From c219ddab75a398137b6f10183e17704c22353088 Mon Sep 17 00:00:00 2001
From: Baptiste Bouchereau <baptiste.bouchereau@gmail.com>
Date: Sat, 22 Aug 2026 14:58:50 +0200
Subject: [PATCH 01/10] Add plan for inline sub category assignment on the
 transaction list

Covers the UI spec for the uncategorized-row cell, the new PATCH endpoint
and assigner service, the progressive-enhancement frontend, functional and
unit test cases, the dependency decision (none), and the performance and
security implications.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q1NqsuwvBdHz19hkzKKmie
---
 docs/plans/inline-sub-category-assignment.md | 560 +++++++++++++++++++
 1 file changed, 560 insertions(+)
 create mode 100644 docs/plans/inline-sub-category-assignment.md

diff --git a/docs/plans/inline-sub-category-assignment.md b/docs/plans/inline-sub-category-assignment.md
new file mode 100644
index 0000000..f278ad3
--- /dev/null
+++ b/docs/plans/inline-sub-category-assignment.md
@@ -0,0 +1,560 @@
+Inline sub category assignment on the transaction list
+=====================================================
+
+Goal
+----
+
+Let a user assign a sub category to an **uncategorized** transaction directly from
+`/transaction/`, without opening the edit page.
+
+This is the fast path of the monthly workflow: after an import, the long tail of
+transactions that no rule matched has to be categorized one by one. Today that costs
+two page loads and a form submit per transaction.
+
+Scope
+-----
+
+**In scope**: the Sub category cell of rows where `transaction.subCategory is null`.
+
+**Out of scope for this branch** (deliberately, see [Follow-ups](#follow-ups)):
+
+* editing the sub category of an already-categorized row (click-to-edit),
+* bulk selection / "apply to selected",
+* the "create a rule from this" prompt after a save,
+* the uncategorized counter and filter shortcut next to the transaction total.
+
+---
+
+1. UI specification
+-------------------
+
+### 1.1 Cell states
+
+The Sub category cell of an uncategorized row moves through three states.
+
+```
+  Label                      Amount   Created     Account  Sub category            Actions
+ ──────────────────────────────────────────────────────────────────────────────────────────
+ ▎Ovh sas - date de valeur…  -34.30   02/04/2025  N26      [Select a category ▾]    ✎  ⚌     (1) idle
+ ▎Campus.coach - date de v…  -15.00   12/04/2025  N26      [Groceries         ▾] ⋯  ✎  ⚌     (2) saving
+  Ccm loire divatte - date…  -20.00   12/04/2025  N26      Groceries  ✓ saved · undo ✎  ⚌     (3) saved
+```
+
+1. **Idle** — a `<select>` scoped to the transaction's own type (see 1.2), plus a submit
+   button that JavaScript hides on init (see 3.1).
+2. **Saving** — the select is disabled, a spinner/ellipsis appears next to it. The row does
+   not move.
+3. **Saved** — the select is replaced by the category name, followed by a transient
+   `✓ saved` marker and a persistent `undo` link. The amber row marker is removed.
+
+An **error** state replaces the marker with `⚠ <message>` in `text-danger` and re-enables
+the select so the user can retry. Nothing is lost.
+
+### 1.2 The picker
+
+* Options are **restricted to the transaction's own transaction type**.
+  `Transaction::getType()` returns `Revenues` when `amount > 0`, `Expenses` otherwise, and
+  `Transaction::checkSubCategory()` throws on a mismatch — so a cross-type option is not
+  merely discouraged, it is unrepresentable. Rendering only valid options removes the
+  error case from the UI entirely.
+* Options are grouped by top category with `<optgroup>`, mirroring the hierarchy shown on
+  `/category/`.
+* Options are sorted by name within each group (already the case in
+  `SubCategoryRepository::findByTransactionType()`).
+* The first option is an empty placeholder, `Select a category`.
+* Native `<select>`, styled `custom-select custom-select-sm` (Bootstrap 4.1 is already
+  loaded). Native gives free keyboard type-ahead and a real picker on mobile. See
+  [§6](#6-third-party-libraries) for why not a combobox widget.
+
+### 1.3 Keyboard flow
+
+This is the point of the feature and constrains the markup:
+
+* Every uncategorized row carries a **live, focusable** select — not a click-to-edit
+  affordance — so `Tab` walks from one row needing work to the next.
+* Saving happens on `change`, so the pass is *Tab → type the first letters → Tab*, with no
+  mouse and no page reload.
+* The select must **not** be removed from the tab order while saving, and focus must not be
+  stolen or reset by the response handler.
+
+### 1.4 Row-level marker
+
+Rows with no sub category get a `.uncategorized-transaction` class and an amber left
+border in `public/styles/main.css`. `templates/transaction/import/validate_transactions.html.twig`
+already sets `.existing-transaction` / `.new-transaction` row classes, so this follows an
+existing convention.
+
+The class is removed client-side on a successful save, and restored on undo.
+
+### 1.5 No reflow
+
+The usual entry point for a categorizing pass is the existing `Categorized: No` filter — at
+which point every row the user categorizes stops matching the active filter. The row must
+**not** be removed, hidden, or re-sorted. It stays where it is, dimmed, and disappears only
+on the next page load. Reflowing the list under the cursor mid-pass is how people lose
+their place and mis-assign the next row.
+
+---
+
+2. Backend
+----------
+
+### 2.1 New route
+
+One route, on `TransactionController`:
+
+```php
+#[Route('/{id}/sub-category', name: 'transaction_set_sub_category', methods: ['PATCH'])]
+public function setSubCategory(
+    Request $request,
+    Transaction $transaction,
+    TransactionSubCategoryAssigner $assigner,
+): Response
+```
+
+`PATCH` matches the existing convention (`transaction_categorize` and `elasticsearch_export`
+are both `PATCH`), and `framework.http_method_override` is already `true`, so the plain-form
+fallback can reach it via a `_method` hidden input.
+
+The path segment `sub-category` cannot collide with `transaction_delete` (`/{id}`,
+`DELETE`) or `transaction_edit` (`/{id}/edit`).
+
+### 2.2 Request contract
+
+| Parameter | Required | Meaning |
+|---|---|---|
+| `_token` | yes | CSRF token, id `set-sub-category<transactionId>` |
+| `subCategory` | yes | Sub category UUID, or empty string to clear (undo) |
+
+No Symfony Form type is used. A form would bind by field name and invites accidental
+widening later; here exactly one property may change and the controller reads exactly one
+parameter. See [§8.3](#83-mass-assignment).
+
+### 2.3 New service: `App\Services\TransactionSubCategoryAssigner`
+
+```php
+public function assign(Transaction $transaction, ?SubCategory $subCategory): void
+```
+
+Responsibilities:
+
+1. set the sub category on the transaction,
+2. if `TransactionDiffChecker::subCategoryChanged()` reports a change, set
+   `categorizedManually` to `$transaction->isCategorized()`,
+3. **validate** the entity (see 2.4) and throw a typed exception on violation,
+4. flush.
+
+**Why a service rather than inline controller code.** The `categorizedManually` rule is
+already duplicated between `TransactionController::new()` and `TransactionController::edit()`
+in slightly different forms; a third inline copy is the point at which the rule stops being
+maintainable. It also gives the unit tests in [§5.2](#52-unit-tests) a real target. This
+matches the existing service style (`TransactionCategorizer`, `TransactionDiffChecker`,
+`RuleChecker`).
+
+This branch wires only the new action to the service. Migrating `new()` and `edit()` onto it
+is a separate, mechanical change — noted in [Follow-ups](#follow-ups) to keep this diff
+reviewable.
+
+### 2.4 Validation — and why it is mandatory
+
+`Transaction::checkSubCategory()` is a `#[ORM\PreUpdate]` callback that throws a **raw
+`\Exception`** when the sub category's transaction type does not match the transaction's.
+If an invalid pair reaches `flush()`, the result is an uncaught exception and a 500 with no
+usable response body.
+
+So the assigner must validate **before** flushing, using the existing
+`TransactionSubCategoryIsLogicalConstraint` via `ValidatorInterface`, and surface the
+translated violation message. The constraint validator already calls `checkSubCategory()`
+and catches the exception, so no new validation logic is needed — only that it is actually
+run on this path.
+
+### 2.5 Response contract
+
+`Accept: application/json` (what the JS sends) → `JsonResponse`:
+
+| Status | Body | Case |
+|---|---|---|
+| `200` | `{"id": "...", "subCategory": {"id": "...", "name": "Groceries"}, "categorized": true}` | assigned |
+| `200` | `{"id": "...", "subCategory": null, "categorized": false}` | cleared (undo) |
+| `403` | `{"error": "<translated>"}` | invalid CSRF token |
+| `404` | — | unknown transaction id (handled by the argument resolver) |
+| `422` | `{"error": "<translated violation message>"}` | unknown sub category id, or type mismatch |
+
+Otherwise (the no-JavaScript fallback, which posts a normal form) → redirect back to
+`transaction_index`, preserving the current query string so filters and page number
+survive. On error, put the message in the session flash bag.
+
+Content negotiation on `$request->getPreferredFormat()` / the `Accept` header keeps both
+paths on one action.
+
+`JsonResponse` from HttpFoundation is enough — see [§6](#6-third-party-libraries).
+
+### 2.6 Elasticsearch
+
+Nothing to do, but worth recording so nobody adds a guard "just in case":
+
+`ElasticsearchSyncStatusUpdater::onFlush()` only flips the `toSyncInElasticsearch` boolean;
+the only listener that actually talks to Elasticsearch is
+`ElasticsearchTransactionRemover`, bound to `preRemove`. An update therefore has **no
+external dependency** and cannot fail because Elasticsearch is down. The transaction is
+correctly re-flagged for the next export.
+
+---
+
+3. Frontend
+-----------
+
+### 3.1 Progressive enhancement
+
+Each uncategorized cell renders a real, self-sufficient form:
+
+```twig
+<form method="post"
+      action="{{ path('transaction_set_sub_category', {'id': transaction.id}) }}"
+      class="inline-sub-category"
+      data-transaction-id="{{ transaction.id }}">
+    <input type="hidden" name="_method" value="PATCH">
+    <input type="hidden" name="_token" value="{{ csrf_token('set-sub-category' ~ transaction.id) }}">
+    <select name="subCategory" class="custom-select custom-select-sm">
+        <option value="">{% trans %}Select a category{% endtrans %}</option>
+        {% for topCategoryName, subCategories in sub_categories[transaction.type] %}
+            <optgroup label="{{ topCategoryName }}">
+                {% for subCategory in subCategories %}
+                    <option value="{{ subCategory.id }}">{{ subCategory.name }}</option>
+                {% endfor %}
+            </optgroup>
+        {% endfor %}
+    </select>
+    <button class="btn btn-sm btn-primary">{% trans %}Save{% endtrans %}</button>
+</form>
+```
+
+The JS module **hides the button on successful init** rather than the template wrapping it in
+`<noscript>`. `<noscript>` only covers "JavaScript disabled"; it does not cover "the script
+threw". That distinction is not hypothetical here — `templates/sub_category_transaction_rule/form.js.twig`
+currently throws a `TypeError` on load and silently disables the rule preview panel. If this
+script breaks the same way, the feature degrades to a working form-submit instead of a dead
+cell.
+
+This also makes the whole feature reachable from `WebTestCase`, which does not execute
+JavaScript — see [§5.1](#51-functional-tests).
+
+### 3.2 The script
+
+New file `public/js/inline_sub_category.js`, an ES module, loaded from
+`templates/transaction/index.html.twig`:
+
+```twig
+{% block javascripts %}
+    {{ parent() }}
+    <script type="module">
+        import lib from '/js/inline_sub_category.js';
+        lib.init();
+    </script>
+{% endblock %}
+```
+
+This follows the existing `public/js/sf_collection.js` precedent (ES module, imported from
+a template, no build step). It is deliberately **not** inline JS in the Twig file: the three
+templates that do that today (`categorize.html.twig`, `export.html.twig`,
+`form.js.twig`) have duplicated helpers, no caching, and no syntax checking.
+
+Behaviour:
+
+1. On `init()`, for each `form.inline-sub-category`: hide the submit button, attach a
+   `change` listener on the select.
+2. On `change` with a non-empty value: disable the select, show the saving marker, `fetch()`
+   the form's `action` with `method: 'POST'`, `body: new FormData(form)` (the `_method`
+   override carries the PATCH), and `Accept: application/json`.
+3. On `200`: swap the cell to the saved state, drop `.uncategorized-transaction` from the
+   `<tr>`, and keep the previous markup in a closure so undo can restore it.
+4. On `undo`: re-issue the same request with an empty `subCategory`, then restore the select.
+5. On a non-2xx or a network failure: re-enable the select, show the error marker.
+
+**Every insertion of server data into the DOM uses `textContent`, never `innerHTML`.**
+See [§8.4](#84-xss).
