Separate user intent from planner output via day assertions

The calendar mixed two kinds of truth in one table. `planned_leave_day` was
simultaneously the allocator's output cache, the user's override store
(`is_pinned`, plus ad-hoc rows with no `wish_id`), and the resource ledger that
analytics and the age-4 maths read. The planner therefore had to ask "am I
allowed to touch this row?" on every sync, and got it wrong at the edges.

Every user assertion is now one `day_assertion` row — a concrete `day_type`
replaces a pinned day, a row with no `wish_id` replaces an ad-hoc day, and
`day_type='none'` replaces `planned_day_exclusion`. `planned_leave_day` becomes
purely derived with a single writer, and `PlanningService.pinned_keys()` is the
single answer to "is this day pinned", used by the allocator's loader, by
`sync_plan` and by the read router alike.

On top of that, every calendar band is now a real event: an ad-hoc band opens
the same full editor as a wish-backed one and saving it promotes it to a
`LeaveWish`, so it can be named, repeated yearly, assigned to either or both
parents, and handed to the planner. "Planering" is a `moveable` toggle plus a
from/to month bound plus a separate lock/unlock action on the days themselves,
replacing a three-rung ladder whose "planner decides" rung set a search window
equal to the drawn dates and so could never move anything.

Bugs found and fixed along the way:

- The plan erased its own history. Fixed windows clip to today, so an elapsed
  auto-placed day fell into `stale_keys` and was deleted on the next sync —
  and a background sync runs on every workspace load. Past rows are now frozen
  and counted as spent.
- Migration 010's downgrade silently destroyed every pinned day and exclusion
  (`is_pinned` returned as DEFAULT 0, the exclusion table came back empty,
  exit 0, no warning). It now reconstructs both from `day_assertion`, and 009
  itemises what it cannot recover before dropping the table.
- Deleting a period left its assertions behind, locking those dates forever
  with no UI path to clear them. Wish deletion now clears them by `wish_id`.
- `DayAssertionService` and `LeaveWishService` committed multi-statement writes
  without a transaction; a crash mid-write diverged the tables or half-deleted
  a series. Both now run in a unit of work.
- A sibling year's shortfall was never surfaced: the toast only inspected the
  edited occurrence's outcome, so a fully unfunded later year rendered as an
  empty band with no warning.
- A flexible window whose bound had entirely elapsed was dropped from the
  proposal with no outcome at all. It now reports as `unplaced`.
- Unlocking a period deleted its days instead of returning them to the planner.
- The e2e global setup posted to a route deleted in this change, which would
  have failed the whole suite before its first test.

Gates: backend 938 tests / 91% coverage, frontend 1351 / 97.4 | 92.2 | 94.37 |
97.4. Migrations 009 and 010 audited against a hand-built realistic database:
the upgrade reconciles exactly and a constraint violation fails safe, leaving
the schema at 008.

Not complete. Step 4's toggle, month picker and lock/unlock action are verified
by browser walk and unit tests, but the partial-lock readout was not exercised.
`ideas.md` §7 adds a full plan for the vacation-forfeiture defect (the planner
detects expiring days and then does nothing about them) — not implemented here.
Remaining smaller items are listed in the session's restructure notes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T4wjgbVL4HAC5Rdaw75VbV

backend/tests/unit/test_leave_wish_router.py

@@ -14,10 +14,14 @@ import pytest_asyncio
 from httpx import ASGITransport, AsyncClient
 
 from app.dependencies import get_connection, get_current_user
+from app.entities.child import Child
+from app.entities.day_assertion import DayAssertion
 from app.entities.personal_data import PersonalData
 from app.entities.user import User
 from app.entities.workspace import Workspace
 from app.main import app
+from app.repositories_impl.sqlite.child_repository import SQLiteChildRepository
+from app.repositories_impl.sqlite.day_assertion_repository import SQLiteDayAssertionRepository
 from app.repositories_impl.sqlite.personal_data_repository import SQLitePersonalDataRepository
 from app.repositories_impl.sqlite.workspace_repository import SQLiteWorkspaceRepository
 
