F-r-ldraledigplannerare/todo.md

todo

Everything in the previous list is done — the original wording is in git history (git show d2bc2e9:todo.md). What is still open, below.

Open

• Rate limiting is keyed on the caller's address, which behind a reverse proxy without forwarded-header handling is the proxy's — so every user would share one 30/minute refresh budget, and AuthContext.tsx turns a failed refresh into a silent logout. The e2e suite hit exactly this. Two separable calls: which proxies to trust for X-Forwarded-For, and whether a non-401 refresh failure should log someone out or retry. The catch there has two identical branches, which reads unfinished.
• A removed day is never cleaned up. Delete the whole period and the veto rows stay, so a later period covering that date still skips it. Reachable only through that day's popover; there is no list of them.
• Undo after an "every year" edit restores the anchor's dates across the series rather than each year's previous dates, so per-year divergence from before the edit is lost. Would need a per-edit snapshot.
• PLANNING_ENGINE_SPEC.md §2.1/§3.2/§10.2 and parts of ARCHITECTURE.md still describe the single-row recurrence model that no longer exists.
• Dubbeldagar are not outside the 480. dubbeldagar.md sets this out: the 60 are combined for the couple, as assumed, but each parent still spends one of their own days on a doubled date. Nothing in the engine changed on the strength of it — worth confirming against Försäkringskassan before anything is built on the other reading.
• ParentalLeaveFetch.dubbeldagar_left is scraped per parent and read by nothing. Per-parent is the wrong shape for a combined pot. Flagged, not touched.