+
+### 3.3 Controller and template data
+
+`TransactionController::index()` gains a `SubCategoryRepository` argument and passes:
+
+```php
+'sub_categories' => [
+    TransactionType::EXPENSES => $groupedExpenses,
+    TransactionType::REVENUES => $groupedRevenues,
+],
+```
+
+grouped by top category name, fetched **once per page**, not per row. See
+[§7.2](#72-sub-category-options).
+
+---
+
+4. Translations
+---------------
+
+New keys in `translations/messages.en.yml` and `translations/messages.fr.yml`:
+
+| Key | English |
+|---|---|
+| `Select a category` | Select a category |
+| `saved` | saved |
+| `undo` | undo |
+| `Could not save the sub category` | Could not save the sub category |
+| `Invalid security token, please reload the page` | Invalid security token, please reload the page |
+
+Strings used by the JS module are passed through `data-` attributes on the table (rendered
+by Twig with `|trans`), not hardcoded in the `.js` file — the file lives outside Twig and
+cannot call the translator. `composer lint:yaml` covers the files.
+
+---
+
+5. Tests
+--------
+
+### 5.1 Functional tests
+
+New `tests/Controller/TransactionSubCategoryTest.php`, `WebTestCase`, following the fixture
+style of `TransactionImportControllerTest` (which builds an `Account` and transactions
+directly through the `EntityManagerInterface` from the test container; DAMA rolls each test
+back).
+
+Fixtures per test: one account, one `Expenses` top category with two sub categories, one
+`Revenues` top category with one sub category, one negative and one positive transaction,
+both uncategorized.
+
+| # | Test | Asserts |
+|---|---|---|
+| 1 | The list renders a select for an uncategorized row | `select[name="subCategory"]` exists in that row; the `<tr>` carries `.uncategorized-transaction` |
+| 2 | The list renders **no** select for a categorized row | selector absent; plain text present |
+| 3 | Options are scoped by type | the negative row offers only the `Expenses` sub categories; the positive row only the `Revenues` one |
+| 4 | Options are grouped | `optgroup[label="<top category name>"]` present |
+| 5 | **Submitting the form assigns the sub category** | redirect to `transaction_index`; reloading shows the name; `categorizedManually` is `true` in DB |
+| 6 | Submitting an empty value clears it | sub category `null`, `categorizedManually` `false` |
+| 7 | Filters and page survive the fallback redirect | submit from `/transaction/?item_filter[...]=...&page=2`, assert the redirect target keeps the query string |
+| 8 | JSON request returns the JSON contract | `Accept: application/json` → 200 and the documented body |
+| 9 | A missing/incorrect CSRF token is rejected | 403, DB unchanged |
+| 10 | A cross-type sub category is rejected | 422 with the translated violation, DB unchanged, **no 500** |
+| 11 | An unknown sub category id is rejected | 422, DB unchanged |
+| 12 | An unknown transaction id | 404 |
+
+Test 5 is the important one: because of the progressive-enhancement design, browser-kit can
+drive the *real* user path end to end even though it runs no JavaScript. Test 10 guards the
+`PreUpdate` throw described in [§2.4](#24-validation--and-why-it-is-mandatory).
+
+### 5.2 Unit tests
+
+New `tests/Services/TransactionSubCategoryAssignerTest.php`, plain `PHPUnit\Framework\TestCase`
+with mocked `EntityManagerInterface`, `TransactionDiffChecker` and `ValidatorInterface` —
+matching the mock-based style of `tests/RuleCheckerTest.php`.
+
+| # | Case | Expected |
+|---|---|---|
+| 1 | assign a sub category to an uncategorized transaction | sub category set, `categorizedManually === true`, one `flush()` |
+| 2 | assign `null` (undo) | sub category `null`, `categorizedManually === false` |
+| 3 | assign the sub category it already has | no change reported by the diff checker, `categorizedManually` untouched |
+| 4 | validator returns a violation | typed exception thrown, **`flush()` never called** |
+
+Case 4 is the one that matters: it pins the ordering "validate, then flush", which is the
+whole defence against the 500 in [§2.4](#24-validation--and-why-it-is-mandatory).
+
+### 5.3 JavaScript tests
+
+**None, deliberately.** The repository has no `package.json`, no Node in CI, and no
+JavaScript test tooling. Adding Vitest or Jest for one module means adding a Node toolchain
+to a PHP pipeline and a second dependency tree to maintain — a cost far larger than the
+module it would cover.
+
+The design compensates: the script is a thin transport layer over a form that is fully
+tested server-side, and if the script fails the feature still works. Coverage thresholds
+(`rregeer/phpunit-coverage-check`) only look at `src`, so this does not move the gate.
+
+### 5.4 Static analysis and style
+
+`composer lint` must stay green at PHPStan level 7 — `phpstan.dist.neon` is currently at
+level 7 with a small baseline; new code must not add to the baseline.
+`composer lint:twig` covers the template change.
+
+---
+
+6. Third-party libraries
+------------------------
+
+The conclusion is **no new dependency, PHP or JavaScript**. Reasoning, since the question is
+worth recording:
+
+**API Platform / FOSRestBundle** — rejected. One endpoint returning one small object does not
+justify a resource layer, its configuration surface, or its upgrade cost.
+
+**`symfony/serializer`** — already installed, but not needed here. The response is three
+scalars; `JsonResponse` with an array literal is clearer than a normalizer and cannot
+accidentally leak entity fields (see [§8.5](#85-response-shape)). Left unused on this path.
+
+**FOSJsRoutingBundle** — rejected. The one URL the script needs is already in the form's
+`action` attribute, generated by Twig.
+
+**Stimulus / Symfony UX** — rejected *for this branch*, though it is the strongest candidate.
+It would give a real controller lifecycle and remove the hand-rolled `init()`, but it
+requires AssetMapper or Encore, i.e. an asset pipeline this project does not have. Adopting
+one is a project-wide decision affecting all four existing hand-written scripts; making it
+here, as a side effect of one cell, would be the wrong place to decide it. Recorded in
+[Follow-ups](#follow-ups).
+
+**A select/combobox widget (Select2, Tom Select, Choices.js)** — rejected. A native
+`<select>` already provides keyboard type-ahead, a native mobile picker, correct
+accessibility semantics for free, and zero bytes. It only becomes limiting past roughly 40
+options per type; the default fixture set is below that, and `<optgroup>` grouping raises
+the ceiling further. Revisit only if a user's category list actually outgrows it — and note
+that a widget would also add a CDN dependency, which cuts against the app being usable
+offline.
+
+---
+
+7. Performance
+--------------
+
+### 7.1 Existing N+1 on the list
+
+`TransactionController::index()` selects only `transaction`, so the template's
+`{{ transaction.account }}` and `{{ transaction.subCategory }}` lazy-load one proxy each per
+row. Since this branch touches the same query, fix it here:
+
+```php
+->select('transaction', 'account', 'subCategory')
+->leftJoin('transaction.account', 'account')
+->leftJoin('transaction.subCategory', 'subCategory')
+```
+
+Pagerfanta's `QueryAdapter` handles the joins correctly for counting. This turns a
+`2n + k` query page into a constant one.
+
+### 7.2 Sub category options
+
+Fetched **once per page render**, not once per row: two calls to
+`SubCategoryRepository::findByTransactionType()`, grouped into an array in PHP, then read
+from Twig.
+
+`findByTransactionType()` currently does `innerJoin('s.topCategory', 't')` **without**
+`addSelect('t')`, so reading `subCategory.topCategory.name` while grouping would lazy-load
+one proxy per sub category. Add `->addSelect('t')` (or add a dedicated method if the change
+risks affecting the other two callers — `TransactionImportController` and the fixtures).
+
+### 7.3 Page weight
+
+Worst case is 20 rows × the sub categories of one type. At ~60 sub categories per type that
+is ~1200 `<option>` elements, roughly 40–60 KB of extra HTML before gzip — acceptable, and
+only incurred for rows that are actually uncategorized, which shrinks as the user works.
+
+If it ever becomes a problem, the mitigation that preserves the no-JS fallback is to render
+one `<template>` of options per type at the bottom of the page and clone it into the cell on
+first focus. **Not** in this branch.
+
+### 7.4 The endpoint
+
+One `SELECT` by primary key, one validation pass, one `UPDATE`. No external calls
+([§2.6](#26-elasticsearch)). Nothing to optimise.
+
+---
+
+8. Security
+-----------
+
+### 8.1 There is no authentication
+
+`config/packages/security.yaml` declares an in-memory provider with no users and an empty
+`access_control`. Every route in this application is anonymous. That is defensible for a
+localhost-only tool, but it means **CSRF protection is the only thing standing between a
+malicious page in another tab and a write to this database**. It has to be right.
+
+### 8.2 CSRF
+
+* A per-transaction token, id `set-sub-category<transactionId>`, mirroring the existing
+  `delete<id>` convention in `TransactionController::delete()`.
+* Validated with `isCsrfTokenValid()` **before** any entity is touched.
+* Failure returns `403` and changes nothing — it must not fall through to a redirect that
+  looks like success.
+* Per-transaction rather than one page-wide token so a token captured for one row cannot be
+  replayed against another.
+
+### 8.3 Mass assignment
+
+The action reads exactly one request parameter, `subCategory`, and passes a resolved
+`SubCategory` entity (or `null`) to the assigner. No Symfony Form, no
+`$form->handleRequest()`, no property accessor walking request keys. `label`, `amount`,
+`account`, `createdAt` and `tags` are unreachable from this endpoint by construction.
+
+### 8.4 XSS
+
+Transaction labels come from parsed bank statements — externally-influenced text — and sub
+category names are user input. The JS module must build DOM nodes and assign `textContent`;
+it must never concatenate server data into `innerHTML`.
+
+Related, and worth knowing while working here: `templates/transaction/categorize.html.twig`
+and `templates/transaction/export.html.twig` **do** build rows with `innerHTML` from
+WebSocket payloads containing transaction labels. That is a pre-existing injection path via
+a crafted statement label. Out of scope for this branch; flagged so the new code does not
+copy the pattern, and worth its own issue.
+
+### 8.5 Response shape
+
+The JSON body is an explicit array literal of three known values. It never serializes the
+`Transaction` entity, so no field added to the entity later can leak through this endpoint
+by accident.
+
+### 8.6 IDOR
+
+Not applicable: single-tenant, no user model, nothing to own. Recorded so a reviewer does not
+look for a missing ownership check.
+
+---
+
+9. Implementation checklist
+---------------------------
+
+Backend
+
+- [ ] `src/Services/TransactionSubCategoryAssigner.php` — assign / validate / flush
+- [ ] `src/Exception/` — typed exception carrying the violation message
+- [ ] `TransactionController::setSubCategory()` — new `PATCH` route, CSRF, content negotiation
+- [ ] `TransactionController::index()` — joins ([§7.1](#71-existing-n1-on-the-list)) + grouped sub categories ([§3.3](#33-controller-and-template-data))
+- [ ] `SubCategoryRepository::findByTransactionType()` — `addSelect('t')` ([§7.2](#72-sub-category-options))
+
+Frontend
+
+- [ ] `templates/transaction/index.html.twig` — per-row form, row class, module import
+- [ ] `public/js/inline_sub_category.js` — new ES module
+- [ ] `public/styles/main.css` — `.uncategorized-transaction`, saved/error markers, cell sizing
+
+Translations
+
+- [ ] `translations/messages.en.yml`, `translations/messages.fr.yml` — keys from [§4](#4-translations)
+
+Tests
+
+- [ ] `tests/Controller/TransactionSubCategoryTest.php` — 12 functional cases
+- [ ] `tests/Services/TransactionSubCategoryAssignerTest.php` — 4 unit cases
+- [ ] `composer lint` green, PHPStan baseline not extended
+
+---
+
+Follow-ups
+----------
+
+Not in this branch, in rough priority order:
+
+1. Click-to-edit for already-categorized rows, reusing this endpoint (it already accepts a
+   clear, and the assigner already handles the categorized → categorized transition).
+2. Migrate `TransactionController::new()` and `::edit()` onto
+   `TransactionSubCategoryAssigner` to remove the `categorizedManually` duplication.
+3. The "create a rule from this" link in the saved-state receipt — the moment right after
+   choosing a category is when the user knows what the rule should say.
+4. `3 transactions · 3 uncategorized`, with the count linking to the `Categorized: No`
+   filter — the entry point to this whole workflow currently takes four interactions with
+   the filter bar.
+5. Bulk selection with an "apply to selected" toolbar.
+6. Fix the `TypeError` in `templates/sub_category_transaction_rule/form.js.twig` that
+   silently disables the rule preview panel.
+7. Replace `innerHTML` row building in `categorize.html.twig` / `export.html.twig`
+   ([§8.4](#84-xss)).
+8. Decide on an asset pipeline (AssetMapper + Stimulus) for the four hand-written scripts as
+   a project-wide change ([§6](#6-third-party-libraries)).

