotice = options.showNotice;
             this.showError = options.showError;
+            this.loadVersion = 0;
+            this.settingsSaving = false;
             this.state = { currentUser: null, teams: [], selectedTeamCode: '', month: '', activeView: 'month', monthPlan: null, organization: {}, loading: false };
             this.chrome = new options.PlanChrome({
                 byId: options.byId, esc: options.esc,
@@ -55,52 +57,104 @@
         }
 
         async reloadActive() {
+            const loadVersion = ++this.loadVersion;
             this.state.loading = true; this.render(); this.showNotice('');
             try {
-                if (this.state.activeView === 'settings') this.applyState(await this.repository.state());
-                else await this.loadMonth();
-            } catch (error) { this.showError(error, 'Ansicht konnte nicht geladen werden.'); }
-            finally { this.state.loading = false; this.render(); }
+                if (this.state.activeView === 'settings') {
+                    const data = await this.repository.state();
+                    if (loadVersion === this.loadVersion) this.applyState(data);
+                } else {
+                    await this.loadMonth(loadVersion);
+                }
+            } catch (error) {
+                if (loadVersion === this.loadVersion) this.showError(error, 'Ansicht konnte nicht geladen werden.');
+            } finally {
+                if (loadVersion === this.loadVersion) {
+                    this.state.loading = false;
+                    this.render();
+                }
+            }
         }
 
-        async loadMonth() {
-            this.state.monthPlan = await this.repository.monthPlan(this.state.selectedTeamCode, this.state.month);
-            const updatedTeam = this.state.monthPlan.team;
+        async loadMonth(loadVersion = ++this.loadVersion) {
+            const teamCode = this.state.selectedTeamCode;
+            const month = this.state.month;
+            const monthPlan = await this.repository.monthPlan(teamCode, month);
+            if (loadVersion !== this.loadVersion || teamCode !== this.state.selectedTeamCode || month !== this.state.month || this.state.activeView !== 'month') {
+                return false;
+            }
+            this.state.monthPlan = monthPlan;
+            const updatedTeam = monthPlan.team;
             this.state.teams = this.state.teams.map(team => team.code === updatedTeam.code ? updatedTeam : team);
+            return true;
         }
 
         async selectTeam(value) { this.state.selectedTeamCode = value; this.state.monthPlan = null; await this.reloadActive(); }
-        async selectMonth(value) { this.state.month = value; if (this.state.activeView === 'month') await this.reloadActive(); }
+        async selectMonth(value) {
+            this.state.month = value;
+            this.state.monthPlan = null;
+            if (this.state.activeView === 'month') await this.reloadActive();
+        }
         async selectView(value) { this.state.activeView = value; this.render(); await this.reloadActive(); }
 
         async handleAction(button) {
+            if (button.disabled) return;
+            button.disabled = true;
+            let mutationCompleted = false;
             try {
                 const action = button.dataset.action;
                 const team = this.state.selectedTeamCode; const month = this.state.month; const slot = button.dataset.slotId;
                 if (action === 'add-self') await this.repository.addSelf(team, month, slot);
                 else if (action === 'add-selected') {
-                    const select = this.panel.panel.querySelector(`select[data-add-select="${CSS.escape(slot)}"]`);
-                    if (!select || select.disabled || !select.value) return;
-                    await this.repository.addSelected(team, month, slot, select.value);
+                    const targetUid = button.dataset.targetUid || '';
+                    if (!targetUid) return;
+                    await this.repository.addSelected(team, month, slot, targetUid);
                 } else if (action === 'remove-candidate') await this.repository.removeCandidate(team, month, slot, button.dataset.targetUid || '');
+                else if (action === 'transition-status') await this.repository.transitionStatus(team, month, button.dataset.targetStatus || '');
                 else if (action === 'save-note') {
                     const textarea = this.panel.panel.querySelector(`textarea[data-note-date="${CSS.escape(button.dataset.date)}"]`);
                     await this.repository.saveDayNote(team, month, button.dataset.date, textarea ? textarea.value : '');
                 } else return;
+                mutationCompleted = true;
+                this.state.monthPlan = null;
                 await this.loadMonth();
-            } catch (error) { this.showError(error, 'Aktion konnte nicht ausgeführt werden.'); }
-            finally { this.panel.render(this.state, this.selectedTeam()); }
+            } catch (error) {
+                this.showError(
+                    error,
+                    mutationCompleted
+                        ? 'Die Änderung wurde gespeichert, aber der Monatsplan konnte nicht neu geladen werden.'
+                        : 'Aktion konnte nicht ausgeführt werden.'
+                );
+            }
+            finally {
+                button.disabled = false;
+                this.panel.render(this.state, this.selectedTeam());
+            }
         }
 
         async saveSettings(values) {
+            if (this.settingsSaving) return;
+            this.settingsSaving = true;
+            let mutationCompleted = false;
             try {
                 if (values.shifts.length === 0) throw new Error('Mindestens eine Schicht muss konfiguriert sein.');
                 await this.repository.saveSettings(this.state.selectedTeamCode, values.displayName, values.meetingDay, values.shifts);
+                mutationCompleted = true;
+                this.state.monthPlan = null;
                 this.applyState(await this.repository.state());
                 this.state.activeView = 'month';
                 await this.loadMonth();
-                this.render();
-            } catch (error) { this.showError(error, 'Einstellungen konnten nicht gespeichert werden.'); }
+            } catch (error) {
+                this.showError(
+                    error,
+                    mutationCompleted
+                        ? 'Die Einstellungen wurden gespeichert, aber die Ansicht konnte nicht neu geladen werden.'
+                        : 'Einstellungen konnten nicht gespeichert werden.'
+                );
+            } finally {
+                this.settingsSaving = false;
+                if (mutationCompleted) this.render();
+            }
         }
     }
 
diff --git a/js/repositories/plan-repository.js b/js/repositories/plan-repository.js
index ba239e3..9d6e267 100644
--- a/js/repositories/plan-repository.js
+++ b/js/repositories/plan-repository.js
@@ -38,6 +38,12 @@
             });
         }
 
+        transitionStatus(teamCode, month, targetStatus) {
+            return this.post(this.teamPath(teamCode) + '/months/' + this.encode(month) + '/status', {
+                targetStatus
+            });
+        }
+
         saveSettings(teamCode, displayName, meetingDay, shifts) {
             return this.post(this.teamPath(teamCode) + '/settings', {
                 displayName,
diff --git a/lib/Controller/ApiController.php b/lib/Controller/ApiController.php
index b103b91..e35bb33 100644
--- a/lib/Controller/ApiController.php
+++ b/lib/Controller/ApiController.php
@@ -55,6 +55,25 @@ public function monthPlan(string $teamCode, string $month): DataResponse {
         }, [$this->logger, 'error'], 'month_plan', ['team_code' => $teamCode, 'month' => $month]);
     }
 
+    #[NoAdminRequired]
+    public function transitionMonthStatus(string $teamCode, string $month, string $targetStatus): DataResponse {
+        return $this->responder->respond(function () use ($teamCode, $month, $targetStatus): array {
+            $team = $this->teamAccess->assertCanCoordinate($teamCode);
+            $status = $this->scheduleService->transitionMonthStatus(
+                $team,
+                $month,
+                $targetStatus,
+                $this->teamAccess->currentUserId()
+            );
+
+            return ['ok' => true, 'status' => $status];
+        }, [$this->logger, 'error'], 'transition_month_status', [
+            'team_code' => $teamCode,
+            'month' => $month,
+            'target_status' => $targetStatus,
+        ]);
+    }
+
     #[NoAdminRequired]
     public function saveTeamSettings(
         string $teamCode,
@@ -79,9 +98,9 @@ public function saveTeamSettings(
 
     #[NoAdminRequired]
     public function saveDayNote(string $teamCode, string $month, string $workDate, string $note = ''): DataResponse {
-        return $this->responder->respond(function () use ($teamCode, $workDate, $note): array {
+        return $this->responder->respond(function () use ($teamCode, $month, $workDate, $note): array {
             $team = $this->teamAccess->assertCanCoordinate($teamCode);
-            $this->scheduleService->saveDayNote($team, $workDate, $note, $this->teamAccess->currentUserId());
+            $this->scheduleService->saveDayNote($team, $month, $workDate, $note, $this->teamAccess->currentUserId());
 
             return ['ok' => true];
         }, [$this->logger, 'error'], 'save_day_note', [
diff --git a/lib/Controller/DemoAdminController.php b/lib/Controller/DemoAdminController.php
index a4a6d70..66f47f4 100644
--- a/lib/Controller/DemoAdminController.php
+++ b/lib/Controller/DemoAdminController.php
@@ -17,13 +17,14 @@
 /** Zweck: Startet den Assistenzplaner-Demo-Pack ausschließlich mit Admin- und CSRF-Schutz. */
 final class DemoAdminController extends Controller {
     public function __construct(IRequest $request, private IUserSession $session, private IGroupManager $groups, private PlanerDemoPackService $demoPack, private LoggerInterface $logger) { parent::__construct(Application::APP_ID, $request); }
-    public function install(): JSONResponse {
+    public function install(mixed $confirmed = false): JSONResponse {
         if (!$this->isAdmin()) return new JSONResponse(['error' => 'Keine Berechtigung.'], Http::STATUS_FORBIDDEN);
+        if ($confirmed !== true) return new JSONResponse(['error' => 'Die Installation muss ausdrücklich bestätigt werden.'], Http::STATUS_BAD_REQUEST);
         try {
             return new JSONResponse(['result' => $this->demoPack->install()]);
         } catch (\Throwable $error) {
             $this->logger->error('Assistenzplaner-Demo-Pack konnte nicht installiert werden.', ['exception' => $error]);
-            return new JSONResponse(['error' => $error->getMessage()], Http::STATUS_BAD_REQUEST);
+            return new JSONResponse(['error' => 'Demo-Daten konnten nicht installiert werden.'], Http::STATUS_INTERNAL_SERVER_ERROR);
         }
     }
     private function isAdmin(): bool {
diff --git a/lib/Migration/Version000003Date202608080001.php b/lib/Migration/Version000003Date202608080001.php
new file mode 100644
index 0000000..f022266
--- /dev/null
+++ b/lib/Migration/Version000003Date202608080001.php
@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\AdPlaner\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\DB\Types;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+final class Version000003Date202608080001 extends SimpleMigrationStep {
+    public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+        /** @var ISchemaWrapper $schema */
+        $schema = $schemaClosure();
+        if ($schema->hasTable('adp_month_plans')) {
+            return $schema;
+        }
+
+        $table = $schema->createTable('adp_month_plans');
+        $table->addColumn('id', Types::BIGINT, ['autoincrement' => true, 'notnull' => true]);
+        $table->addColumn('team_code', Types::STRING, ['notnull' => true, 'length' => 16]);
+        $table->addColumn('plan_month', Types::STRING, ['notnull' => true, 'length' => 7]);
+        $table->addColumn('status', Types::STRING, ['notnull' => true, 'length' => 16, 'default' => 'draft']);
+        $table->addColumn('updated_by_uid', Types::STRING, ['notnull' => true, 'length' => 64]);
+        $table->addColumn('updated_at', Types::DATETIME, ['notnull' => true]);
+        $table->setPrimaryKey(['id']);
+        $table->addUniqueIndex(['team_code', 'plan_month'], 'adp_month_plan_unique');
+
+        return $schema;
+    }
+}
diff --git a/lib/Migration/Version000004Date202608090001.php b/lib/Migration/Version000004Date202608090001.php
new file mode 100644
index 0000000..9eb9e82
--- /dev/null
+++ b/lib/Migration/Version000004Date202608090001.php
@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\AdPlaner\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\DB\Types;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+final class Version000004Date202608090001 extends SimpleMigrationStep {
+    public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+        /** @var ISchemaWrapper $schema */
+        $schema = $schemaClosure();
+        if (!$schema->hasTable('adp_month_plans')) {
+            return $schema;
+        }
+
+        $table = $schema->getTable('adp_month_plans');
+        if ($table->hasColumn('revision')) {
+            return $schema;
+        }
+
+        $table->addColumn('revision', Types::INTEGER, [
+            'notnull' => true,
+            'default' => 0,
+        ]);
+
+        return $schema;
+    }
+}
diff --git a/lib/Model/Assistant.php b/lib/Model/Assistant.php
index 6e6e64a..ca21af4 100644
--- a/lib/Model/Assistant.php
+++ b/lib/Model/Assistant.php
@@ -28,10 +28,11 @@ protected static function fromArray(array $assistant): self {
 
     public static function fromUser($user, bool $isEb): self {
         $uid = $user->getUID();
+        $displayName = (string)$user->getDisplayName();
 
         return new self(
             $uid,
-            $user->getDisplayName() ?: $uid,
+            $displayName === '' ? $uid : $displayName,
             $isEb,
             !$isEb
         );
diff --git a/lib/Model/ShiftCandidate.php b/lib/Model/ShiftCandidate.php
index 9c625b9..7300ae8 100644
--- a/lib/Model/ShiftCandidate.php
+++ b/lib/Model/ShiftCandidate.php
@@ -37,7 +37,6 @@ public function toArray(array $assistantLabels = [], string $currentUid = ''): a
             'id' => $this->id,
             'uid' => $this->assistantUid,
             'displayName' => $assistantLabels[$this->assistantUid] ?? ($this->displayName !== '' ? $this->displayName : $this->assistantUid),
-            'createdByUid' => $this->createdByUid,
             'isSelf' => $this->isSelf || $this->assistantUid === $currentUid,
         ];
     }
diff --git a/lib/Model/Team.php b/lib/Model/Team.php
index 73b74fa..c7444c0 100644
--- a/lib/Model/Team.php
+++ b/lib/Model/Team.php
@@ -48,7 +48,13 @@ public function assistants(): array {
     }
 
     public function assistantsArray(): array {
-        return array_map(static fn(Assistant $assistant): array => $assistant->toArray(), $this->assistants);
+        return array_values(array_map(
+            static fn(Assistant $assistant): array => $assistant->toArray(),
+            array_filter(
+                $this->assistants,
+                static fn(Assistant $assistant): bool => $assistant->canReceiveShifts
+            )
+        ));
     }
 
     public function assistantLabelMap(): array {
diff --git a/lib/Repository/ShiftPlanRepository.php b/lib/Repository/ShiftPlanRepository.php
index 06d70a3..bf9b27c 100644
--- a/lib/Repository/ShiftPlanRepository.php
+++ b/lib/Repository/ShiftPlanRepository.php
@@ -5,6 +5,7 @@
 namespace OCA\AdPlaner\Repository;
 
 use DateTimeImmutable;
+use OCP\DB\Exception;
 use OCP\DB\QueryBuilder\IQueryBuilder;
 use OCP\IDBConnection;
 
@@ -14,6 +15,25 @@ public function __construct(
     ) {
     }
 
+    public function transactional(callable $operation): mixed {
+        if ($this->db->inTransaction()) {
+            return $operation();
+        }
+
+        $this->db->beginTransaction();
+        try {
+            $result = $operation();
+            $this->db->commit();
+
+            return $result;
+        } catch (\Throwable $exception) {
+            if ($this->db->inTransaction()) {
+                $this->db->rollBack();
+            }
+            throw $exception;
+        }
+    }
+
     public function findSlotsForMonth(string $teamCode, string $month): array {
         $qb = $this->db->getQueryBuilder();
         $qb->select('*')
@@ -117,7 +137,13 @@ public function addCandidate(int $slotId, string $assistantUid, string $createdB
                 'created_by_uid' => $qb->createNamedParameter($createdByUid),
                 'created_at' => $qb->createNamedParameter(new DateTimeImmutable(), IQueryBuilder::PARAM_DATETIME_IMMUTABLE),
             ]);
-        $qb->executeStatement();
+        try {
+            $qb->executeStatement();
+        } catch (Exception $exception) {
+            if ($exception->getReason() !== Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
+                throw $exception;
+            }
+        }
     }
 
     public function removeCandidate(int $slotId, string $assistantUid): void {
@@ -161,8 +187,14 @@ public function saveDayNote(string $teamCode, string $workDate, string $note, st
                     'updated_by_uid' => $qb->createNamedParameter($updatedByUid),
                     'updated_at' => $qb->createNamedParameter($now, IQueryBuilder::PARAM_DATETIME_IMMUTABLE),
                 ]);
-            $qb->executeStatement();
-            return;
+            try {
+                $qb->executeStatement();
+                return;
+            } catch (Exception $exception) {
+                if ($exception->getReason() !== Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
+                    throw $exception;
+                }
+            }
         }
 
         $qb = $this->db->getQueryBuilder();
@@ -175,6 +207,114 @@ public function saveDayNote(string $teamCode, string $workDate, string $note, st
         $qb->executeStatement();
     }
 
+    public function deleteDayNote(string $teamCode, string $workDate): void {
+        $qb = $this->db->getQueryBuilder();
+        $qb->delete('adp_day_notes')
+            ->where($qb->expr()->eq('team_code', $qb->createNamedParameter($teamCode)))
+            ->andWhere($qb->expr()->eq('work_date', $qb->createNamedParameter($workDate)));
+        $qb->executeStatement();
+    }
+
+    public function monthStatus(string $teamCode, string $month): ?string {
+        $qb = $this->db->getQueryBuilder();
+        $qb->select('status')
+            ->from('adp_month_plans')
+            ->where($qb->expr()->eq('team_code', $qb->createNamedParameter($teamCode)))
+            ->andWhere($qb->expr()->eq('plan_month', $qb->createNamedParameter($month)));
+        $row = $qb->executeQuery()->fetchAssociative();
+
+        return $row === false ? null : (string)$row['status'];
+    }
+
+    public function ensureMonthStatus(string $teamCode, string $month, string $updatedByUid): void {
+        if ($this->monthStatus($teamCode, $month) !== null) {
+            return;
+        }
+
+        $qb = $this->db->getQueryBuilder();
+        $qb->insert('adp_month_plans')->values([
+            'team_code' => $qb->createNamedParameter($teamCode),
+            'plan_month' => $qb->createNamedParameter($month),
+            'status' => $qb->createNamedParameter('draft'),
+            'revision' => $qb->createNamedParameter(0, IQueryBuilder::PARAM_INT),
+            'updated_by_uid' => $qb->createNamedParameter($updatedByUid),
+            'updated_at' => $qb->createNamedParameter(new DateTimeImmutable(), IQueryBuilder::PARAM_DATETIME_IMMUTABLE),
+        ]);
+
+        try {
+            $qb->executeStatement();
+        } catch (Exception $exception) {
+            if ($exception->getReason() !== Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
+                throw $exception;
+            }
+        }
+    }
+
+    public function lockMonthStatus(
+        string $teamCode,
+        string $month,
+        array $expectedStatuses
+    ): ?string {
+        $expectedStatuses = array_values(array_unique(array_map('strval', $expectedStatuses)));
+        if ($expectedStatuses === []) {
+            return null;
+        }
+
+        $qb = $this->db->getQueryBuilder();
+        $statusConditions = array_map(
+            fn(string $status) => $qb->expr()->eq('status', $qb->createNamedParameter($status)),
+            $expectedStatuses
+        );
+        $qb->update('adp_month_plans')
+            ->set('revision', $qb->createFunction('revision + 1'))
+            ->where($qb->expr()->eq('team_code', $qb->createNamedParameter($teamCode)))
+            ->andWhere($qb->expr()->eq('plan_month', $qb->createNamedParameter($month)))
+            ->andWhere($qb->expr()->orX(...$statusConditions));
+
+        if ($qb->executeStatement() !== 1) {
+            return null;
+        }
+
+        return $this->monthStatus($teamCode, $month);
+    }
+
+    public function transitionMonthStatus(
+        string $teamCode,
+        string $month,
+        string $expectedStatus,
+        string $targetStatus,
+        string $updatedByUid
+    ): bool {
+        $now = new DateTimeImmutable();
+        if ($this->monthStatus($teamCode, $month) === null) {
+            if ($expectedStatus !== 'draft') {
+                return false;
+            }
+            $qb = $this->db->getQueryBuilder();
+            $qb->insert('adp_month_plans')->values([
+                'team_code' => $qb->createNamedParameter($teamCode),
+                'plan_month' => $qb->createNamedParameter($month),
+                'status' => $qb->createNamedParameter($targetStatus),
+                'revision' => $qb->createNamedParameter(0, IQueryBuilder::PARAM_INT),
+                'updated_by_uid' => $qb->createNamedParameter($updatedByUid),
+                'updated_at' => $qb->createNamedParameter($now, IQueryBuilder::PARAM_DATETIME_IMMUTABLE),
+            ]);
+
+            return $qb->executeStatement() === 1;
+        }
+
+        $qb = $this->db->getQueryBuilder();
+        $qb->update('adp_month_plans')
+            ->set('status', $qb->createNamedParameter($targetStatus))
+            ->set('updated_by_uid', $qb->createNamedParameter($updatedByUid))
+            ->set('updated_at', $qb->createNamedParameter($now, IQueryBuilder::PARAM_DATETIME_IMMUTABLE))
+            ->where($qb->expr()->eq('team_code', $qb->createNamedParameter($teamCode)))
+            ->andWhere($qb->expr()->eq('plan_month', $qb->createNamedParameter($month)))
+            ->andWhere($qb->expr()->eq('status', $qb->createNamedParameter($expectedStatus)));
+
+        return $qb->executeStatement() === 1;
+    }
+
     private function candidateExists(int $slotId, string $assistantUid): bool {
         $qb = $this->db->getQueryBuilder();
         $qb->select('id')
diff --git a/lib/Repository/TeamSettingsRepository.php b/lib/Repository/TeamSettingsRepository.php
index 26d4b95..693b340 100644
--- a/lib/Repository/TeamSettingsRepository.php
+++ b/lib/Repository/TeamSettingsRepository.php
@@ -5,6 +5,7 @@
 namespace OCA\AdPlaner\Repository;
 
 use DateTimeImmutable;
+use OCP\DB\Exception;
 use OCP\DB\QueryBuilder\IQueryBuilder;
 use OCP\IDBConnection;
 
@@ -43,8 +44,14 @@ public function save(string $teamCode, string $displayName, array $settings): vo
                     'created_at' => $qb->createNamedParameter($now, IQueryBuilder::PARAM_DATETIME_IMMUTABLE),
                     'updated_at' => $qb->createNamedParameter($now, IQueryBuilder::PARAM_DATETIME_IMMUTABLE),
                 ]);
-            $qb->executeStatement();
-            return;
+            try {
+                $qb->executeStatement();
+                return;
+            } catch (Exception $exception) {
+                if ($exception->getReason() !== Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
+                    throw $exception;
+                }
+            }
         }
 
         $qb = $this->db->getQueryBuilder();
diff --git a/lib/Service/PlanningHintService.php b/lib/Service/PlanningHintService.php
new file mode 100644
index 0000000..e95f6cc
--- /dev/null
+++ b/lib/Service/PlanningHintService.php
@@ -0,0 +1,105 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\AdPlaner\Service;
+
+use DateTimeImmutable;
+use DateTimeZone;
+use OCA\LocalBase\Calendar\AbsenceQueryEvent;
+use OCA\LocalBase\Calendar\ScheduleConflictQueryEvent;
+use OCP\EventDispatcher\IEventDispatcher;
+
+/** Aggregiert optionale Abwesenheiten und Kalenderbelegungen ohne Schreibwirkung oder fremde Detaildaten. */
+class PlanningHintService {
+    public function __construct(
+        private IEventDispatcher $events,
+        private AdPlanerLogger $logger,
+    ) {}
+
+    /** @param list<string> $employeeUids
+     *  @return array<string, list<array{employeeUid:string,type:string,marker:string,label:string,blocks:bool}>>
+     */
+    public function forMonth(string $month, array $employeeUids): array {
+        if (preg_match('/^(\d{4})-(\d{2})$/', $month, $matches) !== 1
+            || !checkdate((int)$matches[2], 1, (int)$matches[1])) {
+            throw new \InvalidArgumentException('Ungültiger Planungsmonat.');
+        }
+        $employeeUids = array_values(array_unique(array_filter(array_map('strval', $employeeUids))));
+        if ($employeeUids === []) {
+            return [];
+        }
+
+        $utc = new DateTimeZone('UTC');
+        $start = new DateTimeImmutable($month . '-01 00:00:00', $utc);
+        $end = $start->modify('+1 month');
+        $hints = [];
+
+        try {
+            $absenceEvent = new AbsenceQueryEvent($start, $end, $employeeUids);
+            $this->events->dispatchTyped($absenceEvent);
+            foreach ($absenceEvent->absences() as $absence) {
+                $payload = $absence->toArray();
+                $this->appendForDays(
+                    $hints,
+                    new DateTimeImmutable($payload['start']),
+                    new DateTimeImmutable($payload['end']),
+                    $start,
+                    $end,
+                    [
+                        'employeeUid' => $payload['employeeUid'],
+                        'type' => 'absence',
+                        'marker' => $payload['marker'],
+                        'label' => 'Urlaub',
+                        'blocks' => false,
+                    ]
+                );
+            }
+        } catch (\Throwable $error) {
+            $this->logger->error('planning_hint_absences', $error, ['month' => $month]);
+        }
+
+        foreach ($employeeUids as $employeeUid) {
+            try {
+                $conflictEvent = new ScheduleConflictQueryEvent($employeeUid, $start, $end);
+                $this->events->dispatchTyped($conflictEvent);
+                foreach ($conflictEvent->conflicts() as $conflict) {
+                    $payload = $conflict->toArray();
+                    $this->appendForDays(
+                        $hints,
+                        new DateTimeImmutable($payload['start']),
+                        new DateTimeImmutable($payload['end']),
+                        $start,
+                        $end,
+                        [
+                            'employeeUid' => $employeeUid,
+                            'type' => 'calendar',
+                            'marker' => 'K',
+                            'label' => $payload['type'] === 'shift' ? 'Dienst' : 'Termin',
+                            'blocks' => false,
+                        ]
+                    );
+                }
+            } catch (\Throwable $error) {
+                $this->logger->error('planning_hint_calendar', $error, ['month' => $month]);
+            }
+        }
+
+        foreach ($hints as &$dayHints) {
+            usort($dayHints, static fn(array $left, array $right): int => [$left['employeeUid'], $left['marker']] <=> [$right['employeeUid'], $right['marker']]);
+        }
+        unset($dayHints);
+
+        return $hints;
+    }
+
+    private function appendForDays(array &$hints, DateTimeImmutable $hintStart, DateTimeImmutable $hintEnd, DateTimeImmutable $monthStart, DateTimeImmutable $monthEnd, array $hint): void {
+        $cursor = $hintStart < $monthStart ? $monthStart : $hintStart;
+        $limit = $hintEnd > $monthEnd ? $monthEnd : $hintEnd;
+        $cursor = $cursor->setTime(0, 0);
+        while ($cursor < $limit) {
+            $hints[$cursor->format('Y-m-d')][] = $hint;
+            $cursor = $cursor->modify('+1 day');
+        }
+    }
+}
diff --git a/lib/Service/ScheduleService.php b/lib/Service/ScheduleService.php
index d4c969b..f52cf60 100644
--- a/lib/Service/ScheduleService.php
+++ b/lib/Service/ScheduleService.php
@@ -10,23 +10,50 @@
 use OCA\AdPlaner\Store\ShiftPlanStore;
 
 class ScheduleService {
+    private const STATUS_DRAFT = 'draft';
+    private const STATUS_PLANNED = 'planned';
+    private const STATUS_APPROVED = 'approved';
+    private const MAX_DAY_NOTE_LENGTH = 2000;
+
     public function __construct(
         private ShiftPlanStore $store,
         private ShiftConfigService $shiftConfig,
-        private TeamAccessService $teamAccess
+        private TeamAccessService $teamAccess,
+        private PlanningHintService $planningHints
     ) {
     }
 
     public function monthPlan(Team $team, string $month, string $currentUid): array {
         $month = $this->shiftConfig->normalizeMonth($month);
-        $this->ensureMonthSlots($team, $month);
+        $status = $this->store->monthStatus($team->code, $month);
+        if ($status !== self::STATUS_APPROVED) {
+            $this->store->ensureMonthStatus($team->code, $month, $currentUid);
+            $status = $this->store->transactional(function () use ($team, $month): string {
+                $lockedStatus = $this->store->lockMonthStatus(
+                    $team->code,
+                    $month,
+                    [self::STATUS_DRAFT, self::STATUS_PLANNED]
+                );
+                if ($lockedStatus === null) {
+                    return $this->store->monthStatus($team->code, $month);
+                }
+
+                $this->ensureMonthSlots($team, $month);
+
+                return $lockedStatus;
+            });
+        }
 