@@ -554,3 +558,140 @@ class TestLeaveWishScopeQueryParam:
 
         response = await client.delete(f"/api/leave-wishes/{rows[0]['id']}?scope=everything")
         assert response.status_code == 422, response.text
+
+
+class TestLeaveWishDeleteClearsDayAssertions:
+    """Bugs 2 & 3 (adversarial-review follow-ups) — deleting a wish must
+
+    clear every `DayAssertion` attached to it, INCLUDING one whose mirrored
+    `planned_leave_day` row is already missing (a "dangling" assertion —
+    e.g. left behind by a crash between `DayAssertionService`'s own
+    assertion write and its mirror write, before that service had a `uow`).
+    Before the fix, `LeaveWishService._clear_assertions_for` only walked
+    SURVIVING `planned_leave_day` rows, so a dangling assertion was
+    invisible to it and outlived the wish as a `wish_id=NULL` ad-hoc
+    assertion that permanently locked its date. Also asserts the DELETE
+    itself returns its correct 2xx status (bug 3 — reported as a live 503
+    despite the mutation succeeding).
+    """
+
+    async def _workspace_with_child(
+        self, connection: aiosqlite.Connection
+    ) -> tuple[Workspace, Child]:
+        now = datetime.now()
+        ws = await SQLiteWorkspaceRepository(connection).create(
+            Workspace(id=uuid4(), name="Familj", created_at=now)
+        )
+        await SQLitePersonalDataRepository(connection).create(
+            PersonalData(
+                uuid=_CURRENT_USER_PD_UUID, workspace_id=ws.id, name="Alex", created_at=now
+            )
+        )
+        child = await SQLiteChildRepository(connection).create(
+            Child(
+                id=uuid4(),
+                workspace_id=ws.id,
+                name="Barn",
+                birth_date=date(2024, 1, 1),
+                created_at=now,
+            )
+        )
+        return ws, child
+
+    async def test_delete_clears_a_normally_mirrored_assertion(
+        self, client: AsyncClient, connection: aiosqlite.Connection
+    ) -> None:
+        ws, child = await self._workspace_with_child(connection)
+        create = await client.post(
+            "/api/leave-wishes",
+            json={
+                "workspace_id": str(ws.id),
+                "child_id": str(child.id),
+                "name": "Sommar",
+                "window_start_month": 7,
+                "window_start_day": 1,
+                "window_end_month": 7,
+                "window_end_day": 5,
+                "target_weeks": 1,
+                "first_year": date.today().year + 1,
+            },
+        )
+        assert create.status_code == 201, create.text
+        wish = create.json()
+
+        day = f"{wish['first_year']}-07-01"
+        asserted = await client.post(
+            "/api/day-assertions",
+            json={
+                "workspace_id": str(ws.id),
+                "child_id": str(child.id),
+                "parent_personal_data_uuid": str(_CURRENT_USER_PD_UUID),
+                "date": day,
+                "day_type": "vacation",
+                "wish_id": wish["id"],
+            },
+        )
+        assert asserted.status_code == 201, asserted.text
+
+        response = await client.delete(f"/api/leave-wishes/{wish['id']}")
+        assert response.status_code == 204, response.text
+
+        remaining = await client.get(f"/api/day-assertions/workspace/{ws.id}")
+        assert remaining.status_code == 200
+        assert remaining.json() == []
+
+    async def test_delete_clears_a_dangling_assertion_with_no_mirrored_row(
+        self, client: AsyncClient, connection: aiosqlite.Connection
+    ) -> None:
+        """The assertion exists, but its `planned_leave_day` mirror row does
+
+        not — e.g. left behind by a pre-uow-fix crash. `list_by_wish` (the
+        by-`wish_id` lookup, not a row walk) must still find and clear it.
+        """
+        ws, child = await self._workspace_with_child(connection)
+        create = await client.post(
+            "/api/leave-wishes",
+            json={
+                "workspace_id": str(ws.id),
+                "child_id": str(child.id),
+                "name": "Sommar",
+                "window_start_month": 7,
+                "window_start_day": 1,
+                "window_end_month": 7,
+                "window_end_day": 5,
+                "target_weeks": 1,
+                "first_year": date.today().year + 1,
+            },
+        )
+        assert create.status_code == 201, create.text
+        wish = create.json()
+        day = date(wish["first_year"], 7, 1)
+
+        # A dangling assertion: inserted directly at the repository, with
+        # `wish_id` pointing at the wish, but NO `planned_leave_day` row —
+        # exactly the state a crash mid-mirror (bug 1, before its `uow` fix)
+        # would leave behind.
+        now = datetime.now()
+        await SQLiteDayAssertionRepository(connection).create(
+            DayAssertion(
+                id=uuid4(),
+                workspace_id=ws.id,
+                child_id=child.id,
+                parent_personal_data_uuid=_CURRENT_USER_PD_UUID,
+                date=day,
+                day_type="vacation",
+                wish_id=wish["id"],
+                created_at=now,
+                updated_at=now,
+            )
+        )
+
+        response = await client.delete(f"/api/leave-wishes/{wish['id']}")
+        assert response.status_code == 204, response.text
+
+        remaining = await client.get(f"/api/day-assertions/workspace/{ws.id}")
+        assert remaining.status_code == 200
+        assert remaining.json() == [], (
+            "a dangling assertion (no mirrored row) must not outlive the wish it "
+            "was attached to as a permanently-locked, invisible ad-hoc assertion"
+        )