From 395e22ccd049495e8206cbffb431681be73213f5 Mon Sep 17 00:00:00 2001
From: Baptiste Bouchereau <baptiste.bouchereau@gmail.com>
Date: Sat, 22 Aug 2026 15:09:27 +0200
Subject: [PATCH 02/10] Make inline sub category assignment set-only and
 one-way

Drop undo from the UI and the endpoint. The select is removed from the DOM
on save and the cell settles into the same markup a server-rendered
categorized row produces, so a reload shows no visual change.

The assigner now takes a non-nullable SubCategory, so the set-only rule is
enforced by the type signature rather than by a runtime check.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q1NqsuwvBdHz19hkzKKmie
---
 docs/plans/inline-sub-category-assignment.md | 131 ++++++++++++++-----
 1 file changed, 98 insertions(+), 33 deletions(-)

diff --git a/docs/plans/inline-sub-category-assignment.md b/docs/plans/inline-sub-category-assignment.md
index f278ad3..4957784 100644
--- a/docs/plans/inline-sub-category-assignment.md
+++ b/docs/plans/inline-sub-category-assignment.md
@@ -15,9 +15,12 @@ Scope
 -----
 
 **In scope**: the Sub category cell of rows where `transaction.subCategory is null`.
+Assignment is **one-way**: once set from the list, the cell becomes an ordinary categorized
+cell and further changes go through the edit page.
 
 **Out of scope for this branch** (deliberately, see [Follow-ups](#follow-ups)):
 
+* undoing an assignment from the list, and clearing a category back to none,
 * editing the sub category of an already-categorized row (click-to-edit),
 * bulk selection / "apply to selected",
 * the "create a rule from this" prompt after a save,
@@ -37,19 +40,41 @@ The Sub category cell of an uncategorized row moves through three states.
  ──────────────────────────────────────────────────────────────────────────────────────────
  ▎Ovh sas - date de valeur…  -34.30   02/04/2025  N26      [Select a category ▾]    ✎  ⚌     (1) idle
  ▎Campus.coach - date de v…  -15.00   12/04/2025  N26      [Groceries         ▾] ⋯  ✎  ⚌     (2) saving
-  Ccm loire divatte - date…  -20.00   12/04/2025  N26      Groceries  ✓ saved · undo ✎  ⚌     (3) saved
+  Ccm loire divatte - date…  -20.00   12/04/2025  N26      Groceries       ✓ saved  ✎  ⚌     (3) saved
+  Biocoop montreuil          -42.10   14/04/2025  N26      Groceries                ✎  ⚌     (4) settled
 ```
 
 1. **Idle** — a `<select>` scoped to the transaction's own type (see 1.2), plus a submit
    button that JavaScript hides on init (see 3.1).
 2. **Saving** — the select is disabled, a spinner/ellipsis appears next to it. The row does
    not move.
-3. **Saved** — the select is replaced by the category name, followed by a transient
-   `✓ saved` marker and a persistent `undo` link. The amber row marker is removed.
+3. **Saved** — the select is **removed from the DOM** and replaced by the category name.
+   A transient `✓ saved` marker fades out after ~2s and removes itself. The amber row
+   marker is removed.
+4. **Settled** — once the marker is gone, the cell is indistinguishable from a row that was
+   already categorized when the page was rendered. The assignment is final on this page;
+   correcting it goes through the existing edit page (the pencil icon), as it does for every
+   other categorized row.
+
+There is no undo. The transition is one-way, which is what keeps the endpoint set-only
+([§2.2](#22-request-contract)) and the state model to four boxes instead of a graph.
 
 An **error** state replaces the marker with `⚠ <message>` in `text-danger` and re-enables
 the select so the user can retry. Nothing is lost.
 
+### 1.1.1 The saved markup must match the server's
+
+`SubCategory::__toString()` returns the name, and the categorized branch of
+`templates/transaction/index.html.twig` renders `{{ transaction.subCategory }}` — so the
+name returned in the JSON response is exactly what a page reload would print. The script
+must produce the *same* markup the server produces for a categorized row, so that reloading
+the page after a pass shows no visual change at all.
+
+Concretely: the current template emits an empty `<em></em>` for categorized rows (the
+`uncategorized` label lives inside a conditional inside the `<em>`). Restructure that branch
+so a categorized cell is just the name, and have the script emit the same. Otherwise the
+"looks like the other rows" requirement holds only until the next reload.
+
 ### 1.2 The picker
 
 * Options are **restricted to the transaction's own transaction type**.
@@ -84,7 +109,7 @@ border in `public/styles/main.css`. `templates/transaction/import/validate_trans
 already sets `.existing-transaction` / `.new-transaction` row classes, so this follows an
 existing convention.
 
-The class is removed client-side on a successful save, and restored on undo.
+The class is removed client-side on a successful save.
 
 ### 1.5 No reflow
 
@@ -124,7 +149,12 @@ The path segment `sub-category` cannot collide with `transaction_delete` (`/{id}
 | Parameter | Required | Meaning |
 |---|---|---|
 | `_token` | yes | CSRF token, id `set-sub-category<transactionId>` |
-| `subCategory` | yes | Sub category UUID, or empty string to clear (undo) |
+| `subCategory` | yes | Sub category UUID. Must be non-empty and must resolve. |
+
+**The endpoint is set-only.** A missing, empty, or unresolvable `subCategory` is a `422`,
+never a clear. Nothing on this path can set a transaction's sub category back to `null` —
+that remains the edit page's job. This keeps the write surface to a single verb and means no
+request to this route can ever destroy a categorization.
 
 No Symfony Form type is used. A form would bind by field name and invites accidental
 widening later; here exactly one property may change and the controller reads exactly one
@@ -133,17 +163,26 @@ parameter. See [§8.3](#83-mass-assignment).
 ### 2.3 New service: `App\Services\TransactionSubCategoryAssigner`
 
 ```php
-public function assign(Transaction $transaction, ?SubCategory $subCategory): void
+public function assign(Transaction $transaction, SubCategory $subCategory): void
 ```
 
+Note the **non-nullable** `$subCategory`: the set-only rule is expressed in the type
+signature, so no future caller can clear a category through this service by passing `null`.
+
 Responsibilities:
 
 1. set the sub category on the transaction,
 2. if `TransactionDiffChecker::subCategoryChanged()` reports a change, set
-   `categorizedManually` to `$transaction->isCategorized()`,
+   `categorizedManually` to `true`,
 3. **validate** the entity (see 2.4) and throw a typed exception on violation,
 4. flush.
 
+Step 2 is always true for the rows this branch touches — they are uncategorized, so
+`null → SubCategory` is by definition a change. The diff-checker guard is kept anyway
+because it costs one line and is the behaviour the follow-up click-to-edit needs: re-picking
+the category a *rule* already assigned should not silently pin the transaction against
+future rule runs.
+
 **Why a service rather than inline controller code.** The `categorizedManually` rule is
 already duplicated between `TransactionController::new()` and `TransactionController::edit()`
 in slightly different forms; a third inline copy is the point at which the rule stops being
@@ -174,11 +213,13 @@ run on this path.
 
 | Status | Body | Case |
 |---|---|---|
-| `200` | `{"id": "...", "subCategory": {"id": "...", "name": "Groceries"}, "categorized": true}` | assigned |
-| `200` | `{"id": "...", "subCategory": null, "categorized": false}` | cleared (undo) |
+| `200` | `{"id": "...", "subCategory": {"id": "...", "name": "Groceries"}}` | assigned |
 | `403` | `{"error": "<translated>"}` | invalid CSRF token |
 | `404` | — | unknown transaction id (handled by the argument resolver) |
-| `422` | `{"error": "<translated violation message>"}` | unknown sub category id, or type mismatch |
+| `422` | `{"error": "<translated violation message>"}` | missing/empty `subCategory`, unknown sub category id, or type mismatch |
+
+`name` is what the script prints into the cell, and it is the same string
+`{{ transaction.subCategory }}` renders server-side ([§1.1.1](#111-the-saved-markup-must-match-the-servers)).
 
 Otherwise (the no-JavaScript fallback, which posts a normal form) → redirect back to
 `transaction_index`, preserving the current query string so filters and page number
@@ -263,13 +304,26 @@ Behaviour:
 
 1. On `init()`, for each `form.inline-sub-category`: hide the submit button, attach a
    `change` listener on the select.
-2. On `change` with a non-empty value: disable the select, show the saving marker, `fetch()`
-   the form's `action` with `method: 'POST'`, `body: new FormData(form)` (the `_method`
-   override carries the PATCH), and `Accept: application/json`.
-3. On `200`: swap the cell to the saved state, drop `.uncategorized-transaction` from the
-   `<tr>`, and keep the previous markup in a closure so undo can restore it.
-4. On `undo`: re-issue the same request with an empty `subCategory`, then restore the select.
-5. On a non-2xx or a network failure: re-enable the select, show the error marker.
+2. On `change` to the empty placeholder: do nothing (no request — the endpoint would reject
+   it anyway).
+3. On `change` to a real value: disable the select, show the saving marker, `fetch()` the
+   form's `action` with `method: 'POST'`, `body: new FormData(form)` (the `_method` override
+   carries the PATCH), and `Accept: application/json`.
+4. On `200`: **replace the whole `<form>`** with a text node holding the returned name, drop
+   `.uncategorized-transaction` from the `<tr>`, and show the transient `✓ saved` marker
+   which removes itself after ~2s. The cell then matches a server-rendered categorized row
+   exactly ([§1.1.1](#111-the-saved-markup-must-match-the-servers)).
+5. On a non-2xx or a network failure: re-enable the select, show the error marker. The form
+   is left intact so a retry is one keystroke away.
+
+Because step 4 destroys the form, the row cannot be submitted twice, and there is no state to
+restore — which is the simplification that dropping undo buys.
+
+**Focus.** Removing the form removes the focused element, which would drop focus to
+`<body>` and break the Tab chain described in [§1.3](#13-keyboard-flow). Before replacing the
+form, move focus to the next remaining `.inline-sub-category select` in the table, so a
+keyboard pass continues uninterrupted. This is the one piece of the script with real
+behaviour in it and is worth writing carefully.
 
 **Every insertion of server data into the DOM uses `textContent`, never `innerHTML`.**
 See [§8.4](#84-xss).
@@ -299,8 +353,8 @@ New keys in `translations/messages.en.yml` and `translations/messages.fr.yml`:
 |---|---|
 | `Select a category` | Select a category |
 | `saved` | saved |
-| `undo` | undo |
 | `Could not save the sub category` | Could not save the sub category |
+| `A sub category is required` | A sub category is required |
 | `Invalid security token, please reload the page` | Invalid security token, please reload the page |
 
 Strings used by the JS module are passed through `data-` attributes on the table (rendered
@@ -326,21 +380,25 @@ both uncategorized.
 | # | Test | Asserts |
 |---|---|---|
 | 1 | The list renders a select for an uncategorized row | `select[name="subCategory"]` exists in that row; the `<tr>` carries `.uncategorized-transaction` |
-| 2 | The list renders **no** select for a categorized row | selector absent; plain text present |
+| 2 | The list renders **no** select for a categorized row | selector absent; the name present as plain text |
 | 3 | Options are scoped by type | the negative row offers only the `Expenses` sub categories; the positive row only the `Revenues` one |
 | 4 | Options are grouped | `optgroup[label="<top category name>"]` present |
-| 5 | **Submitting the form assigns the sub category** | redirect to `transaction_index`; reloading shows the name; `categorizedManually` is `true` in DB |
-| 6 | Submitting an empty value clears it | sub category `null`, `categorizedManually` `false` |
+| 5 | **Submitting the form assigns the sub category** | redirect to `transaction_index`; `categorizedManually` is `true` in DB |
+| 6 | **After assignment the row renders as a categorized row** | reload: that `<tr>` has no `select`, no `.uncategorized-transaction`, and its cell text equals the sub category name — i.e. identical to the row asserted in test 2 |
 | 7 | Filters and page survive the fallback redirect | submit from `/transaction/?item_filter[...]=...&page=2`, assert the redirect target keeps the query string |
 | 8 | JSON request returns the JSON contract | `Accept: application/json` → 200 and the documented body |
 | 9 | A missing/incorrect CSRF token is rejected | 403, DB unchanged |
 | 10 | A cross-type sub category is rejected | 422 with the translated violation, DB unchanged, **no 500** |
 | 11 | An unknown sub category id is rejected | 422, DB unchanged |
-| 12 | An unknown transaction id | 404 |
+| 12 | An **empty** `subCategory` is rejected | 422, the transaction is still uncategorized — the endpoint cannot clear |
+| 13 | An unknown transaction id | 404 |
 
 Test 5 is the important one: because of the progressive-enhancement design, browser-kit can
-drive the *real* user path end to end even though it runs no JavaScript. Test 10 guards the
-`PreUpdate` throw described in [§2.4](#24-validation--and-why-it-is-mandatory).
+drive the *real* user path end to end even though it runs no JavaScript. Test 6 is the
+regression guard for "renders like the other rows" — it compares against the same assertions
+test 2 makes about an always-categorized row, so the two cannot drift apart. Test 10 guards
+the `PreUpdate` throw described in [§2.4](#24-validation--and-why-it-is-mandatory), and test
+12 pins the set-only rule from [§2.2](#22-request-contract).