         $slots = $this->store->slotsForMonth($team->code, $month);
         $enabledSlots = array_values(array_filter($slots, static fn(ShiftSlot $slot): bool => $slot->enabled));
+        $segments = $status === self::STATUS_APPROVED
+            ? $this->segmentsFromFrozenSlots($enabledSlots)
+            : array_values(array_filter($this->shiftConfig->segments($team->settings), static fn(array $segment): bool => $segment['enabled']));
         $candidatesBySlot = $this->store->candidatesForSlotIds(array_map(static fn(ShiftSlot $slot): int => $slot->id, $enabledSlots));
         $assistantLabels = $team->assistantLabelMap();
         $assignableUids = $team->assignableAssistantUidMap();
         $notes = $this->store->dayNotesForMonth($team->code, $month);
+        $hints = $this->planningHints->forMonth($month, array_keys($assignableUids));
         $slotsByDate = [];
 
         foreach ($enabledSlots as $slot) {
@@ -47,20 +74,26 @@ public function monthPlan(Team $team, string $month, string $currentUid): array
                 'weekday' => $day['weekday'],
                 'slots' => $slotsByDate[$date] ?? [],
                 'note' => isset($notes[$date]) ? $notes[$date]->note : '',
+                'hints' => array_map(static function (array $hint) use ($assistantLabels): array {
+                    $employeeUid = (string)($hint['employeeUid'] ?? '');
+                    $hint['displayName'] = $assistantLabels[$employeeUid] ?? '';
+                    unset($hint['employeeUid']);
+                    return $hint;
+                }, $hints[$date] ?? []),
             ];
         }
 
         return [
             'team' => $team->toArray(),
             'month' => $month,
-            'segments' => array_values(array_filter($this->shiftConfig->segments($team->settings), static fn(array $segment): bool => $segment['enabled'])),
+            'status' => $status,
+            'segments' => $segments,
             'days' => $days,
         ];
     }
 
     public function addCandidate(Team $team, string $month, int $slotId, string $targetUid, string $currentUid): void {
         $month = $this->shiftConfig->normalizeMonth($month);
-        $slot = $this->requireSlot($slotId, $team->code, $month);
         if ($targetUid === '') {
             if ($team->isEb) {
                 throw new \DomainException('Bitte eine Assistenzkraft auswählen.');
@@ -72,27 +105,78 @@ public function addCandidate(Team $team, string $month, int $slotId, string $tar
         $this->assertCandidateMutationAllowed($team, $targetUid, $currentUid);
         $this->assertAssignableAssistantInTeam($team, $targetUid);
 
-        $this->store->addCandidate($slot->id, $targetUid, $currentUid);
+        $this->withMutableMonth($team->code, $month, $currentUid, function () use ($slotId, $team, $month, $targetUid, $currentUid): void {
+            $slot = $this->requireSlot($slotId, $team->code, $month);
+            $this->store->addCandidate($slot->id, $targetUid, $currentUid);
+        });
     }
 
     public function removeCandidate(Team $team, string $month, int $slotId, string $targetUid, string $currentUid): void {
         $month = $this->shiftConfig->normalizeMonth($month);
-        $slot = $this->requireSlot($slotId, $team->code, $month);
         $targetUid = $targetUid === '' ? $currentUid : $targetUid;
 
         $this->assertCandidateMutationAllowed($team, $targetUid, $currentUid);
         $this->assertAssignableAssistantInTeam($team, $targetUid);
 
-        $this->store->removeCandidate($slot->id, $targetUid);
+        $this->withMutableMonth($team->code, $month, $currentUid, function () use ($slotId, $team, $month, $targetUid): void {
+            $slot = $this->requireSlot($slotId, $team->code, $month);
+            $this->store->removeCandidate($slot->id, $targetUid);
+        });
     }
 
-    public function saveDayNote(Team $team, string $workDate, string $note, string $currentUid): void {
+    public function saveDayNote(Team $team, string $month, string $workDate, string $note, string $currentUid): void {
         if (!$team->isEb) {
             throw new \DomainException('Nur die Einsatzbegleitung darf Bemerkungen bearbeiten.');
         }
 
+        $month = $this->shiftConfig->normalizeMonth($month);
         $workDate = $this->shiftConfig->normalizeDate($workDate);
-        $this->store->saveDayNote($team->code, $workDate, trim($note), $currentUid);
+        if (!str_starts_with($workDate, $month . '-')) {
+            throw new \DomainException('Das Datum gehört nicht zum ausgewählten Planungsmonat.');
+        }
+        $note = $this->normalizeDayNote($note);
+        $this->withMutableMonth($team->code, $month, $currentUid, function () use ($team, $workDate, $note, $currentUid): void {
+            if ($note === '') {
+                $this->store->deleteDayNote($team->code, $workDate);
+                return;
+            }
+
+            $this->store->saveDayNote($team->code, $workDate, $note, $currentUid);
+        });
+    }
+
+    public function transitionMonthStatus(Team $team, string $month, string $targetStatus, string $currentUid): string {
+        if (!$team->isEb) {
+            throw new \DomainException('Nur die Einsatzbegleitung darf den Planstatus ändern.');
+        }
+
+        $month = $this->shiftConfig->normalizeMonth($month);
+        $targetStatus = strtolower(trim($targetStatus));
+        $currentStatus = $this->store->monthStatus($team->code, $month);
+        $allowedTargets = [
+            self::STATUS_DRAFT => [self::STATUS_PLANNED],
+            self::STATUS_PLANNED => [self::STATUS_DRAFT, self::STATUS_APPROVED],
+            self::STATUS_APPROVED => [self::STATUS_PLANNED],
+        ];
+        if (!in_array($targetStatus, $allowedTargets[$currentStatus] ?? [], true)) {
+            throw new \DomainException('Dieser Planstatuswechsel ist nicht erlaubt.');
+        }
+
+        $this->store->ensureMonthStatus($team->code, $month, $currentUid);
+        return $this->store->transactional(function () use ($team, $month, $targetStatus, $currentUid, $currentStatus): string {
+            $lockedStatus = $this->store->lockMonthStatus($team->code, $month, [$currentStatus]);
+            if ($lockedStatus !== $currentStatus) {
+                throw new \DomainException('Der Planstatus wurde zwischenzeitlich geändert. Bitte neu laden.');
+            }
+            if ($targetStatus === self::STATUS_APPROVED) {
+                $this->ensureMonthSlots($team, $month);
+            }
+            if (!$this->store->transitionMonthStatus($team->code, $month, $currentStatus, $targetStatus, $currentUid)) {
+                throw new \DomainException('Der Planstatus wurde zwischenzeitlich geändert. Bitte neu laden.');
+            }
+
+            return $targetStatus;
+        });
     }
 
     private function ensureMonthSlots(Team $team, string $month): void {
@@ -150,6 +234,25 @@ private function ensureMonthSlots(Team $team, string $month): void {
         }
     }
 
+    /** @param list<ShiftSlot> $slots */
+    private function segmentsFromFrozenSlots(array $slots): array {
+        $segments = [];
+        foreach ($slots as $slot) {
+            if (isset($segments[$slot->segmentKey])) {
+                continue;
+            }
+            $segments[$slot->segmentKey] = [
+                'key' => $slot->segmentKey,
+                'label' => $slot->label,
+                'startsAt' => $slot->startsAt,
+                'endsAt' => $slot->endsAt,
+                'enabled' => true,
+            ];
+        }
+
+        return array_values($segments);
+    }
+
     private function requireSlot(int $slotId, string $teamCode, string $month): ShiftSlot {
         $slot = $this->store->slotForMonth($slotId, $teamCode, $month);
         if ($slot === null || !$slot->enabled) {
@@ -188,4 +291,34 @@ private function assertAssignableAssistantInTeam(Team $team, string $assistantUi
             throw new \DomainException('Einsatzbegleitungen können keiner Schicht zugeteilt werden.');
         }
     }
+
+    private function normalizeDayNote(string $note): string {
+        $note = trim($note);
+        $length = preg_match_all('/./us', $note);
+        if ($length === false) {
+            throw new \InvalidArgumentException('Bemerkungen müssen gültiges UTF-8 enthalten.');
+        }
+        if ($length > self::MAX_DAY_NOTE_LENGTH) {
+            throw new \InvalidArgumentException('Bemerkungen dürfen höchstens 2.000 Zeichen lang sein.');
+        }
+
+        return $note;
+    }
+
+    private function withMutableMonth(string $teamCode, string $month, string $currentUid, callable $operation): mixed {
+        $this->store->ensureMonthStatus($teamCode, $month, $currentUid);
+
+        return $this->store->transactional(function () use ($teamCode, $month, $operation): mixed {
+            $status = $this->store->lockMonthStatus(
+                $teamCode,
+                $month,
+                [self::STATUS_DRAFT, self::STATUS_PLANNED]
+            );
+            if ($status === null) {
+                throw new \DomainException('Der genehmigte Monatsplan ist gegen Änderungen gesperrt.');
+            }
+
+            return $operation();
+        });
+    }
 }
diff --git a/lib/Service/ShiftConfigService.php b/lib/Service/ShiftConfigService.php
index d6135e2..2cfd7aa 100644
--- a/lib/Service/ShiftConfigService.php
+++ b/lib/Service/ShiftConfigService.php
@@ -111,6 +111,10 @@ private function normalizeShifts(array $shifts): array {
             throw new \InvalidArgumentException('Mindestens eine Schicht muss konfiguriert sein.');
         }
 
+        if (!array_is_list($shifts)) {
+            throw new \InvalidArgumentException('Schichten müssen als Liste übergeben werden.');
+        }
+
         if (count($shifts) > 64) {
             throw new \InvalidArgumentException('Höchstens 64 Schichten können konfiguriert werden.');
         }
@@ -129,10 +133,14 @@ private function normalizeShifts(array $shifts): array {
 
             $label = trim((string)($shift['label'] ?? ''));
             if ($label === '') {
-                $label = 'Schicht ' . ($index + 1);
+                throw new \InvalidArgumentException('Schichtnamen dürfen nicht leer sein.');
             }
 
-            if (strlen($label) > 64) {
+            $labelLength = preg_match_all('/./us', $label);
+            if ($labelLength === false) {
+                throw new \InvalidArgumentException('Schichtnamen müssen gültiges UTF-8 enthalten.');
+            }
+            if ($labelLength > 64) {
                 throw new \InvalidArgumentException('Schichtnamen dürfen höchstens 64 Zeichen lang sein.');
             }
 
@@ -183,14 +191,22 @@ private function normalizeBoolean(mixed $value): bool {
         }
 
         if (is_int($value)) {
-            return $value !== 0;
+            if ($value === 0 || $value === 1) {
+                return $value === 1;
+            }
         }
 
         if (is_string($value)) {
-            return in_array(strtolower($value), ['1', 'true', 'yes', 'on'], true);
+            $value = strtolower(trim($value));
+            if (in_array($value, ['1', 'true', 'yes', 'on'], true)) {
+                return true;
+            }
+            if (in_array($value, ['0', 'false', 'no', 'off'], true)) {
+                return false;
+            }
         }
 
-        return (bool)$value;
+        throw new \InvalidArgumentException('Der Aktivstatus einer Schicht muss eindeutig wahr oder falsch sein.');
     }
 
     private function shift(string $key, string $label, string $startsAt, string $endsAt, bool $enabled): array {
diff --git a/lib/Service/TeamAccessService.php b/lib/Service/TeamAccessService.php
index 1820024..5d22171 100644
--- a/lib/Service/TeamAccessService.php
+++ b/lib/Service/TeamAccessService.php
@@ -62,7 +62,7 @@ public function teamsForCurrentUser(): array {
         )));
     }
 
-    public function teamForCode(string $teamCode): ?Team {
+    private function teamForCode(string $teamCode): ?Team {
         $teamCode = $this->normalizeTeamCode($teamCode);
         $groupName = $this->teamGroupName($teamCode);
         $group = $this->groupManager->get($groupName);
@@ -84,8 +84,13 @@ public function teamForCode(string $teamCode): ?Team {
     }
 
     public function assertTeamAccess(string $teamCode): Team {
+        $teamCode = $this->normalizeTeamCode($teamCode);
+        if (!$this->currentUserInGroup($this->teamGroupName($teamCode))) {
+            throw new \DomainException('Kein Zugriff auf dieses Assistenzteam.');
+        }
+
         $team = $this->teamForCode($teamCode);
-        if ($team === null || !$this->currentUserInGroup($team->groupName)) {
+        if ($team === null) {
             throw new \DomainException('Kein Zugriff auf dieses Assistenzteam.');
         }
 
@@ -133,6 +138,10 @@ public function assistantLabelMap(array $assistants): array {
     private function assistantsForGroup($group): array {
         $assistants = [];
         foreach ($group->getUsers() as $user) {
+            if (!$user->isEnabled()) {
+                continue;
+            }
+
             $isEb = $this->userHasEbGroup($user);
             $assistants[] = Assistant::fromUser($user, $isEb);
         }
diff --git a/lib/Store/ShiftPlanStore.php b/lib/Store/ShiftPlanStore.php
index f347380..9a1ab9d 100644
--- a/lib/Store/ShiftPlanStore.php
+++ b/lib/Store/ShiftPlanStore.php
@@ -15,6 +15,10 @@ public function __construct(
     ) {
     }
 
+    public function transactional(callable $operation): mixed {
+        return $this->repository->transactional($operation);
+    }
+
     public function slotsForMonth(string $teamCode, string $month): array {
         return ShiftSlot::get_all($this->repository->findSlotsForMonth($teamCode, $month));
     }
@@ -45,6 +49,34 @@ public function dayNotesForMonth(string $teamCode, string $month): array {
         return $notes;
     }
 
+    public function monthStatus(string $teamCode, string $month): string {
+        return $this->repository->monthStatus($teamCode, $month) ?? 'draft';
+    }
+
+    public function ensureMonthStatus(string $teamCode, string $month, string $updatedByUid): void {
+        $this->repository->ensureMonthStatus($teamCode, $month, $updatedByUid);
+    }
+
+    public function lockMonthStatus(string $teamCode, string $month, array $expectedStatuses): ?string {
+        return $this->repository->lockMonthStatus($teamCode, $month, $expectedStatuses);
+    }
+
+    public function transitionMonthStatus(
+        string $teamCode,
+        string $month,
+        string $expectedStatus,
+        string $targetStatus,
+        string $updatedByUid
+    ): bool {
+        return $this->repository->transitionMonthStatus(
+            $teamCode,
+            $month,
+            $expectedStatus,
+            $targetStatus,
+            $updatedByUid
+        );
+    }
+
     public function insertSlot(
         string $teamCode,
         string $month,
@@ -82,4 +114,8 @@ public function removeCandidate(int $slotId, string $assistantUid): void {
     public function saveDayNote(string $teamCode, string $workDate, string $note, string $updatedByUid): void {
         $this->repository->saveDayNote($teamCode, $workDate, $note, $updatedByUid);
     }
+
+    public function deleteDayNote(string $teamCode, string $workDate): void {
+        $this->repository->deleteDayNote($teamCode, $workDate);
+    }
 }
diff --git a/lib/Store/TeamSettingsStore.php b/lib/Store/TeamSettingsStore.php
index b85af14..d066d18 100644
--- a/lib/Store/TeamSettingsStore.php
+++ b/lib/Store/TeamSettingsStore.php
@@ -28,10 +28,14 @@ public function forTeam(string $teamCode): TeamSettings {
         if (!is_array($decoded)) {
             $decoded = [];
         }
+        $displayName = trim((string)($row['display_name'] ?? ''));
+        if ($displayName === '') {
+            $displayName = $this->defaultDisplayName($teamCode);
+        }
 
         return new TeamSettings(
             $teamCode,
-            (string)($row['display_name'] ?: $this->defaultDisplayName($teamCode)),
+            $displayName,
             $this->shiftConfig->normalize($decoded)
         );
     }
@@ -39,7 +43,14 @@ public function forTeam(string $teamCode): TeamSettings {
     public function save(string $teamCode, string $displayName, array $config): TeamSettings {
         $displayName = trim($displayName);
         if ($displayName === '') {
-            $displayName = $this->defaultDisplayName($teamCode);
+            throw new \InvalidArgumentException('Der Anzeigename darf nicht leer sein.');
+        }
+        $displayNameLength = preg_match_all('/./us', $displayName);
+        if ($displayNameLength === false) {
+            throw new \InvalidArgumentException('Der Anzeigename muss gültiges UTF-8 enthalten.');
+        }
+        if ($displayNameLength > 255) {
+            throw new \InvalidArgumentException('Der Anzeigename darf höchstens 255 Zeichen lang sein.');
         }
 
         $normalized = $this->shiftConfig->normalize($config);
diff --git a/templates/index.php b/templates/index.php
index d23ea3c..5486d52 100644
--- a/templates/index.php
+++ b/templates/index.php
@@ -37,7 +37,11 @@
             </label>
             <label>
                 Monat
-                <input id="month-input" type="month">
+                <span class="adp-month-control">
+                    <button type="button" id="month-prev" class="adp-icon-button" aria-label="Vorheriger Monat">‹</button>
+                    <input id="month-input" type="month" min="2000-01" max="2100-12" required>
+                    <button type="button" id="month-next" class="adp-icon-button" aria-label="Nächster Monat">›</button>
+                </span>
             </label>
         </div>
     </header>
diff --git a/tests/AccessSmokeContractTest.php b/tests/AccessSmokeContractTest.php
new file mode 100644
index 0000000..6819f3c
--- /dev/null
+++ b/tests/AccessSmokeContractTest.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+$smoke = file_get_contents(__DIR__ . '/access-http-smoke.sh');
+if ($smoke === false) {
+    throw new RuntimeException('Der C3-HTTP-Smoke konnte nicht gelesen werden.');
+}
+if (!str_contains($smoke, '$candidate["uid"] ?? ""')) {
+    throw new RuntimeException('Der C3-HTTP-Smoke prüft nicht den öffentlichen Kandidaten-Schlüssel uid.');
+}
+if (str_contains($smoke, '$candidate["assistantUid"]')) {
+    throw new RuntimeException('Der C3-HTTP-Smoke verwendet noch den internen Kandidaten-Schlüssel assistantUid.');
+}
+foreach (['$beforeCandidateUids', '$afterCandidateUids', '$beforeCandidateUids !== $afterCandidateUids'] as $contract) {
+    if (!str_contains($smoke, $contract)) {
+        throw new RuntimeException('Der C3-HTTP-Smoke vergleicht den Schichtzustand vor und nach der abgewiesenen Änderung nicht korrekt.');
+    }
+}
+if (str_contains($smoke, 'Die abgewiesene Fremdänderung wurde dennoch gespeichert.')) {
+    throw new RuntimeException('Der C3-HTTP-Smoke verwechselt einen bereits vorhandenen Fremdeintrag mit einer neuen Mutation.');
+}
+
+echo 'AdPlaner access smoke contract test passed' . PHP_EOL;
diff --git a/tests/BrowserDdevSmokeContractTest.php b/tests/BrowserDdevSmokeContractTest.php
new file mode 100644
index 0000000..4816701
--- /dev/null
+++ b/tests/BrowserDdevSmokeContractTest.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+$shell = file_get_contents(__DIR__ . '/browser-ddev-smoke.sh');
+$browser = file_get_contents(__DIR__ . '/js/browser-ddev-smoke.mjs');
+$probe = file_get_contents(__DIR__ . '/integration/PrivacyRuntimeProbe.php');
+if ($shell === false || $browser === false || $probe === false) {
+    throw new RuntimeException('Der selbstbereinigende Browser-Smoke konnte nicht gelesen werden.');
+}
+
+foreach (['trap \'cleanup || report_failed_cleanup\' EXIT', 'run_probe assert-clean', 'user:delete', 'group:delete', 'rm -rf "$workdir"'] as $contract) {
+    if (!str_contains($shell, $contract)) {
+        throw new RuntimeException('Dem Browser-Smoke fehlt ein Cleanup-Vertrag: ' . $contract);
+    }
+}
+foreach (['transition-status', 'add-self', 'save-note', 'settings-form', 'Page.captureScreenshot', '__adpBrowserErrors'] as $contract) {
+    if (!str_contains($browser, $contract)) {
+        throw new RuntimeException('Dem Browser-Smoke fehlt ein Oberflächenvertrag: ' . $contract);
+    }
+}
+foreach (["['adp_shift_slots', ['team_code' => \$teamCode]]", "['adp_month_plans', ['team_code' => \$teamCode]]"] as $contract) {
+    if (!str_contains($probe, $contract)) {
+        throw new RuntimeException('Der Cleanup-Probe entfernt nicht alle durch initiale Browserloads erzeugten Testmonate.');
+    }
+}
+if (str_contains($shell, 'app:disable') || str_contains($shell, 'app:enable')) {
+    throw new RuntimeException('Die Browser-Abnahme darf den Nextcloud-App-Zustand nicht verändern.');
+}
+
+echo 'AdPlaner browser DDEV smoke contract test passed' . PHP_EOL;
diff --git a/tests/Controller/ControllerAttributeSmokeTest.php b/tests/Controller/ControllerAttributeSmokeTest.php
index 2327942..c969a81 100644
--- a/tests/Controller/ControllerAttributeSmokeTest.php
+++ b/tests/Controller/ControllerAttributeSmokeTest.php
@@ -35,8 +35,7 @@ final class Application {
 }
 
 namespace {
-    require __DIR__ . '/../../lib/Controller/PageController.php';
-    require __DIR__ . '/../../lib/Controller/ApiController.php';
+    require_once dirname(__DIR__) . '/bootstrap.php';
 
     use OCA\AdPlaner\Controller\ApiController;
     use OCA\AdPlaner\Controller\PageController;
@@ -58,6 +57,7 @@ final class Application {
         'saveDayNote',
         'addShiftCandidate',
         'removeShiftCandidate',
+        'transitionMonthStatus',
     ];
 
     foreach ($apiActions as $action) {
diff --git a/tests/Controller/DemoAdminControllerTest.php b/tests/Controller/DemoAdminControllerTest.php
new file mode 100644
index 0000000..eb7c859
--- /dev/null
+++ b/tests/Controller/DemoAdminControllerTest.php
@@ -0,0 +1,138 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCP\AppFramework {
+    if (!class_exists(Controller::class)) {
+        class Controller { public function __construct(string $appName, \OCP\IRequest $request) {} }
+    }
+    if (!class_exists(Http::class)) {
+        final class Http {
+            public const STATUS_BAD_REQUEST = 400;
+            public const STATUS_FORBIDDEN = 403;
+            public const STATUS_INTERNAL_SERVER_ERROR = 500;
+        }
+    }
+}
+
+namespace OCP\AppFramework\Http {
+    if (!class_exists(JSONResponse::class)) {
+        final class JSONResponse {
+            public function __construct(public array $data = [], public int $status = 200) {}
+            public function getData(): array { return $this->data; }
+            public function getStatus(): int { return $this->status; }
+        }
+    }
+}
+
+namespace OCP {
+    if (!interface_exists(IRequest::class)) {
+        interface IRequest {}
+    }
+    if (!interface_exists(IUserSession::class)) {
+        interface IUserSession { public function getUser(); }
+    }
+    if (!interface_exists(IGroupManager::class)) {
+        interface IGroupManager { public function isAdmin($uid); }
+    }
+}
+
+namespace Psr\Log {
+    if (!interface_exists(LoggerInterface::class)) {
+        interface LoggerInterface { public function error(string|\Stringable $message, array $context = []): void; }
+    }
+}
+
+namespace OCA\AdPlaner\AppInfo {
+    if (!class_exists(Application::class)) {
+        final class Application { public const APP_ID = 'adplaner'; }
+    }
+}
+
+namespace OCA\AdPlaner\Service {
+    if (!class_exists(PlanerDemoPackService::class)) {
+        class PlanerDemoPackService {
+            public int $installCalls = 0;
+            public bool $throwOnInstall = false;
+            public function install(): array {
+                $this->installCalls++;
+                if ($this->throwOnInstall) {
+                    throw new \RuntimeException('SQL password=synthetic-secret');
+                }
+                return ['accounts' => [], 'teams' => ['A', 'B', 'C']];
+            }
+        }
+    }
+}
+
+namespace {
+    require_once dirname(__DIR__) . '/bootstrap.php';
+
+    use OCA\AdPlaner\Controller\DemoAdminController;
+    use OCA\AdPlaner\Service\PlanerDemoPackService;
+    use OCP\IGroupManager;
+    use OCP\IRequest;
+    use OCP\IUserSession;
+    use Psr\Log\LoggerInterface;
+
+    $request = new class implements IRequest {};
+    $session = new class implements IUserSession {
+        public function getUser(): object {
+            return new class {
+                public function getUID(): string { return 'admin-test'; }
+            };
+        }
+    };
+    $groups = new class implements IGroupManager {
+        public bool $admin = true;
+        public function isAdmin($uid): bool { return $this->admin && $uid === 'admin-test'; }
+    };
+    $logger = new class implements LoggerInterface {
+        public array $errors = [];
+        public function error(string|\Stringable $message, array $context = []): void {
+            $this->errors[] = compact('message', 'context');
+        }
+    };
+    $demoPack = new PlanerDemoPackService();
+    $controller = new DemoAdminController($request, $session, $groups, $demoPack, $logger);
+
+    $unconfirmed = $controller->install(false);
+    if ($unconfirmed->getStatus() !== 400 || $demoPack->installCalls !== 0) {
+        throw new RuntimeException('Eine unbestätigte Demo-Installation muss ohne Mutation mit HTTP 400 abgewiesen werden.');
+    }
+
+    $confirmed = $controller->install(true);
+    if ($confirmed->getStatus() !== 200 || $demoPack->installCalls !== 1 || ($confirmed->getData()['result']['teams'] ?? []) !== ['A', 'B', 'C']) {
+        throw new RuntimeException('Eine bestätigte Admin-Installation muss den Demo-Service genau einmal ausführen.');
+    }
+
+    $controller->install(false);
+    if ($demoPack->installCalls !== 1) {
+        throw new RuntimeException('Jede weitere Demo-Installation muss erneut ausdrücklich bestätigt werden.');
+    }
+
+    foreach (['true', '1', 1, null] as $manipulatedConfirmation) {
+        $manipulated = $controller->install($manipulatedConfirmation);
+        if ($manipulated->getStatus() !== 400 || $demoPack->installCalls !== 1) {
+            throw new RuntimeException('Nur das JSON-Boolean true darf die Demo-Installation bestätigen.');
+        }
+    }
+
+    $groups->admin = false;
+    $forbidden = $controller->install(true);
+    if ($forbidden->getStatus() !== 403 || $demoPack->installCalls !== 1) {
+        throw new RuntimeException('Eine bestätigte Nicht-Admin-Anfrage muss ohne Mutation mit HTTP 403 abgewiesen werden.');
+    }
+
+    $groups->admin = true;
+    $demoPack->throwOnInstall = true;
+    $failed = $controller->install(true);
+    if ($failed->getStatus() !== 500 || ($failed->getData()['error'] ?? '') !== 'Demo-Daten konnten nicht installiert werden.') {
+        throw new RuntimeException('Interne Demo-Fehler müssen ohne technische Details als generische HTTP-500-Antwort erscheinen.');
+    }
+    if (str_contains(json_encode($failed->getData()), 'synthetic-secret') || count($logger->errors) !== 1) {
+        throw new RuntimeException('Interne Fehlermeldungen dürfen nur im Serverlog und nie in der API-Antwort landen.');
+    }
+
+    echo 'AdPlaner demo admin controller tests passed' . PHP_EOL;
+}
diff --git a/tests/IntegrationCapabilityListenerTest.php b/tests/IntegrationCapabilityListenerTest.php
index cf1e852..4eb239f 100644
--- a/tests/IntegrationCapabilityListenerTest.php
+++ b/tests/IntegrationCapabilityListenerTest.php
@@ -6,9 +6,7 @@
 namespace OCA\AdPlaner\AppInfo { final class Application { public const APP_ID = 'adplaner'; } }
 
 namespace {
-    require_once __DIR__ . '/../../localbase/lib/Integration/AdIntegrationCapabilities.php';
-    require_once __DIR__ . '/../../localbase/lib/Integration/IntegrationCapabilityQueryEvent.php';
-    require_once __DIR__ . '/../lib/Listener/IntegrationCapabilityQueryListener.php';
+    require_once __DIR__ . '/bootstrap.php';
 
     use OCA\AdPlaner\Listener\IntegrationCapabilityQueryListener;
     use OCA\LocalBase\Integration\AdIntegrationCapabilities;
diff --git a/tests/MigrationContractTest.php b/tests/MigrationContractTest.php
new file mode 100644
index 0000000..f4d4e53
--- /dev/null
+++ b/tests/MigrationContractTest.php
@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+$migration = __DIR__ . '/../lib/Migration/Version000003Date202608080001.php';
+if (!is_file($migration)) {
+    throw new RuntimeException('Die additive Monatsplanstatus-Migration fehlt.');
+}
+
+$source = file_get_contents($migration);
+if ($source === false) {
+    throw new RuntimeException('Die Monatsplanstatus-Migration konnte nicht gelesen werden.');
+}
+
+foreach (['adp_month_plans', 'team_code', 'plan_month', 'status', 'updated_by_uid', 'updated_at', 'adp_month_plan_unique'] as $contract) {
+    if (!str_contains($source, $contract)) {
+        throw new RuntimeException("Der Monatsplanstatus-Migrationsvertrag fehlt: {$contract}");
+    }
+}
+if (!str_contains($source, "'default' => 'draft'")) {
+    throw new RuntimeException('Bestehende Monatspläne erhalten keinen sicheren Entwurfsstatus.');
+}
+
+$revisionMigration = __DIR__ . '/../lib/Migration/Version000004Date202608090001.php';
+if (!is_file($revisionMigration)) {
+    throw new RuntimeException('Die additive Revisionsmigration für atomare Monatsänderungen fehlt.');
+}
+$revisionSource = file_get_contents($revisionMigration);
+if ($revisionSource === false
+    || !str_contains($revisionSource, "hasColumn('revision')")
+    || !str_contains($revisionSource, "addColumn('revision', Types::INTEGER")
+    || !str_contains($revisionSource, "'default' => 0")) {
+    throw new RuntimeException('Bestehende Monatsstatuszeilen erhalten keine sichere Revisionsnummer ab 0.');
+}
+
+$info = file_get_contents(__DIR__ . '/../appinfo/info.xml');
+if ($info === false || !str_contains($info, '<version>0.4.0-rc.2</version>')) {
+    throw new RuntimeException('Die additive Revisionsmigration besitzt keinen neuen App-Versionsauslöser.');
+}
+
+echo "AdPlaner month plan migration contract test passed\n";
diff --git a/tests/MigrationExecutionTest.php b/tests/MigrationExecutionTest.php
new file mode 100644
index 0000000..44c3d08
--- /dev/null
+++ b/tests/MigrationExecutionTest.php
@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCP\Migration {
+    abstract class SimpleMigrationStep {
+    }
+
+    interface IOutput {
+    }
+}
+
+namespace OCP\DB {
+    interface ISchemaWrapper {
+    }
+
+    final class Types {
+        public const BIGINT = 'bigint';
+        public const INTEGER = 'integer';
+        public const STRING = 'string';
+        public const DATETIME = 'datetime';
+    }
+}
+
+namespace {
+    require_once __DIR__ . '/bootstrap.php';
+
+    use OCA\AdPlaner\Migration\Version000003Date202608080001;
+    use OCA\AdPlaner\Migration\Version000004Date202608090001;
+    use OCP\DB\ISchemaWrapper;
+    use OCP\Migration\IOutput;
+    use function OCA\AdPlaner\Tests\assertSameValue;
+
+    final class MigrationOutputFake implements IOutput {
+    }
+
+    final class MigrationTableFake {
+        public array $columns = [];
+        public array $rows = [];
+        public array $uniqueIndexes = [];
+        public array $primaryKey = [];
+        public int $revisionAdditions = 0;
+
+        public function addColumn(string $name, string $type, array $options): void {
+            $this->columns[$name] = compact('type', 'options');
+            if ($name === 'revision') {
+                $this->revisionAdditions++;
+            }
+            if (array_key_exists('default', $options)) {
+                foreach ($this->rows as &$row) {
+                    $row[$name] ??= $options['default'];
+                }
+                unset($row);
+            }
+        }
+
+        public function hasColumn(string $name): bool {
+            return isset($this->columns[$name]);
+        }
+
+        public function setPrimaryKey(array $columns): void {
+            $this->primaryKey = $columns;
+        }
+
+        public function addUniqueIndex(array $columns, string $name): void {
+            $this->uniqueIndexes[$name] = $columns;
+        }
+    }
+
+    final class MigrationSchemaFake implements ISchemaWrapper {
+        /** @var array<string, MigrationTableFake> */
+        public array $tables = [];
+
+        public function hasTable(string $name): bool {
+            return isset($this->tables[$name]);
+        }
+
+        public function createTable(string $name): MigrationTableFake {
+            return $this->tables[$name] = new MigrationTableFake();
+        }
+
+        public function getTable(string $name): MigrationTableFake {
+            return $this->tables[$name];
+        }
+    }
+
+    $run = static function (object $migration, MigrationSchemaFake $schema): void {
+        $result = $migration->changeSchema(
+            new MigrationOutputFake(),
+            static fn(): MigrationSchemaFake => $schema,
+            []
+        );
+        assertSameValue($schema, $result, 'A schema migration should return the schema it changed.');
+    };
+
+    $freshSchema = new MigrationSchemaFake();
+    $run(new Version000003Date202608080001(), $freshSchema);
+    $run(new Version000004Date202608090001(), $freshSchema);
+    $freshTable = $freshSchema->getTable('adp_month_plans');
+    assertSameValue(true, $freshTable->hasColumn('status'), 'A fresh migration sequence should create the month status column.');
+    assertSameValue(true, $freshTable->hasColumn('revision'), 'A fresh migration sequence should create the revision column.');
+    assertSameValue(0, $freshTable->columns['revision']['options']['default'] ?? null, 'A fresh revision column should default to zero.');
+    assertSameValue(['team_code', 'plan_month'], $freshTable->uniqueIndexes['adp_month_plan_unique'] ?? null, 'A fresh schema should enforce one status per team and month.');
+
+    $upgradeSchema = new MigrationSchemaFake();
+    $upgradeTable = $upgradeSchema->createTable('adp_month_plans');
+    $upgradeTable->addColumn('status', 'string', ['notnull' => true, 'default' => 'draft']);
+    $upgradeTable->rows = [
+        ['status' => 'planned'],
+        ['status' => 'approved'],
+    ];
+    $run(new Version000004Date202608090001(), $upgradeSchema);
+    assertSameValue(
+        [
+            ['status' => 'planned', 'revision' => 0],
+            ['status' => 'approved', 'revision' => 0],
+        ],
+        $upgradeTable->rows,
+        'Existing month statuses should be preserved and receive revision zero during upgrade.'
+    );
+
+    $run(new Version000004Date202608090001(), $upgradeSchema);
+    assertSameValue(1, $upgradeTable->revisionAdditions, 'Repeating the revision migration must not add the column twice.');
+
+    $missingBaseSchema = new MigrationSchemaFake();
+    $run(new Version000004Date202608090001(), $missingBaseSchema);
+    assertSameValue(false, $missingBaseSchema->hasTable('adp_month_plans'), 'The revision migration must not invent a missing base table out of sequence.');
+
+    echo 'AdPlaner migration execution tests passed' . PHP_EOL;
+}
diff --git a/tests/PrivacyDdevSmokeContractTest.php b/tests/PrivacyDdevSmokeContractTest.php
new file mode 100644
index 0000000..9caf5e3
--- /dev/null
+++ b/tests/PrivacyDdevSmokeContractTest.php
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+$smoke = file_get_contents(__DIR__ . '/privacy-ddev-smoke.sh');
+$probe = file_get_contents(__DIR__ . '/integration/PrivacyRuntimeProbe.php');
+if ($smoke === false || $probe === false) {
+    throw new RuntimeException('Der Datenschutz-DDEV-Smoke konnte nicht gelesen werden.');
+}
+
+foreach (['trap \'cleanup || report_failed_cleanup\' EXIT', 'user:disable', 'assert-note-absent', 'assert-clean'] as $contract) {
+    if (!str_contains($smoke, $contract)) {
+        throw new RuntimeException('Dem Datenschutz-DDEV-Smoke fehlt ein Sicherheitsvertrag: ' . $contract);
+    }
+}
+foreach (['PARAM_INT_ARRAY', "'adp_shift_candidates'", "'adp_day_notes'", "'adp_shift_slots'", "'adp_month_plans'", "'adp_team_settings'"] as $contract) {
+    if (!str_contains($probe, $contract)) {
+        throw new RuntimeException('Der Datenbank-Probe fehlt ein Cleanup-Vertrag: ' . $contract);
+    }
+}
+if (!str_contains($probe, "preg_match('/^P[0-9]{1,15}$/D'")) {
+    throw new RuntimeException('Der Datenbank-Probe begrenzt Löschungen nicht auf synthetische Teamkürzel.');
+}
+
+echo 'AdPlaner privacy DDEV smoke contract test passed' . PHP_EOL;
diff --git a/tests/Repository/ShiftPlanRepositoryTest.php b/tests/Repository/ShiftPlanRepositoryTest.php
new file mode 100644
index 0000000..f9a4643
--- /dev/null
+++ b/tests/Repository/ShiftPlanRepositoryTest.php
@@ -0,0 +1,149 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCP {
+    interface IDBConnection {
+        public function getQueryBuilder();
+    }
+}
+
+namespace OCP\DB\QueryBuilder {
+    interface IQueryBuilder {
+        public const PARAM_INT = 'int';
+        public const PARAM_DATETIME_IMMUTABLE = 'datetime_immutable';
+    }
+}
+
+namespace OCP\DB {
+    class Exception extends \Exception {
+        public const REASON_DRIVER = 6;
+        public const REASON_UNIQUE_CONSTRAINT_VIOLATION = 14;
+
+        public function __construct(private ?int $reason) {
+            parent::__construct('Synthetic database failure');
+        }
+
+        public function getReason(): ?int {
+            return $this->reason;
+        }
+    }
+}
+
+namespace {
+    require_once dirname(__DIR__) . '/bootstrap.php';
+
+    use OCA\AdPlaner\Repository\ShiftPlanRepository;
+    use OCP\DB\Exception;
+    use OCP\IDBConnection;
+    use function OCA\AdPlaner\Tests\assertSameValue;
+
+    final class CandidateResultFake {
+        public function __construct(private array|false $row = false) {}
+
+        public function fetchAssociative(): array|false {
+            return $this->row;
+        }
+    }
+
+    final class CandidateExpressionFake {
+        public function eq(mixed $left, mixed $right): array {
+            return [$left, $right];
+        }
+
+        public function orX(mixed ...$conditions): array {
+            return $conditions;
+        }
+    }
+
+    final class CandidateConnectionFake implements IDBConnection {
+        public int $insertFailureReason = Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION;
+        public int $insertAttempts = 0;
+        public int $updateAttempts = 0;
+        public array|false $statusRow = false;
+        public array $updatedColumns = [];
+
+        public function getQueryBuilder(): CandidateQueryBuilderFake {
+            return new CandidateQueryBuilderFake($this);
+        }
+    }
+
+    final class CandidateQueryBuilderFake {
+        private string $operation = 'select';
+        private string $table = '';
+
+        public function __construct(private CandidateConnectionFake $connection) {
+        }
+
+        public function select(string ...$columns): self { return $this; }
+        public function from(string $table): self {
+            $this->table = $table;
+            return $this;
+        }
+        public function where(mixed $condition): self { return $this; }
+        public function andWhere(mixed $condition): self { return $this; }
+        public function setMaxResults(int $limit): self { return $this; }
+        public function expr(): CandidateExpressionFake { return new CandidateExpressionFake(); }
+        public function createNamedParameter(mixed $value, mixed $type = null): mixed { return $value; }
+        public function createFunction(string $expression): string { return $expression; }
+
+        public function insert(string $table): self {
+            $this->operation = 'insert';
+            return $this;
+        }
+
+        public function values(array $values): self { return $this; }
+        public function update(string $table): self {
+            $this->operation = 'update';
+            $this->table = $table;
+            return $this;
+        }
+        public function set(string $column, mixed $value): self {
+            $this->connection->updatedColumns[] = $column;
+            return $this;
+        }
+        public function executeQuery(): CandidateResultFake {
+            return new CandidateResultFake($this->table === 'adp_month_plans' ? $this->connection->statusRow : false);
+        }
+
+        public function executeStatement(): int {
+            if ($this->operation === 'update') {
+                $this->connection->updateAttempts++;
+                return 1;
+            }
+
+            $this->connection->insertAttempts++;
+            throw new Exception($this->connection->insertFailureReason);
+        }
+    }
+
+    $connection = new CandidateConnectionFake();
+    $repository = new ShiftPlanRepository($connection);
+    $repository->addCandidate(7, 'assistant-a', 'test-eb');
+    assertSameValue(1, $connection->insertAttempts, 'A concurrent duplicate candidate should require only one insert attempt.');
+
+    $noteConnection = new CandidateConnectionFake();
+    $noteRepository = new ShiftPlanRepository($noteConnection);
+    $noteRepository->saveDayNote('A1', '2026-08-03', 'Neuester Inhalt', 'test-eb');
+    assertSameValue(1, $noteConnection->insertAttempts, 'A first day-note save should attempt one insert.');
+    assertSameValue(1, $noteConnection->updateAttempts, 'A concurrent first day-note insert must be recovered with one update.');
+
+    $lockConnection = new CandidateConnectionFake();
+    $lockConnection->statusRow = ['status' => 'planned'];
+    $lockRepository = new ShiftPlanRepository($lockConnection);
+    assertSameValue('planned', $lockRepository->lockMonthStatus('A1', '2026-08', ['draft', 'planned']), 'A matching month status should be locked.');
+    assertSameValue(['revision'], $lockConnection->updatedColumns, 'A technical month lock must not persist viewer identity or overwrite the last functional update time.');
+
+    $failingConnection = new CandidateConnectionFake();
+    $failingConnection->insertFailureReason = Exception::REASON_DRIVER;
+    $failingRepository = new ShiftPlanRepository($failingConnection);
+    try {
+        $failingRepository->addCandidate(7, 'assistant-a', 'test-eb');
+    } catch (Exception $exception) {
+        assertSameValue(Exception::REASON_DRIVER, $exception->getReason(), 'A non-unique candidate database failure must propagate unchanged.');
+        echo 'AdPlaner shift plan repository tests passed' . PHP_EOL;
+        return;
+    }
+
+    throw new RuntimeException('A non-unique candidate database failure must not be swallowed.');
+}
diff --git a/tests/Repository/TeamSettingsRepositoryTest.php b/tests/Repository/TeamSettingsRepositoryTest.php
new file mode 100644
index 0000000..e24790e
--- /dev/null
+++ b/tests/Repository/TeamSettingsRepositoryTest.php
@@ -0,0 +1,167 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCP {
+    interface IDBConnection {
+        public function getQueryBuilder();
+    }
+}
+
+namespace OCP\DB\QueryBuilder {
+    interface IQueryBuilder {
+        public const PARAM_DATETIME_IMMUTABLE = 'datetime_immutable';
+    }
+}
+
+namespace OCP\DB {
+    class Exception extends \Exception {
+        public const REASON_DRIVER = 6;
+        public const REASON_UNIQUE_CONSTRAINT_VIOLATION = 14;
+
+        public function __construct(private ?int $reason) {
+            parent::__construct('Synthetic database failure');
+        }
+
+        public function getReason(): ?int {
+            return $this->reason;
+        }
+    }
+}
+
+namespace {
+    require_once dirname(__DIR__) . '/bootstrap.php';
+
+    use OCA\AdPlaner\Repository\TeamSettingsRepository;
+    use OCP\DB\Exception;
+    use OCP\IDBConnection;
+    use function OCA\AdPlaner\Tests\assertSameValue;
+
+    final class TeamSettingsResultFake {
+        public function __construct(private array|false $row) {
+        }
+
+        public function fetchAssociative(): array|false {
+            return $this->row;
+        }
+    }
+
+    final class TeamSettingsExpressionFake {
+        public function eq(mixed $left, mixed $right): array {
+            return [$left, $right];
+        }
+    }
+
+    final class TeamSettingsConnectionFake implements IDBConnection {
+        public array|false $row = false;
+        public ?int $insertFailureReason = null;
+        public int $insertAttempts = 0;
+        public int $updateAttempts = 0;
+
+        public function getQueryBuilder(): TeamSettingsQueryBuilderFake {
+            return new TeamSettingsQueryBuilderFake($this);
+        }
+    }
+
+    final class TeamSettingsQueryBuilderFake {
+        private string $operation = 'select';
+        private array $values = [];
+
+        public function __construct(private TeamSettingsConnectionFake $connection) {
+        }
+
+        public function select(string ...$columns): self {
+            $this->operation = 'select';
+            return $this;
+        }
+
+        public function from(string $table): self {
+            return $this;
+        }
+
+        public function where(mixed $condition): self {
+            return $this;
+        }
+
+        public function expr(): TeamSettingsExpressionFake {
+            return new TeamSettingsExpressionFake();
+        }
+
+        public function createNamedParameter(mixed $value, mixed $type = null): mixed {
+            return $value;
+        }
+
+        public function insert(string $table): self {
+            $this->operation = 'insert';
+            return $this;
+        }
+
+        public function values(array $values): self {
+            $this->values = $values;
+            return $this;
+        }
+
+        public function update(string $table): self {
+            $this->operation = 'update';
+            return $this;
+        }
+
+        public function set(string $column, mixed $value): self {
+            $this->values[$column] = $value;
+            return $this;
+        }
+
+        public function executeQuery(): TeamSettingsResultFake {
+            return new TeamSettingsResultFake($this->connection->row);
+        }
+
+        public function executeStatement(): int {
+            if ($this->operation === 'insert') {
+                $this->connection->insertAttempts++;
+                if ($this->connection->insertFailureReason !== null) {
+                    $reason = $this->connection->insertFailureReason;
+                    if ($reason === Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION) {
+                        $this->connection->row = [
+                            'team_code' => $this->values['team_code'],
+                            'display_name' => 'Concurrent name',
+                            'settings_json' => '{}',
+                        ];
+                    }
+                    throw new Exception($reason);
+                }
+                $this->connection->row = $this->values;
+                return 1;
+            }
+
+            $this->connection->updateAttempts++;
+            if ($this->connection->row !== false) {
+                $this->connection->row = array_merge($this->connection->row, $this->values);
+            }
+            return 1;
+        }
+    }
+
+    $connection = new TeamSettingsConnectionFake();
+    $connection->insertFailureReason = Exception::REASON_UNIQUE_CONSTRAINT_VIOLATION;
+    $repository = new TeamSettingsRepository($connection);
+    $repository->save('A1', 'Latest name', ['meetingDay' => 'monday']);
+
+    assertSameValue(1, $connection->insertAttempts, 'A first save should attempt one insert.');
+    assertSameValue(1, $connection->updateAttempts, 'A concurrent first insert must be recovered with one update.');
+    assertSameValue('Latest name', $connection->row['display_name'] ?? null, 'The successfully completed save must persist its display name.');
+    assertSameValue('{"meetingDay":"monday"}', $connection->row['settings_json'] ?? null, 'The successfully completed save must persist its settings.');
+
+    $failingConnection = new TeamSettingsConnectionFake();
+    $failingConnection->insertFailureReason = Exception::REASON_DRIVER;
+    $failingRepository = new TeamSettingsRepository($failingConnection);
+    try {
+        $failingRepository->save('A1', 'Name', []);
+    } catch (Exception $exception) {
+        assertSameValue(Exception::REASON_DRIVER, $exception->getReason(), 'A non-unique database failure must propagate unchanged.');
+        assertSameValue(0, $failingConnection->updateAttempts, 'A non-unique database failure must not trigger an update.');
+        echo 'AdPlaner team settings repository tests passed' . PHP_EOL;
+        return;
+    }
+
+    throw new RuntimeException('A non-unique database failure must not be swallowed.');
+}
diff --git a/tests/RouteContractTest.php b/tests/RouteContractTest.php
new file mode 100644
index 0000000..017fd64
--- /dev/null
+++ b/tests/RouteContractTest.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+$configuration = require dirname(__DIR__) . '/appinfo/routes.php';
+$routes = $configuration['routes'] ?? [];
+$byName = [];
+foreach ($routes as $route) {
+    $byName[$route['name'] ?? ''] = $route;
+}
+
+foreach (['api#addShiftCandidate', 'api#removeShiftCandidate'] as $name) {
+    $slotRequirement = $byName[$name]['requirements']['slotId'] ?? null;
+    if ($slotRequirement !== '\\d+') {
+        throw new RuntimeException($name . ' muss nichtnumerische Schicht-IDs bereits an der Route abweisen.');
+    }
+}
+
+echo 'AdPlaner route contract tests passed' . PHP_EOL;
diff --git a/tests/Service/MonthPlanStatusServiceTest.php b/tests/Service/MonthPlanStatusServiceTest.php
new file mode 100644
index 0000000..af4bcb2
--- /dev/null
+++ b/tests/Service/MonthPlanStatusServiceTest.php
@@ -0,0 +1,214 @@
+<?php
+
+declare(strict_types=1);
+
+require_once dirname(__DIR__) . '/bootstrap.php';
+
+use OCA\AdPlaner\Model\ShiftSlot;
+use OCA\AdPlaner\Model\Team;
+use OCA\AdPlaner\Service\ScheduleService;
+use OCA\AdPlaner\Service\ShiftConfigService;
+use OCA\AdPlaner\Service\TeamAccessService;
+use OCA\AdPlaner\Service\PlanningHintService;
+use OCA\AdPlaner\Store\ShiftPlanStore;
+use function OCA\AdPlaner\Tests\assertDomainException;
+use function OCA\AdPlaner\Tests\assertSameValue;
+
+final class MonthPlanStatusStoreFake extends ShiftPlanStore {
+    /** @var array<string, string> */
+    public array $statuses = [];
+    public array $added = [];
+    public array $updatedSlots = [];
+    public array $insertedSlots = [];
+    public int $transactionCalls = 0;
+    public bool $rejectNextTransition = false;
+    public array $candidatesBySlot = [];
+
+    public function __construct() {}
+
+    public function monthStatus(string $teamCode, string $month): string {
+        return $this->statuses[$teamCode . '|' . $month] ?? 'draft';
+    }
+
+    public function transitionMonthStatus(string $teamCode, string $month, string $expectedStatus, string $targetStatus, string $updatedByUid): bool {
+        if ($this->rejectNextTransition) {
+            $this->rejectNextTransition = false;
+            return false;
+        }
+        $key = $teamCode . '|' . $month;
+        if ($this->monthStatus($teamCode, $month) !== $expectedStatus) {
+            return false;
+        }
+        $this->statuses[$key] = $targetStatus;
+        return true;
+    }
+
+    public function ensureMonthStatus(string $teamCode, string $month, string $updatedByUid): void {
+        $this->statuses[$teamCode . '|' . $month] ??= 'draft';
+    }
+
+    public function lockMonthStatus(string $teamCode, string $month, array $expectedStatuses): ?string {
+        $status = $this->monthStatus($teamCode, $month);
+
+        return in_array($status, $expectedStatuses, true) ? $status : null;
+    }
+
+    public function transactional(callable $operation): mixed {
+        $this->transactionCalls++;
+        $statuses = $this->statuses;
+        $updatedSlots = $this->updatedSlots;
+        $insertedSlots = $this->insertedSlots;
+        try {
+            return $operation();
+        } catch (\Throwable $exception) {
+            $this->statuses = $statuses;
+            $this->updatedSlots = $updatedSlots;
+            $this->insertedSlots = $insertedSlots;
+            throw $exception;
+        }
+    }
+
+    public function slotForMonth(int $slotId, string $teamCode, string $month): ?ShiftSlot {
+        return new ShiftSlot($slotId, $teamCode, $month, $month . '-01', 'early', 'Früh', '08:00', '14:00', true);
+    }
+
+    public function slotsForMonth(string $teamCode, string $month): array {
+        return [new ShiftSlot(1, $teamCode, $month, $month . '-01', 'early', 'Früh', '08:00', '14:00', true)];
+    }
+
+    public function candidatesForSlotIds(array $slotIds): array { return $this->candidatesBySlot; }
+    public function dayNotesForMonth(string $teamCode, string $month): array { return []; }
+
+    public function addCandidate(int $slotId, string $assistantUid, string $createdByUid): void {
+        $this->added[] = compact('slotId', 'assistantUid', 'createdByUid');
+    }
+
+    public function updateSlotDefinition(int $slotId, string $label, string $startsAt, string $endsAt, bool $enabled): void {
+        $this->updatedSlots[] = compact('slotId', 'label', 'startsAt', 'endsAt', 'enabled');
+    }
+
+    public function insertSlot(
+        string $teamCode,
+        string $month,
+        string $workDate,
+        string $segmentKey,
+        string $label,
+        string $startsAt,
+        string $endsAt,
+        bool $enabled
+    ): int {
+        $this->insertedSlots[] = compact(
+            'teamCode',
+            'month',
+            'workDate',
+            'segmentKey',
+            'label',
+            'startsAt',
+            'endsAt',
+            'enabled'
+        );
+        return 100 + count($this->insertedSlots);
+    }
+}
+
+final class MonthPlanStatusTeamAccessFake extends TeamAccessService {
+    public function __construct() {}
+}
+
+final class MonthPlanStatusHintServiceFake extends PlanningHintService {
+    public function __construct() {}
+    public function forMonth(string $month, array $employeeUids): array { return []; }
+}
+
+$assistants = [[
+    'uid' => 'assistant-a',
+    'displayName' => 'Assistant A',
+    'isEb' => false,
+    'canReceiveShifts' => true,
+]];
+$settings = ['shifts' => [[
+    'key' => 'early',
+    'label' => 'Früh',
+    'startsAt' => '08:00',
+    'endsAt' => '14:00',
+    'enabled' => true,
+]]];
+$assistantTeam = new Team('A1', 'ad-ASN-A1', 'Team A1', $assistants, false, $settings);
+$ebTeam = new Team('A1', 'ad-ASN-A1', 'Team A1', $assistants, true, $settings);
+$store = new MonthPlanStatusStoreFake();
+$service = new ScheduleService($store, new ShiftConfigService(), new MonthPlanStatusTeamAccessFake(), new MonthPlanStatusHintServiceFake());
+
+assertSameValue('draft', $service->monthPlan($ebTeam, '2026-08', 'test-eb')['status'] ?? null, 'A new month plan starts as draft.');
+assertDomainException(
+    static fn() => $service->transitionMonthStatus($assistantTeam, '2026-08', 'planned', 'assistant-a'),
+    'Only the responsible EB may transition a month plan.'
+);
+assertDomainException(
+    static fn() => $service->transitionMonthStatus($ebTeam, '2026-08', 'approved', 'test-eb'),
+    'A draft plan may not skip the planned state.'
+);
+
+$directStore = new MonthPlanStatusStoreFake();
+$directService = new ScheduleService($directStore, new ShiftConfigService(), new MonthPlanStatusTeamAccessFake(), new MonthPlanStatusHintServiceFake());
+assertSameValue('planned', $directService->transitionMonthStatus($ebTeam, '2026-08', 'planned', 'test-eb'), 'A month can be planned without loading it first.');
+assertSameValue('approved', $directService->transitionMonthStatus($ebTeam, '2026-08', 'approved', 'test-eb'), 'A month can be approved without loading it first.');
+assertSameValue(2, $directStore->transactionCalls, 'Status transitions run through the store transaction boundary.');
+assertSameValue(30, count($directStore->insertedSlots), 'Approval materializes every missing slot before freezing the plan.');
+
+assertSameValue('planned', $service->transitionMonthStatus($ebTeam, '2026-08', 'planned', 'test-eb'), 'EB can mark a draft plan as planned.');
+assertSameValue('approved', $service->transitionMonthStatus($ebTeam, '2026-08', 'approved', 'test-eb'), 'EB can approve a planned plan.');
+assertDomainException(
+    static fn() => $service->addCandidate($ebTeam, '2026-08', 1, 'assistant-a', 'test-eb'),
+    'Approved plans reject candidate mutations.'
+);
+assertDomainException(
+    static fn() => $service->saveDayNote($ebTeam, '2026-08', '2026-08-01', 'Gesperrt', 'test-eb'),
+    'Approved plans reject note mutations.'
+);
+
+$store->updatedSlots = [];
+assertSameValue('approved', $service->monthPlan($ebTeam, '2026-08', 'test-eb')['status'] ?? null, 'Approved status remains visible after reload.');
+assertSameValue([], $store->updatedSlots, 'Loading an approved plan does not rewrite frozen slot definitions.');
+$changedSettingsTeam = new Team('A1', 'ad-ASN-A1', 'Team A1', $assistants, true, ['shifts' => [[
+    'key' => 'late',
+    'label' => 'Spät neu',
+    'startsAt' => '14:00',
+    'endsAt' => '20:00',
+    'enabled' => true,
+]]]);
+$approvedSnapshot = $service->monthPlan($changedSettingsTeam, '2026-08', 'test-eb');
+assertSameValue(
+    ['early'],
+    array_column($approvedSnapshot['segments'] ?? [], 'key'),
+    'Approved plans should render the frozen slot segments instead of later team settings.'
+);
+
+$store->candidatesBySlot = [
+    1 => [
+        new \OCA\AdPlaner\Model\ShiftCandidate(1, 1, 'assistant-a', 'test-eb'),
+        new \OCA\AdPlaner\Model\ShiftCandidate(2, 1, 'former-assistant', 'test-eb'),
+    ],
+];
+$privacyMinimizedSnapshot = $service->monthPlan($ebTeam, '2026-08', 'test-eb');
+assertSameValue(
+    ['assistant-a'],
+    array_column($privacyMinimizedSnapshot['days'][0]['slots'][0]['candidates'] ?? [], 'uid'),
+    'Approved plans should expose only currently assignable team members instead of freezing historical person data.'
+);
+
+assertSameValue('planned', $service->transitionMonthStatus($ebTeam, '2026-08', 'planned', 'test-eb'), 'EB has an explicit unlock path back to planned.');
+$insertedBeforeConflict = $store->insertedSlots;
+$updatedBeforeConflict = $store->updatedSlots;
+$store->rejectNextTransition = true;
+assertDomainException(
+    static fn() => $service->transitionMonthStatus($ebTeam, '2026-08', 'approved', 'test-eb'),
+    'A concurrent status conflict rejects approval.'
+);
+assertSameValue('planned', $store->monthStatus('A1', '2026-08'), 'A failed approval keeps the concurrent month status.');
+assertSameValue($insertedBeforeConflict, $store->insertedSlots, 'A failed approval rolls back newly materialized slots.');
+assertSameValue($updatedBeforeConflict, $store->updatedSlots, 'A failed approval rolls back slot-definition updates.');
+$service->addCandidate($ebTeam, '2026-08', 1, 'assistant-a', 'test-eb');
+assertSameValue(1, count($store->added), 'Unlocked plans accept candidate mutations again.');
+assertSameValue('draft', $service->transitionMonthStatus($ebTeam, '2026-08', 'draft', 'test-eb'), 'EB can explicitly reset a planned plan to draft.');
+
+echo "AdPlaner month plan status tests passed\n";
diff --git a/tests/Service/PlanningHintServiceTest.php b/tests/Service/PlanningHintServiceTest.php
new file mode 100644
index 0000000..97830fa
--- /dev/null
+++ b/tests/Service/PlanningHintServiceTest.php
@@ -0,0 +1,107 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCP\EventDispatcher {
+    if (!class_exists(Event::class)) {
+        class Event { public function __construct() {} }
+    }
+    if (!interface_exists(IEventDispatcher::class)) {
+        interface IEventDispatcher {
+            public function dispatchTyped(Event $event): Event;
+        }
+    }
+}
+
+namespace {
+    require_once dirname(__DIR__) . '/bootstrap.php';
+
+    use OCA\AdPlaner\Service\PlanningHintService;
+    use OCA\AdPlaner\Service\AdPlanerLogger;
+    use OCA\LocalBase\Calendar\AbsenceInterval;
+    use OCA\LocalBase\Calendar\AbsenceQueryEvent;
+    use OCA\LocalBase\Calendar\ScheduleConflict;
+    use OCA\LocalBase\Calendar\ScheduleConflictQueryEvent;
+    use OCP\EventDispatcher\Event;
+    use OCP\EventDispatcher\IEventDispatcher;
+    use function OCA\AdPlaner\Tests\assertSameValue;
+
+    final class PlanningHintEventDispatcherFake implements IEventDispatcher {
+        public bool $provideData = true;
+        public bool $throwAbsence = false;
+        public bool $throwCalendar = false;
+
+        public function dispatchTyped(Event $event): Event {
+            if ($this->throwAbsence && $event instanceof AbsenceQueryEvent) {
+                throw new \RuntimeException('Absence provider failed');
+            }
+            if ($this->throwCalendar && $event instanceof ScheduleConflictQueryEvent) {
+                throw new \RuntimeException('Calendar provider failed');
+            }
+            if (!$this->provideData) {
+                return $event;
+            }
+            $utc = new \DateTimeZone('UTC');
+            if ($event instanceof AbsenceQueryEvent) {
+                $event->add(new AbsenceInterval('assistant-a', new \DateTimeImmutable('2026-08-02', $utc), new \DateTimeImmutable('2026-08-04', $utc), 'planned'));
+                $event->add(new AbsenceInterval('assistant-b', new \DateTimeImmutable('2026-08-05', $utc), new \DateTimeImmutable('2026-08-06', $utc), 'approved'));
+                $event->add(new AbsenceInterval('foreign-person', new \DateTimeImmutable('2026-08-09', $utc), new \DateTimeImmutable('2026-08-10', $utc), 'approved'));
+            }
+            if ($event instanceof ScheduleConflictQueryEvent && $event->employeeUid() === 'assistant-a') {
+                $event->add(new ScheduleConflict('appointment', new \DateTimeImmutable('2026-08-07 10:00:00', $utc), new \DateTimeImmutable('2026-08-07 11:00:00', $utc), 'Vertraulicher Titel'));
+            }
+
+            return $event;
+        }
+    }
+
+    final class PlanningHintLoggerFake extends AdPlanerLogger {
+        public array $errors = [];
+
+        public function __construct() {}
+
+        public function error(string $action, \Throwable $exception, array $context = []): void {
+            $this->errors[] = compact('action', 'context');
+        }
+    }
+
+    $events = new PlanningHintEventDispatcherFake();
+    $logger = new PlanningHintLoggerFake();
+    $service = new PlanningHintService($events, $logger);
+    $hints = $service->forMonth('2026-08', ['assistant-a', 'assistant-b']);
+
+    assertSameValue('U?', $hints['2026-08-02'][0]['marker'] ?? null, 'Planned vacation is exposed as U?.');
+    assertSameValue(false, $hints['2026-08-02'][0]['blocks'] ?? null, 'Planning hints never block AdPlaner mutations.');
+    assertSameValue('U', $hints['2026-08-05'][0]['marker'] ?? null, 'Approved vacation remains distinguishable.');
+    assertSameValue('K', $hints['2026-08-07'][0]['marker'] ?? null, 'Calendar occupation is exposed as a compact marker.');
+    assertSameValue('Termin', $hints['2026-08-07'][0]['label'] ?? null, 'Calendar titles are not leaked into the team plan.');
+    assertSameValue('assistant-a', $hints['2026-08-07'][0]['employeeUid'] ?? null, 'Hints remain assigned to the visible team member.');
+    assertSameValue(false, isset($hints['2026-08-09']), 'Absences returned for a non-requested person must not enter the team plan.');
+    $hintUids = [];
+    foreach ($hints as $dayHints) {
+        array_push($hintUids, ...array_column($dayHints, 'employeeUid'));
+    }
+    assertSameValue(false, in_array('foreign-person', $hintUids, true), 'A foreign provider UID must not leak through any day hint.');
+
+    $events->throwAbsence = true;
+    $withoutAbsenceProvider = $service->forMonth('2026-08', ['assistant-a']);
+    assertSameValue('K', $withoutAbsenceProvider['2026-08-07'][0]['marker'] ?? null, 'A failing absence provider must not block calendar hints.');
+    $events->throwAbsence = false;
+    $events->throwCalendar = true;
+    $withoutCalendarProvider = $service->forMonth('2026-08', ['assistant-a']);
+    assertSameValue('U?', $withoutCalendarProvider['2026-08-02'][0]['marker'] ?? null, 'A failing calendar provider must not block absence hints.');
+    assertSameValue(
+        [
+            ['action' => 'planning_hint_absences', 'context' => ['month' => '2026-08']],
+            ['action' => 'planning_hint_calendar', 'context' => ['month' => '2026-08']],
+        ],
+        $logger->errors,
+        'Provider failures should be logged without employee identifiers.'
+    );
+    $events->throwCalendar = false;
+
+    $events->provideData = false;
+    assertSameValue([], $service->forMonth('2026-08', ['assistant-a']), 'Missing providers are a valid empty standalone state.');
+
+    echo "AdPlaner planning hint service tests passed\n";
+}
diff --git a/tests/Service/ScheduleServiceSmokeTest.php b/tests/Service/ScheduleServiceSmokeTest.php
index 2ec9bb1..b132bdf 100644
--- a/tests/Service/ScheduleServiceSmokeTest.php
+++ b/tests/Service/ScheduleServiceSmokeTest.php
@@ -2,19 +2,7 @@
 