 
 ### 5.2 Unit tests
 
@@ -351,13 +409,15 @@ matching the mock-based style of `tests/RuleCheckerTest.php`.
 | # | Case | Expected |
 |---|---|---|
 | 1 | assign a sub category to an uncategorized transaction | sub category set, `categorizedManually === true`, one `flush()` |
-| 2 | assign `null` (undo) | sub category `null`, `categorizedManually === false` |
-| 3 | assign the sub category it already has | no change reported by the diff checker, `categorizedManually` untouched |
-| 4 | validator returns a violation | typed exception thrown, **`flush()` never called** |
+| 2 | assign the sub category it already has | no change reported by the diff checker, `categorizedManually` untouched |
+| 3 | validator returns a violation | typed exception thrown, **`flush()` never called** |
 
-Case 4 is the one that matters: it pins the ordering "validate, then flush", which is the
+Case 3 is the one that matters: it pins the ordering "validate, then flush", which is the
 whole defence against the 500 in [§2.4](#24-validation--and-why-it-is-mandatory).
 
+There is no "clear" case to test — `assign()` takes a non-nullable `SubCategory`, so PHPStan
+rejects the call at level 7 rather than a test catching it at runtime.
+
 ### 5.3 JavaScript tests
 
 **None, deliberately.** The repository has no `package.json`, no Node in CI, and no
@@ -522,7 +582,9 @@ Backend
 Frontend
 
 - [ ] `templates/transaction/index.html.twig` — per-row form, row class, module import
-- [ ] `public/js/inline_sub_category.js` — new ES module
+- [ ] `templates/transaction/index.html.twig` — restructure the categorized branch so the cell
+      is just the name, no empty `<em>` ([§1.1.1](#111-the-saved-markup-must-match-the-servers))
+- [ ] `public/js/inline_sub_category.js` — new ES module, incl. focus handoff on row settle
 - [ ] `public/styles/main.css` — `.uncategorized-transaction`, saved/error markers, cell sizing
 
 Translations
@@ -531,8 +593,8 @@ Translations
 
 Tests
 
-- [ ] `tests/Controller/TransactionSubCategoryTest.php` — 12 functional cases
-- [ ] `tests/Services/TransactionSubCategoryAssignerTest.php` — 4 unit cases
+- [ ] `tests/Controller/TransactionSubCategoryTest.php` — 13 functional cases
+- [ ] `tests/Services/TransactionSubCategoryAssignerTest.php` — 3 unit cases
 - [ ] `composer lint` green, PHPStan baseline not extended
 
 ---
@@ -542,8 +604,11 @@ Follow-ups
 
 Not in this branch, in rough priority order:
 
-1. Click-to-edit for already-categorized rows, reusing this endpoint (it already accepts a
-   clear, and the assigner already handles the categorized → categorized transition).
+1. Click-to-edit for already-categorized rows. It can reuse this endpoint as-is for
+   *changing* a category — the assigner already handles the categorized → categorized
+   transition correctly. Clearing a category back to none would need a separate route, or a
+   deliberate widening of this one; do not widen it casually, since set-only is what makes
+   this endpoint incapable of destroying data ([§2.2](#22-request-contract)).
 2. Migrate `TransactionController::new()` and `::edit()` onto
    `TransactionSubCategoryAssigner` to remove the `categorizedManually` duplication.
 3. The "create a rule from this" link in the saved-state receipt — the moment right after

From 7740d234f8189c248fe52036ab0afa76249d1ad6 Mon Sep 17 00:00:00 2001
From: Baptiste Bouchereau <baptiste.bouchereau@gmail.com>
Date: Sat, 22 Aug 2026 15:41:04 +0200
Subject: [PATCH 03/10] Allow assigning a sub category from the transaction
 list

Uncategorized rows now render a sub category select scoped to the
transaction type and grouped by top category. Choosing one saves it over
fetch and settles the cell into the same markup a categorized row renders
server-side, so a reload shows no change.

The cell is a real form with a submit button that the module hides on init,
so the feature degrades to a normal form submit if the script fails, and is
reachable from WebTestCase, which runs no javascript.

The endpoint is set-only: an empty or unknown sub category is rejected
rather than treated as a request to clear. Assignments are validated before
the flush, because Transaction::checkSubCategory() throws a raw exception
from a PreUpdate callback on a type mismatch.

The list query now selects account and subCategory, and the sub categories
are fetched before the filter form view is built so its group_by finds the
top categories in the identity map. The page drops from 34 queries to 8.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q1NqsuwvBdHz19hkzKKmie
---
 public/js/inline_sub_category.js              | 144 ++++++++
 public/styles/main.css                        |  23 ++
 src/Controller/TransactionController.php      | 109 +++++-
 .../InvalidSubCategoryAssignmentException.php |   7 +
 src/Repository/SubCategoryRepository.php      |  20 ++
 .../TransactionSubCategoryAssigner.php        |  55 +++
 templates/transaction/index.html.twig         |  52 ++-
 .../Controller/TransactionSubCategoryTest.php | 315 ++++++++++++++++++
 .../TransactionSubCategoryAssignerTest.php    | 100 ++++++
 translations/messages.en.yml                  |   7 +-
 translations/messages.fr.yml                  |   5 +
 11 files changed, 826 insertions(+), 11 deletions(-)
 create mode 100644 public/js/inline_sub_category.js
 create mode 100644 src/Exception/InvalidSubCategoryAssignmentException.php
 create mode 100644 src/Services/TransactionSubCategoryAssigner.php
 create mode 100644 tests/Controller/TransactionSubCategoryTest.php
 create mode 100644 tests/Services/TransactionSubCategoryAssignerTest.php

diff --git a/public/js/inline_sub_category.js b/public/js/inline_sub_category.js
new file mode 100644
index 0000000..6bc3776
--- /dev/null
+++ b/public/js/inline_sub_category.js
@@ -0,0 +1,144 @@
+/**
+ * Inline sub category assignment on the transaction list.
+ *
+ * Progressive enhancement: every uncategorized cell already contains a working
+ * form. This module hides its submit button and turns a change on the select
+ * into a fetch, so a whole page of transactions can be categorized without a
+ * reload. If this module fails to load or throws, the forms keep working.
+ *
+ * See docs/plans/inline-sub-category-assignment.md
+ */
+
+const SAVED_MARKER_DURATION = 2000;
+
+const getLabels = () => {
+    const table = document.getElementById('transaction-list');
+
+    return {
+        saved: (table && table.dataset.savedLabel) || 'saved',
+        error: (table && table.dataset.errorLabel) || 'Could not save the sub category',
+    };
+};
+
+/**
+ * The selects of every row still waiting to be categorized, in document order.
+ */
+const remainingSelects = () => Array.from(
+    document.querySelectorAll('form.inline-sub-category select')
+);
+
+/**
+ * Removing the form removes the focused element, which would drop focus to
+ * <body> and break the tab chain. Hand focus to the next row still needing work.
+ */
+const moveFocusToNextRow = (select) => {
+    const selects = remainingSelects();
+    const next = selects[selects.indexOf(select) + 1] || selects[selects.indexOf(select) - 1];
+
+    if (next) {
+        next.focus();
+    }
+};
+
+const createMarker = (className, text) => {
+    const marker = document.createElement('span');
+    marker.className = className;
+    // textContent, never innerHTML: labels and category names are external input.
+    marker.textContent = text;
+
+    return marker;
+};
+
+const showError = (form, select, message) => {
+    clearMarkers(form.parentNode);
+    select.disabled = false;
+    form.parentNode.appendChild(createMarker('sub-category-marker text-danger', `⚠ ${message}`));
+};
+
+const clearMarkers = (cell) => {
+    cell.querySelectorAll('.sub-category-marker').forEach((marker) => marker.remove());
+};
+
+/**
+ * Replaces the form with the plain category name, so the cell becomes
+ * indistinguishable from a row that was already categorized on page load.
+ */
+const settleRow = (form, select, subCategoryName, labels) => {
+    const cell = form.parentNode;
+    const row = form.closest('tr');
+
+    moveFocusToNextRow(select);
+
+    clearMarkers(cell);
+    form.remove();
+    cell.insertBefore(document.createTextNode(subCategoryName), cell.firstChild);
+
+    if (row) {
+        row.classList.remove('uncategorized-transaction');
+    }
+
+    const marker = createMarker('sub-category-marker text-success', `✓ ${labels.saved}`);
+    cell.appendChild(marker);
+    window.setTimeout(() => marker.remove(), SAVED_MARKER_DURATION);
+};
+
+const submit = async (form, select, labels) => {
+    const cell = form.parentNode;
+
+    // Serialized before disabling the select: FormData skips disabled controls,
+    // which would drop the subCategory field and make the request a no-op.
+    const body = new FormData(form);
+
+    clearMarkers(cell);
+    select.disabled = true;
+    cell.appendChild(createMarker('sub-category-marker text-muted', '⋯'));
+
+    let response;
+    let payload;
+
+    try {
+        response = await fetch(form.action, {
+            method: 'POST',
+            body,
+            headers: { Accept: 'application/json' },
+        });
+        payload = await response.json();
+    } catch (error) {
+        showError(form, select, labels.error);
+
+        return;
+    }
+
+    if (!response.ok) {
+        showError(form, select, (payload && payload.error) || labels.error);
+
+        return;
+    }
+
+    settleRow(form, select, payload.subCategory.name, labels);
+};
+
+const init = () => {
+    const labels = getLabels();
+
+    document.querySelectorAll('form.inline-sub-category').forEach((form) => {
+        const select = form.querySelector('select');
+        const button = form.querySelector('button');
+
+        // Only hidden once this module is known to run: a broken script must
+        // leave a usable form behind, which <noscript> would not do.
+        if (button) {
+            button.hidden = true;
+        }
+
+        select.addEventListener('change', () => {
+            if ('' === select.value) {
+                return;
+            }
+
+            submit(form, select, labels);
+        });
+    });
+};
+
+export default { init };
diff --git a/public/styles/main.css b/public/styles/main.css
index 239b66c..5f51594 100644
--- a/public/styles/main.css
+++ b/public/styles/main.css
@@ -257,3 +257,26 @@ form#filter-form.large-filter-form .col-form-label {
     color: #3b3968;
     font-weight: bold;
 }
+
+/* Inline sub category assignment on the transaction list */
+
+tr.uncategorized-transaction > td:first-child {
+    border-left: 3px solid #ffc107;
+}
+
+#main .sub-category-cell form.inline-sub-category {
+    display: inline-block;
+    margin-bottom: 0;
+}
+
+#main .sub-category-cell select {
+    max-width: 18rem;
+    width: auto;
+    display: inline-block;
+}
+
+.sub-category-marker {
+    margin-left: 0.5rem;
+    font-size: 0.875rem;
+    white-space: nowrap;
+}
diff --git a/src/Controller/TransactionController.php b/src/Controller/TransactionController.php
index bc347c3..955709c 100644
--- a/src/Controller/TransactionController.php
+++ b/src/Controller/TransactionController.php
@@ -3,9 +3,13 @@
 namespace App\Controller;
 
 use App\Entity\Transaction;
+use App\Entity\TransactionType as TransactionTypeEnum;
+use App\Exception\InvalidSubCategoryAssignmentException;
 use App\FilterForm\TransactionFilterType;
 use App\Form\TransactionType;
+use App\Repository\SubCategoryRepository;
 use App\Services\TransactionDiffChecker;
+use App\Services\TransactionSubCategoryAssigner;
 use Doctrine\ORM\EntityManagerInterface;
 use Doctrine\Persistence\ManagerRegistry;
 use Elasticsearch\Common\Exceptions\NoNodesAvailableException;
@@ -15,6 +19,7 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\Form\FormError;
 use Symfony\Component\Form\FormFactoryInterface;
+use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpFoundation\Session\Session;
@@ -30,13 +35,18 @@ public function index(
         FormFactoryInterface $formFactory,
         EntityManagerInterface $entityManager,
         FilterBuilderUpdaterInterface $filterBuilderUpdater,
+        SubCategoryRepository $subCategoryRepository,
     ): Response {
         $hasFilters = false;
         $filterForm = $formFactory->create(TransactionFilterType::class);
 
+        // account and subCategory are selected along with the transaction to avoid
+        // hydrating one proxy per row when the template renders them.
         $queryBuilder = $entityManager->createQueryBuilder()
-            ->select('transaction')
+            ->select('transaction', 'account', 'subCategory')
             ->from(Transaction::class, 'transaction')
+            ->leftJoin('transaction.account', 'account')
+            ->leftJoin('transaction.subCategory', 'subCategory')
             ->orderBy('transaction.createdAt', 'desc')
         ;
 
@@ -59,10 +69,22 @@ public function index(
             $pagerfanta->setCurrentPage($request->query->getInt('page'));
         }
 
+        // Fetched once per page, not once per uncategorized row. Fetched before the
+        // filter form view is built on purpose: these queries also select the top
+        // categories, so the filter form's group_by finds them in the identity map
+        // instead of lazy loading one per top category.