 declare(strict_types=1);
 
-require __DIR__ . '/helpers.php';
-require __DIR__ . '/../../../localbase/lib/Model/ModelApiTrait.php';
-require __DIR__ . '/../../../localbase/lib/Organization/AdOrganizationDefinition.php';
-require __DIR__ . '/../../lib/Model/Assistant.php';
-require __DIR__ . '/../../lib/Model/ShiftCandidate.php';
-require __DIR__ . '/../../lib/Model/ShiftDefinition.php';
-require __DIR__ . '/../../lib/Model/ShiftSlot.php';
-require __DIR__ . '/../../lib/Model/Team.php';
-require __DIR__ . '/../../lib/Repository/ShiftPlanRepository.php';
-require __DIR__ . '/../../lib/Service/ShiftConfigService.php';
-require __DIR__ . '/../../lib/Service/TeamAccessService.php';
-require __DIR__ . '/../../lib/Service/ScheduleService.php';
-require __DIR__ . '/../../lib/Store/ShiftPlanStore.php';
+require_once dirname(__DIR__) . '/bootstrap.php';
 
 use OCA\AdPlaner\Model\ShiftCandidate;
 use OCA\AdPlaner\Model\ShiftSlot;
@@ -22,27 +10,69 @@
 use OCA\AdPlaner\Service\ScheduleService;
 use OCA\AdPlaner\Service\ShiftConfigService;
 use OCA\AdPlaner\Service\TeamAccessService;
+use OCA\AdPlaner\Service\PlanningHintService;
 use OCA\AdPlaner\Store\ShiftPlanStore;
 use function OCA\AdPlaner\Tests\assertDomainException;
 use function OCA\AdPlaner\Tests\assertSameValue;
 
 class FakeShiftPlanStoreForSchedule extends ShiftPlanStore {
     public array $added = [];
+    public array $removed = [];
     public array $slots = [];
     public array $updatedSlots = [];
     public array $insertedSlots = [];
+    public array $savedNotes = [];
+    public array $deletedNotes = [];
+    public bool $slotEnabled = true;
+    public string $status = 'draft';
+    public ?string $statusOnNextLock = null;
+    public int $transactionCalls = 0;
+    public array $lockCalls = [];
 
     public function __construct() {
     }
 
+    public function monthStatus(string $teamCode, string $month): string {
+        return $this->status;
+    }
+
+    public function transactional(callable $operation): mixed {
+        $this->transactionCalls++;
+        return $operation();
+    }
+
+    public function ensureMonthStatus(string $teamCode, string $month, string $updatedByUid): void {}
+
+    public function lockMonthStatus(string $teamCode, string $month, array $expectedStatuses): ?string {
+        $this->lockCalls[] = compact('teamCode', 'month', 'expectedStatuses');
+        if ($this->statusOnNextLock !== null) {
+            $this->status = $this->statusOnNextLock;
+            $this->statusOnNextLock = null;
+        }
+
+        return in_array($this->status, $expectedStatuses, true) ? $this->status : null;
+    }
+
     public function slotForMonth(int $slotId, string $teamCode, string $month): ?ShiftSlot {
-        return new ShiftSlot($slotId, $teamCode, $month, $month . '-01', 'early', 'Früh', '08:00', '14:00', true);
+        return new ShiftSlot($slotId, $teamCode, $month, $month . '-01', 'early', 'Früh', '08:00', '14:00', $this->slotEnabled);
     }
 
     public function addCandidate(int $slotId, string $assistantUid, string $createdByUid): void {
         $this->added[] = compact('slotId', 'assistantUid', 'createdByUid');
     }
 
+    public function removeCandidate(int $slotId, string $assistantUid): void {
+        $this->removed[] = compact('slotId', 'assistantUid');
+    }
+
+    public function saveDayNote(string $teamCode, string $workDate, string $note, string $updatedByUid): void {
+        $this->savedNotes[] = compact('teamCode', 'workDate', 'note', 'updatedByUid');
+    }
+
+    public function deleteDayNote(string $teamCode, string $workDate): void {
+        $this->deletedNotes[] = compact('teamCode', 'workDate');
+    }
+
     public function slotsForMonth(string $teamCode, string $month): array {
         if ($this->slots !== []) {
             return $this->slots;
@@ -117,6 +147,19 @@ public function __construct() {
     }
 }
 
+class FakePlanningHintServiceForSchedule extends PlanningHintService {
+    public function __construct() {}
+    public function forMonth(string $month, array $employeeUids): array {
+        return [$month . '-01' => [[
+            'employeeUid' => 'assistant-a',
+            'type' => 'absence',
+            'marker' => 'U?',
+            'label' => 'Urlaub',
+            'blocks' => false,
+        ]]];
+    }
+}
+
 $assistants = [
     ['uid' => 'assistant-a', 'displayName' => 'Assistant A', 'isEb' => false, 'canReceiveShifts' => true],
     ['uid' => 'test-eb', 'displayName' => 'Test EB', 'isEb' => true, 'canReceiveShifts' => false],
@@ -139,7 +182,16 @@ public function __construct() {
 assertSameValue('Team A1', $mappedTeam->toArray()['displayName'], 'Team::get should keep the API payload shape.');
 
 $store = new FakeShiftPlanStoreForSchedule();
-$service = new ScheduleService($store, new ShiftConfigService(), new FakeTeamAccessServiceForSchedule());
+$service = new ScheduleService($store, new ShiftConfigService(), new FakeTeamAccessServiceForSchedule(), new FakePlanningHintServiceForSchedule());
+
+$approvalRaceStore = new FakeShiftPlanStoreForSchedule();
+$approvalRaceStore->statusOnNextLock = 'approved';
+$approvalRaceService = new ScheduleService($approvalRaceStore, new ShiftConfigService(), new FakeTeamAccessServiceForSchedule(), new FakePlanningHintServiceForSchedule());
+$approvalRacePlan = $approvalRaceService->monthPlan($ebTeam, '2026-07', 'test-eb');
+assertSameValue('approved', $approvalRacePlan['status'] ?? null, 'A concurrent approval must win over mutable month materialization.');
+assertSameValue([], $approvalRaceStore->updatedSlots, 'A concurrent approval must prevent slot-definition rewrites.');
+assertSameValue([], $approvalRaceStore->insertedSlots, 'A concurrent approval must prevent missing-slot inserts.');
+assertSameValue(1, $approvalRaceStore->transactionCalls, 'Mutable month materialization must run inside one transaction.');
 
 $service->addCandidate($assistantTeam, '2026-07', 9, '', 'assistant-a');
 assertSameValue('assistant-a', $store->added[0]['assistantUid'] ?? null, 'Assistant should be able to add themself.');
@@ -147,6 +199,19 @@ public function __construct() {
 $service->addCandidate($ebTeam, '2026-07', 9, 'assistant-a', 'test-eb');
 assertSameValue('assistant-a', $store->added[1]['assistantUid'] ?? null, 'EB should be able to assign an assistant.');
 
+$service->removeCandidate($assistantTeam, '2026-07', 9, '', 'assistant-a');
+assertSameValue(
+    ['slotId' => 9, 'assistantUid' => 'assistant-a'],
+    $store->removed[0] ?? null,
+    'An assistant should be able to remove their own request.'
+);
+$service->removeCandidate($ebTeam, '2026-07', 9, 'assistant-a', 'test-eb');
+assertSameValue(
+    ['slotId' => 9, 'assistantUid' => 'assistant-a'],
+    $store->removed[1] ?? null,
+    'The responsible EB should be able to remove another assistant assignment.'
+);
+
 assertDomainException(
     static fn() => $service->addCandidate($ebTeam, '2026-07', 9, '', 'test-eb'),
     'EB should not be able to add themself without selecting an assistant.'
@@ -159,10 +224,96 @@ public function __construct() {
     static fn() => $service->addCandidate($assistantTeam, '2026-07', 9, 'test-eb', 'assistant-a'),
     'Assistants should not assign other users.'
 );
+assertDomainException(
+    static fn() => $service->removeCandidate($assistantTeam, '2026-07', 9, 'test-eb', 'assistant-a'),
+    'Assistants should not remove other users.'
+);
+assertDomainException(
+    static fn() => $service->saveDayNote($assistantTeam, '2026-07', '2026-07-01', 'Nicht erlaubt', 'assistant-a'),
+    'Assistants should not edit day notes.'
+);
+$addedBeforeDisabledMutation = count($store->added);
+$store->slotEnabled = false;
+assertDomainException(
+    static fn() => $service->addCandidate($ebTeam, '2026-07', 9, 'assistant-a', 'test-eb'),
+    'Disabled shift slots must reject direct candidate mutations.'
+);
+assertSameValue($addedBeforeDisabledMutation, count($store->added), 'A rejected disabled-slot mutation must not persist a candidate.');
+$store->slotEnabled = true;
+
+$store->status = 'planned';
+$store->statusOnNextLock = 'approved';
+$addedBeforeConcurrentApproval = count($store->added);
+assertDomainException(
+    static fn() => $service->addCandidate($ebTeam, '2026-07', 9, 'assistant-a', 'test-eb'),
+    'A candidate mutation racing with approval must fail closed.'
+);
+assertSameValue($addedBeforeConcurrentApproval, count($store->added), 'Concurrent approval must prevent the candidate write.');
+
+$store->status = 'planned';
+$store->statusOnNextLock = 'approved';
+assertDomainException(
+    static fn() => $service->saveDayNote($ebTeam, '2026-07', '2026-07-01', 'Nicht speichern', 'test-eb'),
+    'A note mutation racing with approval must fail closed.'
+);
+assertSameValue([], $store->savedNotes, 'Concurrent approval must prevent the note write.');
+$store->status = 'draft';
+
+$mismatchedMonthMessage = '';
+try {
+    $service->saveDayNote($ebTeam, '2026-07', '2026-08-01', 'Nicht speichern', 'test-eb');
+} catch (\Throwable $error) {
+    $mismatchedMonthMessage = $error->getMessage();
+}
+assertSameValue(
+    'Das Datum gehört nicht zum ausgewählten Planungsmonat.',
+    $mismatchedMonthMessage,
+    'A day note should reject a work date outside the requested plan month.'
+);
+assertSameValue([], $store->savedNotes, 'A rejected cross-month day note must not be persisted.');
+$service->saveDayNote($ebTeam, '2026-07', '2026-07-01', '  Hinweis  ', 'test-eb');
+assertSameValue(
+    [[
+        'teamCode' => 'A1',
+        'workDate' => '2026-07-01',
+        'note' => 'Hinweis',
+        'updatedByUid' => 'test-eb',
+    ]],
+    $store->savedNotes,
+    'A day note inside the requested month should be trimmed and persisted.'
+);
+$service->saveDayNote($ebTeam, '2026-07', '2026-07-01', " \n\t ", 'test-eb');
+assertSameValue(
+    [['teamCode' => 'A1', 'workDate' => '2026-07-01']],
+    $store->deletedNotes,
+    'Clearing a day note should remove its no-longer-needed row and editor metadata.'
+);
+assertSameValue(1, count($store->savedNotes), 'Clearing a day note must not persist an empty replacement row.');
+
+$maximumNote = str_repeat('Ä', 2000);
+$service->saveDayNote($ebTeam, '2026-07', '2026-07-01', $maximumNote, 'test-eb');
+assertSameValue($maximumNote, $store->savedNotes[array_key_last($store->savedNotes)]['note'] ?? null, 'A 2,000-character Unicode day note should be valid.');
+
+$assertInvalidNoteWithoutWrite = static function (string $note, string $message) use ($service, $ebTeam, $store): void {
+    $before = count($store->savedNotes);
+    try {
+        $service->saveDayNote($ebTeam, '2026-07', '2026-07-01', $note, 'test-eb');
+    } catch (\InvalidArgumentException) {
+        assertSameValue($before, count($store->savedNotes), $message);
+        return;
+    }
+
+    throw new \RuntimeException($message);
+};
+$assertInvalidNoteWithoutWrite(str_repeat('Ä', 2001), 'A day note longer than 2,000 Unicode characters must be rejected without persistence.');
+$assertInvalidNoteWithoutWrite("\xC3\x28", 'An invalid UTF-8 day note must be rejected without persistence.');
 
 $plan = $service->monthPlan($ebTeam, '2026-07', 'test-eb');
 $slotCandidates = $plan['days'][0]['slots'][0]['candidates'] ?? [];
 assertSameValue(['assistant-a'], array_column($slotCandidates, 'uid'), 'Month plan should hide non-assignable EB candidates.');
+assertSameValue(false, array_key_exists('createdByUid', $slotCandidates[0] ?? []), 'Month plans must not expose the internal candidate creator uid.');
+assertSameValue('Assistant A', $plan['days'][0]['hints'][0]['displayName'] ?? null, 'Planning hints use the visible team label without exposing foreign details.');
+assertSameValue(false, array_key_exists('employeeUid', $plan['days'][0]['hints'][0] ?? []), 'Public planning hints must not expose an internal Nextcloud uid once the visible label is resolved.');
 
 $configuredStore = new FakeShiftPlanStoreForSchedule();
 $configuredStore->slots = [
@@ -176,7 +327,7 @@ public function __construct() {
         ['key' => 'night', 'label' => 'Nacht', 'startsAt' => '20:00', 'endsAt' => '08:00', 'enabled' => false],
     ],
 ]);
-$configuredService = new ScheduleService($configuredStore, new ShiftConfigService(), new FakeTeamAccessServiceForSchedule());
+$configuredService = new ScheduleService($configuredStore, new ShiftConfigService(), new FakeTeamAccessServiceForSchedule(), new FakePlanningHintServiceForSchedule());
 $configuredPlan = $configuredService->monthPlan($configuredTeam, '2026-07', 'test-eb');
 $updatesById = [];
 foreach ($configuredStore->updatedSlots as $updatedSlot) {
diff --git a/tests/Service/ShiftConfigServiceSmokeTest.php b/tests/Service/ShiftConfigServiceSmokeTest.php
index b0047f0..1543f8d 100644
--- a/tests/Service/ShiftConfigServiceSmokeTest.php
+++ b/tests/Service/ShiftConfigServiceSmokeTest.php
@@ -2,10 +2,7 @@
 
 declare(strict_types=1);
 
-require __DIR__ . '/helpers.php';
-require __DIR__ . '/../../../localbase/lib/Model/ModelApiTrait.php';
-require __DIR__ . '/../../lib/Model/ShiftDefinition.php';
-require __DIR__ . '/../../lib/Service/ShiftConfigService.php';
+require_once dirname(__DIR__) . '/bootstrap.php';
 
 use OCA\AdPlaner\Service\ShiftConfigService;
 use function OCA\AdPlaner\Tests\assertSameValue;
@@ -50,6 +47,7 @@
 ]);
 $customSegments = $service->segments($customSettings);
 $days = $service->monthDays('2026-02');
+$leapDays = $service->monthDays('2028-02');
 
 assertSameValue('2026-07-15', $customSettings['meetingDay'], 'Meeting day should be preserved.');
 assertSameValue(['first', 'overlap', 'night'], array_column($customSegments, 'key'), 'Custom shifts should keep their configured order.');
@@ -60,6 +58,27 @@
 assertSameValue(false, $customSegments[2]['enabled'], 'Disabled custom shifts should be preserved.');
 assertSameValue(28, count($days), 'February 2026 should have 28 days.');
 assertSameValue('2026-02-01', $days[0]['date'], 'First month day should be correct.');
+assertSameValue(29, count($leapDays), 'A leap-year February should have 29 days.');
+assertSameValue('2028-02-29', $leapDays[28]['date'] ?? null, 'The leap day should occur exactly once at the end of February 2028.');
+
+$gappedSegments = $service->segments($service->normalize(['shifts' => [
+    ['key' => 'morning', 'label' => 'Vormittag', 'startsAt' => '08:00', 'endsAt' => '10:00', 'enabled' => true],
+    ['key' => 'afternoon', 'label' => 'Nachmittag', 'startsAt' => '12:00', 'endsAt' => '14:00', 'enabled' => true],
+]]));
+assertSameValue(
+    [['08:00', '10:00'], ['12:00', '14:00']],
+    array_map(static fn(array $shift): array => [$shift['startsAt'], $shift['endsAt']], $gappedSegments),
+    'A deliberate gap between shifts should remain valid and must not be closed automatically.'
+);
+
+$unicodeBoundary = $service->normalize(['shifts' => [[
+    'key' => 'unicode',
+    'label' => str_repeat('Ä', 64),
+    'startsAt' => '08:00',
+    'endsAt' => '09:00',
+    'enabled' => true,
+]]]);
+assertSameValue(str_repeat('Ä', 64), $unicodeBoundary['shifts'][0]['label'], 'A 64-character Unicode shift label should be valid.');
 
 $assertInvalidArgument = static function (callable $operation, string $message): void {
     try {
@@ -74,6 +93,18 @@
     static fn() => $service->normalize(['shifts' => 'invalid']),
     'Non-list shift settings should be rejected.'
 );
+$assertInvalidArgument(
+    static fn() => $service->normalize(['shifts' => [
+        'named-shift' => [
+            'key' => 'day',
+            'label' => 'Tag',
+            'startsAt' => '08:00',
+            'endsAt' => '16:00',
+            'enabled' => true,
+        ],
+    ]]),
+    'JSON objects must not be silently reinterpreted as ordered shift lists.'
+);
 $assertInvalidArgument(
     static fn() => $service->monthDays('2026-13'),
     'Out-of-range months should be rejected.'
@@ -86,5 +117,55 @@
     static fn() => $service->normalizeDate('30.02.2026'),
     'Non-ISO calendar dates should be rejected.'
 );
+$assertInvalidArgument(
+    static fn() => $service->normalize(['shifts' => [[
+        'key' => 'blank-label',
+        'label' => '   ',
+        'startsAt' => '08:00',
+        'endsAt' => '09:00',
+        'enabled' => true,
+    ]]]),
+    'A blank shift label must be rejected instead of silently replaced.'
+);
+$assertInvalidArgument(
+    static fn() => $service->normalize(['shifts' => [[
+        'key' => 'too-long',
+        'label' => str_repeat('Ä', 65),
+        'startsAt' => '08:00',
+        'endsAt' => '09:00',
+        'enabled' => true,
+    ]]]),
+    'A Unicode shift label longer than 64 characters should be rejected.'
+);
+$assertInvalidArgument(
+    static fn() => $service->normalize(['shifts' => [[
+        'key' => 'invalid-utf8',
+        'label' => "\xC3\x28",
+        'startsAt' => '08:00',
+        'endsAt' => '09:00',
+        'enabled' => true,
+    ]]]),
+    'An invalid UTF-8 shift label should be rejected.'
+);
+$invalidEnabledShift = static fn(mixed $enabled): array => ['shifts' => [[
+    'key' => 'typed-enabled',
+    'label' => 'Typisiert',
+    'startsAt' => '08:00',
+    'endsAt' => '09:00',
+    'enabled' => $enabled,
+]]];
+$assertInvalidArgument(
+    static fn() => $service->normalize($invalidEnabledShift('irgendwie')),
+    'Unknown enabled strings must not silently disable a shift.'
+);
+$assertInvalidArgument(
+    static fn() => $service->normalize($invalidEnabledShift([])),
+    'Structured enabled values must be rejected instead of coerced.'
+);
+$assertInvalidArgument(
+    static fn() => $service->normalize($invalidEnabledShift(2)),
+    'Enabled integers other than zero and one must be rejected.'
+);
+assertSameValue(false, $service->normalize($invalidEnabledShift('false'))['shifts'][0]['enabled'], 'The explicit false string remains supported.');
 
 echo 'AdPlaner shift config smoke tests passed' . PHP_EOL;
diff --git a/tests/Service/TeamAccessServiceSmokeTest.php b/tests/Service/TeamAccessServiceSmokeTest.php
index a89dc8d..b0b09c9 100644
--- a/tests/Service/TeamAccessServiceSmokeTest.php
+++ b/tests/Service/TeamAccessServiceSmokeTest.php
@@ -10,14 +10,7 @@
         eval('namespace OCP; interface IUserSession { public function getUser(); }');
     }
 
-    require __DIR__ . '/helpers.php';
-    require __DIR__ . '/../../../localbase/lib/Model/ModelApiTrait.php';
-    require __DIR__ . '/../../../localbase/lib/Organization/AdOrganizationDefinition.php';
-    require __DIR__ . '/../../lib/Model/Assistant.php';
-    require __DIR__ . '/../../lib/Model/Team.php';
-    require __DIR__ . '/../../lib/Model/TeamSettings.php';
-    require __DIR__ . '/../../lib/Service/TeamSettingsService.php';
-    require __DIR__ . '/../../lib/Service/TeamAccessService.php';
+    require_once dirname(__DIR__) . '/bootstrap.php';
 
     use OCA\AdPlaner\Model\TeamSettings;
     use OCA\AdPlaner\Service\TeamAccessService;
@@ -46,6 +39,10 @@ public function getDisplayName(): string {
         public function getEMailAddress(): string {
             return $this->email;
         }
+
+        public function isEnabled(): bool {
+            return true;
+        }
     };
     $bob = new class('bob', 'Bob EB', 'bob@example.invalid') {
         public function __construct(
@@ -66,6 +63,15 @@ public function getDisplayName(): string {
         public function getEMailAddress(): string {
             return $this->email;
         }
+
+        public function isEnabled(): bool {
+            return true;
+        }
+    };
+    $disabledAssistant = new class {
+        public function getUID(): string { return 'disabled-assistant'; }
+        public function getDisplayName(): string { return 'Disabled Assistant'; }
+        public function isEnabled(): bool { return false; }
     };
     $legacyEb = new class('legacy-eb', 'Legacy EB', '') {
         public function __construct(private string $uid, private string $displayName, private string $email) {}
@@ -73,12 +79,24 @@ public function getUID(): string { return $this->uid; }
         public function getDisplayName(): string { return $this->displayName; }
         public function getEMailAddress(): string { return $this->email; }
     };
+    $zeroNameUser = new class {
+        public function getUID(): string { return 'zero-name'; }
+        public function getDisplayName(): string { return '0'; }
+    };
+    assertSameValue(
+        '0',
+        \OCA\AdPlaner\Model\Assistant::fromUser($zeroNameUser, false)->displayName,
+        'The valid Nextcloud display name "0" must not be replaced with the uid.'
+    );
+
+    $teamGroup = new class([$alice, $bob, $disabledAssistant]) {
+        public int $getUsersCalls = 0;
 
-    $teamGroup = new class([$alice, $bob]) {
         public function __construct(private array $users) {
         }
 
         public function getUsers(): array {
+            $this->getUsersCalls++;
             return $this->users;
         }
     };
@@ -126,10 +144,13 @@ public function setUser(?object $user): void {
     };
 
     $settings = new class extends TeamSettingsService {
+        public int $settingsCalls = 0;
+
         public function __construct() {
         }
 
         public function settingsForTeam(string $teamCode): TeamSettings {
+            $this->settingsCalls++;
             return new TeamSettings($teamCode, $teamCode === 'TeamB' ? 'Team B' : $teamCode, ['meetingDay' => '2026-07-15']);
         }
     };
@@ -140,11 +161,17 @@ public function settingsForTeam(string $teamCode): TeamSettings {
     assertSameValue('TeamB', $service->normalizeTeamCode(' TeamB '), 'Team codes should be trimmed.');
     assertSameValue(true, $service->currentUserIsEbForTeam('TeamB'), 'EB users should be detected through ad-EB groups.');
 
-    $team = $service->teamForCode('TeamB');
+    $team = $service->assertTeamAccess('TeamB');
     assertSameValue('Team B', $team->displayName, 'Team display name should come from team settings.');
     assertSameValue('ad-ASN-TeamB', $team->groupName, 'Team group name should follow the AD schema.');
     assertSameValue(['Alice Assistenz', 'Bob EB'], array_map(static fn($assistant): string => $assistant->displayName, $team->assistants()), 'Assistants should be sorted by display name.');
+    assertSameValue(null, $team->assistantByUid('disabled-assistant'), 'Disabled Nextcloud users must not be exposed as current shift-capable team members.');
     assertSameValue(false, $team->assistantByUid('bob')->canReceiveShifts, 'EB users should not receive shifts.');
+    assertSameValue(
+        ['alice'],
+        array_column($team->toArray()['assistants'] ?? [], 'uid'),
+        'Public team payloads should contain only current shift-capable assistants.'
+    );
     assertSameValue(['alice' => 'Alice Assistenz', 'bob' => 'Bob EB'], $service->assistantLabelMap($team->assistants()), 'Assistant label maps should expose display names by uid.');
     assertSameValue(
         ['carla' => 'Carla Assistenz'],
@@ -188,10 +215,15 @@ public function settingsForTeam(string $teamCode): TeamSettings {
     $session->setUser(null);
     assertSameValue([], $service->teamsForCurrentUser(), 'Anonymous sessions should not expose teams.');
     assertSameValue(false, $service->currentUserIsEbForTeam('TeamB'), 'Anonymous sessions should not receive EB rights.');
+    $settings->settingsCalls = 0;
+    $teamGroup->getUsersCalls = 0;
     assertDomainException(
         static fn() => $service->assertTeamAccess('TeamB'),
         'Anonymous sessions should not access an existing team.'
     );
+    assertSameValue(0, $settings->settingsCalls, 'Denied team access must not load protected team settings.');
+    assertSameValue(0, $teamGroup->getUsersCalls, 'Denied team access must not enumerate protected team members.');
+    assertSameValue(true, (new \ReflectionMethod(TeamAccessService::class, 'teamForCode'))->isPrivate(), 'The unguarded team loader must not remain a public service path.');
     try {
         $service->currentUserId();
         throw new RuntimeException('Anonymous sessions received a user id.');
diff --git a/tests/Service/TeamSettingsStoreTest.php b/tests/Service/TeamSettingsStoreTest.php
new file mode 100644
index 0000000..a02ca66
--- /dev/null
+++ b/tests/Service/TeamSettingsStoreTest.php
@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+require_once dirname(__DIR__) . '/bootstrap.php';
+
+use OCA\AdPlaner\Repository\TeamSettingsRepository;
+use OCA\AdPlaner\Service\ShiftConfigService;
+use OCA\AdPlaner\Store\TeamSettingsStore;
+use function OCA\AdPlaner\Tests\assertSameValue;
+
+final class TeamSettingsRepositoryFake extends TeamSettingsRepository {
+    public array $saved = [];
+    public ?array $row = null;
+
+    public function __construct() {}
+
+    public function findByCode(string $teamCode): ?array {
+        return $this->row;
+    }
+
+    public function save(string $teamCode, string $displayName, array $settings): void {
+        $this->saved[] = compact('teamCode', 'displayName', 'settings');
+    }
+}
+
+$repository = new TeamSettingsRepositoryFake();
+$store = new TeamSettingsStore($repository, new ShiftConfigService());
+$config = ['shifts' => [[
+    'key' => 'day',
+    'label' => 'Tag',
+    'startsAt' => '08:00',
+    'endsAt' => '16:00',
+    'enabled' => true,
+]]];
+
+$validName = str_repeat('Ä', 255);
+$saved = $store->save('A1', $validName, $config);
+assertSameValue($validName, $saved->displayName, 'A 255-character Unicode team display name should be valid.');
+assertSameValue(1, count($repository->saved), 'A valid team display name should be persisted once.');
+
+$assertRejectedWithoutWrite = static function (string $displayName, string $message) use ($store, $repository, $config): void {
+    $before = count($repository->saved);
+    try {
+        $store->save('A1', $displayName, $config);
+    } catch (\InvalidArgumentException) {
+        assertSameValue($before, count($repository->saved), $message);
+        return;
+    }
+
+    throw new \RuntimeException($message);
+};
+
+$assertRejectedWithoutWrite(str_repeat('Ä', 256), 'A team display name longer than 255 characters must be rejected without persistence.');
+$assertRejectedWithoutWrite("\xC3\x28", 'An invalid UTF-8 team display name must be rejected without persistence.');
+$assertRejectedWithoutWrite('   ', 'A blank team display name must be rejected without persistence.');
+
+$repository->row = [
+    'display_name' => '0',
+    'settings_json' => json_encode($config, JSON_THROW_ON_ERROR),
+];
+assertSameValue('0', $store->forTeam('A1')->displayName, 'The valid display name "0" must survive the persistence roundtrip.');
+
+echo 'AdPlaner team settings store tests passed' . PHP_EOL;
diff --git a/tests/Service/helpers.php b/tests/Service/helpers.php
index 774791e..ed7a31b 100644
--- a/tests/Service/helpers.php
+++ b/tests/Service/helpers.php
@@ -4,8 +4,6 @@
 
 namespace OCA\AdPlaner\Tests;
 
-require_once __DIR__ . '/../../../localbase/tests/Support/assertions.php';
-
 use function OCA\LocalBase\Tests\Support\assertSameValue as supportAssertSameValue;
 use function OCA\LocalBase\Tests\Support\assertThrows as supportAssertThrows;
 
diff --git a/tests/StandaloneNavigationListenerTest.php b/tests/StandaloneNavigationListenerTest.php
index fdf3308..7123fed 100644
--- a/tests/StandaloneNavigationListenerTest.php
+++ b/tests/StandaloneNavigationListenerTest.php
@@ -8,7 +8,7 @@
 namespace OCP\App { interface IAppManager { public function isEnabledForUser($appId, $user = null); } }
 