+        $subCategories = [
+            TransactionTypeEnum::EXPENSES => $subCategoryRepository
+                ->findByTransactionTypeGroupedByTopCategory(TransactionTypeEnum::EXPENSES),
+            TransactionTypeEnum::REVENUES => $subCategoryRepository
+                ->findByTransactionTypeGroupedByTopCategory(TransactionTypeEnum::REVENUES),
+        ];
+
         return $this->render('transaction/index.html.twig', [
             'pager' => $pagerfanta,
             'filter_form' => $filterForm->createView(),
             'has_filters' => $hasFilters,
+            'sub_categories' => $subCategories,
         ]);
     }
 
@@ -123,6 +145,91 @@ public function edit(
         ]);
     }
 
+    /**
+     * Assigns a sub category to a transaction from the transaction list.
+     *
+     * Set-only: an empty or unknown sub category is rejected, never treated as a
+     * request to clear the category. See docs/plans/inline-sub-category-assignment.md.
+     */
+    #[Route('/{id}/sub-category', name: 'transaction_set_sub_category', methods: ['PATCH'])]
+    public function setSubCategory(
+        Request $request,
+        Transaction $transaction,
+        TransactionSubCategoryAssigner $assigner,
+        SubCategoryRepository $subCategoryRepository,
+        TranslatorInterface $translator,
+    ): Response {
+        $wantsJson = 'json' === $request->getPreferredFormat(null);
+
+        if (!$this->isCsrfTokenValid('set-sub-category'.$transaction->getId(), $request->request->getString('_token'))) {
+            return $this->subCategoryError(
+                $request,
+                $wantsJson,
+                $translator->trans('Invalid security token, please reload the page'),
+                Response::HTTP_FORBIDDEN
+            );
+        }
+
+        $subCategoryId = $request->request->getString('subCategory');
+        $subCategory = '' === $subCategoryId ? null : $subCategoryRepository->find($subCategoryId);
+
+        if (null === $subCategory) {
+            return $this->subCategoryError(
+                $request,
+                $wantsJson,
+                $translator->trans('A sub category is required'),
+                Response::HTTP_UNPROCESSABLE_ENTITY
+            );
+        }
+
+        try {
+            $assigner->assign($transaction, $subCategory);
+        } catch (InvalidSubCategoryAssignmentException $e) {
+            return $this->subCategoryError(
+                $request,
+                $wantsJson,
+                $translator->trans($e->getMessage(), [], 'validators'),
+                Response::HTTP_UNPROCESSABLE_ENTITY
+            );
+        }
+
+        if ($wantsJson) {
+            return new JsonResponse([
+                'id' => $transaction->getId(),
+                'subCategory' => [
+                    'id' => $subCategory->getId(),
+                    'name' => $subCategory->getName(),
+                ],
+            ]);
+        }
+
+        return $this->redirectToTransactionList($request);
+    }
+
+    private function subCategoryError(Request $request, bool $wantsJson, string $message, int $status): Response
+    {
+        if ($wantsJson) {
+            return new JsonResponse(['error' => $message], $status);
+        }
+
+        $this->addFlash('error', $message);
+
+        return $this->redirectToTransactionList($request);
+    }
+
+    /**
+     * Sends the no-javascript fallback back to the list it came from, keeping the
+     * active filters and page number.
+     */
+    private function redirectToTransactionList(Request $request): Response
+    {
+        $queryString = parse_url((string) $request->headers->get('referer'), PHP_URL_QUERY);
+
+        return $this->redirect(
+            $this->generateUrl('transaction_index').(is_string($queryString) && '' !== $queryString ? '?'.$queryString : '')
+        );
+    }
+
     #[Route('/{id}', name: 'transaction_delete', methods: ['DELETE'])]
     public function delete(
         Request $request,
diff --git a/src/Exception/InvalidSubCategoryAssignmentException.php b/src/Exception/InvalidSubCategoryAssignmentException.php
new file mode 100644
index 0000000..c549dac
--- /dev/null
+++ b/src/Exception/InvalidSubCategoryAssignmentException.php
@@ -0,0 +1,7 @@
+<?php
+
+namespace App\Exception;
+
+class InvalidSubCategoryAssignmentException extends \Exception
+{
+}
diff --git a/src/Repository/SubCategoryRepository.php b/src/Repository/SubCategoryRepository.php
index 672ed23..9764c6e 100644
--- a/src/Repository/SubCategoryRepository.php
+++ b/src/Repository/SubCategoryRepository.php
@@ -27,6 +27,7 @@ public function __construct(ManagerRegistry $registry)
     public function findByTransactionType(string $value)
     {
         return $this->createQueryBuilder('s')
+            ->addSelect('t')
             ->innerJoin('s.topCategory', 't', 'WITH', 't.transactionType = ?1')
             ->orderBy('s.name', 'ASC')
             ->setParameter(1, $value)
@@ -35,6 +36,25 @@ public function findByTransactionType(string $value)
         ;
     }
 
+    /**
+     * Sub categories of a transaction type, grouped by top category name, ready to be
+     * rendered as optgroups. The top category is fetched in the same query.
+     *
+     * @return array<string, SubCategory[]>
+     */
+    public function findByTransactionTypeGroupedByTopCategory(string $value): array
+    {
+        $grouped = [];
+
+        foreach ($this->findByTransactionType($value) as $subCategory) {
+            $grouped[$subCategory->getTopCategory()->getName()][] = $subCategory;
+        }
+
+        ksort($grouped);
+
+        return $grouped;
+    }
+
     /**
      * @return SubCategory[] Returns an array of SubCategory objects
      */
diff --git a/src/Services/TransactionSubCategoryAssigner.php b/src/Services/TransactionSubCategoryAssigner.php
new file mode 100644
index 0000000..2f25b4d
--- /dev/null
+++ b/src/Services/TransactionSubCategoryAssigner.php
@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Services;
+
+use App\Entity\SubCategory;
+use App\Entity\Transaction;
+use App\Exception\InvalidSubCategoryAssignmentException;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Component\Validator\Validator\ValidatorInterface;
+
+/**
+ * Assigns a sub category to a transaction.
+ *
+ * The sub category is not nullable on purpose: this service can only set a
+ * category, never clear one. See docs/plans/inline-sub-category-assignment.md.
+ */
+class TransactionSubCategoryAssigner
+{
+    private EntityManagerInterface $entityManager;
+    private TransactionDiffChecker $transactionDiffChecker;
+    private ValidatorInterface $validator;
+
+    public function __construct(
+        EntityManagerInterface $entityManager,
+        TransactionDiffChecker $transactionDiffChecker,
+        ValidatorInterface $validator,
+    ) {
+        $this->entityManager = $entityManager;
+        $this->transactionDiffChecker = $transactionDiffChecker;
+        $this->validator = $validator;
+    }
+
+    /**
+     * @throws InvalidSubCategoryAssignmentException when the sub category does not
+     *                                               match the transaction type
+     */
+    public function assign(Transaction $transaction, SubCategory $subCategory): void
+    {
+        $transaction->setSubCategory($subCategory);
+
+        if ($this->transactionDiffChecker->subCategoryChanged($transaction)) {
+            $transaction->setCategorizedManually(true);
+        }
+
+        // Transaction::checkSubCategory() throws in a PreUpdate callback when the
+        // types do not match, which would surface as a 500. Validate before flushing.
+        $violations = $this->validator->validate($transaction);
+
+        if (count($violations) > 0) {
+            throw new InvalidSubCategoryAssignmentException((string) $violations->get(0)->getMessage());
+        }
+
+        $this->entityManager->flush();
+    }
+}
diff --git a/templates/transaction/index.html.twig b/templates/transaction/index.html.twig
index 3eb8e09..3ddaf91 100644
--- a/templates/transaction/index.html.twig
+++ b/templates/transaction/index.html.twig
@@ -9,6 +9,10 @@
 {% block body %}
     <h1>{% trans %}Transaction list{% endtrans %}</h1>
 
+    {% for message in app.flashes('error') %}
+        <div class="alert alert-danger" role="alert">{{ message }}</div>
+    {% endfor %}
+
     <div class="pagerfanta">
         {{ pagerfanta(pager, 'custom_view') }}
         <p>{{ pager.getNbResults }} transactions</p>
@@ -32,7 +36,12 @@
         {% trans %}Create a new transaction{% endtrans %}
     </a>
 
-    <table class="table">
+    <table
+        class="table"
+        id="transaction-list"
+        data-saved-label="{% trans %}saved{% endtrans %}"
+        data-error-label="{% trans %}Could not save the sub category{% endtrans %}"
+    >
         <thead class="thead-dark">
             <tr>
                 <th>{% trans %}Label{% endtrans %}</th>
@@ -45,18 +54,35 @@
         </thead>
         <tbody>
         {% for transaction in pager.currentPageResults %}
-            <tr>
+            <tr{% if transaction.subCategory is null %} class="uncategorized-transaction"{% endif %}>
                 <td>{{ transaction.label | capitalize }}</td>
                 <td>{{ transaction.amount }}</td>
                 <td>{{ transaction.createdAt|date('d/m/Y') }}</td>
                 <td>{{ transaction.account }}</td>
-                <td>
-                    {{ transaction.subCategory }}
-                    <em>
-                        {% if transaction.subCategory is null %}
-                            {% trans %}uncategorized{% endtrans %}
-                        {% endif %}
-                    </em>
+                <td class="sub-category-cell">
+                    {%- if transaction.subCategory is null -%}
+                        <form
+                            method="post"
+                            action="{{ path('transaction_set_sub_category', {'id': transaction.id}) }}"
+                            class="inline-sub-category"
+                        >
+                            <input type="hidden" name="_method" value="PATCH">
+                            <input type="hidden" name="_token" value="{{ csrf_token('set-sub-category' ~ transaction.id) }}">
+                            <select name="subCategory" class="custom-select custom-select-sm">
+                                <option value="">{% trans %}Select a category{% endtrans %}</option>
+                                {% for topCategoryName, subCategories in sub_categories[transaction.type] %}
+                                    <optgroup label="{{ topCategoryName }}">
+                                        {% for subCategory in subCategories %}
+                                            <option value="{{ subCategory.id }}">{{ subCategory.name }}</option>
+                                        {% endfor %}
+                                    </optgroup>
+                                {% endfor %}
+                            </select>
+                            <button class="btn btn-sm btn-primary">{% trans %}Save{% endtrans %}</button>
+                        </form>
+                    {%- else -%}
+                        {{- transaction.subCategory -}}
+                    {%- endif -%}
                 </td>
                 <td>
                     <a href="{{ path('transaction_edit', {'id': transaction.id}) }}"><i class="fas fa-edit"></i></a>
@@ -76,3 +102,11 @@
     </div>
 
 {% endblock %}
+
+{% block javascripts %}
+    {{ parent() }}
+    <script type="module">
+        import lib from '/js/inline_sub_category.js';
+        lib.init();
+    </script>
+{% endblock %}
diff --git a/tests/Controller/TransactionSubCategoryTest.php b/tests/Controller/TransactionSubCategoryTest.php
new file mode 100644
index 0000000..bdfb5f5
--- /dev/null
+++ b/tests/Controller/TransactionSubCategoryTest.php
@@ -0,0 +1,315 @@
+<?php
+
+namespace App\Tests\Controller;
+
+use App\Entity\Account;
+use App\Entity\SubCategory;
+use App\Entity\TopCategory;
+use App\Entity\Transaction;
+use App\Entity\TransactionType;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\KernelBrowser;
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+use Symfony\Component\DomCrawler\Crawler;
+
+/**
+ * Assigning a sub category from the transaction list.
+ *
+ * See docs/plans/inline-sub-category-assignment.md
+ */
+class TransactionSubCategoryTest extends WebTestCase
+{
+    private KernelBrowser $client;
+
+    private EntityManagerInterface $manager;
+
+    private SubCategory $groceries;
+
+    private SubCategory $rent;
+
+    private SubCategory $salary;
+
+    private Transaction $expense;
+
+    private Transaction $categorized;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->client = static::createClient();
+        $this->manager = static::getContainer()->get(EntityManagerInterface::class);
+
+        $account = (new Account())->setName('Test account')->setCurrency('EUR');
+        $this->manager->persist($account);
+
+        $expenses = (new TopCategory())
+            ->setName('Everyday')
+            ->setTransactionType(TransactionType::EXPENSES);
+        $revenues = (new TopCategory())
+            ->setName('Work')
+            ->setTransactionType(TransactionType::REVENUES);
+        $this->manager->persist($expenses);
+        $this->manager->persist($revenues);
+
+        $this->groceries = (new SubCategory())->setName('Groceries')->setTopCategory($expenses);
+        $this->rent = (new SubCategory())->setName('Rent')->setTopCategory($expenses);
+        $this->salary = (new SubCategory())->setName('Salary')->setTopCategory($revenues);
+        $this->manager->persist($this->groceries);
+        $this->manager->persist($this->rent);
+        $this->manager->persist($this->salary);
+
+        $this->expense = $this->createTransaction($account, 'Biocoop', -42.1);
+        // Only needed so the list has a Revenues row to scope options against.