 namespace {
-    require_once __DIR__ . '/../../localbase/lib/Service/StandaloneAppNavigationService.php'; require_once __DIR__ . '/../lib/Listener/StandaloneNavigationListener.php';
+    require_once __DIR__ . '/bootstrap.php';
     use OCA\AdPlaner\Listener\StandaloneNavigationListener; use OCA\LocalBase\Service\StandaloneAppNavigationService; use OCP\App\IAppManager; use OCP\INavigationManager; use OCP\IURLGenerator; use OCP\IUser; use OCP\IUserSession; use OCP\Navigation\Events\LoadAdditionalEntriesEvent;
     $user = new class implements IUser {}; $session = new class($user) implements IUserSession { public function __construct(private IUser $user) {} public function getUser(): ?IUser { return $this->user; } }; $apps = new class implements IAppManager { public function isEnabledForUser($appId, $user = null): bool { return false; } }; $nav = new class implements INavigationManager { public array $entries = []; public function add(callable $entry): void { $this->entries[] = $entry; } }; $url = new class implements IURLGenerator { public function linkToRoute(string $routeName, array $arguments = []): string { return $routeName; } public function imagePath(string $appName, string $file): string { return "$appName/$file"; } };
     (new StandaloneNavigationListener(new StandaloneAppNavigationService($session, $apps, $nav, $url)))->handle(new LoadAdditionalEntriesEvent()); $entry = ($nav->entries[0] ?? static fn(): array => [])();
diff --git a/tests/Ui/LayoutSmokeTest.php b/tests/Ui/LayoutSmokeTest.php
new file mode 100644
index 0000000..06459fe
--- /dev/null
+++ b/tests/Ui/LayoutSmokeTest.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+$css = file_get_contents(__DIR__ . '/../../css/style.css');
+$template = file_get_contents(__DIR__ . '/../../templates/index.php');
+if ($css === false || $template === false) {
+    throw new RuntimeException('AdPlaner-Layoutquellen konnten nicht gelesen werden.');
+}
+
+foreach (['max-height: calc(100vh - 260px)', '.adp-month-table th:last-child', '.adp-month-table td:last-child', 'position: sticky', 'right: 0'] as $contract) {
+    if (!str_contains($css, $contract)) {
+        throw new RuntimeException("Der sichtbare Monatsplan-Scrollvertrag fehlt: {$contract}");
+    }
+}
+foreach (['.adp-assignment-control', 'position: relative', '.adp-assignment-picker[hidden]', 'display: none', 'position: absolute'] as $contract) {
+    if (!str_contains($css, $contract)) {
+        throw new RuntimeException("Der kompakte Zuteilungsdialog fehlt: {$contract}");
+    }
+}
+foreach (['id="month-prev"', 'id="month-next"', 'aria-label="Vorheriger Monat"', 'aria-label="Nächster Monat"', 'min="2000-01"', 'max="2100-12"', 'required'] as $contract) {
+    if (!str_contains($template, $contract)) {
+        throw new RuntimeException("Die direkte Monatsnavigation fehlt: {$contract}");
+    }
+}
+
+echo "AdPlaner layout smoke test passed\n";
diff --git a/tests/access-http-smoke.sh b/tests/access-http-smoke.sh
new file mode 100755
index 0000000..7b05a57
--- /dev/null
+++ b/tests/access-http-smoke.sh
@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${ADP_BASE_URL:?ADP_BASE_URL fehlt}"
+: "${ADP_USER:?ADP_USER fehlt}"
+: "${ADP_PASSWORD:?ADP_PASSWORD fehlt}"
+: "${ADP_TEAM_CODE:?ADP_TEAM_CODE fehlt}"
+: "${ADP_FOREIGN_UID:?ADP_FOREIGN_UID fehlt}"
+
+workdir="$(mktemp -d)"
+page="$workdir/page.html"
+cookies="$workdir/cookies.txt"
+plan="$workdir/plan.json"
+error="$workdir/error.json"
+plan_after="$workdir/plan-after.json"
+trap 'rm -rf "$workdir"' EXIT
+
+curl --fail --silent --show-error --insecure --user "$ADP_USER:$ADP_PASSWORD" \
+    --cookie-jar "$cookies" "$ADP_BASE_URL/index.php/apps/adplaner/" --output "$page"
+
+token="$(sed -n 's/.*data-requesttoken="\([^"]*\)".*/\1/p' "$page" | head -n 1)"
+if [[ -z "$token" ]]; then
+    echo 'Request-Token fehlt.' >&2
+    exit 1
+fi
+
+month="$(date -u +%Y-%m)"
+plan_endpoint="$ADP_BASE_URL/index.php/apps/adplaner/api/teams/$ADP_TEAM_CODE/months/$month"
+curl --fail --silent --show-error --insecure --user "$ADP_USER:$ADP_PASSWORD" \
+    --cookie "$cookies" --cookie-jar "$cookies" -H "requesttoken: $token" \
+    "$plan_endpoint" --output "$plan"
+
+slot_id="$(php -r '
+$data = json_decode(file_get_contents($argv[1]), true, flags: JSON_THROW_ON_ERROR);
+foreach (($data["days"] ?? []) as $day) {
+    foreach (($day["slots"] ?? []) as $slot) {
+        if (isset($slot["id"])) {
+            echo (int)$slot["id"];
+            exit;
+        }
+    }
+}
+exit(1);
+' "$plan")"
+
+candidate_endpoint="$plan_endpoint/slots/$slot_id/candidates"
+status="$(curl --silent --show-error --insecure --user "$ADP_USER:$ADP_PASSWORD" \
+    --cookie "$cookies" --cookie-jar "$cookies" -H "requesttoken: $token" -H 'Content-Type: application/json' \
+    -X POST --data "{\"targetUid\":\"$ADP_FOREIGN_UID\"}" --write-out '%{http_code}' \
+    --output "$error" "$candidate_endpoint")"
+if [[ "$status" != '403' ]] || ! php -r '
+$data = json_decode(file_get_contents($argv[1]), true, flags: JSON_THROW_ON_ERROR);
+exit(($data["ok"] ?? true) === false ? 0 : 1);
+' "$error"; then
+    echo "Fremdänderung durch normales Teammitglied ergab HTTP $status statt eines verständlichen 403-Fehlers." >&2
+    exit 1
+fi
+
+curl --fail --silent --show-error --insecure --user "$ADP_USER:$ADP_PASSWORD" \
+    --cookie "$cookies" --cookie-jar "$cookies" -H "requesttoken: $token" \
+    "$plan_endpoint" --output "$plan_after"
+php -r '
+$before = json_decode(file_get_contents($argv[1]), true, flags: JSON_THROW_ON_ERROR);
+$after = json_decode(file_get_contents($argv[2]), true, flags: JSON_THROW_ON_ERROR);
+$slotId = (int)$argv[3];
+$candidateUids = static function (array $plan, int $slotId): array {
+    foreach (($plan["days"] ?? []) as $day) {
+        foreach (($day["slots"] ?? []) as $slot) {
+            if ((int)($slot["id"] ?? 0) !== $slotId) {
+                continue;
+            }
+            $uids = array_map(static fn(array $candidate): string => (string)($candidate["uid"] ?? ""), $slot["candidates"] ?? []);
+            sort($uids);
+            return $uids;
+        }
+    }
+
+    throw new RuntimeException("Die geprüfte Schicht fehlt im Monatsplan.");
+};
+$beforeCandidateUids = $candidateUids($before, $slotId);
+$afterCandidateUids = $candidateUids($after, $slotId);
+if ($beforeCandidateUids !== $afterCandidateUids) {
+    throw new RuntimeException("Die abgewiesene Fremdänderung hat den Kandidatenzustand verändert.");
+}
+' "$plan" "$plan_after" "$slot_id"
+
+echo "AdPlaner C3 API access smoke: OK ($ADP_USER)"
diff --git a/tests/access-matrix-ddev-smoke.sh b/tests/access-matrix-ddev-smoke.sh
new file mode 100755
index 0000000..50f08d6
--- /dev/null
+++ b/tests/access-matrix-ddev-smoke.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+base_url="${ADP_BASE_URL:-https://nextcloud-dev.ddev.site}"
+ddev_project="${ADP_DDEV_PROJECT:-$(cd "$(dirname "$0")/../../nextcloud-dev" && pwd)}"
+suffix="$(date +%s)-$$"
+password="$(php -r 'echo bin2hex(random_bytes(24));')"
+team_code="Smoke$$"
+team_group="ad-ASN-$team_code"
+created_users=()
+
+occ() {
+    (cd "$ddev_project" && ddev exec -d /var/www/html/html php occ "$@")
+}
+
+cleanup() {
+    local uid
+    for uid in "${created_users[@]}"; do
+        occ user:delete "$uid" >/dev/null 2>&1 || true
+    done
+    occ group:delete "$team_group" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+create_user() {
+    local uid="$1"
+    (cd "$ddev_project" && ddev exec -d /var/www/html/html env OC_PASS="$password" php occ user:add --password-from-env "$uid") >/dev/null
+    created_users+=("$uid")
+    occ group:adduser "$team_group" "$uid" >/dev/null
+}
+
+occ group:add "$team_group" >/dev/null
+actor="adp-smoke-${suffix}-actor"
+foreign="adp-smoke-${suffix}-foreign"
+create_user "$actor"
+create_user "$foreign"
+
+ADP_BASE_URL="$base_url" ADP_USER="$actor" ADP_PASSWORD="$password" \
+    ADP_TEAM_CODE="$team_code" ADP_FOREIGN_UID="$foreign" \
+    "$(dirname "$0")/access-http-smoke.sh"
+
+echo 'AdPlaner DDEV access matrix smoke: OK'
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
new file mode 100644
index 0000000..59ff676
--- /dev/null
+++ b/tests/bootstrap.php
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+$workspaceRoot = dirname(__DIR__, 2);
+$appRoot = dirname(__DIR__);
+
+spl_autoload_register(static function (string $class) use ($workspaceRoot, $appRoot): void {
+    $prefixes = [
+        'OCA\\LocalBase\\Tests\\Support\\' => $workspaceRoot . '/localbase/tests/Support/',
+        'OCA\\LocalBase\\' => $workspaceRoot . '/localbase/lib/',
+        'OCA\\AdPlaner\\' => $appRoot . '/lib/',
+    ];
+
+    foreach ($prefixes as $prefix => $directory) {
+        if (!str_starts_with($class, $prefix)) {
+            continue;
+        }
+
+        $file = $directory . str_replace('\\', '/', substr($class, strlen($prefix))) . '.php';
+        if (is_file($file)) {
+            require_once $file;
+        }
+        return;
+    }
+});
+
+require_once $workspaceRoot . '/localbase/tests/Support/assertions.php';
+require_once __DIR__ . '/Service/helpers.php';
diff --git a/tests/browser-ddev-smoke.sh b/tests/browser-ddev-smoke.sh
new file mode 100755
index 0000000..34e21e1
--- /dev/null
+++ b/tests/browser-ddev-smoke.sh
@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+base_url="${ADP_BASE_URL:-https://nextcloud-dev.ddev.site}"
+ddev_project="${ADP_DDEV_PROJECT:-$(cd "$(dirname "$0")/../../nextcloud-dev" && pwd)}"
+suffix="$(date +%s)$$"
+team_code="P${suffix: -15}"
+team_group="ad-ASN-$team_code"
+month='2098-11'
+password="$(php -r 'echo bin2hex(random_bytes(24));')"
+actor="adp-browser-$suffix-eb"
+assistant="adp-browser-$suffix-assistant"
+member="adp-browser-$suffix-member"
+created_users=()
+workdir="$(mktemp -d)"
+chrome_profile="$workdir/chrome-profile"
+chrome_log="$workdir/chrome.log"
+screenshot="$workdir/adplaner-approved.png"
+chrome_pid=''
+probe='/var/www/html/html/custom_apps/adplaner/tests/integration/PrivacyRuntimeProbe.php'
+
+occ() {
+    (cd "$ddev_project" && ddev exec -d /var/www/html/html php occ "$@")
+}
+
+run_probe() {
+    (cd "$ddev_project" && ddev exec -d /var/www/html/html php "$probe" "$@")
+}
+
+cleanup() {
+    local failed=0
+    if [[ -n "$chrome_pid" ]] && kill -0 "$chrome_pid" >/dev/null 2>&1; then
+        kill "$chrome_pid" >/dev/null 2>&1 || failed=1
+        wait "$chrome_pid" >/dev/null 2>&1 || true
+    fi
+    run_probe cleanup "$team_code" "$month" >/dev/null || failed=1
+    local uid
+    for uid in "${created_users[@]}"; do
+        occ user:delete "$uid" >/dev/null 2>&1 || failed=1
+    done
+    occ group:delete "$team_group" >/dev/null 2>&1 || failed=1
+    rm -rf "$workdir"
+    return "$failed"
+}
+
+report_failed_cleanup() {
+    echo 'Der Browser-Smoke wurde abgebrochen; die automatische Bereinigung war nicht vollständig erfolgreich.' >&2
+    echo "Bitte synthetische Objekte prüfen: Team $team_code, Gruppe $team_group, Nutzer ${created_users[*]:-keine}." >&2
+}
+
+trap 'cleanup || report_failed_cleanup' EXIT
+
+create_user() {
+    local uid="$1"
+    (cd "$ddev_project" && ddev exec -d /var/www/html/html env OC_PASS="$password" php occ user:add --password-from-env "$uid") >/dev/null
+    created_users+=("$uid")
+    occ group:adduser "$team_group" "$uid" >/dev/null
+}
+
+if ! occ group:info ad-EB >/dev/null 2>&1; then
+    echo 'Die bestehende EB-Rollengruppe ad-EB fehlt; der Smoke verändert die Organisationskonfiguration nicht.' >&2
+    exit 1
+fi
+
+occ group:add "$team_group" >/dev/null
+create_user "$actor"
+create_user "$assistant"
+create_user "$member"
+occ group:adduser ad-EB "$actor" >/dev/null
+
+mkdir -p "$chrome_profile"
+google-chrome \
+    --headless=new \
+    --disable-dev-shm-usage \
+    --ignore-certificate-errors \
+    --remote-allow-origins='*' \
+    --remote-debugging-port=0 \
+    --user-data-dir="$chrome_profile" \
+    about:blank >"$chrome_log" 2>&1 &
+chrome_pid="$!"
+
+for _ in $(seq 1 100); do
+    [[ -s "$chrome_profile/DevToolsActivePort" ]] && break
+    if ! kill -0 "$chrome_pid" >/dev/null 2>&1; then
+        echo 'Headless Chrome wurde unerwartet beendet.' >&2
+        sed -n '1,120p' "$chrome_log" >&2
+        exit 1
+    fi
+    sleep 0.1
+done
+if [[ ! -s "$chrome_profile/DevToolsActivePort" ]]; then
+    echo 'Chrome stellte innerhalb des Zeitlimits keinen DevTools-Port bereit.' >&2
+    exit 1
+fi
+cdp_port="$(sed -n '1p' "$chrome_profile/DevToolsActivePort")"
+
+ADP_CDP_PORT="$cdp_port" \
+ADP_BASE_URL="$base_url" \
+ADP_BROWSER_EB="$actor" \
+ADP_BROWSER_ASSISTANT="$assistant" \
+ADP_BROWSER_MEMBER="$member" \
+ADP_BROWSER_PASSWORD="$password" \
+ADP_BROWSER_TEAM="$team_code" \
+ADP_BROWSER_MONTH="$month" \
+ADP_BROWSER_SCREENSHOT="$screenshot" \
+node "$(dirname "$0")/js/browser-ddev-smoke.mjs"
+
+if [[ ! -s "$screenshot" ]]; then
+    echo 'Der genehmigte Plan wurde nicht als temporärer Sichtnachweis erfasst.' >&2
+    exit 1
+fi
+
+cleanup
+trap - EXIT
+run_probe assert-clean "$team_code" "$month" >/dev/null
+for uid in "$actor" "$assistant" "$member"; do
+    if occ user:info "$uid" >/dev/null 2>&1; then
+        echo "Synthetischer Nutzer verblieb nach der Bereinigung: $uid" >&2
+        exit 1
+    fi
+done
+if occ group:info "$team_group" >/dev/null 2>&1; then
+    echo "Synthetische Gruppe verblieb nach der Bereinigung: $team_group" >&2
+    exit 1
+fi
+
+echo 'AdPlaner selbstbereinigende Browser-Abnahme: OK'
diff --git a/tests/integration-ddev-smoke.sh b/tests/integration-ddev-smoke.sh
new file mode 100755
index 0000000..2c0b5b6
--- /dev/null
+++ b/tests/integration-ddev-smoke.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ddev_project="${ADP_DDEV_PROJECT:-$(cd "$(dirname "$0")/../../nextcloud-dev" && pwd)}"
+
+(cd "$ddev_project" && ddev exec -d /var/www/html/html php -r \
+    "define('OC_CONSOLE', true); require '/var/www/html/html/custom_apps/adplaner/tests/integration/MonthPlanStatusSmoke.php';")
diff --git a/tests/integration/MonthPlanStatusSmoke.php b/tests/integration/MonthPlanStatusSmoke.php
new file mode 100644
index 0000000..86e430a
--- /dev/null
+++ b/tests/integration/MonthPlanStatusSmoke.php
@@ -0,0 +1,111 @@
+<?php
+
+declare(strict_types=1);
+
+require_once dirname(__DIR__, 4) . '/lib/base.php';
+
+use OCA\AdPlaner\Repository\ShiftPlanRepository;
+use OCA\AdPlaner\Model\Team;
+use OCA\AdPlaner\Service\ScheduleService;
+use OCA\AdPlaner\Store\ShiftPlanStore;
+use OCP\IDBConnection;
+
+$teamCode = 'TXSTATUS';
+$month = '2099-02';
+$db = \OC::$server->get(IDBConnection::class);
+$repository = \OC::$server->get(ShiftPlanRepository::class);
+$store = \OC::$server->get(ShiftPlanStore::class);
+$service = \OC::$server->get(ScheduleService::class);
+$team = new Team($teamCode, 'ad-ASN-' . $teamCode, 'Transaktionstest', [], true, [
+    'shifts' => [[
+        'key' => 'early',
+        'label' => 'Früh',
+        'startsAt' => '08:00',
+        'endsAt' => '14:00',
+        'enabled' => true,
+    ]],
+]);
+
+$cleanup = static function () use ($db, $teamCode, $month): void {
+    $qb = $db->getQueryBuilder();
+    $qb->delete('adp_day_notes')
+        ->where($qb->expr()->eq('team_code', $qb->createNamedParameter($teamCode)))
+        ->andWhere($qb->expr()->gte('work_date', $qb->createNamedParameter($month . '-01')))
+        ->andWhere($qb->expr()->lte('work_date', $qb->createNamedParameter($month . '-28')));
+    $qb->executeStatement();
+
+    $qb = $db->getQueryBuilder();
+    $qb->delete('adp_shift_slots')
+        ->where($qb->expr()->eq('team_code', $qb->createNamedParameter($teamCode)))
+        ->andWhere($qb->expr()->eq('plan_month', $qb->createNamedParameter($month)));
+    $qb->executeStatement();
+
+    $qb = $db->getQueryBuilder();
+    $qb->delete('adp_month_plans')
+        ->where($qb->expr()->eq('team_code', $qb->createNamedParameter($teamCode)))
+        ->andWhere($qb->expr()->eq('plan_month', $qb->createNamedParameter($month)));
+    $qb->executeStatement();
+};
+
+$cleanup();
+try {
+    try {
+        $store->transactional(static function () use ($store, $teamCode, $month): void {
+            $store->insertSlot($teamCode, $month, $month . '-01', 'rollback', 'Rollback', '00:00', '01:00', true);
+            throw new RuntimeException('Erwarteter Rollback-Testabbruch.');
+        });
+        throw new RuntimeException('Die Rollback-Testtransaktion wurde unerwartet abgeschlossen.');
+    } catch (RuntimeException $exception) {
+        if ($exception->getMessage() !== 'Erwarteter Rollback-Testabbruch.') {
+            throw $exception;
+        }
+    }
+    if ($store->slotsForMonth($teamCode, $month) !== []) {
+        throw new RuntimeException('Eine fehlgeschlagene Transaktion hat einen Slot zurückgelassen.');
+    }
+
+    if ($repository->monthStatus($teamCode, $month) !== null) {
+        throw new RuntimeException('Ein neuer Monatsplan besitzt unerwartet einen persistierten Status.');
+    }
+    if ($service->transitionMonthStatus($team, $month, 'planned', 'transaction-test') !== 'planned') {
+        throw new RuntimeException('Der erste Statusübergang wurde nicht persistiert.');
+    }
+    if ($service->transitionMonthStatus($team, $month, 'approved', 'transaction-test') !== 'approved') {
+        throw new RuntimeException('Die Genehmigung wurde nicht persistiert.');
+    }
+    if ($repository->monthStatus($teamCode, $month) !== 'approved') {
+        throw new RuntimeException('Der persistierte Monatsstatus ist nicht genehmigt.');
+    }
+    $slots = $store->slotsForMonth($teamCode, $month);
+    if (count($slots) !== 28) {
+        throw new RuntimeException('Der genehmigte Februar-Snapshot enthält nicht genau 28 Schichten.');
+    }
+    foreach ($slots as $slot) {
+        if ($slot->segmentKey !== 'early' || !$slot->enabled) {
+            throw new RuntimeException('Der genehmigte Snapshot enthält eine unerwartete Schichtdefinition.');
+        }
+    }
+
+    $qb = $db->getQueryBuilder();
+    $qb->select('revision')
+        ->from('adp_month_plans')
+        ->where($qb->expr()->eq('team_code', $qb->createNamedParameter($teamCode)))
+        ->andWhere($qb->expr()->eq('plan_month', $qb->createNamedParameter($month)));
+    $row = $qb->executeQuery()->fetchAssociative();
+    if ($row === false || (int)$row['revision'] < 2) {
+        throw new RuntimeException('Die Monatsrevision wurde durch Planung und Genehmigung nicht fortgeschrieben.');
+    }
+
+    try {
+        $service->saveDayNote($team, $month, $month . '-01', 'Darf nicht gespeichert werden', 'transaction-test');
+        throw new RuntimeException('Ein genehmigter Plan akzeptierte nachträglich eine Bemerkung.');
+    } catch (DomainException) {
+    }
+    if ($store->dayNotesForMonth($teamCode, $month) !== []) {
+        throw new RuntimeException('Der abgewiesene Schreibversuch hat eine Bemerkung zurückgelassen.');
+    }
+} finally {
+    $cleanup();
+}
+
+echo "AdPlaner real month plan status persistence smoke passed\n";
diff --git a/tests/integration/PrivacyRuntimeProbe.php b/tests/integration/PrivacyRuntimeProbe.php
new file mode 100644
index 0000000..268bfdd
--- /dev/null
+++ b/tests/integration/PrivacyRuntimeProbe.php
@@ -0,0 +1,149 @@
+<?php
+
+declare(strict_types=1);
+
+require_once dirname(__DIR__, 4) . '/lib/base.php';
+
+use OCPDBQueryBuilder\IQueryBuilder;
+use OCP\IDBConnection;
+
+$mode = (string)($argv[1] ?? '');
+$teamCode = (string)($argv[2] ?? '');
+$month = (string)($argv[3] ?? '');
+$workDate = (string)($argv[4] ?? '');
+
+if (!preg_match('/^P[0-9]{1,15}$/D', $teamCode)) {
+    throw new InvalidArgumentException('Das synthetische Teamkürzel ist ungültig.');
+}
+if (!preg_match('/^20[0-9]{2}-(?:0[1-9]|1[0-2])$/D', $month)) {
+    throw new InvalidArgumentException('Der synthetische Planungsmonat ist ungültig.');
+}
+if ($workDate !== '' && !preg_match('/^20[0-9]{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])$/D', $workDate)) {
+    throw new InvalidArgumentException('Das synthetische Arbeitsdatum ist ungültig.');
+}
+
+$db = \OC::$server->get(IDBConnection::class);
+
+$monthRow = static function () use ($db, $teamCode, $month): ?array {
+    $qb = $db->getQueryBuilder();
+    $qb->select('revision', 'updated_by_uid', 'updated_at')
+        ->from('adp_month_plans')
+        ->where($qb->expr()->eq('team_code', $qb->createNamedParameter($teamCode)))
+        ->andWhere($qb->expr()->eq('plan_month', $qb->createNamedParameter($month)));
+    $row = $qb->executeQuery()->fetchAssociative();
+
+    if ($row === false) {
+        return null;
+    }
+
+    return [
+        'revision' => (int)$row['revision'],
+        'updatedByUid' => (string)$row['updated_by_uid'],
+        'updatedAt' => $row['updated_at'] instanceof DateTimeInterface
+            ? $row['updated_at']->format('Y-m-d H:i:s')
+            : (string)$row['updated_at'],
+    ];
+};
+
+$rowCount = static function (string $table, array $conditions) use ($db): int {
+    $qb = $db->getQueryBuilder();
+    $qb->select($qb->func()->count('*', 'row_count'))->from($table);
+    foreach ($conditions as $column => $value) {
+        $condition = $qb->expr()->eq($column, $qb->createNamedParameter($value));
+        $qb->andWhere($condition);
+    }
+
+    return (int)$qb->executeQuery()->fetchOne();
+};
+
+switch ($mode) {
+    case 'assert-no-browser-data':
+        $remaining = [];
+        foreach (['adp_month_plans', 'adp_day_notes'] as $table) {
+            $qb = $db->getQueryBuilder();
+            $qb->select($qb->func()->count('*', 'row_count'))
+                ->from($table)
+                ->where($qb->expr()->like('updated_by_uid', $qb->createNamedParameter('adp-browser-%')));
+            $count = (int)$qb->executeQuery()->fetchOne();
+            if ($count > 0) {
+                $remaining[$table] = $count;
+            }
+        }
+        if ($remaining !== []) {
+            throw new RuntimeException('Browser-Smoke-Daten verblieben: ' . json_encode($remaining, JSON_THROW_ON_ERROR));
+        }
+        echo "Keine Browser-Smoke-Daten verblieben.\n";
+        break;
+
+    case 'snapshot':
+        $row = $monthRow();
+        if ($row === null) {
+            throw new RuntimeException('Der synthetische Monatsplan fehlt.');
+        }
+        echo json_encode($row, JSON_THROW_ON_ERROR) . PHP_EOL;
+        break;
+
+    case 'assert-note-present':
+        if ($workDate === '' || $rowCount('adp_day_notes', ['team_code' => $teamCode, 'work_date' => $workDate]) !== 1) {
+            throw new RuntimeException('Die synthetische Tagesbemerkung wurde nicht eindeutig persistiert.');
+        }
+        echo "Synthetische Tagesbemerkung ist physisch vorhanden.\n";
+        break;
+
+    case 'assert-note-absent':
+        if ($workDate === '' || $rowCount('adp_day_notes', ['team_code' => $teamCode, 'work_date' => $workDate]) !== 0) {
+            throw new RuntimeException('Die geleerte Tagesbemerkung besitzt weiterhin eine Datenbankzeile.');
+        }
+        echo "Geleerte Tagesbemerkung besitzt keine Datenbankzeile.\n";
+        break;
+
+    case 'cleanup':
+        $qb = $db->getQueryBuilder();
+        $qb->select('id')->from('adp_shift_slots')
+            ->where($qb->expr()->eq('team_code', $qb->createNamedParameter($teamCode)));
+        $slotIds = array_map('intval', $qb->executeQuery()->fetchFirstColumn());
+        if ($slotIds !== []) {
+            $qb = $db->getQueryBuilder();
+            $qb->delete('adp_shift_candidates')
+                ->where($qb->expr()->in('slot_id', $qb->createNamedParameter($slotIds, IQueryBuilder::PARAM_INT_ARRAY)));
+            $qb->executeStatement();
+        }
+
+        foreach ([
+            ['adp_day_notes', ['team_code' => $teamCode]],
+            ['adp_shift_slots', ['team_code' => $teamCode]],
+            ['adp_month_plans', ['team_code' => $teamCode]],
+            ['adp_team_settings', ['team_code' => $teamCode]],
+        ] as [$table, $conditions]) {
+            $qb = $db->getQueryBuilder();
+            $qb->delete($table);
+            foreach ($conditions as $column => $value) {
+                $qb->andWhere($qb->expr()->eq($column, $qb->createNamedParameter($value)));
+            }
+            $qb->executeStatement();
+        }
+        echo "Synthetische AdPlaner-Daten wurden bereinigt.\n";
+        break;
+
+    case 'assert-clean':
+        $remaining = [];
+        foreach ([
+            'adp_day_notes' => ['team_code' => $teamCode],
+            'adp_shift_slots' => ['team_code' => $teamCode],
+            'adp_month_plans' => ['team_code' => $teamCode],
+            'adp_team_settings' => ['team_code' => $teamCode],
+        ] as $table => $conditions) {
+            $count = $rowCount($table, $conditions);
+            if ($count > 0) {
+                $remaining[$table] = $count;
+            }
+        }
+        if ($remaining !== []) {
+            throw new RuntimeException('Synthetische AdPlaner-Daten verblieben: ' . json_encode($remaining, JSON_THROW_ON_ERROR));
+        }
+        echo "Keine synthetischen AdPlaner-Daten verblieben.\n";
+        break;
+
+    default:
+        throw new InvalidArgumentException('Unbekannter Prüfmodus.');
+}
diff --git a/tests/js/admin-smoke.js b/tests/js/admin-smoke.js
new file mode 100644
index 0000000..f1e0f50
--- /dev/null
+++ b/tests/js/admin-smoke.js
@@ -0,0 +1,66 @@
+const assert = require('assert');
+
+function element() {
+    return {
+        checked: false,
+        disabled: false,
+        hidden: true,
+        className: '',
+        textContent: '',
+        listeners: {},
+        classList: { add() {} },
+        addEventListener(type, listener) { this.listeners[type] = listener; }
+    };
+}
+
+const confirmation = element();
+const button = element();
+button.disabled = true;
+const notice = element();
+const requests = [];
+let resolveRequest;
+const pendingResponse = new Promise(resolve => { resolveRequest = resolve; });
+
+global.document = {
+    getElementById(id) {
+        return {
+            'adp-demo-confirm': confirmation,
+            'adp-demo-install': button,
+            'adp-demo-notice': notice,
+        }[id] || null;
+    }
+};
+global.window = {
+    LocalBase: {
+        api: {
+            ApiClient: class {
+                async request(path, options) {
+                    requests.push({ path, options });
+                    return pendingResponse;
+                }
+            }
+        }
+    }
+};
+
+require('../../js/admin.js');
+
+(async () => {
+    confirmation.checked = true;
+    confirmation.listeners.change();
+    assert.strictEqual(button.disabled, false);
+    const firstClick = button.listeners.click();
+    const secondClick = button.listeners.click();
+    assert.deepStrictEqual(requests, [{
+        path: '/api/admin/demo-pack/install',
+        options: { method: 'POST', body: '{"confirmed":true}' }
+    }]);
+    resolveRequest({ result: { teams: ['A', 'B', 'C'] } });
+    await Promise.all([firstClick, secondClick]);
+    assert.strictEqual(confirmation.checked, false);
+    assert.strictEqual(button.disabled, true);
+    console.log('AdPlaner admin smoke test passed.');
+})().catch(error => {
+    console.error(error);
+    process.exit(1);
+});
diff --git a/tests/js/assignment-control-smoke.js b/tests/js/assignment-control-smoke.js
index 6ab9919..4db2ca5 100644
--- a/tests/js/assignment-control-smoke.js
+++ b/tests/js/assignment-control-smoke.js
@@ -23,13 +23,19 @@ const html = assignmentControl.render(
 
 assert(html.includes('data-assignment-control="7"'));
 assert(html.includes('data-action="open-assignment-picker"'));
-assert(html.includes('value="alice"'));
-assert(!html.includes('value="bob"'));
-assert(!html.includes('value="eb"'));
-assert(html.includes('value="chris"'));
+assert(html.includes('aria-label="Assistenz zuteilen"'));
+assert(html.includes('data-assignment-trigger="7"'));
+assert(html.includes('aria-expanded="false"'));
+assert(html.includes('class="adp-assignment-picker"'));
+assert(html.includes('role="group"'));
+assert(html.includes('aria-label="Assistenz auswählen"'));
+assert(html.includes('data-action="add-selected" data-slot-id="7" data-target-uid="alice"'));
+assert(!html.includes('data-target-uid="bob"'));
+assert(!html.includes('data-target-uid="eb"'));
+assert(html.includes('data-target-uid="chris"'));
 assert(html.includes('&lt;Chris &amp; Co&gt;'));
 assert(!html.includes('<Chris & Co>'));
-assert(!html.includes('<select data-add-select="7" disabled'));
+assert(!html.includes('<select'));
 
 const emptyHtml = assignmentControl.render(
     { id: 8 },
@@ -42,11 +48,31 @@ const emptyHtml = assignmentControl.render(
     [{ uid: 'bob' }]
 );
 