+        $this->createTransaction($account, 'Payslip', 2400.0);
+        $this->categorized = $this->createTransaction($account, 'Already done', -10.0);
+        $this->categorized->setSubCategory($this->rent);
+
+        $this->manager->flush();
+    }
+
+    private function createTransaction(Account $account, string $label, float $amount): Transaction
+    {
+        $transaction = (new Transaction())
+            ->setAccount($account)
+            ->setLabel($label)
+            ->setAmount($amount)
+            ->setCreatedAt(new \DateTime('2025-04-02'));
+
+        $this->manager->persist($transaction);
+
+        return $transaction;
+    }
+
+    private function rowOf(Crawler $crawler, string $label): Crawler
+    {
+        $row = $crawler->filter('#transaction-list tbody tr')->reduce(
+            fn (Crawler $tr) => str_contains($tr->filter('td')->first()->text(), $label)
+        );
+
+        $this->assertCount(1, $row, sprintf('Expected exactly one row for "%s"', $label));
+
+        return $row;
+    }
+
+    private function url(Transaction $transaction): string
+    {
+        return sprintf('/transaction/%s/sub-category', $transaction->getId());
+    }
+
+    /**
+     * @param array<string, string> $parameters
+     */
+    private function patch(Transaction $transaction, array $parameters, bool $json = false): void
+    {
+        $this->client->request(
+            'POST',
+            $this->url($transaction),
+            array_merge(['_method' => 'PATCH'], $parameters),
+            [],
+            $json ? ['HTTP_ACCEPT' => 'application/json'] : []
+        );
+    }
+
+    private function token(Transaction $transaction): string
+    {
+        $crawler = $this->client->request('GET', '/transaction/');
+
+        return $this->rowOf($crawler, (string) $transaction->getLabel())
+            ->filter('input[name="_token"]')
+            ->attr('value');
+    }
+
+    private function refresh(Transaction $transaction): Transaction
+    {
+        $this->manager->clear();
+
+        return $this->manager->getRepository(Transaction::class)->find($transaction->getId());
+    }
+
+    public function testUncategorizedRowRendersASelect(): void
+    {
+        $crawler = $this->client->request('GET', '/transaction/');
+        $this->assertResponseIsSuccessful();
+
+        $row = $this->rowOf($crawler, 'Biocoop');
+        $this->assertCount(1, $row->filter('form.inline-sub-category select[name="subCategory"]'));
+        $this->assertStringContainsString('uncategorized-transaction', (string) $row->attr('class'));
+    }
+
+    public function testCategorizedRowRendersPlainTextAndNoSelect(): void
+    {
+        $crawler = $this->client->request('GET', '/transaction/');
+
+        $row = $this->rowOf($crawler, 'Already done');
+        $this->assertCount(0, $row->filter('select[name="subCategory"]'));
+        $this->assertSame('Rent', $row->filter('td.sub-category-cell')->text());
+        $this->assertStringNotContainsString('uncategorized-transaction', (string) $row->attr('class'));
+    }
+
+    public function testOptionsAreScopedToTheTransactionType(): void
+    {
+        $crawler = $this->client->request('GET', '/transaction/');
+
+        $expenseOptions = $this->rowOf($crawler, 'Biocoop')->filter('option')->each(
+            fn (Crawler $option) => $option->text()
+        );
+        $this->assertContains('Groceries', $expenseOptions);
+        $this->assertContains('Rent', $expenseOptions);
+        $this->assertNotContains('Salary', $expenseOptions);
+
+        $revenueOptions = $this->rowOf($crawler, 'Payslip')->filter('option')->each(
+            fn (Crawler $option) => $option->text()
+        );
+        $this->assertContains('Salary', $revenueOptions);
+        $this->assertNotContains('Groceries', $revenueOptions);
+    }
+
+    public function testOptionsAreGroupedByTopCategory(): void
+    {
+        $crawler = $this->client->request('GET', '/transaction/');
+
+        $this->assertCount(
+            1,
+            $this->rowOf($crawler, 'Biocoop')->filter('optgroup[label="Everyday"]')
+        );
+    }
+
+    public function testSubmittingTheFormAssignsTheSubCategory(): void
+    {
+        $this->patch($this->expense, [
+            '_token' => $this->token($this->expense),
+            'subCategory' => (string) $this->groceries->getId(),
+        ]);
+
+        $this->assertResponseRedirects('/transaction/');
+
+        $transaction = $this->refresh($this->expense);
+        $this->assertSame('Groceries', (string) $transaction->getSubCategory());
+        $this->assertTrue($transaction->isCategorizedManually());
+    }
+
+    public function testAssignedRowThenRendersLikeACategorizedRow(): void
+    {
+        $this->patch($this->expense, [
+            '_token' => $this->token($this->expense),
+            'subCategory' => (string) $this->groceries->getId(),
+        ]);
+
+        $crawler = $this->client->request('GET', '/transaction/');
+        $row = $this->rowOf($crawler, 'Biocoop');
+
+        // Exactly what testCategorizedRowRendersPlainTextAndNoSelect asserts about a
+        // row that was already categorized when the page was rendered.
+        $this->assertCount(0, $row->filter('select[name="subCategory"]'));
+        $this->assertSame('Groceries', $row->filter('td.sub-category-cell')->text());
+        $this->assertStringNotContainsString('uncategorized-transaction', (string) $row->attr('class'));
+    }
+
+    public function testFallbackRedirectKeepsFiltersAndPage(): void
+    {
+        $token = $this->token($this->expense);
+        $listUrl = '/transaction/?item_filter%5Blabel%5D=Biocoop&page=1';
+
+        $this->client->request('GET', $listUrl);
+        $this->client->request(
+            'POST',
+            $this->url($this->expense),
+            [
+                '_method' => 'PATCH',
+                '_token' => $token,
+                'subCategory' => (string) $this->groceries->getId(),
+            ],
+            [],
+            ['HTTP_REFERER' => 'http://localhost'.$listUrl]
+        );
+
+        $this->assertResponseRedirects($listUrl);
+    }
+
+    public function testJsonRequestReturnsTheSubCategory(): void
+    {
+        $this->patch($this->expense, [
+            '_token' => $this->token($this->expense),
+            'subCategory' => (string) $this->groceries->getId(),
+        ], true);
+
+        $this->assertResponseIsSuccessful();
+        $this->assertSame(
+            [
+                'id' => (string) $this->expense->getId(),
+                'subCategory' => [
+                    'id' => (string) $this->groceries->getId(),
+                    'name' => 'Groceries',
+                ],
+            ],
+            json_decode((string) $this->client->getResponse()->getContent(), true)
+        );
+    }
+
+    public function testAnInvalidCsrfTokenIsRejected(): void
+    {
+        $this->patch($this->expense, [
+            '_token' => 'not-a-valid-token',
+            'subCategory' => (string) $this->groceries->getId(),
+        ], true);
+
+        $this->assertResponseStatusCodeSame(403);
+        $this->assertNull($this->refresh($this->expense)->getSubCategory());
+    }
+
+    public function testACrossTypeSubCategoryIsRejected(): void
+    {
+        // Salary is a Revenues category, the transaction is an expense.
+        $this->patch($this->expense, [
+            '_token' => $this->token($this->expense),
+            'subCategory' => (string) $this->salary->getId(),
+        ], true);
+
+        $this->assertResponseStatusCodeSame(422);
+        $this->assertStringContainsString(
+            'does not make sense',
+            (string) $this->client->getResponse()->getContent()
+        );
+        $this->assertNull($this->refresh($this->expense)->getSubCategory());
+    }
+
+    public function testAnUnknownSubCategoryIsRejected(): void
+    {
+        $this->patch($this->expense, [
+            '_token' => $this->token($this->expense),
+            'subCategory' => '3d7c2a1e-0000-4000-8000-000000000000',
+        ], true);
+
+        $this->assertResponseStatusCodeSame(422);
+        $this->assertNull($this->refresh($this->expense)->getSubCategory());
+    }
+
+    public function testAnEmptySubCategoryIsRejectedAndDoesNotClear(): void
+    {
+        // The token is read while the row still renders a form, then reused: it is
+        // tied to the transaction id, not to the transaction being uncategorized.
+        $token = $this->token($this->expense);
+
+        $this->patch($this->expense, [
+            '_token' => $token,
+            'subCategory' => (string) $this->groceries->getId(),
+        ], true);
+        $this->assertResponseIsSuccessful();
+
+        $this->patch($this->expense, ['_token' => $token, 'subCategory' => ''], true);
+
+        $this->assertResponseStatusCodeSame(422);
+        // The endpoint is set-only: the category just assigned is untouched.
+        $this->assertSame('Groceries', (string) $this->refresh($this->expense)->getSubCategory());
+    }
+
+    public function testAnUnknownTransactionIsNotFound(): void
+    {
+        $this->client->request('POST', '/transaction/3d7c2a1e-0000-4000-8000-000000000000/sub-category', [
+            '_method' => 'PATCH',
+        ]);
+
+        $this->assertResponseStatusCodeSame(404);
+    }
+}
diff --git a/tests/Services/TransactionSubCategoryAssignerTest.php b/tests/Services/TransactionSubCategoryAssignerTest.php
new file mode 100644
index 0000000..a11fff8
--- /dev/null
+++ b/tests/Services/TransactionSubCategoryAssignerTest.php
@@ -0,0 +1,100 @@
+<?php
+
+namespace App\Tests\Services;
+
+use App\Entity\Account;
+use App\Entity\SubCategory;
+use App\Entity\TopCategory;
+use App\Entity\Transaction;
+use App\Entity\TransactionType;
+use App\Exception\InvalidSubCategoryAssignmentException;
+use App\Services\TransactionDiffChecker;
+use App\Services\TransactionSubCategoryAssigner;
+use Doctrine\ORM\EntityManagerInterface;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Validator\ConstraintViolation;
+use Symfony\Component\Validator\ConstraintViolationList;
+use Symfony\Component\Validator\Validator\ValidatorInterface;
+
+class TransactionSubCategoryAssignerTest extends TestCase
+{
+    private function createSubCategory(string $name, string $transactionType): SubCategory
+    {
+        $topCategory = (new TopCategory())
+            ->setName('Top '.$name)
+            ->setTransactionType($transactionType);
+
+        return (new SubCategory())->setName($name)->setTopCategory($topCategory);
+    }
+
+    private function createTransaction(float $amount): Transaction
+    {
+        return (new Transaction())
+            ->setAccount((new Account())->setName('Fake account')->setCurrency('EUR'))
+            ->setLabel('Fake transaction')
+            ->setAmount($amount)
+            ->setCreatedAt(new \DateTime('now'));
+    }
+
+    private function createAssigner(
+        bool $subCategoryChanged,
+        ConstraintViolationList $violations,
+        int $expectedFlushCount,
+    ): TransactionSubCategoryAssigner {
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager->expects($this->exactly($expectedFlushCount))->method('flush');
+
+        $diffChecker = $this->createMock(TransactionDiffChecker::class);
+        $diffChecker->method('subCategoryChanged')->willReturn($subCategoryChanged);
+
+        $validator = $this->createMock(ValidatorInterface::class);
+        $validator->method('validate')->willReturn($violations);
+
+        return new TransactionSubCategoryAssigner($entityManager, $diffChecker, $validator);
+    }
+
+    public function testAssigningToAnUncategorizedTransactionMarksItManual(): void
+    {
+        $transaction = $this->createTransaction(-42.0);
+        $subCategory = $this->createSubCategory('Groceries', TransactionType::EXPENSES);
+
+        $assigner = $this->createAssigner(true, new ConstraintViolationList(), 1);
+        $assigner->assign($transaction, $subCategory);
+
+        $this->assertSame($subCategory, $transaction->getSubCategory());
+        $this->assertTrue($transaction->isCategorizedManually());
+    }
+
+    public function testAssigningTheSameSubCategoryLeavesTheManualFlagAlone(): void
+    {
+        $subCategory = $this->createSubCategory('Groceries', TransactionType::EXPENSES);
+        $transaction = $this->createTransaction(-42.0);
+        $transaction->setSubCategory($subCategory);
+
+        // The diff checker reports no change: a rule-assigned category re-picked as
+        // is must not silently pin the transaction against future rule runs.
+        $assigner = $this->createAssigner(false, new ConstraintViolationList(), 1);
+        $assigner->assign($transaction, $subCategory);
+
+        $this->assertFalse($transaction->isCategorizedManually());
+    }
+
+    public function testAViolationPreventsTheFlush(): void
+    {
+        $transaction = $this->createTransaction(-42.0);
+        $subCategory = $this->createSubCategory('Salary', TransactionType::REVENUES);
+
+        $violations = new ConstraintViolationList([
+            new ConstraintViolation('transaction_sub_category.is_logical', null, [], null, null, null),
+        ]);
+
+        // Zero flushes: Transaction::checkSubCategory() throws a raw exception in a
+        // PreUpdate callback, so an invalid pair must never reach the database.
+        $assigner = $this->createAssigner(true, $violations, 0);
+
+        $this->expectException(InvalidSubCategoryAssignmentException::class);
+        $this->expectExceptionMessage('transaction_sub_category.is_logical');
+
+        $assigner->assign($transaction, $subCategory);
+    }
+}
diff --git a/translations/messages.en.yml b/translations/messages.en.yml
index b1ab0ec..b893372 100644
--- a/translations/messages.en.yml
+++ b/translations/messages.en.yml
@@ -10,4 +10,9 @@ tags_info: >
     <ul>
       <li>If you want to know how much your vacation cost, create a "<em>Holidays</em>" tags and mark your transactions with it.</li>
       <li>If you want to follow some transactions that should be refunded, create a tag such as "<em>Waiting for refund</em>"</li>
-    </ul>
\ No newline at end of file
+    </ul>
+Select a category: Select a category
+saved: saved
+Could not save the sub category: Could not save the sub category
+A sub category is required: A sub category is required
+Invalid security token, please reload the page: Invalid security token, please reload the page
diff --git a/translations/messages.fr.yml b/translations/messages.fr.yml
index 5df2a14..4fbea9f 100644
--- a/translations/messages.fr.yml
+++ b/translations/messages.fr.yml
@@ -239,3 +239,8 @@ Carpooling: Covoiturage
 Tramway or subway: Tramway ou métro
 Ferry: Ferry
 Interest: Intérêts
+Select a category: Choisir une catégorie
+saved: enregistré
+Could not save the sub category: "Impossible d'enregistrer la sous catégorie"
+A sub category is required: Une sous catégorie est obligatoire
+Invalid security token, please reload the page: Jeton de sécurité invalide, veuillez recharger la page

From f58b46422ef13194a4a34a013f1f75be189261d8 Mon Sep 17 00:00:00 2001
From: Baptiste Bouchereau <baptiste.bouchereau@gmail.com>
Date: Sat, 22 Aug 2026 16:06:59 +0200
Subject: [PATCH 04/10] Keep the transaction list from shifting while
 categorizing

Three separate causes made columns and rows move as a category was picked
and saved:

- the select was auto width, so it resized to fit the selected option
- the save markers added inline width, the error message most of all
- the cell lost height when the form was replaced by plain text

The select and the column now have fixed widths, markers are truncated with
the full text kept in a title attribute, and every cell reserves the height
of a select. Columns and row heights are identical across the idle, picked,
saving, settled and error states.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q1NqsuwvBdHz19hkzKKmie
---
 public/js/inline_sub_category.js      |  3 +++
 public/styles/main.css                | 33 ++++++++++++++++++++++++---
 templates/transaction/index.html.twig |  2 +-
 3 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/public/js/inline_sub_category.js b/public/js/inline_sub_category.js
index 6bc3776..fc26f1e 100644
--- a/public/js/inline_sub_category.js
+++ b/public/js/inline_sub_category.js
@@ -45,6 +45,9 @@ const createMarker = (className, text) => {
     marker.className = className;
     // textContent, never innerHTML: labels and category names are external input.
     marker.textContent = text;
+    // The marker is truncated to keep the column width stable, so the full
+    // message has to stay reachable on hover.
+    marker.title = text;
 
     return marker;
 };
diff --git a/public/styles/main.css b/public/styles/main.css
index 5f51594..c41305a 100644
--- a/public/styles/main.css
+++ b/public/styles/main.css
@@ -264,19 +264,46 @@ tr.uncategorized-transaction > td:first-child {
     border-left: 3px solid #ffc107;
 }
 
+/* The column keeps a constant width whatever the cell currently holds: a
+   select, a plain category name, or a save marker. Without this, settling a
+   row narrows the column and drags every other column sideways. */
+#transaction-list th.sub-category-column,
+#transaction-list td.sub-category-cell {
+    width: 24rem;
+}
+
+/* Every row is as tall as a row holding a select, so settling one down to
+   plain text does not make it shrink. The cell is border-box, so the figure
+   adds up the select, the cell padding (.75rem top and bottom) and the
+   collapsed row border. */
+#main td.sub-category-cell {
+    position: relative;
+    height: calc(1.8125rem + 2px + 1.5rem + 1px);
+}
+
 #main .sub-category-cell form.inline-sub-category {
     display: inline-block;
     margin-bottom: 0;
 }
 
+/* Fixed width on purpose: an auto width select grows to fit the selected
+   option and would resize the column on every pick. */
 #main .sub-category-cell select {
-    max-width: 18rem;
-    width: auto;
+    width: 13rem;
+    max-width: 13rem;
     display: inline-block;
+    vertical-align: middle;
 }
 
+/* Truncated rather than wrapped: a long error message must not widen the
+   column or push the row taller. The full text stays in the title attribute. */
 .sub-category-marker {
+    display: inline-block;
     margin-left: 0.5rem;
-    font-size: 0.875rem;
+    max-width: 8rem;
+    overflow: hidden;
+    text-overflow: ellipsis;
     white-space: nowrap;
+    vertical-align: middle;
+    font-size: 0.875rem;
 }
diff --git a/templates/transaction/index.html.twig b/templates/transaction/index.html.twig
index 3ddaf91..871307d 100644
--- a/templates/transaction/index.html.twig
+++ b/templates/transaction/index.html.twig
@@ -48,7 +48,7 @@
                 <th>{% trans %}Amount{% endtrans %}</th>
                 <th>{% trans %}Created at{% endtrans %}</th>
                 <th>{% trans %}Account{% endtrans %}</th>
-                <th>{% trans %}Sub category{% endtrans %}</th>
+                <th class="sub-category-column">{% trans %}Sub category{% endtrans %}</th>
                 <th>{% trans %}Actions{% endtrans %}</th>
             </tr>
         </thead>

From 29f927987be8694f8e0b6d5cd77642c8efe96b74 Mon Sep 17 00:00:00 2001
From: Baptiste Bouchereau <baptiste.bouchereau@gmail.com>
Date: Sun, 23 Aug 2026 09:39:36 +0200
Subject: [PATCH 05/10] Drop unnecessary comment

---
 src/Repository/SubCategoryRepository.php | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/src/Repository/SubCategoryRepository.php b/src/Repository/SubCategoryRepository.php
index 9764c6e..835e359 100644
--- a/src/Repository/SubCategoryRepository.php
+++ b/src/Repository/SubCategoryRepository.php
@@ -37,9 +37,6 @@ public function findByTransactionType(string $value)
     }
 
     /**
-     * Sub categories of a transaction type, grouped by top category name, ready to be
-     * rendered as optgroups. The top category is fetched in the same query.
-     *
      * @return array<string, SubCategory[]>
      */
     public function findByTransactionTypeGroupedByTopCategory(string $value): array

From af956811532b9582770d601e5ac9d9aa11ebd913 Mon Sep 17 00:00:00 2001
From: Baptiste Bouchereau <baptiste.bouchereau@gmail.com>
Date: Sun, 23 Aug 2026 09:40:39 +0200
Subject: [PATCH 06/10] Drop references to plan

---
 public/js/inline_sub_category.js                | 2 --
 src/Controller/TransactionController.php        | 2 +-
 src/Services/TransactionSubCategoryAssigner.php | 2 +-
 tests/Controller/TransactionSubCategoryTest.php | 2 --
 4 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/public/js/inline_sub_category.js b/public/js/inline_sub_category.js
index fc26f1e..8b8e084 100644
--- a/public/js/inline_sub_category.js
+++ b/public/js/inline_sub_category.js
@@ -5,8 +5,6 @@
  * form. This module hides its submit button and turns a change on the select
  * into a fetch, so a whole page of transactions can be categorized without a
  * reload. If this module fails to load or throws, the forms keep working.
- *
- * See docs/plans/inline-sub-category-assignment.md
  */
 
 const SAVED_MARKER_DURATION = 2000;
diff --git a/src/Controller/TransactionController.php b/src/Controller/TransactionController.php
index 955709c..2843687 100644
--- a/src/Controller/TransactionController.php
+++ b/src/Controller/TransactionController.php
@@ -149,7 +149,7 @@ public function edit(
      * Assigns a sub category to a transaction from the transaction list.
      *
      * Set-only: an empty or unknown sub category is rejected, never treated as a
-     * request to clear the category. See docs/plans/inline-sub-category-assignment.md.
+     * request to clear the category.
      */
     #[Route('/{id}/sub-category', name: 'transaction_set_sub_category', methods: ['PATCH'])]
     public function setSubCategory(
diff --git a/src/Services/TransactionSubCategoryAssigner.php b/src/Services/TransactionSubCategoryAssigner.php
index 2f25b4d..7d695b4 100644
--- a/src/Services/TransactionSubCategoryAssigner.php
+++ b/src/Services/TransactionSubCategoryAssigner.php
@@ -12,7 +12,7 @@
  * Assigns a sub category to a transaction.
  *
  * The sub category is not nullable on purpose: this service can only set a
- * category, never clear one. See docs/plans/inline-sub-category-assignment.md.
+ * category, never clear one.
  */
 class TransactionSubCategoryAssigner
 {
diff --git a/tests/Controller/TransactionSubCategoryTest.php b/tests/Controller/TransactionSubCategoryTest.php
index bdfb5f5..af0f681 100644
--- a/tests/Controller/TransactionSubCategoryTest.php
+++ b/tests/Controller/TransactionSubCategoryTest.php
@@ -14,8 +14,6 @@
 
 /**
  * Assigning a sub category from the transaction list.
- *
- * See docs/plans/inline-sub-category-assignment.md
  */
 class TransactionSubCategoryTest extends WebTestCase
 {

From ec9c5ac807767f5f06814c06eb517ccfbbe56120 Mon Sep 17 00:00:00 2001
From: Baptiste Bouchereau <baptiste.bouchereau@gmail.com>
Date: Sun, 23 Aug 2026 09:47:09 +0200
Subject: [PATCH 07/10] Move comments where it's useful and tweak logic order

---
 src/Services/TransactionSubCategoryAssigner.php | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/Services/TransactionSubCategoryAssigner.php b/src/Services/TransactionSubCategoryAssigner.php
index 7d695b4..7b35998 100644
--- a/src/Services/TransactionSubCategoryAssigner.php
+++ b/src/Services/TransactionSubCategoryAssigner.php
@@ -10,9 +10,6 @@
 
 /**
  * Assigns a sub category to a transaction.
- *
- * The sub category is not nullable on purpose: this service can only set a
- * category, never clear one.
  */
 class TransactionSubCategoryAssigner
 {
@@ -33,15 +30,14 @@ public function __construct(
     /**
      * @throws InvalidSubCategoryAssignmentException when the sub category does not
      *                                               match the transaction type
+     *
+     * The sub category is not nullable on purpose.
+     * For now this service can only set a category, not clear one.
      */
     public function assign(Transaction $transaction, SubCategory $subCategory): void
     {
         $transaction->setSubCategory($subCategory);
 
-        if ($this->transactionDiffChecker->subCategoryChanged($transaction)) {
-            $transaction->setCategorizedManually(true);
-        }
-
         // Transaction::checkSubCategory() throws in a PreUpdate callback when the
         // types do not match, which would surface as a 500. Validate before flushing.
         $violations = $this->validator->validate($transaction);
@@ -50,6 +46,10 @@ public function assign(Transaction $transaction, SubCategory $subCategory): void
             throw new InvalidSubCategoryAssignmentException((string) $violations->get(0)->getMessage());
         }
 
+        if ($this->transactionDiffChecker->subCategoryChanged($transaction)) {
+            $transaction->setCategorizedManually(true);
+        }
+
         $this->entityManager->flush();
     }
 }

From fe9edd63221390a706d8ec35810b0b581d316d41 Mon Sep 17 00:00:00 2001
From: Baptiste Bouchereau <baptiste.bouchereau@gmail.com>
Date: Sun, 23 Aug 2026 09:58:17 +0200
Subject: [PATCH 08/10] Remove comments

---
 src/Controller/TransactionController.php | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/src/Controller/TransactionController.php b/src/Controller/TransactionController.php
index 2843687..7267f9c 100644
--- a/src/Controller/TransactionController.php
+++ b/src/Controller/TransactionController.php
@@ -40,8 +40,6 @@ public function index(
         $hasFilters = false;
         $filterForm = $formFactory->create(TransactionFilterType::class);
 
-        // account and subCategory are selected along with the transaction to avoid
-        // hydrating one proxy per row when the template renders them.
         $queryBuilder = $entityManager->createQueryBuilder()
             ->select('transaction', 'account', 'subCategory')
             ->from(Transaction::class, 'transaction')
@@ -69,15 +67,9 @@ public function index(
             $pagerfanta->setCurrentPage($request->query->getInt('page'));
         }
 
-        // Fetched once per page, not once per uncategorized row. Fetched before the
-        // filter form view is built on purpose: these queries also select the top
-        // categories, so the filter form's group_by finds them in the identity map
-        // instead of lazy loading one per top category.