-assert(emptyHtml.includes('<select data-add-select="8" disabled'));
-assert(emptyHtml.includes('data-action="add-selected" data-slot-id="8" disabled'));
+assert(emptyHtml.includes('data-action="open-assignment-picker"'));
+assert(emptyHtml.includes('data-assignment-trigger="8" data-slot-id="8" disabled'));
+assert(emptyHtml.includes('Keine Assistenz verfügbar'));
 
 const focused = [];
+const expanded = [];
+const triggerOne = {
+    dataset: { assignmentTrigger: '1' },
+    setAttribute(name, value) {
+        assert.strictEqual(name, 'aria-expanded');
+        expanded.push(['1', value]);
+    }
+};
+const triggerTwo = {
+    dataset: { assignmentTrigger: '2', slotId: '2' },
+    setAttribute(name, value) {
+        assert.strictEqual(name, 'aria-expanded');
+        expanded.push(['2', value]);
+    },
+    focus() {
+        focused.push('trigger-2');
+    }
+};
 const pickerOne = {
+    id: 'adp-assignment-picker-1',
     dataset: { assignmentPicker: '1' },
     hidden: false,
     querySelector() {
@@ -54,19 +80,25 @@ const pickerOne = {
     }
 };
 const pickerTwo = {
+    id: 'adp-assignment-picker-2',
     dataset: { assignmentPicker: '2' },
     hidden: true,
-    querySelector() {
+    querySelector(selector) {
+        assert.strictEqual(selector, 'button[data-action="add-selected"]');
         return { focus: () => focused.push('2') };
+    },
+    addEventListener(type, listener) {
+        assert.strictEqual(type, 'keydown');
+        this.keydown = listener;
     }
 };
 
 global.CSS = { escape: String };
 global.document = {
     querySelectorAll(selector) {
-        assert.strictEqual(selector, '[data-assignment-picker]');
-
-        return [pickerOne, pickerTwo];
+        if (selector === '[data-assignment-picker]') return [pickerOne, pickerTwo];
+        if (selector === '[data-assignment-trigger]') return [triggerOne, triggerTwo];
+        assert.fail(`Unexpected selector: ${selector}`);
     },
     querySelector(selector) {
         assert.strictEqual(selector, '[data-assignment-picker="2"]');
@@ -75,9 +107,25 @@ global.document = {
     }
 };
 
-assignmentControl.open({ dataset: { slotId: '2' } });
+assignmentControl.open(triggerTwo);
 assert.strictEqual(pickerOne.hidden, true);
 assert.strictEqual(pickerTwo.hidden, false);
 assert.deepStrictEqual(focused, ['2']);
+assert.deepStrictEqual(expanded.slice(-3), [['1', 'false'], ['2', 'false'], ['2', 'true']]);
+
+let prevented = false;
+pickerTwo.keydown({
+    key: 'Escape',
+    preventDefault() { prevented = true; }
+});
+assert.strictEqual(prevented, true);
+assert.strictEqual(pickerTwo.hidden, true);
+assert.deepStrictEqual(expanded.at(-1), ['2', 'false']);
+assert.deepStrictEqual(focused, ['2', 'trigger-2']);
+
+assignmentControl.open(triggerTwo);
+assignmentControl.open(triggerTwo);
+assert.strictEqual(pickerTwo.hidden, true);
+assert.deepStrictEqual(expanded.at(-1), ['2', 'false']);
 
 console.log('AdPlaner assignment control smoke test passed.');
diff --git a/tests/js/browser-ddev-smoke.mjs b/tests/js/browser-ddev-smoke.mjs
new file mode 100644
index 0000000..f666e58
--- /dev/null
+++ b/tests/js/browser-ddev-smoke.mjs
@@ -0,0 +1,199 @@
+import assert from 'node:assert/strict';
+import { writeFile } from 'node:fs/promises';
+
+const required = ['ADP_CDP_PORT', 'ADP_BASE_URL', 'ADP_BROWSER_EB', 'ADP_BROWSER_ASSISTANT', 'ADP_BROWSER_MEMBER', 'ADP_BROWSER_PASSWORD', 'ADP_BROWSER_TEAM', 'ADP_BROWSER_MONTH', 'ADP_BROWSER_SCREENSHOT'];
+for (const name of required) {
+    if (!process.env[name]) throw new Error(`${name} fehlt.`);
+}
+
+const port = Number(process.env.ADP_CDP_PORT);
+const baseUrl = process.env.ADP_BASE_URL.replace(/\/$/, '');
+const ebUid = process.env.ADP_BROWSER_EB;
+const assistantUid = process.env.ADP_BROWSER_ASSISTANT;
+const memberUid = process.env.ADP_BROWSER_MEMBER;
+const password = process.env.ADP_BROWSER_PASSWORD;
+const teamCode = process.env.ADP_BROWSER_TEAM;
+const month = process.env.ADP_BROWSER_MONTH;
+const screenshotPath = process.env.ADP_BROWSER_SCREENSHOT;
+
+const targetResponse = await fetch(`http://127.0.0.1:${port}/json/new?about%3Ablank`, { method: 'PUT' });
+if (!targetResponse.ok) throw new Error(`Chrome-Ziel konnte nicht angelegt werden: HTTP ${targetResponse.status}`);
+const target = await targetResponse.json();
+
+class CdpClient {
+    constructor(url) {
+        this.nextId = 1;
+        this.pending = new Map();
+        this.socket = new WebSocket(url);
+    }
+
+    async connect() {
+        await new Promise((resolve, reject) => {
+            this.socket.addEventListener('open', resolve, { once: true });
+            this.socket.addEventListener('error', reject, { once: true });
+        });
+        this.socket.addEventListener('message', event => {
+            const message = JSON.parse(String(event.data));
+            if (!message.id || !this.pending.has(message.id)) return;
+            const { resolve, reject } = this.pending.get(message.id);
+            this.pending.delete(message.id);
+            if (message.error) reject(new Error(`${message.error.message} (${message.error.code})`));
+            else resolve(message.result || {});
+        });
+    }
+
+    call(method, params = {}) {
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            this.pending.set(id, { resolve, reject });
+            this.socket.send(JSON.stringify({ id, method, params }));
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+}
+
+const cdp = new CdpClient(target.webSocketDebuggerUrl);
+await cdp.connect();
+
+const sleep = milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds));
+async function evaluate(expression) {
+    const result = await cdp.call('Runtime.evaluate', { expression, awaitPromise: true, returnByValue: true });
+    if (result.exceptionDetails) {
+        throw new Error(result.exceptionDetails.exception?.description || result.exceptionDetails.text || 'JavaScript-Auswertung fehlgeschlagen.');
+    }
+    return result.result?.value;
+}
+
+async function waitFor(expression, label, timeout = 20000) {
+    const deadline = Date.now() + timeout;
+    let lastError = null;
+    while (Date.now() < deadline) {
+        try {
+            if (await evaluate(`Boolean(${expression})`)) return;
+        } catch (error) {
+            lastError = error;
+        }
+        await sleep(100);
+    }
+    const pageState = await evaluate(`({url: location.href, title: document.title, panel: document.querySelector('#adp-panel')?.innerText?.slice(0, 500) || '', notice: document.querySelector('#adp-notice')?.innerText || ''})`);
+    throw new Error(`${label} wurde nicht erreicht. Zustand: ${JSON.stringify(pageState)}${lastError ? `; letzter Fehler: ${lastError.message}` : ''}`);
+}
+
+async function navigateAs(uid) {
+    await cdp.call('Network.clearBrowserCookies');
+    await cdp.call('Network.clearBrowserCache');
+    await cdp.call('Network.setExtraHTTPHeaders', { headers: {} });
+    await cdp.call('Page.navigate', { url: `${baseUrl}/index.php/login?browser-smoke=${Date.now()}` });
+    await waitFor(`document.readyState === 'complete' && document.querySelector('form[name="login"] #user') && document.querySelector('form[name="login"] #password')`, `Loginformular für ${uid}`);
+    await evaluate(`(() => {
+        const form = document.querySelector('form[name="login"]');
+        const user = form.querySelector('#user');
+        const password = form.querySelector('#password');
+        user.value = ${JSON.stringify(uid)};
+        password.value = ${JSON.stringify(password)};
+        user.dispatchEvent(new Event('input', {bubbles: true}));
+        password.dispatchEvent(new Event('input', {bubbles: true}));
+        form.requestSubmit();
+        return true;
+    })()`);
+    await waitFor(`!location.pathname.endsWith('/login') && !document.querySelector('form[name="login"]')`, `Anmeldung für ${uid}`, 30000);
+    await cdp.call('Page.navigate', { url: `${baseUrl}/index.php/apps/adplaner/?browser-smoke=${Date.now()}` });
+    await waitFor(`document.readyState === 'complete'`, 'Dokumentabschluss');
+    await waitFor(`document.querySelector('#adp-panel .adp-month-table')`, `Monatsplan für ${uid}`);
+    assert.match(await evaluate('location.pathname'), /\/apps\/adplaner\/$/);
+    assert.equal(await evaluate(`Boolean(document.querySelector('form[name="login"]'))`), false, 'Der Browser darf nicht auf der Login-Seite landen.');
+}
+
+async function selectMonth() {
+    await evaluate(`(() => { const input = document.querySelector('#month-input'); input.value = ${JSON.stringify(month)}; input.dispatchEvent(new Event('change', {bubbles: true})); return true; })()`);
+    await waitFor(`document.querySelector('#month-input')?.value === ${JSON.stringify(month)} && document.querySelector('.adp-section-head h2')?.textContent?.includes(${JSON.stringify(month)})`, `Monat ${month}`);
+}
+
+async function click(selector, label) {
+    const clicked = await evaluate(`(() => { const element = document.querySelector(${JSON.stringify(selector)}); if (!element) return false; element.click(); return true; })()`);
+    assert.equal(clicked, true, `${label} fehlt.`);
+}
+
+try {
+    await cdp.call('Runtime.enable');
+    await cdp.call('Page.enable');
+    await cdp.call('Network.enable');
+    await cdp.call('Emulation.setDeviceMetricsOverride', { width: 700, height: 700, deviceScaleFactor: 1, mobile: false });
+    await cdp.call('Page.addScriptToEvaluateOnNewDocument', {
+        source: `window.__adpBrowserErrors = []; window.addEventListener('error', event => window.__adpBrowserErrors.push(String(event.error || event.message))); window.addEventListener('unhandledrejection', event => window.__adpBrowserErrors.push(String(event.reason)));`,
+    });
+
+    await navigateAs(ebUid);
+    await selectMonth();
+
+    assert.equal(await evaluate(`document.querySelector('#team-select')?.value`), teamCode, 'Das synthetische Team muss ausgewählt sein.');
+    assert.equal(await evaluate(`document.querySelector('[data-action="transition-status"]')?.dataset.targetStatus`), 'planned', 'Die EB muss den Entwurf festschreiben können.');
+    assert.equal(await evaluate(`Boolean(document.querySelector('textarea[data-note-date]'))`), true, 'Die EB benötigt editierbare Tagesbemerkungen.');
+    assert.equal(await evaluate(`Boolean(Array.from(document.querySelectorAll('[data-action="add-selected"]')).find(button => button.dataset.targetUid === ${JSON.stringify(assistantUid)}))`), true, 'Die aktive Assistenz muss auswählbar sein.');
+    assert.equal(await evaluate(`Boolean(Array.from(document.querySelectorAll('[data-action="add-selected"]')).find(button => button.dataset.targetUid === ${JSON.stringify(ebUid)}))`), false, 'Das EB-Konto darf nicht schichtfähig sein.');
+
+    await click('#month-prev', 'Schalter für den vorherigen Monat');
+    await waitFor(`document.querySelector('#month-input')?.value === '2098-10'`, 'Vorheriger Monat');
+    await click('#month-next', 'Schalter für den nächsten Monat');
+    await waitFor(`document.querySelector('#month-input')?.value === ${JSON.stringify(month)}`, 'Rückkehr zum Prüfmonat');
+
+    await evaluate(`document.querySelector('#adp-tab-month').focus(); document.querySelector('#adp-tab-month').dispatchEvent(new KeyboardEvent('keydown', {key: 'ArrowRight', bubbles: true}));`);
+    await waitFor(`document.querySelector('#adp-tab-settings')?.getAttribute('aria-selected') === 'true' && document.activeElement?.id === 'adp-tab-settings'`, 'Tastaturnavigation zum Einstellungstab');
+    await waitFor(`document.querySelector('#settings-form')`, 'EB-Einstellungsformular');
+    await click('#adp-tab-month', 'Wunschplan-Tab');
+    await waitFor(`document.querySelector('#adp-panel .adp-month-table')`, 'Rückkehr zum Monatsplan');
+
+    await click('[data-action="open-assignment-picker"]', 'Zuteilungsschalter');
+    await waitFor(`Array.from(document.querySelectorAll('[data-action="add-selected"]')).some(button => !button.closest('[hidden]') && button.dataset.targetUid === ${JSON.stringify(assistantUid)})`, 'Geöffnete Assistenzwahl');
+    await evaluate(`Array.from(document.querySelectorAll('[data-action="add-selected"]')).find(button => button.dataset.targetUid === ${JSON.stringify(assistantUid)}).click()`);
+    await waitFor(`Array.from(document.querySelectorAll('.adp-chip')).some(chip => chip.textContent.includes(${JSON.stringify(assistantUid)}))`, 'Persistierte Fremdzuweisung');
+
+    await evaluate(`(() => { const textarea = document.querySelector('textarea[data-note-date]'); window.__adpNoteTextareaBeforeSave = textarea; textarea.value = 'Synthetische Browserbemerkung'; textarea.dispatchEvent(new Event('input', {bubbles: true})); textarea.parentElement.querySelector('[data-action="save-note"]').click(); return true; })()`);
+    await waitFor(`document.querySelector('textarea[data-note-date]') !== window.__adpNoteTextareaBeforeSave && Array.from(document.querySelectorAll('textarea[data-note-date]')).some(textarea => textarea.value === 'Synthetische Browserbemerkung')`, 'Persistierte und neu geladene Tagesbemerkung');
+
+    await click('#adp-tab-settings', 'Einstellungstab');
+    await waitFor(`document.querySelector('#settings-form')`, 'Einstellungsformular');
+    await evaluate(`(() => { const form = document.querySelector('#settings-form'); form.querySelector('[name="displayName"]').value = 'Browserteam ${teamCode}'; form.querySelector('[name="shiftLabel"]').value = 'Früh Browser'; form.requestSubmit(); return true; })()`);
+    await waitFor(`document.querySelector('#adp-tab-month')?.getAttribute('aria-selected') === 'true' && Array.from(document.querySelectorAll('.adp-month-table thead th')).some(th => th.textContent.includes('Früh Browser'))`, 'Persistierte Schichtkonfiguration');
+
+    await click('[data-action="transition-status"][data-target-status="planned"]', 'Festschreiben als geplant');
+    await waitFor(`document.querySelector('[data-plan-status="planned"]')`, 'Status geplant');
+    await click('[data-action="transition-status"][data-target-status="approved"]', 'Genehmigung');
+    await waitFor(`document.querySelector('[data-plan-status="approved"]')`, 'Status genehmigt');
+    assert.equal(await evaluate(`Boolean(document.querySelector('textarea[data-note-date], [data-action="add-selected"], [data-action="remove-candidate"]'))`), false, 'Ein genehmigter Plan muss vollständig gesperrt sein.');
+
+    const layout = await evaluate(`(() => { const root = document.querySelector('#adplaner-app'); const wrap = document.querySelector('.adp-table-wrap'); const last = document.querySelector('.adp-month-table th:last-child'); const rootStyle = getComputedStyle(root); return { rootOverflowY: rootStyle.overflowY, rootBackground: rootStyle.backgroundColor, rootScrollable: root.scrollHeight > root.clientHeight, wrapOverflowX: getComputedStyle(wrap).overflowX, wrapScrollable: wrap.scrollWidth > wrap.clientWidth, lastPosition: getComputedStyle(last).position, lastRight: getComputedStyle(last).right, panelLabel: document.querySelector('#adp-panel')?.getAttribute('aria-labelledby') }; })()`);
+    assert.equal(layout.rootOverflowY, 'auto');
+    assert.notEqual(layout.rootBackground, 'rgba(0, 0, 0, 0)');
+    assert.equal(layout.rootScrollable, true, 'Der App-Root muss bei langem Plan vertikal scrollen.');
+    assert.equal(layout.wrapOverflowX, 'auto');
+    assert.equal(layout.wrapScrollable, true, 'Der schmale Plan-Viewport muss horizontal scrollen.');
+    assert.equal(layout.lastPosition, 'sticky');
+    assert.equal(layout.lastRight, '0px');
+    assert.equal(layout.panelLabel, 'adp-tab-month');
+
+    const screenshot = await cdp.call('Page.captureScreenshot', { format: 'png', captureBeyondViewport: false });
+    await writeFile(screenshotPath, Buffer.from(screenshot.data, 'base64'));
+
+    await click('[data-action="transition-status"][data-target-status="planned"]', 'Aufheben der Genehmigung');
+    await waitFor(`document.querySelector('[data-plan-status="planned"]') && document.querySelector('textarea[data-note-date]')`, 'Wieder entsperrter Plan');
+
+    await navigateAs(memberUid);
+    await selectMonth();
+    assert.equal(await evaluate(`Boolean(document.querySelector('[data-action="transition-status"], textarea[data-note-date], [data-action="add-selected"]'))`), false, 'Ein normales Teammitglied darf keine EB-Steuerung erhalten.');
+    assert.equal(await evaluate(`Boolean(document.querySelector('[data-action="add-self"]'))`), true, 'Ein normales Teammitglied muss einen eigenen Wunsch eintragen können.');
+    await click('[data-action="add-self"]', 'Eigener Wunsch');
+    await waitFor(`Array.from(document.querySelectorAll('.adp-chip')).some(chip => chip.textContent.includes(${JSON.stringify(memberUid)}))`, 'Persistierter eigener Wunsch');
+    await click('#adp-tab-settings', 'Einstellungstab des normalen Mitglieds');
+    await waitFor(`document.querySelector('.adp-settings-readonly')`, 'Schreibgeschützte Einstellungen');
+    assert.equal(await evaluate(`Boolean(document.querySelector('#settings-form'))`), false, 'Ein normales Mitglied darf kein Einstellungsformular erhalten.');
+
+    const browserErrors = await evaluate(`window.__adpBrowserErrors || []`);
+    assert.deepEqual(browserErrors, [], `Die Oberfläche erzeugte Browserfehler: ${browserErrors.join('; ')}`);
+    console.log('AdPlaner synthetischer DDEV-Browser-Smoke: OK');
+} finally {
+    cdp.close();
+}
diff --git a/tests/js/main-workflow-smoke.js b/tests/js/main-workflow-smoke.js
index 5b49810..dba4e2c 100644
--- a/tests/js/main-workflow-smoke.js
+++ b/tests/js/main-workflow-smoke.js
@@ -8,6 +8,8 @@ const {
 const elements = createElementMap([
     'team-select',
     'month-input',
+    'month-prev',
+    'month-next',
     'adp-panel',
 ]);
 const tabs = new FakeElement('tabs');
@@ -86,6 +88,9 @@ global.document = {
 class FakePlanRepository {
     constructor() {
         lastRepository = this;
+        this.failMonth = '';
+        this.deferredMonths = new Map();
+        this.pendingAddSelf = null;
     }
 
     async state() {
@@ -103,12 +108,40 @@ class FakePlanRepository {
 
     async monthPlan(teamCode, month) {
         repositoryCalls.push(['monthPlan', teamCode, month]);
+        if (month === this.failMonth) {
+            throw new Error('Monat nicht verfügbar');
+        }
+        if (this.deferredMonths.has(month)) {
+            return this.deferredMonths.get(month).promise;
+        }
 
         return { month, team: { code: teamCode, displayName: teamCode === 'TeamA' ? 'Team <A>' : teamCode } };
     }
 
+    deferMonth(month) {
+        let resolve;
+        const promise = new Promise(done => { resolve = done; });
+        this.deferredMonths.set(month, { promise, resolve });
+        return resolve;
+    }
+
     async addSelf(teamCode, month, slotId) {
         repositoryCalls.push(['addSelf', teamCode, month, slotId]);
+        if (this.pendingAddSelf) await this.pendingAddSelf;
+    }
+
+    deferAddSelf() {
+        let resolve;
+        this.pendingAddSelf = new Promise(done => { resolve = done; });
+        return resolve;
+    }
+
+    async addSelected(teamCode, month, slotId, targetUid) {
+        repositoryCalls.push(['addSelected', teamCode, month, slotId, targetUid]);
+    }
+
+    async transitionStatus(teamCode, month, targetStatus) {
+        repositoryCalls.push(['transitionStatus', teamCode, month, targetStatus]);
     }
 
 }
@@ -138,6 +171,40 @@ async function flush() {
     assert(!elements.get('team-select').innerHTML.includes('Team <A>'));
     assert.strictEqual(elements.get('team-select').disabled, false);
     assert.strictEqual(elements.get('month-input').value, '2026-07');
+
+    await elements.get('month-prev').listeners.click();
+    assert.strictEqual(elements.get('month-input').value, '2026-06');
+    assert.deepStrictEqual(repositoryCalls.at(-1), ['monthPlan', 'TeamA', '2026-06']);
+    await elements.get('month-next').listeners.click();
+    assert.strictEqual(elements.get('month-input').value, '2026-07');
+    assert.deepStrictEqual(repositoryCalls.at(-1), ['monthPlan', 'TeamA', '2026-07']);
+    const callsBeforeInvalidMonth = repositoryCalls.length;
+    for (const invalidMonth of ['', '1999-12', '2101-01', '2026-13']) {
+        await elements.get('month-input').listeners.change({ target: { value: invalidMonth } });
+        assert.strictEqual(elements.get('month-input').value, '2026-07');
+    }
+    assert.strictEqual(repositoryCalls.length, callsBeforeInvalidMonth);
+    await elements.get('month-input').listeners.change({ target: { value: '2000-01' } });
+    assert.strictEqual(elements.get('month-prev').disabled, true);
+    const callsAtLowerBoundary = repositoryCalls.length;
+    await elements.get('month-prev').listeners.click();
+    assert.strictEqual(repositoryCalls.length, callsAtLowerBoundary);
+    assert.strictEqual(elements.get('month-input').value, '2000-01');
+    await elements.get('month-input').listeners.change({ target: { value: '2100-12' } });
+    assert.strictEqual(elements.get('month-next').disabled, true);
+    const callsAtUpperBoundary = repositoryCalls.length;
+    await elements.get('month-next').listeners.click();
+    assert.strictEqual(repositoryCalls.length, callsAtUpperBoundary);
+    assert.strictEqual(elements.get('month-input').value, '2100-12');
+    await elements.get('month-input').listeners.change({ target: { value: '2026-07' } });
+    await elements.get('month-input').listeners.change({ target: { value: '2026-12' } });
+    await elements.get('month-next').listeners.click();
+    assert.strictEqual(elements.get('month-input').value, '2027-01');
+    assert.deepStrictEqual(repositoryCalls.at(-1), ['monthPlan', 'TeamA', '2027-01']);
+    await elements.get('month-prev').listeners.click();
+    assert.strictEqual(elements.get('month-input').value, '2026-12');
+    assert.deepStrictEqual(repositoryCalls.at(-1), ['monthPlan', 'TeamA', '2026-12']);
+    await elements.get('month-input').listeners.change({ target: { value: '2026-07' } });
     assert.strictEqual(tabMonth.classList.has('is-active'), true);
     assert.strictEqual(tabMonth.getAttribute('aria-selected'), 'true');
     assert.strictEqual(tabSettings.getAttribute('aria-selected'), 'false');
@@ -175,6 +242,85 @@ async function flush() {
     ]);
     assert.deepStrictEqual(errors, []);
 