         $subCategories = [
-            TransactionTypeEnum::EXPENSES => $subCategoryRepository
-                ->findByTransactionTypeGroupedByTopCategory(TransactionTypeEnum::EXPENSES),
-            TransactionTypeEnum::REVENUES => $subCategoryRepository
-                ->findByTransactionTypeGroupedByTopCategory(TransactionTypeEnum::REVENUES),
+            TransactionTypeEnum::EXPENSES => $subCategoryRepository->findByTransactionTypeGroupedByTopCategory(TransactionTypeEnum::EXPENSES),
+            TransactionTypeEnum::REVENUES => $subCategoryRepository->findByTransactionTypeGroupedByTopCategory(TransactionTypeEnum::REVENUES),
         ];
 
         return $this->render('transaction/index.html.twig', [

From ce689b1f46bff322e68270f4d6308454eb94fe68 Mon Sep 17 00:00:00 2001
From: Baptiste Bouchereau <baptiste.bouchereau@gmail.com>
Date: Mon, 24 Aug 2026 14:32:50 +0200
Subject: [PATCH 09/10] Move twig logic to a partial

---
 .../transaction/_sub_category_cell.html.twig  | 25 ++++++++++++++++++
 templates/transaction/index.html.twig         | 26 +------------------
 2 files changed, 26 insertions(+), 25 deletions(-)
 create mode 100644 templates/transaction/_sub_category_cell.html.twig

diff --git a/templates/transaction/_sub_category_cell.html.twig b/templates/transaction/_sub_category_cell.html.twig
new file mode 100644
index 0000000..ede0e83
--- /dev/null
+++ b/templates/transaction/_sub_category_cell.html.twig
@@ -0,0 +1,25 @@
+<td class="sub-category-cell">
+    {%- if transaction.subCategory is null -%}
+        <form
+            method="post"
+            action="{{ path('transaction_set_sub_category', {'id': transaction.id}) }}"
+            class="inline-sub-category"
+        >
+            <input type="hidden" name="_method" value="PATCH">
+            <input type="hidden" name="_token" value="{{ csrf_token('set-sub-category' ~ transaction.id) }}">
+            <select name="subCategory" class="custom-select custom-select-sm">
+                <option value="">{% trans %}Select a category{% endtrans %}</option>
+                {% for topCategoryName, subCategories in sub_categories[transaction.type] %}
+                    <optgroup label="{{ topCategoryName }}">
+                        {% for subCategory in subCategories %}
+                            <option value="{{ subCategory.id }}">{{ subCategory.name }}</option>
+                        {% endfor %}
+                    </optgroup>
+                {% endfor %}
+            </select>
+            <button class="btn btn-sm btn-primary">{% trans %}Save{% endtrans %}</button>
+        </form>
+    {%- else -%}
+        {{- transaction.subCategory -}}
+    {%- endif -%}
+</td>
diff --git a/templates/transaction/index.html.twig b/templates/transaction/index.html.twig
index 871307d..67c0db2 100644
--- a/templates/transaction/index.html.twig
+++ b/templates/transaction/index.html.twig
@@ -59,31 +59,7 @@
                 <td>{{ transaction.amount }}</td>
                 <td>{{ transaction.createdAt|date('d/m/Y') }}</td>
                 <td>{{ transaction.account }}</td>
-                <td class="sub-category-cell">
-                    {%- if transaction.subCategory is null -%}
-                        <form
-                            method="post"
-                            action="{{ path('transaction_set_sub_category', {'id': transaction.id}) }}"
-                            class="inline-sub-category"
-                        >
-                            <input type="hidden" name="_method" value="PATCH">
-                            <input type="hidden" name="_token" value="{{ csrf_token('set-sub-category' ~ transaction.id) }}">
-                            <select name="subCategory" class="custom-select custom-select-sm">
-                                <option value="">{% trans %}Select a category{% endtrans %}</option>
-                                {% for topCategoryName, subCategories in sub_categories[transaction.type] %}
-                                    <optgroup label="{{ topCategoryName }}">
-                                        {% for subCategory in subCategories %}
-                                            <option value="{{ subCategory.id }}">{{ subCategory.name }}</option>
-                                        {% endfor %}
-                                    </optgroup>
-                                {% endfor %}
-                            </select>
-                            <button class="btn btn-sm btn-primary">{% trans %}Save{% endtrans %}</button>
-                        </form>
-                    {%- else -%}
-                        {{- transaction.subCategory -}}
-                    {%- endif -%}
-                </td>
+                {{ include('transaction/_sub_category_cell.html.twig', {'transaction': transaction}) }}
                 <td>
                     <a href="{{ path('transaction_edit', {'id': transaction.id}) }}"><i class="fas fa-edit"></i></a>
                     <a href="{{ path('sub_category_transaction_rule_new', {'transaction': transaction.id }) }}"><i class="fas fa-sliders-h"></i></a>

From b62f01ca6c8e8a7667452d2c0f557e227bd902fe Mon Sep 17 00:00:00 2001
From: Baptiste Bouchereau <baptiste.bouchereau@gmail.com>
Date: Mon, 24 Aug 2026 14:48:56 +0200
Subject: [PATCH 10/10] Rename test methods

---
 .../Controller/TransactionSubCategoryTest.php | 50 ++++++++++---------
 1 file changed, 27 insertions(+), 23 deletions(-)

diff --git a/tests/Controller/TransactionSubCategoryTest.php b/tests/Controller/TransactionSubCategoryTest.php
index af0f681..69669a4 100644
--- a/tests/Controller/TransactionSubCategoryTest.php
+++ b/tests/Controller/TransactionSubCategoryTest.php
@@ -79,18 +79,22 @@ private function createTransaction(Account $account, string $label, float $amoun
         return $transaction;
     }
 
-    private function rowOf(Crawler $crawler, string $label): Crawler
+    /**
+     * The one transaction row whose label cell contains $label, as a Crawler so
+     * callers can keep filtering inside it.
+     */
+    private function getRow(Crawler $crawler, string $label): Crawler
     {
-        $row = $crawler->filter('#transaction-list tbody tr')->reduce(
-            fn (Crawler $tr) => str_contains($tr->filter('td')->first()->text(), $label)
+        $matches = $crawler->filter('#transaction-list tbody tr')->reduce(
+            fn (Crawler $row) => str_contains($row->filter('td')->first()->text(), $label)
         );
 
-        $this->assertCount(1, $row, sprintf('Expected exactly one row for "%s"', $label));
+        $this->assertCount(1, $matches, sprintf('Expected exactly one row for "%s"', $label));
 
-        return $row;
+        return $matches->first();
     }
 
-    private function url(Transaction $transaction): string
+    private function getUrl(Transaction $transaction): string
     {
         return sprintf('/transaction/%s/sub-category', $transaction->getId());
     }
@@ -102,18 +106,18 @@ private function patch(Transaction $transaction, array $parameters, bool $json =
     {
         $this->client->request(
             'POST',
-            $this->url($transaction),
+            $this->getUrl($transaction),
             array_merge(['_method' => 'PATCH'], $parameters),
             [],
             $json ? ['HTTP_ACCEPT' => 'application/json'] : []
         );
     }
 
-    private function token(Transaction $transaction): string
+    private function getToken(Transaction $transaction): string
     {
         $crawler = $this->client->request('GET', '/transaction/');
 
-        return $this->rowOf($crawler, (string) $transaction->getLabel())
+        return $this->getRow($crawler, (string) $transaction->getLabel())
             ->filter('input[name="_token"]')
             ->attr('value');
     }
@@ -130,7 +134,7 @@ public function testUncategorizedRowRendersASelect(): void
         $crawler = $this->client->request('GET', '/transaction/');
         $this->assertResponseIsSuccessful();
 
-        $row = $this->rowOf($crawler, 'Biocoop');
+        $row = $this->getRow($crawler, 'Biocoop');
         $this->assertCount(1, $row->filter('form.inline-sub-category select[name="subCategory"]'));
         $this->assertStringContainsString('uncategorized-transaction', (string) $row->attr('class'));
     }
@@ -139,7 +143,7 @@ public function testCategorizedRowRendersPlainTextAndNoSelect(): void
     {
         $crawler = $this->client->request('GET', '/transaction/');
 
-        $row = $this->rowOf($crawler, 'Already done');
+        $row = $this->getRow($crawler, 'Already done');
         $this->assertCount(0, $row->filter('select[name="subCategory"]'));
         $this->assertSame('Rent', $row->filter('td.sub-category-cell')->text());
         $this->assertStringNotContainsString('uncategorized-transaction', (string) $row->attr('class'));
@@ -149,14 +153,14 @@ public function testOptionsAreScopedToTheTransactionType(): void
     {
         $crawler = $this->client->request('GET', '/transaction/');
 
-        $expenseOptions = $this->rowOf($crawler, 'Biocoop')->filter('option')->each(
+        $expenseOptions = $this->getRow($crawler, 'Biocoop')->filter('option')->each(
             fn (Crawler $option) => $option->text()
         );
         $this->assertContains('Groceries', $expenseOptions);
         $this->assertContains('Rent', $expenseOptions);
         $this->assertNotContains('Salary', $expenseOptions);
 
-        $revenueOptions = $this->rowOf($crawler, 'Payslip')->filter('option')->each(
+        $revenueOptions = $this->getRow($crawler, 'Payslip')->filter('option')->each(
             fn (Crawler $option) => $option->text()
         );
         $this->assertContains('Salary', $revenueOptions);
@@ -169,14 +173,14 @@ public function testOptionsAreGroupedByTopCategory(): void
 
         $this->assertCount(
             1,
-            $this->rowOf($crawler, 'Biocoop')->filter('optgroup[label="Everyday"]')
+            $this->getRow($crawler, 'Biocoop')->filter('optgroup[label="Everyday"]')
         );
     }
 
     public function testSubmittingTheFormAssignsTheSubCategory(): void
     {
         $this->patch($this->expense, [
-            '_token' => $this->token($this->expense),
+            '_token' => $this->getToken($this->expense),
             'subCategory' => (string) $this->groceries->getId(),
         ]);
 
@@ -190,12 +194,12 @@ public function testSubmittingTheFormAssignsTheSubCategory(): void
     public function testAssignedRowThenRendersLikeACategorizedRow(): void
     {
         $this->patch($this->expense, [
-            '_token' => $this->token($this->expense),
+            '_token' => $this->getToken($this->expense),
             'subCategory' => (string) $this->groceries->getId(),
         ]);
 
         $crawler = $this->client->request('GET', '/transaction/');
-        $row = $this->rowOf($crawler, 'Biocoop');
+        $row = $this->getRow($crawler, 'Biocoop');
 
         // Exactly what testCategorizedRowRendersPlainTextAndNoSelect asserts about a
         // row that was already categorized when the page was rendered.
@@ -206,13 +210,13 @@ public function testAssignedRowThenRendersLikeACategorizedRow(): void
 
     public function testFallbackRedirectKeepsFiltersAndPage(): void
     {
-        $token = $this->token($this->expense);
+        $token = $this->getToken($this->expense);
         $listUrl = '/transaction/?item_filter%5Blabel%5D=Biocoop&page=1';
 
         $this->client->request('GET', $listUrl);
         $this->client->request(
             'POST',
-            $this->url($this->expense),
+            $this->getUrl($this->expense),
             [
                 '_method' => 'PATCH',
                 '_token' => $token,
@@ -228,7 +232,7 @@ public function testFallbackRedirectKeepsFiltersAndPage(): void
     public function testJsonRequestReturnsTheSubCategory(): void
     {
         $this->patch($this->expense, [
-            '_token' => $this->token($this->expense),
+            '_token' => $this->getToken($this->expense),
             'subCategory' => (string) $this->groceries->getId(),
         ], true);
 
@@ -260,7 +264,7 @@ public function testACrossTypeSubCategoryIsRejected(): void
     {
         // Salary is a Revenues category, the transaction is an expense.
         $this->patch($this->expense, [
-            '_token' => $this->token($this->expense),
+            '_token' => $this->getToken($this->expense),
             'subCategory' => (string) $this->salary->getId(),
         ], true);
 
@@ -275,7 +279,7 @@ public function testACrossTypeSubCategoryIsRejected(): void
     public function testAnUnknownSubCategoryIsRejected(): void
     {
         $this->patch($this->expense, [
-            '_token' => $this->token($this->expense),
+            '_token' => $this->getToken($this->expense),
             'subCategory' => '3d7c2a1e-0000-4000-8000-000000000000',
         ], true);
 
@@ -287,7 +291,7 @@ public function testAnEmptySubCategoryIsRejectedAndDoesNotClear(): void
     {
         // The token is read while the row still renders a form, then reused: it is
         // tied to the transaction id, not to the transaction being uncategorized.
-        $token = $this->token($this->expense);
+        $token = $this->getToken($this->expense);
 
         $this->patch($this->expense, [
             '_token' => $token,