+    await elements.get('adp-panel').listeners.click({
+        target: new FakeButton({
+            action: 'add-selected',
+            slotId: '8',
+            targetUid: 'anna'
+        })
+    });
+    assert.deepStrictEqual(repositoryCalls.slice(-2), [
+        ['addSelected', 'TeamB', '2026-07', '8', 'anna'],
+        ['monthPlan', 'TeamB', '2026-07']
+    ]);
+
+    await elements.get('adp-panel').listeners.click({
+        target: new FakeButton({
+            action: 'transition-status',
+            targetStatus: 'planned'
+        })
+    });
+    assert.deepStrictEqual(repositoryCalls.slice(-2), [
+        ['transitionStatus', 'TeamB', '2026-07', 'planned'],
+        ['monthPlan', 'TeamB', '2026-07']
+    ]);
+
+    const resolveAddSelf = lastRepository.deferAddSelf();
+    const guardedButton = new FakeButton({
+        action: 'add-self',
+        slotId: '42'
+    });
+    const firstGuardedAction = elements.get('adp-panel').listeners.click({ target: guardedButton });
+    await flush();
+    assert.strictEqual(guardedButton.disabled, true);
+    const secondGuardedAction = elements.get('adp-panel').listeners.click({ target: guardedButton });
+    await flush();
+    assert.strictEqual(
+        repositoryCalls.filter(call => call[0] === 'addSelf' && call[3] === '42').length,
+        1,
+        'A disabled action button must not start a second concurrent mutation.'
+    );
+    resolveAddSelf();
+    await Promise.all([firstGuardedAction, secondGuardedAction]);
+    lastRepository.pendingAddSelf = null;
+    assert.strictEqual(guardedButton.disabled, false);
+
+    lastRepository.failMonth = '2026-08';
+    await elements.get('month-input').listeners.change({ target: { value: '2026-08' } });
+    assert.deepStrictEqual(repositoryCalls.at(-1), ['monthPlan', 'TeamB', '2026-08']);
+    assert.strictEqual(errors.at(-1).message, 'Monat nicht verfügbar');
+    assert(!elements.get('adp-panel').innerHTML.includes('TeamB:2026-07'));
+
+    lastRepository.failMonth = '';
+    await elements.get('month-input').listeners.change({ target: { value: '2026-07' } });
+    assert(elements.get('adp-panel').innerHTML.includes('TeamB:2026-07'));
+    lastRepository.failMonth = '2026-07';
+    await elements.get('adp-panel').listeners.click({
+        target: new FakeButton({
+            action: 'add-self',
+            slotId: '9'
+        })
+    });
+    assert.deepStrictEqual(repositoryCalls.slice(-2), [
+        ['addSelf', 'TeamB', '2026-07', '9'],
+        ['monthPlan', 'TeamB', '2026-07']
+    ]);
+    assert.strictEqual(errors.at(-1).fallback, 'Die Änderung wurde gespeichert, aber der Monatsplan konnte nicht neu geladen werden.');
+    assert(!elements.get('adp-panel').innerHTML.includes('TeamB:2026-07'));
+
+    lastRepository.failMonth = '';
+    const resolveAugust = lastRepository.deferMonth('2026-08');
+    const resolveSeptember = lastRepository.deferMonth('2026-09');
+    const augustLoad = elements.get('month-input').listeners.change({ target: { value: '2026-08' } });
+    const septemberLoad = elements.get('month-input').listeners.change({ target: { value: '2026-09' } });
+    resolveSeptember({ month: '2026-09', team: { code: 'TeamB', displayName: 'Team B' } });
+    await septemberLoad;
+    assert(elements.get('adp-panel').innerHTML.includes('TeamB:2026-09'));
+    resolveAugust({ month: '2026-08', team: { code: 'TeamB', displayName: 'Team B' } });
+    await augustLoad;
+    assert(elements.get('adp-panel').innerHTML.includes('TeamB:2026-09'));
+    assert(!elements.get('adp-panel').innerHTML.includes('TeamB:2026-08'));
+
     console.log('AdPlaner main workflow smoke test passed.');
 })().catch((error) => {
     console.error(error);
diff --git a/tests/js/model-smoke.js b/tests/js/model-smoke.js
index 59c2f7d..77d6bb4 100644
--- a/tests/js/model-smoke.js
+++ b/tests/js/model-smoke.js
@@ -34,11 +34,17 @@ assert.strictEqual(assistant.displayName, 'Anna Assistenz');
 const candidate = ShiftCandidate.get({
     slot_id: 7,
     assistant_uid: 'anna',
-    display_name: 'Anna Assistenz'
+    display_name: 'Anna Assistenz',
+    createdByUid: 'internal-coordinator',
+    created_at: '2026-08-09T10:00:00Z'
 });
 
 assert(candidate instanceof ShiftCandidate);
 assert.strictEqual(candidate.uid, 'anna');
+assert.strictEqual(Object.hasOwn(candidate, 'createdByUid'), false);
+assert.strictEqual(Object.hasOwn(candidate, 'createdAt'), false);
+assert.strictEqual(Object.hasOwn(candidate.toArray(), 'createdByUid'), false);
+assert.strictEqual(Object.hasOwn(candidate.toArray(), 'createdAt'), false);
 
 const definition = ShiftDefinition.get({
     key: 'day',
diff --git a/tests/js/month-plan-smoke.js b/tests/js/month-plan-smoke.js
index 26f103a..0c1905c 100644
--- a/tests/js/month-plan-smoke.js
+++ b/tests/js/month-plan-smoke.js
@@ -13,6 +13,7 @@ const { monthPlan } = window.ADPlaner;
 
 const basePlan = {
     month: '2026-07',
+    status: 'draft',
     segments: [
         { key: 'early', label: 'Früh <A>', startsAt: '08:00', endsAt: '14:00' },
         { key: 'late', label: 'Spät', startsAt: '14:00', endsAt: '20:00' }
@@ -23,6 +24,10 @@ const basePlan = {
             dayOfMonth: 1,
             weekday: 3,
             note: '<Hinweis>',
+            hints: [
+                { employeeUid: 'assistant-a', displayName: 'Assistant <A>', marker: 'U?', label: 'Urlaub', blocks: false },
+                { employeeUid: 'assistant-b', displayName: 'Assistant B', marker: 'K', label: 'Termin', blocks: false }
+            ],
             slots: [
                 { id: 10, segmentKey: 'early', candidates: [] },
                 {
@@ -52,12 +57,18 @@ assert(assistantHtml.includes('Team &lt;A1&gt; - 2026-07'));
 assert(!assistantHtml.includes('Team <A1>'));
 assert(assistantHtml.includes('Treffen 15.07.'));
 assert(assistantHtml.includes('Früh &lt;A&gt;'));
+assert(assistantHtml.includes('<th scope="col">Tag</th>'), 'Month-plan column headings need an explicit scope.');
+assert(assistantHtml.includes('<th scope="row" class="adp-day">'), 'Each planning day needs an explicit row heading.');
 assert(assistantHtml.includes('Mi<span>1</span>'));
 assert(assistantHtml.includes('data-action="add-self" data-slot-id="10"'));
 assert(!assistantHtml.includes('data-action="add-self" data-slot-id="11"'));
 assert(!assistantHtml.includes('adp-assignment-control'));
+assert(!assistantHtml.includes('data-action="transition-status"'));
 assert(assistantHtml.includes('<span class="adp-note-text">&lt;Hinweis&gt;</span>'));
 assert(!assistantHtml.includes('<Hinweis>'));
+assert(assistantHtml.includes('U? Assistant &lt;A&gt;'));
+assert(assistantHtml.includes('K Assistant B'));
+assert(!assistantHtml.includes('Assistant <A>'));
 
 const ebHtml = monthPlan.render({
     ...basePlan,
@@ -76,7 +87,44 @@ const ebHtml = monthPlan.render({
 assert(!ebHtml.includes('data-action="add-self"'));
 assert(ebHtml.includes('adp-assignment-control'));
 assert(ebHtml.includes('data-action="remove-candidate" data-slot-id="11" data-target-uid="assistant-a"'));
-assert(ebHtml.includes('<textarea rows="2" data-note-date="2026-07-01">&lt;Hinweis&gt;</textarea>'));
-assert(ebHtml.includes('value="assistant-b"'));
+assert(ebHtml.includes('aria-label="Assistant A entfernen"'));
+assert(ebHtml.includes('<textarea rows="2" maxlength="2000" aria-label="Bemerkung für 01.07." data-note-date="2026-07-01">&lt;Hinweis&gt;</textarea>'));
+assert(ebHtml.includes('aria-label="Bemerkung für 01.07."'), 'The editable day note needs its own accessible name.');
+assert(ebHtml.includes('aria-label="Bemerkung für 01.07. speichern"'));
+assert(ebHtml.includes('data-action="add-selected" data-slot-id="10" data-target-uid="assistant-b"'));
+assert(ebHtml.includes('Entwurf'));
+assert(ebHtml.includes('data-action="transition-status" data-target-status="planned"'));
+
+const approvedHtml = monthPlan.render({
+    ...basePlan,
+    status: 'approved',
+    team: {
+        code: 'A1',
+        displayName: 'Team A1',
+        canCoordinate: true,
+        settings: {},
+        assistants: [{ uid: 'assistant-a', displayName: 'Assistant A', canReceiveShifts: true }]
+    }
+}, { uid: 'eb' });
+assert(approvedHtml.includes('Genehmigt'));
+assert(approvedHtml.includes('data-action="transition-status" data-target-status="planned"'));
+assert(!approvedHtml.includes('adp-assignment-control'));
+assert(!approvedHtml.includes('data-action="remove-candidate"'));
+assert(!approvedHtml.includes('<textarea'));
+
+const unknownStatusHtml = monthPlan.render({
+    ...basePlan,
+    status: 'unexpected',
+    team: {
+        code: 'A1',
+        displayName: 'Team A1',
+        canCoordinate: true,
+        settings: {},
+        assistants: [{ uid: 'assistant-a', displayName: 'Assistant A', canReceiveShifts: true }]
+    }
+}, { uid: 'eb' });
+assert(!unknownStatusHtml.includes('adp-assignment-control'), 'Unknown plan statuses must fail closed in the assignment UI.');
+assert(!unknownStatusHtml.includes('data-action="remove-candidate"'), 'Unknown plan statuses must not expose candidate mutations.');
+assert(!unknownStatusHtml.includes('<textarea'), 'Unknown plan statuses must not expose day-note mutations.');
 
 console.log('AdPlaner month plan smoke test passed.');
diff --git a/tests/js/plan-app-settings-smoke.js b/tests/js/plan-app-settings-smoke.js
new file mode 100644
index 0000000..7fec628
--- /dev/null
+++ b/tests/js/plan-app-settings-smoke.js
@@ -0,0 +1,124 @@
+const assert = require('assert');
+
+global.window = { ADPlaner: {} };
+require('../../js/modules/plan-app.js');
+
+class ChromeFake {
+    constructor() {}
+    render() {}
+}
+
+class PanelFake {
+    constructor() {
+        this.panel = { querySelector() { return null; } };
+    }
+    render() {}
+}
+
+class SettingsRepositoryFake {
+    constructor() {
+        this.saveCalls = 0;
+        this.failState = false;
+        this.failSave = false;
+        this.pendingSave = null;
+    }
+
+    async saveSettings() {
+        this.saveCalls++;
+        if (this.failSave) throw new Error('Speichern fehlgeschlagen');
+        if (this.pendingSave) await this.pendingSave;
+    }
+
+    deferSave() {
+        let resolve;
+        this.pendingSave = new Promise(done => { resolve = done; });
+        return resolve;
+    }
+
+    async state() {
+        if (this.failState) throw new Error('Zustand nicht verfügbar');
+        return {
+            currentUser: { uid: 'test-eb' },
+            teams: [{ code: 'A1', displayName: 'Team A1' }],
+            organization: {}
+        };
+    }
+
+    async monthPlan(teamCode, month) {
+        return { month, team: { code: teamCode, displayName: 'Team A1' } };
+    }
+}
+
+function createApp(repository, errors) {
+    const app = new window.ADPlaner.PlanApp({
+        repository,
+        PlanChrome: ChromeFake,
+        PlanPanel: PanelFake,
+        byId() { return null; },
+        esc: String,
+        showNotice() {},
+        showError(error, fallback) { errors.push({ message: error.message, fallback }); },
+        renderMonth() { return ''; },
+        renderSettings() { return ''; },
+        addShiftRow() {},
+        removeShiftRow() {},
+        collectShifts() { return []; },
+        openAssignmentPicker() {},
+    });
+    app.state = {
+        currentUser: { uid: 'test-eb' },
+        teams: [{ code: 'A1', displayName: 'Team A1' }],
+        selectedTeamCode: 'A1',
+        month: '2026-08',
+        activeView: 'settings',
+        monthPlan: { month: '2026-08', team: { code: 'A1' } },
+        organization: {},
+        loading: false,
+    };
+    return app;
+}
+
+const values = {
+    displayName: 'Team A1',
+    meetingDay: '2026-08-10',
+    shifts: [{ key: 'day', label: 'Tag', startsAt: '08:00', endsAt: '16:00', enabled: true }]
+};
+
+(async () => {
+    const errors = [];
+    const repository = new SettingsRepositoryFake();
+    const app = createApp(repository, errors);
+
+    repository.failState = true;
+    await app.saveSettings(values);
+    assert.strictEqual(repository.saveCalls, 1);
+    assert.strictEqual(errors.at(-1).fallback, 'Die Einstellungen wurden gespeichert, aber die Ansicht konnte nicht neu geladen werden.');
+    assert.strictEqual(app.state.monthPlan, null);
+
+    repository.failState = false;
+    repository.failSave = true;
+    await app.saveSettings(values);
+    assert.strictEqual(repository.saveCalls, 2);
+    assert.strictEqual(errors.at(-1).fallback, 'Einstellungen konnten nicht gespeichert werden.');
+
+    repository.failSave = false;
+    const resolveSave = repository.deferSave();
+    const firstSave = app.saveSettings(values);
+    await Promise.resolve();
+    const secondSave = app.saveSettings(values);
+    await Promise.resolve();
+    assert.strictEqual(repository.saveCalls, 3, 'A second submit must not start another settings write while one is pending.');
+    resolveSave();
+    await Promise.all([firstSave, secondSave]);
+    repository.pendingSave = null;
+    assert.strictEqual(app.settingsSaving, false);
+
+    repository.failSave = true;
+    await app.saveSettings(values);
+    assert.strictEqual(repository.saveCalls, 4, 'Saving must be possible again after the pending request completed.');
+
+    console.log('AdPlaner settings workflow smoke test passed.');
+})().catch(error => {
+    console.error(error);
+    process.exit(1);
+});
diff --git a/tests/js/plan-repository-smoke.js b/tests/js/plan-repository-smoke.js
index 677aae2..18bbc0e 100644
--- a/tests/js/plan-repository-smoke.js
+++ b/tests/js/plan-repository-smoke.js
@@ -47,6 +47,7 @@ require('../../js/repositories/plan-repository.js');
     const monthPlan = await repository.monthPlan('TeamA', '2026-07');
     await repository.addSelected('TeamA', '2026-07', 1, 'anna');
     await repository.saveDayNote('TeamA', '2026-07', '2026-07-01', 'Hinweis');
+    await repository.transitionStatus('TeamA', '2026-07', 'planned');
     await repository.saveSettings('TeamA', 'Team A', '2', [{ key: 'day' }]);
 
     assert.strictEqual(state.teams[0] instanceof window.ADPlaner.models.Team, true);
@@ -58,10 +59,12 @@ require('../../js/repositories/plan-repository.js');
         '/api/teams/TeamA/months/2026-07',
         '/api/teams/TeamA/months/2026-07/slots/1/candidates',
         '/api/teams/TeamA/months/2026-07/days/2026-07-01/note',
+        '/api/teams/TeamA/months/2026-07/status',
         '/api/teams/TeamA/settings'
     ]);
     assert.strictEqual(calls[2].options.body, '{"targetUid":"anna"}');
-    assert.strictEqual(calls[4].options.body, '{"displayName":"Team A","meetingDay":"2","shiftsJson":"[{\\"key\\":\\"day\\"}]"}');
+    assert.strictEqual(calls[4].options.body, '{"targetStatus":"planned"}');
+    assert.strictEqual(calls[5].options.body, '{"displayName":"Team A","meetingDay":"2","shiftsJson":"[{\\"key\\":\\"day\\"}]"}');
 
     console.log('AdPlaner plan repository smoke test passed.');
 })();
diff --git a/tests/js/settings-panel-smoke.js b/tests/js/settings-panel-smoke.js
index d463b95..8b9ae0d 100644
--- a/tests/js/settings-panel-smoke.js
+++ b/tests/js/settings-panel-smoke.js
@@ -42,11 +42,14 @@ const editorHtml = settingsPanel.render({
 });
 
 assert(editorHtml.includes('id="settings-form"'));
+assert(editorHtml.includes('name="displayName" type="text" maxlength="255" required'));
 assert(editorHtml.includes('value="Team &lt;Settings&gt;"'));
 assert(editorHtml.includes('value="early"'));
 assert(editorHtml.includes('value="Früh &lt;A&gt;"'));
 assert(editorHtml.includes('data-action="add-shift-row"'));
 assert(editorHtml.includes('data-action="remove-shift-row"'));
+assert(editorHtml.includes('aria-label="Schicht Früh &lt;A&gt; entfernen"'));
+assert(!editorHtml.includes('aria-label="Schicht Früh <A> entfernen"'));
 assert(editorHtml.includes('<button type="submit">Speichern</button>'));
 
 const collectForm = {
diff --git a/tests/privacy-ddev-smoke.sh b/tests/privacy-ddev-smoke.sh
new file mode 100755
index 0000000..fe6b2f9
--- /dev/null
+++ b/tests/privacy-ddev-smoke.sh
@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+base_url="${ADP_BASE_URL:-https://nextcloud-dev.ddev.site}"
+ddev_project="${ADP_DDEV_PROJECT:-$(cd "$(dirname "$0")/../../nextcloud-dev" && pwd)}"
+suffix="$(date +%s)$$"
+team_code="P${suffix: -15}"
+team_group="ad-ASN-$team_code"
+month='2098-11'
+work_date="$month-03"
+password="$(php -r 'echo bin2hex(random_bytes(24));')"
+actor="adp-privacy-$suffix-eb"
+active="adp-privacy-$suffix-active"
+disabled="adp-privacy-$suffix-disabled"
+created_users=()
+workdir="$(mktemp -d)"
+probe='/var/www/html/html/custom_apps/adplaner/tests/integration/PrivacyRuntimeProbe.php'
+
+occ() {
+    (cd "$ddev_project" && ddev exec -d /var/www/html/html php occ "$@")
+}
+
+run_probe() {
+    (cd "$ddev_project" && ddev exec -d /var/www/html/html php "$probe" "$@")
+}
+
+cleanup() {
+    local failed=0
+    run_probe cleanup "$team_code" "$month" || failed=1
+    local uid
+    for uid in "${created_users[@]}"; do
+        occ user:delete "$uid" >/dev/null 2>&1 || failed=1
+    done
+    occ group:delete "$team_group" >/dev/null 2>&1 || failed=1
+    rm -rf "$workdir"
+    return "$failed"
+}
+
+report_failed_cleanup() {
+    echo 'Der Datenschutz-Smoke wurde abgebrochen; die automatische Bereinigung war nicht vollständig erfolgreich.' >&2
+    echo "Bitte synthetische Objekte prüfen: Team $team_code, Gruppe $team_group, Nutzer ${created_users[*]:-keine}." >&2
+}
+
+trap 'cleanup || report_failed_cleanup' EXIT
+
+create_user() {
+    local uid="$1"
+    (cd "$ddev_project" && ddev exec -d /var/www/html/html env OC_PASS="$password" php occ user:add --password-from-env "$uid") >/dev/null
+    created_users+=("$uid")
+    occ group:adduser "$team_group" "$uid" >/dev/null
+}
+
+if ! occ group:info ad-EB >/dev/null 2>&1; then
+    echo 'Die bestehende EB-Rollengruppe ad-EB fehlt; der Smoke verändert die Organisationskonfiguration nicht.' >&2
+    exit 1
+fi
+
+occ group:add "$team_group" >/dev/null
+create_user "$actor"
+create_user "$active"
+create_user "$disabled"
+occ group:adduser ad-EB "$actor" >/dev/null
+occ user:disable "$disabled" >/dev/null
+
+page="$workdir/page.html"
+cookies="$workdir/cookies.txt"
+plan="$workdir/plan.json"
+response="$workdir/response.json"
+
+curl --fail --silent --show-error --insecure --user "$actor:$password" \
+    --cookie-jar "$cookies" "$base_url/index.php/apps/adplaner/" --output "$page"
+token="$(sed -n 's/.*data-requesttoken="\([^"]*\)".*/\1/p' "$page" | head -n 1)"
+if [[ -z "$token" ]]; then
+    echo 'Request-Token fehlt.' >&2
+    exit 1
+fi
+
+plan_endpoint="$base_url/index.php/apps/adplaner/api/teams/$team_code/months/$month"
+curl --fail --silent --show-error --insecure --user "$actor:$password" \
+    --cookie "$cookies" --cookie-jar "$cookies" -H "requesttoken: $token" \
+    "$plan_endpoint" --output "$plan"
+
+php -r '
+$data = json_decode(file_get_contents($argv[1]), true, flags: JSON_THROW_ON_ERROR);
+$uids = array_column($data["team"]["assistants"] ?? [], "uid");
+if (!in_array($argv[2], $uids, true)) {
+    throw new RuntimeException("Die aktive Assistenz fehlt im öffentlichen Team-Payload.");
+}
+foreach ([$argv[3], $argv[4]] as $forbiddenUid) {
+    if (in_array($forbiddenUid, $uids, true)) {
+        throw new RuntimeException("Ein nicht schichtfähiges Konto wurde öffentlich als Assistenz angeboten: " . $forbiddenUid);
+    }
+}
+' "$plan" "$active" "$disabled" "$actor"
+
+before="$(run_probe snapshot "$team_code" "$month")"
+curl --fail --silent --show-error --insecure --user "$actor:$password" \
+    --cookie "$cookies" --cookie-jar "$cookies" -H "requesttoken: $token" \
+    "$plan_endpoint" --output "$plan"
+after="$(run_probe snapshot "$team_code" "$month")"
+php -r '
+$before = json_decode($argv[1], true, flags: JSON_THROW_ON_ERROR);
+$after = json_decode($argv[2], true, flags: JSON_THROW_ON_ERROR);
+if ($after["revision"] <= $before["revision"]) {
+    throw new RuntimeException("Das technische Monats-Locking hat die Revision nicht fortgeschrieben.");
+}
+if ($after["updatedByUid"] !== $before["updatedByUid"] || $after["updatedAt"] !== $before["updatedAt"]) {
+    throw new RuntimeException("Das technische Monats-Locking hat fachliche Änderungsmetadaten überschrieben.");
+}
+' "$before" "$after"
+
+note_endpoint="$plan_endpoint/days/$work_date/note"
+curl --fail --silent --show-error --insecure --user "$actor:$password" \
+    --cookie "$cookies" --cookie-jar "$cookies" -H "requesttoken: $token" -H 'Content-Type: application/json' \
+    -X POST --data '{"note":"Synthetische Prüfbemerkung"}' "$note_endpoint" --output "$response"
+run_probe assert-note-present "$team_code" "$month" "$work_date" >/dev/null
+
+curl --fail --silent --show-error --insecure --user "$actor:$password" \
+    --cookie "$cookies" --cookie-jar "$cookies" -H "requesttoken: $token" -H 'Content-Type: application/json' \
+    -X POST --data '{"note":"   "}' "$note_endpoint" --output "$response"
+run_probe assert-note-absent "$team_code" "$month" "$work_date" >/dev/null
+
+cleanup
+trap - EXIT
+run_probe assert-clean "$team_code" "$month" >/dev/null
+for uid in "$actor" "$active" "$disabled"; do
+    if occ user:info "$uid" >/dev/null 2>&1; then
+        echo "Synthetischer Nutzer verblieb nach der Bereinigung: $uid" >&2
+        exit 1
+    fi
+done
+if occ group:info "$team_group" >/dev/null 2>&1; then
+    echo "Synthetische Gruppe verblieb nach der Bereinigung: $team_group" >&2
+    exit 1
+fi
+
+echo 'AdPlaner datensparsamer DDEV-Runtime-Smoke: OK'
diff --git a/tests/run-js.mjs b/tests/run-js.mjs
index a2efa1d..8426e6e 100644
--- a/tests/run-js.mjs
+++ b/tests/run-js.mjs
@@ -7,10 +7,12 @@ const root = dirname(dirname(fileURLToPath(import.meta.url)));
 runJavaScriptSuite({
     root,
     testFiles: [
+        'tests/js/admin-smoke.js',
         'tests/js/assignment-control-smoke.js',
         'tests/js/main-workflow-smoke.js',
         'tests/js/model-smoke.js',
         'tests/js/month-plan-smoke.js',
+        'tests/js/plan-app-settings-smoke.js',
         'tests/js/plan-repository-smoke.js',
         'tests/js/settings-panel-smoke.js',
         'tests/js/ui-smoke.js',
diff --git a/tests/run.php b/tests/run.php
index 5e4af37..7bc8b9d 100644
--- a/tests/run.php
+++ b/tests/run.php
@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-require_once __DIR__ . '/../../localbase/tests/Support/PhpTestRunner.php';
+require_once __DIR__ . '/bootstrap.php';
 
 use OCA\LocalBase\Tests\Support\PhpTestRunner;